pipework 0.54.0 → 0.55.1

package/dist/infra/access-links/handle.js

@@ -0,0 +1,413 @@
+import { randomUUID } from 'node:crypto';
+import { sql } from '../../data/db/sql.js';
+import { pipe, pipeRaw, pipeSystem } from '../../data/db/db.js';
+import { requireContext } from '../../request/context/store.js';
+import { resolveActorId } from '../../data/write/audit/actor.js';
+import { getBaseLogger } from '../../core/logging/index.js';
+import { ValidationError } from '../../core/errors/index.js';
+import { createCodeGenerator } from './code.js';
+import { createRateLimiter } from './rate-limit.js';
+const DEFAULT_RESERVATION_MS = 15 * 60 * 1000;
+const DEFAULT_RATE_LIMIT = { max: 30, windowMs: 60_000 };
+const MAX_CODE_ATTEMPTS = 5;
+function asStringArray(value) {
+    return Array.isArray(value) ? value.map(String) : [];
+}
+// Raw `execute` rows carry timestamps as driver strings.
+function toDate(value) {
+    return value instanceof Date ? value : new Date(String(value));
+}
+function toDateOrNull(value) {
+    return value === null || value === undefined ? null : toDate(value);
+}
+function rowToLink(row) {
+    return {
+        id: row['id'],
+        tenantId: row['tenant_id'],
+        code: row['code'],
+        target: { type: row['target_type'], id: row['target_id'] },
+        permissions: asStringArray(row['permissions']),
+        note: row['note'] ?? null,
+        createdBy: row['created_by'] ?? null,
+        createdAt: toDate(row['created_at']),
+        expiresAt: toDateOrNull(row['expires_at']),
+        maxUses: row['max_uses'] ?? null,
+        requireChecks: asStringArray(row['require_checks']),
+        checkData: row['check_data'] ?? null,
+        revokedAt: toDateOrNull(row['revoked_at']),
+        revokedBy: row['revoked_by'] ?? null,
+    };
+}
+function rowToPublic(row) {
+    const link = rowToLink(row);
+    return {
+        id: link.id,
+        target: link.target,
+        permissions: link.permissions,
+        note: link.note,
+        expiresAt: link.expiresAt,
+        maxUses: link.maxUses,
+        usesCompleted: Number(row['uses_completed'] ?? 0),
+        requireChecks: link.requireChecks,
+    };
+}
+function rowToUse(row) {
+    return {
+        id: row['id'],
+        linkId: row['link_id'],
+        kind: row['kind'],
+        status: row['status'],
+        startedAt: toDate(row['started_at']),
+        reservedUntil: toDate(row['reserved_until']),
+        completedAt: toDateOrNull(row['completed_at']),
+        client: row['client'] ?? null,
+        location: row['location'] ?? null,
+    };
+}
+function isUniqueViolation(err) {
+    let current = err;
+    for (let depth = 0; depth < 4 && typeof current === 'object' && current !== null; depth++) {
+        if (current.code === '23505')
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
+function splitToken(useToken) {
+    const dot = useToken.lastIndexOf('.');
+    if (dot <= 0 || dot === useToken.length - 1)
+        return null;
+    const useId = useToken.slice(dot + 1);
+    if (!/^[0-9a-f-]{36}$/i.test(useId))
+        return null;
+    return { code: useToken.slice(0, dot), useId };
+}
+// A link row plus the state a use decision needs, all read with the database
+// clock. The caller that must serialize locks the row in its own statement first.
+function linkWithState(where) {
+    return sql `
+    SELECT l.*,
+      (l.revoked_at IS NOT NULL) AS is_revoked,
+      (l.expires_at IS NOT NULL AND l.expires_at <= now()) AS is_expired,
+      (SELECT count(*)::int FROM access_link_use u WHERE u.link_id = l.id AND u.status = 'completed') AS uses_completed,
+      (SELECT count(*)::int FROM access_link_use u WHERE u.link_id = l.id
+         AND (u.status = 'completed' OR (u.status = 'pending' AND u.reserved_until > clock_timestamp()))) AS uses_held
+    FROM access_link l
+    WHERE ${where}
+  `;
+}
+function stateOf(row, mode) {
+    if (row['is_revoked'] === true)
+        return 'revoked';
+    if (row['is_expired'] === true)
+        return 'expired';
+    const max = row['max_uses'];
+    const used = Number(mode === 'completed' ? row['uses_completed'] : row['uses_held']);
+    if (max !== null && used >= max)
+        return 'exhausted';
+    return null;
+}
+export function createAccessLinks(config) {
+    const permissionSet = new Set(config.permissions);
+    if (permissionSet.size === 0) {
+        throw new Error('[pipework] accessLinks.create needs a non-empty `permissions` list.\n');
+    }
+    const generator = createCodeGenerator(config.code);
+    const checks = config.checks ?? {};
+    const reservationMs = config.reservationMs ?? DEFAULT_RESERVATION_MS;
+    if (!Number.isFinite(reservationMs) || reservationMs <= 0) {
+        throw new Error('[pipework] accessLinks reservationMs must be a positive number of milliseconds.\n');
+    }
+    const rateConfig = config.resolveRateLimit === undefined ? DEFAULT_RATE_LIMIT : config.resolveRateLimit;
+    const limiter = rateConfig === false ? null : createRateLimiter(rateConfig);
+    function requireTenant() {
+        const flow = requireContext();
+        if (flow.tenant === null) {
+            throw new Error('[pipework] This accessLinks method needs a tenant in the Flow.\n\n' +
+                '  link/get/list/revoke/uses manage one tenant\'s links. Call them from an authenticated\n' +
+                '  tenant route; resolve/beginUse/completeUse/abandonUse are the ones for public routes.\n');
+        }
+        return { flow, tenantId: flow.tenant };
+    }
+    // Runs `fn` in a transaction on the owner connection with the tenant session
+    // variable set for that transaction only — the same `set_config(..., true)`
+    // the request path uses (propagateLocals), so the tenant policies on
+    // access_link / access_link_use apply as they do for any tenant write.
+    async function inTenant(tenantId, fn) {
+        const flow = requireContext();
+        const dbName = flow.instance.config.defaultDatabaseName();
+        const sessionVar = flow.instance.config.database(dbName).rls?.sessionVar ?? 'pipework.tenant_id';
+        return pipeSystem(dbName).transaction(async (tx) => {
+            const before = await tx.execute(sql `SELECT current_setting(${sessionVar}, true) AS v`);
+            await tx.execute(sql `SELECT set_config(${sessionVar}, ${tenantId}, true)`);
+            const result = await fn(tx);
+            // Under a collapsed test transaction this is a savepoint, so the setting
+            // would outlive it; put back what was there.
+            await tx.execute(sql `SELECT set_config(${sessionVar}, ${before[0]?.['v'] ?? ''}, true)`);
+            return result;
+        });
+    }
+    async function findTenant(code) {
+        const rows = await pipeSystem().execute(sql `SELECT tenant_id FROM access_link_code WHERE code = ${code}`);
+        return rows.length === 0 ? null : rows[0]['tenant_id'];
+    }
+    function signalMiss(code, client) {
+        getBaseLogger().warn({ event: 'access link resolve miss', client, codeLength: code.length }, 'access link resolve miss');
+        try {
+            config.onMiss?.({ client, code });
+        }
+        catch (err) {
+            getBaseLogger().error({ err }, 'accessLinks onMiss callback threw');
+        }
+    }
+    async function auditUse(flow, tx, tenantId, details) {
+        const trace = flow.trace;
+        const stepId = trace?.buffer.openStepId ?? null;
+        if (trace === null || stepId === null)
+            return;
+        try {
+            await tx.transaction(async (sp) => {
+                await sp.execute(sql `
+          INSERT INTO audit_record
+            (trace_day, trace_id, trace_step_id, tenant_id, actor_id, entity, verb, after, occurred_at)
+          VALUES (${trace.openedDay}, ${trace.id}, ${stepId}, ${tenantId}, ${resolveActorId(flow)},
+            'AccessLink', 'use', ${JSON.stringify(details)}::jsonb, now())
+        `);
+            });
+        }
+        catch (err) {
+            getBaseLogger().error({ err, traceId: trace.id }, 'Failed to write the access link use audit record');
+        }
+    }
+    async function newLink(options) {
+        const { flow, tenantId } = requireTenant();
+        if (options.permissions.length === 0) {
+            throw new ValidationError({ permissions: ['must name at least one permission'] }, 'Access link needs at least one permission.');
+        }
+        const unknownPermissions = options.permissions.filter(p => !permissionSet.has(p));
+        if (unknownPermissions.length > 0) {
+            const detail = `not in the configured set (${[...permissionSet].join(', ')}): ${unknownPermissions.join(', ')}`;
+            throw new ValidationError({ permissions: [detail] }, `Access link permissions ${detail}`);
+        }
+        const requireChecks = options.requireChecks ?? [];
+        const unknownChecks = requireChecks.filter(c => checks[c] === undefined);
+        if (unknownChecks.length > 0) {
+            const detail = `no such check in accessLinks.create({ checks }): ${unknownChecks.join(', ')}`;
+            throw new ValidationError({ requireChecks: [detail] }, `Access link requireChecks ${detail}`);
+        }
+        if (options.maxUses !== undefined && (!Number.isInteger(options.maxUses) || options.maxUses < 1)) {
+            throw new ValidationError({ maxUses: ['must be a positive integer'] }, 'Access link maxUses must be a positive integer.');
+        }
+        const id = randomUUID();
+        const createdBy = resolveActorId(flow);
+        const permissions = JSON.stringify([...new Set(options.permissions)]);
+        const checkData = options.checkData === undefined ? null : JSON.stringify(options.checkData);
+        return pipe.transaction(async (tx) => {
+            for (let attempt = 1; attempt <= MAX_CODE_ATTEMPTS; attempt++) {
+                const code = generator.next();
+                try {
+                    // A savepoint per attempt: a collision aborts only the attempt.
+                    return await tx.transaction(async (sp) => {
+                        await sp.execute(sql `
+              INSERT INTO access_link_code (code, tenant_id, link_id) VALUES (${code}, ${tenantId}, ${id})
+            `);
+                        const rows = await sp.execute(sql `
+              INSERT INTO access_link
+                (id, tenant_id, code, target_type, target_id, permissions, note, created_by,
+                 expires_at, max_uses, require_checks, check_data)
+              VALUES (${id}, ${tenantId}, ${code}, ${options.target.type}, ${options.target.id},
+                ${permissions}::jsonb, ${options.note ?? null}, ${createdBy},
+                ${options.expiresAt?.toISOString() ?? null}, ${options.maxUses ?? null},
+                ${JSON.stringify(requireChecks)}::jsonb,
+                ${checkData === null ? sql `NULL` : sql `${checkData}::jsonb`})
+              RETURNING *
+            `);
+                        return rowToLink(rows[0]);
+                    });
+                }
+                catch (err) {
+                    if (!isUniqueViolation(err))
+                        throw err;
+                }
+            }
+            throw new Error(`[pipework] accessLinks could not find a free code in ${MAX_CODE_ATTEMPTS} attempts.\n\n` +
+                `  Codes are ${generator.length} characters from an alphabet of ${generator.alphabet.length}; the space is\n` +
+                '  nearly full. Raise `code.length` or widen `code.alphabet`.\n');
+        });
+    }
+    const handle = {
+        link: newLink,
+        async get(id) {
+            const { tenantId } = requireTenant();
+            const rows = await pipeRaw().execute(sql `
+        SELECT * FROM access_link WHERE id = ${id} AND tenant_id = ${tenantId}
+      `);
+            return rows.length === 0 ? null : rowToLink(rows[0]);
+        },
+        async list(options) {
+            const { tenantId } = requireTenant();
+            const target = options?.target;
+            const rows = await pipeRaw().execute(sql `
+        SELECT * FROM access_link
+        WHERE tenant_id = ${tenantId}
+          ${target === undefined ? sql `` : sql `AND target_type = ${target.type} AND target_id = ${target.id}`}
+        ORDER BY created_at DESC, id
+      `);
+            return rows.map(rowToLink);
+        },
+        async revoke(id) {
+            const { flow, tenantId } = requireTenant();
+            const db = pipeRaw();
+            const rows = await db.execute(sql `
+        UPDATE access_link SET revoked_at = now(), revoked_by = ${resolveActorId(flow)}
+        WHERE id = ${id} AND tenant_id = ${tenantId} AND revoked_at IS NULL
+        RETURNING *
+      `);
+            if (rows.length > 0)
+                return rowToLink(rows[0]);
+            return handle.get(id);
+        },
+        async uses(linkId) {
+            const { tenantId } = requireTenant();
+            const rows = await pipeRaw().execute(sql `
+        SELECT * FROM access_link_use WHERE link_id = ${linkId} AND tenant_id = ${tenantId}
+        ORDER BY started_at, id
+      `);
+            return rows.map(rowToUse);
+        },
+        async resolve(code, options) {
+            const client = options?.client ?? null;
+            if (limiter !== null && client !== null && !limiter.hit(client))
+                return { status: 'rate-limited' };
+            const tenantId = await findTenant(code);
+            const row = tenantId === null ? undefined : (await inTenant(tenantId, tx => tx.execute(linkWithState(sql `l.code = ${code} AND l.tenant_id = ${tenantId}`))))[0];
+            if (tenantId === null || row === undefined) {
+                signalMiss(code, client);
+                return { status: 'not-found' };
+            }
+            const state = stateOf(row, 'completed');
+            if (state !== null)
+                return { status: state };
+            return { status: 'active', link: rowToPublic(row), tenantId };
+        },
+        async beginUse(code, options) {
+            const client = options.client ?? null;
+            // Same budget as resolve: beginUse takes a raw code too, so it is a guessing path.
+            if (limiter !== null && client !== null && !limiter.hit(client))
+                return { ok: false, reason: 'rate-limited' };
+            const tenantId = await findTenant(code);
+            if (tenantId === null) {
+                signalMiss(code, client);
+                return { ok: false, reason: 'not-found' };
+            }
+            // Read first, without a lock: refuse what is already decided and run the
+            // verifiers (which may be slow) before any row is held.
+            const first = (await inTenant(tenantId, tx => tx.execute(linkWithState(sql `l.code = ${code} AND l.tenant_id = ${tenantId}`))))[0];
+            if (first === undefined) {
+                signalMiss(code, client);
+                return { ok: false, reason: 'not-found' };
+            }
+            const early = stateOf(first, 'held');
+            if (early !== null)
+                return { ok: false, reason: early };
+            const link = rowToLink(first);
+            if (!link.permissions.includes(options.kind))
+                return { ok: false, reason: 'kind-not-permitted' };
+            for (const name of link.requireChecks) {
+                const verify = checks[name];
+                let passed = false;
+                try {
+                    passed = verify !== undefined && await verify({ link, proof: options.proof?.[name], client }) === true;
+                }
+                catch (err) {
+                    getBaseLogger().warn({ err, check: name, linkId: link.id }, 'access link check threw; treated as failed');
+                }
+                if (!passed)
+                    return { ok: false, reason: 'check-failed' };
+            }
+            // Then decide under the link's row lock: concurrent begins queue here,
+            // and each counts the uses the one before it left. The lock and the count
+            // are separate statements: a count in the locking statement reads the
+            // snapshot taken before the wait, missing the use the holder committed.
+            return inTenant(tenantId, async (tx) => {
+                await tx.execute(sql `SELECT 1 FROM access_link WHERE id = ${link.id} AND tenant_id = ${tenantId} FOR UPDATE`);
+                const locked = (await tx.execute(linkWithState(sql `l.id = ${link.id} AND l.tenant_id = ${tenantId}`)))[0];
+                if (locked === undefined)
+                    return { ok: false, reason: 'not-found' };
+                const state = stateOf(locked, 'held');
+                if (state !== null)
+                    return { ok: false, reason: state };
+                const useId = randomUUID();
+                await tx.execute(sql `
+          INSERT INTO access_link_use (id, tenant_id, link_id, kind, status, reserved_until, client, location)
+          VALUES (${useId}, ${tenantId}, ${link.id}, ${options.kind}, 'pending',
+            clock_timestamp() + ${reservationMs} * interval '1 millisecond',
+            ${client}, ${options.location ?? null})
+        `);
+                return { ok: true, useToken: `${code}.${useId}`, link: rowToPublic(locked) };
+            });
+        },
+        async completeUse(useToken) {
+            const flow = requireContext();
+            const parts = splitToken(useToken);
+            if (parts === null)
+                return { ok: false, reason: 'not-found' };
+            const tenantId = await findTenant(parts.code);
+            if (tenantId === null)
+                return { ok: false, reason: 'not-found' };
+            return inTenant(tenantId, async (tx) => {
+                const rows = await tx.execute(sql `
+          SELECT u.id, u.link_id, u.kind, u.status,
+            (u.reserved_until > clock_timestamp()) AS reservation_live,
+            (l.expires_at IS NOT NULL AND l.expires_at <= now()) AS link_expired,
+            l.target_type, l.target_id
+          FROM access_link_use u JOIN access_link l ON l.id = u.link_id
+          WHERE u.id = ${parts.useId} AND l.code = ${parts.code} AND u.tenant_id = ${tenantId}
+          FOR UPDATE OF u
+        `);
+                const row = rows[0];
+                if (row === undefined)
+                    return { ok: false, reason: 'not-found' };
+                if (row['status'] !== 'pending')
+                    return { ok: false, reason: 'already-settled' };
+                if (row['reservation_live'] !== true || row['link_expired'] === true) {
+                    return { ok: false, reason: 'expired-reservation' };
+                }
+                await tx.execute(sql `
+          UPDATE access_link_use SET status = 'completed', completed_at = now() WHERE id = ${parts.useId}
+        `);
+                await auditUse(flow, tx, tenantId, {
+                    linkId: row['link_id'], useId: parts.useId, kind: row['kind'],
+                    targetType: row['target_type'], targetId: row['target_id'],
+                });
+                return { ok: true };
+            });
+        },
+        async abandonUse(useToken) {
+            const parts = splitToken(useToken);
+            if (parts === null)
+                return { ok: false, reason: 'not-found' };
+            const tenantId = await findTenant(parts.code);
+            if (tenantId === null)
+                return { ok: false, reason: 'not-found' };
+            return inTenant(tenantId, async (tx) => {
+                const updated = await tx.execute(sql `
+          UPDATE access_link_use u SET status = 'abandoned'
+          FROM access_link l
+          WHERE u.id = ${parts.useId} AND l.id = u.link_id AND l.code = ${parts.code}
+            AND u.tenant_id = ${tenantId} AND u.status = 'pending'
+          RETURNING u.id
+        `);
+                if (updated.length > 0)
+                    return { ok: true };
+                const exists = await tx.execute(sql `
+          SELECT 1 FROM access_link_use u JOIN access_link l ON l.id = u.link_id
+          WHERE u.id = ${parts.useId} AND l.code = ${parts.code} AND u.tenant_id = ${tenantId}
+        `);
+                return { ok: false, reason: exists.length === 0 ? 'not-found' : 'already-settled' };
+            });
+        },
+    };
+    return handle;
+}
+//# sourceMappingURL=handle.js.map

package/dist/infra/access-links/handle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle.js","sourceRoot":"","sources":["../../../src/infra/access-links/handle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EAAE,mBAAmB,EAAmB,MAAM,WAAW,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,iBAAiB,CAAA;AAoHzE,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC7C,MAAM,kBAAkB,GAAoB,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AACzE,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAI3B,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,yDAAyD;AACzD,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,SAAS,CAAC,GAAQ;IACzB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;QACvB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAW;QACpC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAW;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,CAAW,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,CAAW,EAAE;QAC9E,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,EAAG,GAAG,CAAC,MAAM,CAAmB,IAAI,IAAI;QAC5C,SAAS,EAAG,GAAG,CAAC,YAAY,CAAmB,IAAI,IAAI;QACvD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpC,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,OAAO,EAAG,GAAG,CAAC,UAAU,CAAmB,IAAI,IAAI;QACnD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACnD,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI;QACpC,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,SAAS,EAAG,GAAG,CAAC,YAAY,CAAmB,IAAI,IAAI;KACxD,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjD,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ;IACxB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;QACvB,MAAM,EAAE,GAAG,CAAC,SAAS,CAAW;QAChC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAW;QAC3B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAA4B;QAChD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC5C,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,EAAG,GAAG,CAAC,QAAQ,CAAmB,IAAI,IAAI;QAChD,QAAQ,EAAG,GAAG,CAAC,UAAU,CAAmB,IAAI,IAAI;KACrD,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,OAAO,GAAY,GAAG,CAAA;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1F,IAAK,OAA8B,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QACjE,OAAO,GAAI,OAA+B,CAAC,KAAK,CAAA;IAClD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAA;AAChD,CAAC;AAED,6EAA6E;AAC7E,kFAAkF;AAClF,SAAS,aAAa,CAAC,KAA6B;IAClD,OAAO,GAAG,CAAA;;;;;;;;YAQA,KAAK;GACd,CAAA;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAQ,EAAE,IAA0B;IACnD,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAChD,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAChD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAkB,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IACpF,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,WAAW,CAAA;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACjD,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,sBAAsB,CAAA;IACpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAA;IACtG,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAA;IACvG,MAAM,OAAO,GAAG,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAE3E,SAAS,aAAa;QACpB,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;QAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oEAAoE;gBACpE,2FAA2F;gBAC3F,2FAA2F,CAC5F,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;IACxC,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,uEAAuE;IACvE,KAAK,UAAU,QAAQ,CAAI,QAAgB,EAAE,EAA0B;QACrE,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAA;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,UAAU,IAAI,oBAAoB,CAAA;QAChG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAM,EAAE,EAAE;YACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,0BAA0B,UAAU,cAAc,CAAC,CAAA;YACtF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qBAAqB,UAAU,KAAK,QAAQ,SAAS,CAAC,CAAA;YAC1E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;YAC3B,yEAAyE;YACzE,6CAA6C;YAC7C,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qBAAqB,UAAU,KAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAmB,IAAI,EAAE,SAAS,CAAC,CAAA;YAC3G,OAAO,MAAM,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,IAAY;QACpC,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,uDAAuD,IAAI,EAAE,CAAC,CAAA;QACzG,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,CAAY,CAAA;IACrE,CAAC;IAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAAqB;QACrD,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAA;QACxH,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,IAAU,EAAE,EAAM,EAAE,QAAgB,EAAE,OAAgC;QAC5F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAA;QAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;YAAE,OAAM;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAM,EAAE,EAAE;gBACpC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;oBAGR,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,KAAK,MAAM,KAAK,QAAQ,KAAK,cAAc,CAAC,IAAI,CAAC;mCAC9D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SACjD,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,kDAAkD,CAAC,CAAA;QACvG,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAoB;QACzC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAA;QAC1C,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC,mCAAmC,CAAC,EAAE,EAAE,4CAA4C,CAAC,CAAA;QACjI,CAAC;QACD,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACjF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,8BAA8B,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;YAC/G,MAAM,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,2BAA2B,MAAM,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;QACjD,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QACxE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,oDAAoD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;YAC7F,MAAM,IAAI,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,6BAA6B,MAAM,EAAE,CAAC,CAAA;QAC/F,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,4BAA4B,CAAC,EAAE,EAAE,iDAAiD,CAAC,CAAA;QAC3H,CAAC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;QACvB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;QACrE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAE5F,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAM,EAAE,EAAE;YACvC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;gBAC7B,IAAI,CAAC;oBACH,gEAAgE;oBAChE,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAM,EAAE,EAAE;wBAC3C,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;gFACgD,IAAI,KAAK,QAAQ,KAAK,EAAE;aAC3F,CAAC,CAAA;wBACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;wBAIrB,EAAE,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE;kBAC5E,WAAW,YAAY,OAAO,CAAC,IAAI,IAAI,IAAI,KAAK,SAAS;kBACzD,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,IAAI;kBACpE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;kBAC7B,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,SAAS,SAAS;;aAE9D,CAAC,CAAA;wBACF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAA;oBAC5B,CAAC,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;wBAAE,MAAM,GAAG,CAAA;gBACxC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,wDAAwD,iBAAiB,gBAAgB;gBACzF,eAAe,SAAS,CAAC,MAAM,mCAAmC,SAAS,CAAC,QAAQ,CAAC,MAAM,kBAAkB;gBAC7G,gEAAgE,CACjE,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,IAAI,EAAE,OAAO;QAEb,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAA;YACpC,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;+CACC,EAAE,oBAAoB,QAAQ;OACtE,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAA;QACvD,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAA;YACpC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,CAAA;YAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;4BAElB,QAAQ;YACxB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA,qBAAqB,MAAM,CAAC,IAAI,oBAAoB,MAAM,CAAC,EAAE,EAAE;;OAEtG,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC5B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAA;YAC1C,MAAM,EAAE,GAAG,OAAO,EAAE,CAAA;YACpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;kEAC2B,cAAc,CAAC,IAAI,CAAC;qBACjE,EAAE,oBAAoB,QAAQ;;OAE5C,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAA;YAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACvB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAA;YACpC,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;wDACU,MAAM,oBAAoB,QAAQ;;OAEnF,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO;YACzB,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,CAAA;YACtC,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;YAElG,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAA;YACvC,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CACpF,aAAa,CAAC,GAAG,CAAA,YAAY,IAAI,sBAAsB,QAAQ,EAAE,CAAC,CACnE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACN,IAAI,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC3C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;gBACxB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAChC,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;YACvC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YAC5C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAA;QAC/D,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO;YAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAA;YACrC,mFAAmF;YACnF,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;YAC7G,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAA;YACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;gBACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAC3C,CAAC;YAED,yEAAyE;YACzE,wDAAwD;YACxD,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CACtD,aAAa,CAAC,GAAG,CAAA,YAAY,IAAI,sBAAsB,QAAQ,EAAE,CAAC,CACnE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACN,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;gBACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAC3C,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACpC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YACvD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;YAEhG,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC3B,IAAI,MAAM,GAAG,KAAK,CAAA;gBAClB,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,IAAI,CAAA;gBACxG,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,4CAA4C,CAAC,CAAA;gBAC3G,CAAC;gBACD,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;YAC3D,CAAC;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,sEAAsE;YACtE,wEAAwE;YACxE,OAAO,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAA2B,EAAE;gBAC9D,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,wCAAwC,IAAI,CAAC,EAAE,oBAAoB,QAAQ,aAAa,CAAC,CAAA;gBAC7G,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAC9B,aAAa,CAAC,GAAG,CAAA,UAAU,IAAI,CAAC,EAAE,sBAAsB,QAAQ,EAAE,CAAC,CACpE,CAAC,CAAC,CAAC,CAAC,CAAA;gBACL,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;gBACnE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBACrC,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;gBAEvD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;gBAC1B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;oBAER,KAAK,KAAK,QAAQ,KAAK,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI;kCACjC,aAAa;cACjC,MAAM,KAAK,OAAO,CAAC,QAAQ,IAAI,IAAI;SACxC,CAAC,CAAA;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAA;YAC9E,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,QAAQ;YACxB,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAC7D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC7C,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAEhE,OAAO,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAA8B,EAAE;gBACjE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;;;yBAMhB,KAAK,CAAC,KAAK,iBAAiB,KAAK,CAAC,IAAI,sBAAsB,QAAQ;;SAEpF,CAAC,CAAA;gBACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;gBACnB,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;gBAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;gBAChF,IAAI,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;oBACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;gBACrD,CAAC;gBACD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;6FACiE,KAAK,CAAC,KAAK;SAC/F,CAAC,CAAA;gBACF,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE;oBACjC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;oBAC7D,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC;iBAC3D,CAAC,CAAA;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;YACrB,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,QAAQ;YACvB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAC7D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC7C,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAEhE,OAAO,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAA6B,EAAE;gBAChE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;yBAGnB,KAAK,CAAC,KAAK,sCAAsC,KAAK,CAAC,IAAI;gCACpD,QAAQ;;SAE/B,CAAC,CAAA;gBACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;gBAC3C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;yBAElB,KAAK,CAAC,KAAK,iBAAiB,KAAK,CAAC,IAAI,sBAAsB,QAAQ;SACpF,CAAC,CAAA;gBACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAA;YACrF,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/infra/access-links/index.d.ts

@@ -0,0 +1,5 @@
+export { createAccessLinks } from './handle.js';
+export type { AccessLinks, AccessLinksConfig, AccessLink, PublicLink, AccessLinkUse, AccessLinkTarget, AccessLinkCheck, AccessLinkCheckArgs, LinkOptions, ResolveResult, BeginUseResult, CompleteUseResult, AbandonUseResult, } from './handle.js';
+export type { CodeConfig } from './code.js';
+export type { RateLimitConfig } from './rate-limit.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/infra/access-links/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infra/access-links/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,YAAY,EACV,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EACvF,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAChF,iBAAiB,EAAE,gBAAgB,GACpC,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/infra/access-links/index.js

@@ -0,0 +1,2 @@
+export { createAccessLinks } from './handle.js';
+//# sourceMappingURL=index.js.map

package/dist/infra/access-links/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/infra/access-links/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA"}

package/dist/infra/access-links/namespace.d.ts

@@ -0,0 +1,7 @@
+import { createAccessLinks } from './handle.js';
+/** Access links namespace — short revocable bearer links to a tenant's resource. */
+export declare const accessLinks: {
+    /** Creates an access-link handle: tenant-scoped management plus the public resolve / beginUse / completeUse / abandonUse. */
+    readonly create: typeof createAccessLinks;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/infra/access-links/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/infra/access-links/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,oFAAoF;AACpF,eAAO,MAAM,WAAW;IACtB,6HAA6H;;CAErH,CAAA"}

package/dist/infra/access-links/namespace.js

@@ -0,0 +1,7 @@
+import { createAccessLinks } from './handle.js';
+/** Access links namespace — short revocable bearer links to a tenant's resource. */
+export const accessLinks = {
+    /** Creates an access-link handle: tenant-scoped management plus the public resolve / beginUse / completeUse / abandonUse. */
+    create: createAccessLinks,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/infra/access-links/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/infra/access-links/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,6HAA6H;IAC7H,MAAM,EAAE,iBAAiB;CACjB,CAAA"}

package/dist/infra/access-links/rate-limit.d.ts

@@ -0,0 +1,10 @@
+export interface RateLimitConfig {
+    readonly max: number;
+    readonly windowMs: number;
+}
+export interface RateLimiter {
+    /** Records a hit for `client`; false when the client is over the limit. */
+    hit(client: string, now?: number): boolean;
+}
+export declare function createRateLimiter(config: RateLimitConfig): RateLimiter;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/infra/access-links/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/infra/access-links/rate-limit.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC3C;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CAuBtE"}

package/dist/infra/access-links/rate-limit.js

@@ -0,0 +1,28 @@
+// In-process sliding-window limiter. State lives in this process's memory:
+// with N server processes the effective limit per client is up to N times
+// `max`, and it resets on restart.
+export function createRateLimiter(config) {
+    const hits = new Map();
+    let lastSweep = 0;
+    return {
+        hit(client, now = Date.now()) {
+            if (now - lastSweep > config.windowMs) {
+                lastSweep = now;
+                for (const [key, times] of hits) {
+                    if (times.length === 0 || times[times.length - 1] <= now - config.windowMs)
+                        hits.delete(key);
+                }
+            }
+            const cutoff = now - config.windowMs;
+            const times = (hits.get(client) ?? []).filter(t => t > cutoff);
+            if (times.length >= config.max) {
+                hits.set(client, times);
+                return false;
+            }
+            times.push(now);
+            hits.set(client, times);
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/infra/access-links/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/infra/access-links/rate-limit.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,0EAA0E;AAC1E,mCAAmC;AAYnC,MAAM,UAAU,iBAAiB,CAAC,MAAuB;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAA;IACxC,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,OAAO;QACL,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAC1B,IAAI,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,SAAS,GAAG,GAAG,CAAA;gBACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;oBAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ;wBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC/F,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAA;YACpC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;YAC9D,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;gBACvB,OAAO,KAAK,CAAA;YACd,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACf,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC"}