orbitx-core-models 11.178.0 → 11.180.0

package/dist/helpers/ownTickets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ownTickets.d.ts","sourceRoot":"","sources":["../../src/helpers/ownTickets.ts"],"names":[],"mappings":"AAuBA,wBAAgB,0BAA0B,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,EAAE;IAC9H,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,eAAe,EAAE,GAAG,EAAE,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClE,6EAA6E;IAC7E,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAA;KAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACvH;;;;;;EAoJA"}
+{"version":3,"file":"ownTickets.d.ts","sourceRoot":"","sources":["../../src/helpers/ownTickets.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAMhE,wBAAgB,0BAA0B,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE;IACxI,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,eAAe,EAAE,GAAG,EAAE,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAA;KAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACvH;;;;;;EAiKA"}

package/dist/helpers/ownTickets.js

@@ -12,6 +12,8 @@ exports.createOwnTicketsController = createOwnTicketsController;
  *   createOwnTicketsController({ ownerType: "Partner", categoryOptions: PARTNER_TICKET_CATEGORY_OPTIONS,
  *     fallbackAuthorName: "Partner", uploadAttachments })
  * uploadAttachments(files, ownerId) stores the request's files and resolves the ticket attachment list.
+ * signFile(url) turns a stored attachment URL into a signed link (attachments are private files); without it the
+ * stored URLs are sent as they are.
  */
 const mongoose_1 = __importDefault(require("mongoose"));
 const ticket_model_1 = require("../models/ticket.model");
@@ -22,10 +24,11 @@ const ticketRouting_1 = require("../routing/ticketRouting");
 const ticketSanitize_1 = require("../utils/ticketSanitize");
 const errors_1 = require("./errors");
 const _http_1 = require("./_http");
+const privateFiles_1 = require("./privateFiles");
 // Categories where a client disputes one lead/chat: the only ones with a real LeadDispute behind them.
 // "chat-dispute" is a legacy value (no longer offered) kept so an old ticket behaves as it always did.
 const LEAD_DISPUTE_CATEGORIES = ["chat-dispute", "dispute-billable-lead"];
-function createOwnTicketsController({ ownerType, categoryOptions, fallbackAuthorName, uploadAttachments, raiseDispute }) {
+function createOwnTicketsController({ ownerType, categoryOptions, fallbackAuthorName, uploadAttachments, raiseDispute, signFile }) {
     const TicketModel = ticket_model_1.Ticket;
     const UpdateModel = update_model_1.Update;
     const OverrideModel = ticketCategoryOverride_model_1.TicketSubCategoryOverride;
@@ -55,20 +58,27 @@ function createOwnTicketsController({ ownerType, categoryOptions, fallbackAuthor
             console.error(`[Ticket ${ticket._id}] Failed to write assignment update:`, err.message);
         }
     }
-    // Routes a new ticket the same way Ops's own triage does. Routing is a convenience: an unrouted ticket just waits
-    // for Ops to pick it up.
+    // Routes a new ticket to the team its category belongs to (billing / scripting / the account's Account Manager /
+    // general support -- see routing/ticketRouting.ts). Routing is a convenience: an unrouted ticket just waits for Ops
+    // to pick it up (and its new-ticket alert goes to every Support Manager).
     async function routeNewTicket(ticket) {
         try {
             const routing = await (0, ticketRouting_1.resolveTicketRouting)(ticket);
-            if (!routing.assigneeId && routing.followerIds.length === 0)
-                return;
-            const update = { $push: {} };
+            const update = { $set: {}, $push: {} };
+            if (routing.team)
+                update.$set.team = routing.team;
             if (routing.assigneeId) {
-                update.$set = { assigneeId: routing.assigneeId };
+                update.$set.assigneeId = routing.assigneeId;
                 update.$push.activityLog = { action: "assigned", actorName: "Routing Engine", to: String(routing.assigneeId), createdAt: new Date() };
             }
             if (routing.followerIds.length)
                 update.$push.followerIds = { $each: routing.followerIds };
+            if (!Object.keys(update.$push).length)
+                delete update.$push;
+            if (!Object.keys(update.$set).length)
+                delete update.$set;
+            if (!update.$set && !update.$push)
+                return;
             await TicketModel.updateOne({ _id: ticket._id }, update);
             await notifyAssignee(routing.assigneeId, ticket);
         }
@@ -120,7 +130,11 @@ function createOwnTicketsController({ ownerType, categoryOptions, fallbackAuthor
             }
         }
         await routeNewTicket(ticket);
-        res.status(_http_1.HTTP.CREATED).json({ success: true, message: "Ticket submitted successfully", data: { ticket, disputeWarning } });
+        res.status(_http_1.HTTP.CREATED).json({
+            success: true,
+            message: "Ticket submitted successfully",
+            data: { ticket: await (0, privateFiles_1.signTicketFiles)(ticket, signFile), disputeWarning },
+        });
     });
     const withPeople = (query) => query.populate("requestedBy", "name email").populate("resolvedBy", "name email");
     const getMyTickets = (0, _http_1.catchAsync)(async (req, res) => {
@@ -132,13 +146,14 @@ function createOwnTicketsController({ ownerType, categoryOptions, fallbackAuthor
             queryObj.category = category;
         const tickets = await withPeople(TicketModel.find(queryObj)).sort({ createdAt: -1 }).lean();
         tickets.forEach(ticketSanitize_1.sanitizeTicketForRequester);
-        res.status(_http_1.HTTP.OK).json({ success: true, results: tickets.length, data: { tickets } });
+        const signed = await Promise.all(tickets.map((t) => (0, privateFiles_1.signTicketFiles)(t, signFile)));
+        res.status(_http_1.HTTP.OK).json({ success: true, results: signed.length, data: { tickets: signed } });
     });
     const getMyTicketById = (0, _http_1.catchAsync)(async (req, res, next) => {
         const ticket = await withPeople(TicketModel.findOne({ _id: req.params.id, ownerType, ownerId: req.user.owner })).lean();
         if (!ticket)
             return next(new errors_1.AppError("Ticket not found", _http_1.HTTP.NOT_FOUND));
-        res.status(_http_1.HTTP.OK).json({ success: true, data: { ticket: (0, ticketSanitize_1.sanitizeTicketForRequester)(ticket) } });
+        res.status(_http_1.HTTP.OK).json({ success: true, data: { ticket: await (0, privateFiles_1.signTicketFiles)((0, ticketSanitize_1.sanitizeTicketForRequester)(ticket), signFile) } });
     });
     // A reply from the requester: always visible to them (they can never post an internal note).
     // Body: { body }. File field: attachments (optional, several).
@@ -163,7 +178,11 @@ function createOwnTicketsController({ ownerType, categoryOptions, fallbackAuthor
         };
         await TicketModel.updateOne({ _id: ticket._id }, { $push: { messages: message }, $set: { updatedAt: new Date() } });
         const updated = await withPeople(TicketModel.findById(ticket._id)).lean();
-        res.status(_http_1.HTTP.CREATED).json({ success: true, message: "Message added", data: { ticket: (0, ticketSanitize_1.sanitizeTicketForRequester)(updated) } });
+        res.status(_http_1.HTTP.CREATED).json({
+            success: true,
+            message: "Message added",
+            data: { ticket: await (0, privateFiles_1.signTicketFiles)((0, ticketSanitize_1.sanitizeTicketForRequester)(updated), signFile) },
+        });
     });
     return { getTicketCategories, createTicket, getMyTickets, getMyTicketById, addTicketMessage };
 }

package/dist/helpers/privateFiles.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Swapping stored file URLs for signed links in what a backend sends out, for the private file folders
+ * (PRIVATE_FILE_FOLDERS in s3Storage.ts). Each backend passes its own signer, usually
+ *   const signFile = (url, seconds) => storage.signUrl(url, seconds);
+ * Public files and anything that isn't an S3 link pass through unchanged, so these are safe to call on any data.
+ */
+export type SignFile = (url?: string | null, seconds?: number) => Promise<string | null | undefined>;
+/** A ticket (plain object) with every attachment link signed: the ticket's own and each message's. */
+export declare function signTicketFiles<T = any>(ticket: T, signFile?: SignFile, seconds?: number): Promise<T>;
+/** Chat messages (plain objects) with each mediaUrl signed. */
+export declare function signMessagesMedia<T = any>(messages: T[], signFile?: SignFile, seconds?: number): Promise<T[]>;
+/** A list of rows with an attachment link in `field` (e.g. request attachments), each signed. */
+export declare function signFileList<T = any>(rows: T[] | undefined, signFile?: SignFile, field?: string, seconds?: number): Promise<T[] | undefined>;
+//# sourceMappingURL=privateFiles.d.ts.map

package/dist/helpers/privateFiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateFiles.d.ts","sourceRoot":"","sources":["../../src/helpers/privateFiles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAOrG,sGAAsG;AACtG,wBAAsB,eAAe,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAe3G;AAED,+DAA+D;AAC/D,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CASnH;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,SAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,CAGjJ"}

package/dist/helpers/privateFiles.js

@@ -0,0 +1,45 @@
+"use strict";
+/**
+ * Swapping stored file URLs for signed links in what a backend sends out, for the private file folders
+ * (PRIVATE_FILE_FOLDERS in s3Storage.ts). Each backend passes its own signer, usually
+ *   const signFile = (url, seconds) => storage.signUrl(url, seconds);
+ * Public files and anything that isn't an S3 link pass through unchanged, so these are safe to call on any data.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signTicketFiles = signTicketFiles;
+exports.signMessagesMedia = signMessagesMedia;
+exports.signFileList = signFileList;
+const signList = async (list, signFile, field, seconds) => Array.isArray(list)
+    ? Promise.all(list.map(async (item) => (item && item[field] ? { ...item, [field]: await signFile(item[field], seconds) } : item)))
+    : list;
+/** A ticket (plain object) with every attachment link signed: the ticket's own and each message's. */
+async function signTicketFiles(ticket, signFile, seconds) {
+    const t = ticket;
+    if (!t || !signFile)
+        return ticket;
+    const plain = typeof t.toObject === "function" ? t.toObject() : t;
+    const [attachments, messages] = await Promise.all([
+        signList(plain.attachments, signFile, "url", seconds),
+        Array.isArray(plain.messages)
+            ? Promise.all(plain.messages.map(async (m) => m && Array.isArray(m.attachments) ? { ...m, attachments: await signList(m.attachments, signFile, "url", seconds) } : m))
+            : plain.messages,
+    ]);
+    return { ...plain, attachments, messages };
+}
+/** Chat messages (plain objects) with each mediaUrl signed. */
+async function signMessagesMedia(messages, signFile, seconds) {
+    if (!signFile || !Array.isArray(messages))
+        return messages;
+    return Promise.all(messages.map(async (m) => {
+        if (!(m === null || m === void 0 ? void 0 : m.mediaUrl))
+            return m;
+        const plain = typeof m.toObject === "function" ? m.toObject() : m;
+        return { ...plain, mediaUrl: await signFile(plain.mediaUrl, seconds) };
+    }));
+}
+/** A list of rows with an attachment link in `field` (e.g. request attachments), each signed. */
+async function signFileList(rows, signFile, field = "url", seconds) {
+    if (!signFile)
+        return rows;
+    return signList(rows, signFile, field, seconds);
+}

package/dist/helpers/requestInfo.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Who is signing in, as far as the request can tell, for every backend's sign-in sessions and the activity log:
+ *   clientIp(req)                       the visitor's real IP address
+ *   requestLocation(req)                "Lahore, Pakistan" from Cloudflare's visitor-location headers
+ *   describeDevice(userAgent, hints)    a readable device ("Windows PC", "iPhone", "Samsung SM-S911B"), browser and OS
+ *   isPrivateIp(ip)                     true for proxy / Docker / local addresses, which say nothing about the visitor
+ *
+ * Requests reach the backends through nginx (and Cloudflare on proxied hosts), so the socket address is the proxy's
+ * (inside Docker, the bridge gateway "::ffff:172.18.0.1"), never the visitor's.
+ */
+type Req = any;
+/** "::ffff:1.2.3.4" (an IPv4 address written the IPv6 way) -> "1.2.3.4". */
+export declare function normalizeIp(ip?: string | null): string | undefined;
+/** Loopback, private-network and link-local addresses: what a proxy or Docker hands on, not a visitor's address. */
+export declare function isPrivateIp(ip?: string | null): boolean;
+/**
+ * The visitor's IP address, in order of trust:
+ *   CF-Connecting-IP   set by Cloudflare on proxied hosts (client.orbitxpro.com)
+ *   X-Real-IP          set by nginx from the connecting address (on a Cloudflare-proxied host this is Cloudflare's)
+ *   X-Forwarded-For    first entry
+ *   the socket         only right when nothing sits in front of the app
+ */
+export declare function clientIp(req: Req): string | undefined;
+/**
+ * Where the request came from, from Cloudflare's visitor-location headers: "Lahore, Pakistan", or just "Pakistan".
+ * Only Cloudflare-proxied hosts get these. The country comes with every proxied request; the city and region only
+ * when the zone's "Add visitor location headers" Managed Transform is on. Nothing (undefined) otherwise.
+ */
+export declare function requestLocation(req: Req): string | undefined;
+/** What the browser can add beyond the user agent (Chrome's `navigator.userAgentData`): the Android phone model and
+ *  the real OS version (the only way to tell Windows 11 from Windows 10). */
+export type DeviceHints = {
+    model?: string;
+    platformVersion?: string;
+};
+export type DeviceDescription = {
+    deviceName: string;
+    browser: string;
+    os: string;
+};
+/** Reads the user agent (plus the browser's hints when sent) into a device name, browser and OS. iPhones only ever
+ *  say "iPhone" (no model), and laptops never say their brand: the person can name the device themselves. */
+export declare function describeDevice(userAgent?: string | null, hints?: DeviceHints): DeviceDescription;
+/** A name the person gave a device: trimmed, at most 40 characters, "" to clear it. */
+export declare function cleanDeviceName(value: unknown): string;
+export {};
+//# sourceMappingURL=requestInfo.d.ts.map

package/dist/helpers/requestInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestInfo.d.ts","sourceRoot":"","sources":["../../src/helpers/requestInfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,KAAK,GAAG,GAAG,GAAG,CAAC;AAOf,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAKlE;AAED,oHAAoH;AACpH,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CASvD;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS,CAKrD;AAiBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS,CAS5D;AAED;6EAC6E;AAC7E,MAAM,MAAM,WAAW,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,MAAM,MAAM,iBAAiB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAyBpF;6GAC6G;AAC7G,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,WAAgB,GAAG,iBAAiB,CA8CpG;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}

package/dist/helpers/requestInfo.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * Who is signing in, as far as the request can tell, for every backend's sign-in sessions and the activity log:
+ *   clientIp(req)                       the visitor's real IP address
+ *   requestLocation(req)                "Lahore, Pakistan" from Cloudflare's visitor-location headers
+ *   describeDevice(userAgent, hints)    a readable device ("Windows PC", "iPhone", "Samsung SM-S911B"), browser and OS
+ *   isPrivateIp(ip)                     true for proxy / Docker / local addresses, which say nothing about the visitor
+ *
+ * Requests reach the backends through nginx (and Cloudflare on proxied hosts), so the socket address is the proxy's
+ * (inside Docker, the bridge gateway "::ffff:172.18.0.1"), never the visitor's.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeIp = normalizeIp;
+exports.isPrivateIp = isPrivateIp;
+exports.clientIp = clientIp;
+exports.requestLocation = requestLocation;
+exports.describeDevice = describeDevice;
+exports.cleanDeviceName = cleanDeviceName;
+const header = (req, name) => {
+    var _a, _b;
+    const value = (_a = req === null || req === void 0 ? void 0 : req.headers) === null || _a === void 0 ? void 0 : _a[name];
+    return String((_b = (Array.isArray(value) ? value[0] : value)) !== null && _b !== void 0 ? _b : "").trim();
+};
+/** "::ffff:1.2.3.4" (an IPv4 address written the IPv6 way) -> "1.2.3.4". */
+function normalizeIp(ip) {
+    if (!ip)
+        return undefined;
+    let value = String(ip).trim();
+    if (/^::ffff:\d+\.\d+\.\d+\.\d+$/i.test(value))
+        value = value.slice(7);
+    return value || undefined;
+}
+/** Loopback, private-network and link-local addresses: what a proxy or Docker hands on, not a visitor's address. */
+function isPrivateIp(ip) {
+    const value = normalizeIp(ip);
+    if (!value)
+        return true;
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(value)) {
+        const [a, b] = value.split(".").map(Number);
+        return a === 10 || a === 127 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254);
+    }
+    const lower = value.toLowerCase();
+    return lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
+}
+/**
+ * The visitor's IP address, in order of trust:
+ *   CF-Connecting-IP   set by Cloudflare on proxied hosts (client.orbitxpro.com)
+ *   X-Real-IP          set by nginx from the connecting address (on a Cloudflare-proxied host this is Cloudflare's)
+ *   X-Forwarded-For    first entry
+ *   the socket         only right when nothing sits in front of the app
+ */
+function clientIp(req) {
+    var _a;
+    const forwarded = header(req, "x-forwarded-for").split(",")[0].trim();
+    return normalizeIp(header(req, "cf-connecting-ip") || header(req, "x-real-ip") || forwarded || ((_a = req === null || req === void 0 ? void 0 : req.socket) === null || _a === void 0 ? void 0 : _a.remoteAddress) || (req === null || req === void 0 ? void 0 : req.ip));
+}
+// Cloudflare sends non-English city names as raw UTF-8 bytes, which Node reads as Latin-1.
+function fixEncoding(value) {
+    if (!/[\u0080-ÿ]/.test(value))
+        return value;
+    const decoded = Buffer.from(value, "latin1").toString("utf8");
+    return decoded.includes("�") ? value : decoded;
+}
+function countryName(code) {
+    try {
+        return new Intl.DisplayNames(["en"], { type: "region" }).of(code) || code;
+    }
+    catch {
+        return code;
+    }
+}
+/**
+ * Where the request came from, from Cloudflare's visitor-location headers: "Lahore, Pakistan", or just "Pakistan".
+ * Only Cloudflare-proxied hosts get these. The country comes with every proxied request; the city and region only
+ * when the zone's "Add visitor location headers" Managed Transform is on. Nothing (undefined) otherwise.
+ */
+function requestLocation(req) {
+    const code = header(req, "cf-ipcountry").toUpperCase();
+    // XX = unknown, T1 = Tor.
+    const country = /^[A-Z]{2}$/.test(code) && code !== "XX" && code !== "T1" ? countryName(code) : "";
+    const city = fixEncoding(header(req, "cf-ipcity"));
+    const region = fixEncoding(header(req, "cf-region"));
+    const place = city || region;
+    const parts = [place, country].filter(Boolean);
+    return parts.length ? parts.join(", ").slice(0, 120) : undefined;
+}
+const clean = (value, max = 60) => typeof value === "string" ? value.replace(/[^\w .,()+\-/]/g, "").trim().slice(0, max) : "";
+function describeBrowser(ua) {
+    const pick = (name, re) => {
+        const m = ua.match(re);
+        return m ? `${name} ${m[1]}` : null;
+    };
+    return (pick("Edge", /\bEdg(?:e|A|iOS)?\/(\d+)/) ||
+        pick("Opera", /\b(?:OPR|OPX)\/(\d+)/) ||
+        pick("Samsung Internet", /\bSamsungBrowser\/(\d+)/) ||
+        pick("Firefox", /\b(?:Firefox|FxiOS)\/(\d+)/) ||
+        pick("Chrome", /\bCriOS\/(\d+)/) ||
+        (!/Chromium/.test(ua) ? pick("Chrome", /\bChrome\/(\d+)/) : null) ||
+        pick("Chromium", /\bChromium\/(\d+)/) ||
+        (/Safari\//.test(ua) ? pick("Safari", /\bVersion\/(\d+(?:\.\d+)?)/) || "Safari" : null) ||
+        "Unknown browser");
+}
+const WINDOWS_NT = { "6.3": "Windows 8.1", "6.2": "Windows 8", "6.1": "Windows 7" };
+/** Reads the user agent (plus the browser's hints when sent) into a device name, browser and OS. iPhones only ever
+ *  say "iPhone" (no model), and laptops never say their brand: the person can name the device themselves. */
+function describeDevice(userAgent, hints = {}) {
+    var _a, _b;
+    const ua = String(userAgent || "");
+    const browser = describeBrowser(ua);
+    const model = clean(hints.model);
+    const platformMajor = parseInt(clean(hints.platformVersion, 20), 10);
+    const apple = ua.match(/\b(iPhone|iPad|iPod)\b/);
+    if (apple) {
+        const version = ua.match(/OS (\d+)[_.](\d+)/);
+        const osName = apple[1] === "iPad" ? "iPadOS" : "iOS";
+        return { deviceName: apple[1], browser, os: version ? `${osName} ${version[1]}.${version[2]}` : osName };
+    }
+    const android = ua.match(/Android (\d+(?:\.\d+)?)/);
+    if (android || /Android/.test(ua)) {
+        // Older user agents name the model ("Android 10; SM-G973F Build/..."); current Chrome sends "K" instead and only
+        // tells the model through the hints.
+        const uaModel = (_b = (_a = ua.match(/Android [\d.]+; ([^;)]+?)(?: Build\/|\))/)) === null || _a === void 0 ? void 0 : _a[1]) === null || _b === void 0 ? void 0 : _b.trim();
+        const found = (model || (uaModel && uaModel !== "K" ? clean(uaModel) : "")).replace(/^samsung\s+/i, "");
+        const deviceName = found
+            ? /^SM-/i.test(found)
+                ? `Samsung ${found}`
+                : found
+            : /Mobile/.test(ua)
+                ? "Android phone"
+                : "Android tablet";
+        // Current Chrome freezes the version in the user agent ("Android 10"); the hint has the real one.
+        const version = Number.isFinite(platformMajor) && platformMajor > 0 ? String(platformMajor) : android === null || android === void 0 ? void 0 : android[1];
+        return { deviceName, browser, os: version ? `Android ${version}` : "Android" };
+    }
+    const windows = ua.match(/Windows NT (\d+\.\d+)/);
+    if (windows) {
+        let os = WINDOWS_NT[windows[1]] || "Windows";
+        if (windows[1] === "10.0") {
+            // Windows 11 reports itself as NT 10.0; only the hint's platform version (13 and up) tells them apart.
+            os = Number.isFinite(platformMajor) ? (platformMajor >= 13 ? "Windows 11" : "Windows 10") : "Windows 10/11";
+        }
+        return { deviceName: "Windows PC", browser, os };
+    }
+    // Browsers freeze the macOS version in the user agent (10.15.7), so it isn't shown.
+    if (/Macintosh|Mac OS X/.test(ua))
+        return { deviceName: "Mac", browser, os: "macOS" };
+    if (/CrOS/.test(ua))
+        return { deviceName: "Chromebook", browser, os: "ChromeOS" };
+    if (/Linux/.test(ua))
+        return { deviceName: "Linux PC", browser, os: "Linux" };
+    return { deviceName: "Unknown device", browser, os: "Unknown OS" };
+}
+/** A name the person gave a device: trimmed, at most 40 characters, "" to clear it. */
+function cleanDeviceName(value) {
+    return typeof value === "string" ? value.replace(/\s+/g, " ").trim().slice(0, 40) : "";
+}

package/dist/helpers/s3Storage.d.ts

@@ -2,8 +2,13 @@
  * The dashboards' S3 file storage: file naming, upload, delete and public links, shared by every backend.
  * A backend passes the AWS SDK it already depends on and its settings, then keeps its own wrapper for the
  * file types it accepts and the messages it shows:
- *   const storage = createS3Storage({ sdk: require("@aws-sdk/client-s3"), config: () => env.aws });
+ *   const storage = createS3Storage({ sdk: require("@aws-sdk/client-s3"), presigner: require("@aws-sdk/s3-request-presigner"), config: () => env.aws });
  *   const { key, publicUrl } = await storage.put({ buffer, mimetype, originalname, folder });
+ *   const link = await storage.signUrl(storedUrlOrKey);   // a private file's short-lived link
+ *
+ * Private files: ticket and request attachments and chat files (folders in PRIVATE_FILE_FOLDERS) are not publicly
+ * readable in the bucket. They're stored as before (key + the plain S3 URL), and every response that shows one
+ * swaps the stored URL for a signed link that works for a limited time (FILE_LINK_SECONDS).
  */
 export declare const IMAGE_MIME_TYPES: Set<string>;
 /** Profile photos: no SVG, since these are served as public links. */
@@ -11,14 +16,28 @@ export declare const PHOTO_MIME_TYPES: Set<string>;
 /** What ticket attachments accept: images and documents (PDF, Word, Excel, PowerPoint, text, zip, OpenDocument). */
 export declare const TICKET_ATTACHMENT_MIME_TYPES: Set<string>;
 export declare const sanitizeFileName: (fileName: string) => string;
+/**
+ * Folders whose files are private (may hold customers' or visitors' personal details): only reachable through a
+ * signed link. Everything else (profile photos, agent aliases, review images) stays public, because website
+ * visitors and emails show them directly. The bucket policy must match this list.
+ */
+export declare const PRIVATE_FILE_FOLDERS: string[];
+/** How long a signed link works: long enough for a dashboard page left open all day; emails use the S3 maximum. */
+export declare const FILE_LINK_SECONDS: {
+    readonly dashboard: number;
+    readonly email: number;
+};
+/** True for a key in one of the private folders. */
+export declare const isPrivateFileKey: (key?: string | null) => boolean;
 export type S3Settings = {
     region?: string;
     bucketName?: string;
     accessKeyId?: string;
     secretAccessKey?: string;
 };
-export declare function createS3Storage({ sdk, config }: {
+export declare function createS3Storage({ sdk, presigner, config }: {
     sdk: any;
+    presigner?: any;
     config: () => S3Settings;
 }): {
     put: ({ buffer, mimetype, originalname, folder, fallbackName }: {
@@ -34,5 +53,8 @@ export declare function createS3Storage({ sdk, config }: {
     remove: (key?: string | null) => Promise<void>;
     publicUrlFor: (key: string) => string;
     isConfigured: () => boolean;
+    keyFromUrl: (url?: string | null) => string | null;
+    signedUrl: (key: string, seconds?: number) => Promise<string>;
+    signUrl: (urlOrKey?: string | null, seconds?: number) => Promise<string | null | undefined>;
 };
 //# sourceMappingURL=s3Storage.d.ts.map

package/dist/helpers/s3Storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3Storage.d.ts","sourceRoot":"","sources":["../../src/helpers/s3Storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,eAAO,MAAM,gBAAgB,aAAmF,CAAC;AAEjH,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,aAAkE,CAAC;AAEhG,oHAAoH;AACpH,eAAO,MAAM,4BAA4B,aAiBvC,CAAC;AAEH,eAAO,MAAM,gBAAgB,GAAI,UAAU,MAAM,KAAG,MAA0D,CAAC;AAE/G,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElH,wBAAgB,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,UAAU,CAAA;CAAE;oEA2BC;QACpF,MAAM,EAAE,GAAG,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,KAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;mBAOnB,MAAM,GAAG,IAAI,KAAG,OAAO,CAAC,IAAI,CAAC;wBAnB9B,MAAM;;EAyBlC"}
+{"version":3,"file":"s3Storage.d.ts","sourceRoot":"","sources":["../../src/helpers/s3Storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,gBAAgB,aAAmF,CAAC;AAEjH,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,aAAkE,CAAC;AAEhG,oHAAoH;AACpH,eAAO,MAAM,4BAA4B,aAiBvC,CAAC;AAEH,eAAO,MAAM,gBAAgB,GAAI,UAAU,MAAM,KAAG,MAA0D,CAAC;AAE/G;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAA+D,CAAC;AAEjG,mHAAmH;AACnH,eAAO,MAAM,iBAAiB;;;CAAgE,CAAC;AAE/F,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,GAAG,IAAI,KAAG,OACiB,CAAC;AAEzE,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElH,wBAAgB,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,SAAS,CAAC,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,UAAU,CAAA;CAAE;oEA2B3B;QACpF,MAAM,EAAE,GAAG,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,KAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;mBAOnB,MAAM,GAAG,IAAI,KAAG,OAAO,CAAC,IAAI,CAAC;wBAnB9B,MAAM;;uBA4BP,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAAI;qBAmBzB,MAAM,YAAW,MAAM,KAAiC,OAAO,CAAC,MAAM,CAAC;yBAWnE,MAAM,GAAG,IAAI,YAAW,MAAM,KAAiC,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;EAapI"}

package/dist/helpers/s3Storage.js

@@ -3,11 +3,16 @@
  * The dashboards' S3 file storage: file naming, upload, delete and public links, shared by every backend.
  * A backend passes the AWS SDK it already depends on and its settings, then keeps its own wrapper for the
  * file types it accepts and the messages it shows:
- *   const storage = createS3Storage({ sdk: require("@aws-sdk/client-s3"), config: () => env.aws });
+ *   const storage = createS3Storage({ sdk: require("@aws-sdk/client-s3"), presigner: require("@aws-sdk/s3-request-presigner"), config: () => env.aws });
  *   const { key, publicUrl } = await storage.put({ buffer, mimetype, originalname, folder });
+ *   const link = await storage.signUrl(storedUrlOrKey);   // a private file's short-lived link
+ *
+ * Private files: ticket and request attachments and chat files (folders in PRIVATE_FILE_FOLDERS) are not publicly
+ * readable in the bucket. They're stored as before (key + the plain S3 URL), and every response that shows one
+ * swaps the stored URL for a signed link that works for a limited time (FILE_LINK_SECONDS).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sanitizeFileName = exports.TICKET_ATTACHMENT_MIME_TYPES = exports.PHOTO_MIME_TYPES = exports.IMAGE_MIME_TYPES = void 0;
+exports.isPrivateFileKey = exports.FILE_LINK_SECONDS = exports.PRIVATE_FILE_FOLDERS = exports.sanitizeFileName = exports.TICKET_ATTACHMENT_MIME_TYPES = exports.PHOTO_MIME_TYPES = exports.IMAGE_MIME_TYPES = void 0;
 exports.createS3Storage = createS3Storage;
 const crypto_1 = require("crypto");
 exports.IMAGE_MIME_TYPES = new Set(["image/jpeg", "image/png", "image/gif", "image/webp", "image/svg+xml"]);
@@ -34,8 +39,19 @@ exports.TICKET_ATTACHMENT_MIME_TYPES = new Set([
 ]);
 const sanitizeFileName = (fileName) => fileName.trim().replace(/[^a-zA-Z0-9._-]/g, "-");
 exports.sanitizeFileName = sanitizeFileName;
-function createS3Storage({ sdk, config }) {
-    const { S3Client, PutObjectCommand, DeleteObjectCommand } = sdk;
+/**
+ * Folders whose files are private (may hold customers' or visitors' personal details): only reachable through a
+ * signed link. Everything else (profile photos, agent aliases, review images) stays public, because website
+ * visitors and emails show them directly. The bucket policy must match this list.
+ */
+exports.PRIVATE_FILE_FOLDERS = ["tickets/", "requests/", "partner/tickets/", "chat-media/"];
+/** How long a signed link works: long enough for a dashboard page left open all day; emails use the S3 maximum. */
+exports.FILE_LINK_SECONDS = { dashboard: 12 * 60 * 60, email: 7 * 24 * 60 * 60 };
+/** True for a key in one of the private folders. */
+const isPrivateFileKey = (key) => !!key && exports.PRIVATE_FILE_FOLDERS.some((folder) => key.startsWith(folder));
+exports.isPrivateFileKey = isPrivateFileKey;
+function createS3Storage({ sdk, presigner, config }) {
+    const { S3Client, PutObjectCommand, DeleteObjectCommand, GetObjectCommand } = sdk;
     let client;
     let clientFor = "";
     const s3 = () => {
@@ -69,5 +85,57 @@ function createS3Storage({ sdk, config }) {
             return;
         await s3().send(new DeleteObjectCommand({ Bucket: config().bucketName, Key: key }));
     }
-    return { put, remove, publicUrlFor, isConfigured };
+    /**
+     * The key of a file in this bucket, from its stored S3 URL ("https://<bucket>.s3.<region>.amazonaws.com/<key>",
+     * the path-style form, or an already signed link). Null for anything else (another site, a data: URL).
+     */
+    function keyFromUrl(url) {
+        if (!url || typeof url !== "string")
+            return null;
+        const { bucketName } = config();
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return null;
+        }
+        const host = parsed.hostname.toLowerCase();
+        if (!host.endsWith(".amazonaws.com") || !bucketName)
+            return null;
+        const path = decodeURIComponent(parsed.pathname.replace(/^\/+/, ""));
+        if (host.startsWith(`${bucketName.toLowerCase()}.s3`))
+            return path || null;
+        // Path-style: s3.<region>.amazonaws.com/<bucket>/<key>
+        if (path.startsWith(`${bucketName}/`))
+            return path.slice(bucketName.length + 1) || null;
+        return null;
+    }
+    /** A link to a stored file that works for `seconds` (S3 allows at most 7 days). */
+    async function signedUrl(key, seconds = exports.FILE_LINK_SECONDS.dashboard) {
+        if (!(presigner === null || presigner === void 0 ? void 0 : presigner.getSignedUrl) || !GetObjectCommand)
+            throw new Error("createS3Storage: pass presigner to sign links");
+        const expiresIn = Math.max(60, Math.min(seconds, exports.FILE_LINK_SECONDS.email));
+        return presigner.getSignedUrl(s3(), new GetObjectCommand({ Bucket: config().bucketName, Key: key }), { expiresIn });
+    }
+    /**
+     * What a response should show for a stored file: a signed link when it's a private file of this bucket, else the
+     * stored value unchanged (public files, other sites, empty). Never throws: if signing fails it returns the stored
+     * value (the file just won't open once the bucket is private, instead of the whole page failing).
+     */
+    async function signUrl(urlOrKey, seconds = exports.FILE_LINK_SECONDS.dashboard) {
+        if (!urlOrKey)
+            return urlOrKey;
+        const key = /^https?:\/\//i.test(urlOrKey) ? keyFromUrl(urlOrKey) : urlOrKey;
+        if (!key || !(0, exports.isPrivateFileKey)(key) || !isConfigured())
+            return urlOrKey;
+        try {
+            return await signedUrl(key, seconds);
+        }
+        catch (err) {
+            console.error("[s3Storage] could not sign a file link:", err === null || err === void 0 ? void 0 : err.message);
+            return urlOrKey;
+        }
+    }
+    return { put, remove, publicUrlFor, isConfigured, keyFromUrl, signedUrl, signUrl };
 }

package/dist/helpers/sessions.d.ts

@@ -9,14 +9,62 @@ export type LoginDevice = {
     os?: string;
     userAgent?: string;
     ip?: string;
+    /** From the browser's hints (Chrome's navigator.userAgentData): the Android phone model and the OS version. */
+    deviceModel?: string;
+    platformVersion?: string;
 };
-/** Stores a new 30-day session for the user and returns its id. */
+/**
+ * True when this sign-in comes from a browser the account has never signed in from before, so the person gets a
+ * "new sign-in" email. Call it BEFORE createLoginSession (which records the browser). The very first sign-in of an
+ * account isn't "new" (there's nothing to compare with), and without a browser id there's nothing to go on.
+ * Sessions are never deleted (revoked and expired ones stay), so this sees every browser ever used.
+ */
+export declare function isNewSignInDevice(userId: any, fingerprintId?: string | null): Promise<boolean>;
+/**
+ * Stores a new 30-day session for the user and returns its id. Pass the request so the session gets the visitor's
+ * real IP address and location (read from the Cloudflare / nginx headers) and the real user agent.
+ */
 export declare function createLoginSession(user: {
     _id: any;
-}, { fingerprintId, browser, os, userAgent, ip }: LoginDevice): Promise<string>;
-/** The signed-in user's open sessions, and revoking one of them. */
+}, device: LoginDevice, req?: any): Promise<string>;
+/**
+ * Marks the session as used just now, so the Sessions screen can tell Active from Idle. At most one small write per
+ * session every 5 minutes, never awaited and never failing the request. Ops passes its own session model.
+ */
+export declare function touchSession(sessionId?: string | null, SessionModel?: any): void;
+export type SessionView = {
+    _id: string;
+    sessionId: string;
+    /** What to call the device: the person's own name for it, else the detected one ("Windows PC", "iPhone"). */
+    deviceName: string;
+    /** The detected name, shown under a custom name and used to prefill "Name this device". */
+    detectedName: string;
+    customName?: string;
+    browser?: string;
+    os?: string;
+    /** Unset when only a proxy's address was recorded (sign-ins before the real-IP fix). */
+    ipAddress?: string;
+    location?: string;
+    isCurrent: boolean;
+    status: "active" | "idle";
+    lastActiveAt?: Date;
+    createdAt?: Date;
+    expiresAt?: Date;
+};
+/** One session as the Sessions screens show it. Sessions from before Oct 2026 stored no device name (Client /
+ *  Partner) or an old "Chrome 129 on Windows 10/11" label (Ops); those are read again from their user agent. */
+export declare function sessionView(session: any, currentSessionId?: string | null): SessionView;
+/** The signed-in user's sessions as the Sessions screen shows them: this device first, then most recently used. */
+export declare function listSessionViews(SessionModel: any, userId: any, currentSessionId?: string | null): Promise<SessionView[]>;
+/** Names one of the user's devices (all of that device's sessions, so later sign-ins keep it); "" clears it. */
+export declare function renameSessionDevice(SessionModel: any, userId: any, id: string, rawName: unknown): Promise<{
+    name: string;
+} | null>;
+/** The signed-in user's open sessions, naming a device, and revoking a session. The backend's protect middleware
+ *  sets req.sessionId (the JWT's session) so "This device" is marked here, not guessed in the browser. */
 export declare function createSessionHandlers(): {
     getSessions: (req: any, res: any, next: any) => void;
+    renameSession: (req: any, res: any, next: any) => void;
     revokeSession: (req: any, res: any, next: any) => void;
 };
 //# sourceMappingURL=sessions.d.ts.map

package/dist/helpers/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/helpers/sessions.ts"],"names":[],"mappings":"AAYA,wHAAwH;AACxH,wBAAgB,mBAAmB,IAAI;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAS3E;AAED,MAAM,MAAM,WAAW,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErH,mEAAmE;AACnE,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAexI;AAED,oEAAoE;AACpE,wBAAgB,qBAAqB;;;EAiBpC"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/helpers/sessions.ts"],"names":[],"mappings":"AAiBA,wHAAwH;AACxH,wBAAgB,mBAAmB,IAAI;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAS3E;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,+GAA+G;IAC/G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAYF;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpG;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB5G;AAKD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,GAAE,GAAa,GAAG,IAAI,CAYzF;AAKD,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAEF;gHACgH;AAChH,wBAAgB,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CA4BvF;AAED,mHAAmH;AACnH,wBAAsB,gBAAgB,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAM/H;AAED,gHAAgH;AAChH,wBAAsB,mBAAmB,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;;UAQrG;AAED;0GAC0G;AAC1G,wBAAgB,qBAAqB;;;;EA4BpC"}