ragevault 0.2.3

package/dist/server/server.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The self-hosted RageVault server — a tiny, dependency-free HTTP server (Node
+ * core only) that serves the web UI and a small JSON API used by both the web
+ * app and the browser extension.
+ *
+ * Endpoints (all state-changing ones need the Bearer token from /api/unlock):
+ *   GET  /api/meta                     product/version, whether a vault exists
+ *   POST /api/unlock {password}        → { token }              (401 if wrong)
+ *   POST /api/lock                     end the session
+ *   GET  /api/items?domain=            item metadata (NO secrets)
+ *   GET  /api/reveal/:id               { password, totp }       (the secret)
+ *   POST /api/items {…}                add an item
+ *   POST /api/import?name=  <raw file> import from Bitwarden/1Password/Proton/CSV
+ *   GET  /api/gen?mode=&length=&words= generate a password (no auth)
+ *
+ * Binds to 127.0.0.1 by default. If you bind to all interfaces it loudly warns
+ * you to keep it behind a VPN.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+export interface ServeConfig {
+    vaultPath: string;
+    host: string;
+    port: number;
+}
+export declare function startServer(cfg: ServeConfig): Promise<{
+    port: number;
+}>;

package/dist/server/server.js

@@ -0,0 +1,410 @@
+/**
+ * The self-hosted RageVault server — a tiny, dependency-free HTTP server (Node
+ * core only) that serves the web UI and a small JSON API used by both the web
+ * app and the browser extension.
+ *
+ * Endpoints (all state-changing ones need the Bearer token from /api/unlock):
+ *   GET  /api/meta                     product/version, whether a vault exists
+ *   POST /api/unlock {password}        → { token }              (401 if wrong)
+ *   POST /api/lock                     end the session
+ *   GET  /api/items?domain=            item metadata (NO secrets)
+ *   GET  /api/reveal/:id               { password, totp }       (the secret)
+ *   POST /api/items {…}                add an item
+ *   POST /api/import?name=  <raw file> import from Bitwarden/1Password/Proton/CSV
+ *   GET  /api/gen?mode=&length=&words= generate a password (no auth)
+ *
+ * Binds to 127.0.0.1 by default. If you bind to all interfaces it loudly warns
+ * you to keep it behind a VPN.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { createServer } from "node:http";
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { networkInterfaces } from "node:os";
+import { dirname, extname, join, normalize, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { BRAND } from "../branding.js";
+import { canDo, emptyVault, newId } from "../model.js";
+import { createVault, readVaultFile, rewrapForPassword, saveVault as saveVaultFile, unlockVault } from "../store/vaultfile.js";
+import { generatePassphrase, generatePassword, generatePronounceable, estimateStrength } from "../generator.js";
+import { totp } from "../totp.js";
+import { lock, persist, resolve as resolveSession, unlock } from "./session.js";
+import { importAny } from "../porters.js";
+import { isPackaged, readAssetBuffer } from "../assets.js";
+const PUBLIC_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "public");
+const MIME = {
+    ".html": "text/html; charset=utf-8", ".css": "text/css; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8", ".json": "application/json; charset=utf-8", ".svg": "image/svg+xml",
+    ".webmanifest": "application/manifest+json", ".png": "image/png", ".ico": "image/x-icon",
+    ".woff2": "font/woff2", ".woff": "font/woff",
+};
+function json(res, status, body) {
+    res.writeHead(status, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" });
+    res.end(JSON.stringify(body));
+}
+function readBody(req) {
+    return new Promise((resolvePromise, reject) => {
+        let data = "";
+        req.on("data", (c) => { data += c; if (data.length > 65_536) {
+            reject(new Error("Body too large"));
+            req.destroy();
+        } });
+        req.on("end", () => {
+            try {
+                if (!data)
+                    return resolvePromise({});
+                // Reject prototype-pollution payloads (__proto__, constructor, prototype)
+                // before parsing — defence in depth even though we only read known keys.
+                if (/"(?:__proto__|constructor|prototype)"\s*:/.test(data))
+                    return reject(new Error("Invalid JSON"));
+                resolvePromise(JSON.parse(data));
+            }
+            catch {
+                reject(new Error("Invalid JSON"));
+            }
+        });
+        req.on("error", reject);
+    });
+}
+/** Read a raw text body (for file imports, which can exceed the JSON cap). */
+function readText(req, max = 8_388_608) {
+    return new Promise((resolvePromise, reject) => {
+        let data = "";
+        req.on("data", (c) => { data += c; if (data.length > max) {
+            reject(new Error("File too large (max 8 MB)."));
+            req.destroy();
+        } });
+        req.on("end", () => resolvePromise(data));
+        req.on("error", reject);
+    });
+}
+/** Harden every response: strict CSP (no inline/eval), no framing, no sniffing. */
+function setSecurityHeaders(res) {
+    res.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; " +
+        "connect-src 'self'; manifest-src 'self'; worker-src 'self'; object-src 'none'; " +
+        "base-uri 'none'; form-action 'none'; frame-ancestors 'none'");
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("Permissions-Policy", "geolocation=(), microphone=(), camera=(), interest-cohort=()");
+    res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+    res.setHeader("Cross-Origin-Resource-Policy", "same-origin");
+}
+function bearer(req) {
+    const h = req.headers.authorization ?? "";
+    return h.startsWith("Bearer ") ? h.slice(7) : undefined;
+}
+/** hostname of an item's url, lowercased, for domain matching. */
+function itemHost(item) {
+    try {
+        return item.url ? new URL(item.url).hostname.toLowerCase().replace(/^www\./, "") : "";
+    }
+    catch {
+        return "";
+    }
+}
+/** Fetch a site's favicon from a public icon service. Only the self-hosted
+ *  server ever calls this — never the user's browser — and we hit fixed icon
+ *  endpoints (the domain is only a parameter), so there's no SSRF to arbitrary
+ *  hosts. Returns PNG/ICO bytes or throws. */
+async function fetchFavicon(domain) {
+    const sources = [
+        `https://icons.duckduckgo.com/ip3/${domain}.ico`,
+        `https://www.google.com/s2/favicons?sz=64&domain=${domain}`,
+    ];
+    for (const src of sources) {
+        try {
+            const ctl = new AbortController();
+            const timer = setTimeout(() => ctl.abort(), 4000);
+            const r = await fetch(src, { signal: ctl.signal, headers: { accept: "image/*" } });
+            clearTimeout(timer);
+            if (!r.ok)
+                continue;
+            const buf = Buffer.from(await r.arrayBuffer());
+            if (buf.byteLength >= 100)
+                return buf; // skip empty/placeholder responses
+        }
+        catch { /* try the next source */ }
+    }
+    throw new Error("no favicon");
+}
+export function startServer(cfg) {
+    const server = createServer(async (req, res) => {
+        setSecurityHeaders(res);
+        const url = new URL(req.url ?? "/", "http://localhost");
+        const path = url.pathname;
+        try {
+            if (path === "/api/meta") {
+                return json(res, 200, { product: BRAND.product, version: BRAND.version, author: BRAND.author, hasVault: existsSync(cfg.vaultPath) });
+            }
+            if (path === "/api/gen") {
+                const mode = url.searchParams.get("mode");
+                const pw = mode === "passphrase" ? generatePassphrase(Number(url.searchParams.get("words") ?? 5))
+                    : mode === "pronounceable" ? generatePronounceable()
+                        : generatePassword({ length: Number(url.searchParams.get("length") ?? 20) });
+                return json(res, 200, { password: pw, strength: estimateStrength(pw) });
+            }
+            if (path === "/api/favicon") {
+                // Served from our own origin (keeps CSP img-src 'self'). Only the server
+                // reaches out to the icon service, so the user's browser never reveals
+                // which sites are saved. Requires a valid session (token via ?t= for <img>).
+                if (!resolveSession(url.searchParams.get("t") ?? bearer(req))) {
+                    res.writeHead(401);
+                    return void res.end();
+                }
+                const domain = (url.searchParams.get("domain") ?? "").toLowerCase().replace(/^www\./, "");
+                if (!/^[a-z0-9][a-z0-9.-]{0,253}$/.test(domain)) {
+                    res.writeHead(400);
+                    return void res.end();
+                }
+                const dir = join(dirname(cfg.vaultPath), "favicons");
+                const file = join(dir, `${domain}.png`);
+                try {
+                    let buf;
+                    if (existsSync(file))
+                        buf = await readFile(file);
+                    else {
+                        buf = await fetchFavicon(domain);
+                        await mkdir(dir, { recursive: true });
+                        await writeFile(file, buf);
+                    }
+                    // Declare the true type — the global nosniff header stops the browser guessing.
+                    const type = buf[0] === 0x89 && buf[1] === 0x50 ? "image/png"
+                        : buf[0] === 0x00 && buf[1] === 0x00 && buf[2] === 0x01 ? "image/x-icon"
+                            : buf[0] === 0x47 && buf[1] === 0x49 ? "image/gif"
+                                : buf.slice(0, 4).toString() === "<svg" || buf.slice(0, 5).toString() === "<?xml" ? "image/svg+xml"
+                                    : "image/x-icon";
+                    res.writeHead(200, { "Content-Type": type, "Cache-Control": "max-age=604800" });
+                    return void res.end(buf);
+                }
+                catch {
+                    res.writeHead(404);
+                    return void res.end();
+                }
+            }
+            if (path === "/api/init" && req.method === "POST") {
+                // First-run vault creation from the UI (used by the desktop app). Refuses
+                // if a vault already exists, so it can't clobber your data.
+                if (existsSync(cfg.vaultPath))
+                    return json(res, 409, { error: "A vault already exists here." });
+                const body = await readBody(req);
+                const password = typeof body.password === "string" ? body.password : "";
+                const name = typeof body.name === "string" && body.name.trim() ? body.name.trim() : "My Vault";
+                if (password.length < 8)
+                    return json(res, 400, { error: "Master password must be at least 8 characters." });
+                saveVaultFile(cfg.vaultPath, createVault(emptyVault(name, "owner", new Date().toISOString()), password));
+                const token = await unlock(cfg.vaultPath, password);
+                return json(res, 200, { token });
+            }
+            if (path === "/api/passwd" && req.method === "POST") {
+                const sess = resolveSession(bearer(req));
+                if (!sess)
+                    return json(res, 401, { error: "Locked. Unlock first." });
+                if (!canDo(sess.vault.data.users[0]?.role ?? "viewer", "vault.manage"))
+                    return json(res, 403, { error: "Your role can't change the master password." });
+                const body = await readBody(req);
+                const current = typeof body.current === "string" ? body.current : "";
+                const next = typeof body.next === "string" ? body.next : "";
+                if (next.length < 8)
+                    return json(res, 400, { error: "New master password must be at least 8 characters." });
+                try {
+                    unlockVault(readVaultFile(sess.path), current);
+                }
+                catch {
+                    return json(res, 403, { error: "Current master password is incorrect." });
+                }
+                rewrapForPassword(sess.vault, next);
+                persist(sess);
+                return json(res, 200, { ok: true });
+            }
+            if (path === "/api/unlock" && req.method === "POST") {
+                const body = await readBody(req);
+                if (typeof body.password !== "string")
+                    return json(res, 400, { error: "password required" });
+                try {
+                    const token = await unlock(cfg.vaultPath, body.password);
+                    return json(res, 200, { token });
+                }
+                catch (e) {
+                    return json(res, 401, { error: e.message });
+                }
+            }
+            // ---- everything below needs a valid session ----
+            const session = resolveSession(bearer(req));
+            const guard = () => { json(res, 401, { error: "Locked. Unlock first." }); };
+            if (path === "/api/lock" && req.method === "POST") {
+                lock(bearer(req));
+                return json(res, 200, { ok: true });
+            }
+            if (path === "/api/items" && req.method === "GET") {
+                if (!session)
+                    return guard();
+                const domain = (url.searchParams.get("domain") ?? "").toLowerCase().replace(/^www\./, "");
+                const cats = new Map(session.vault.data.categories.map((c) => [c.id, c.name]));
+                const items = session.vault.data.items
+                    // Title/host substrings power the search box; the host clause is a strict
+                    // exact-or-subdomain match so "github.com.evil.com" can't surface github.com
+                    // credentials to the extension's one-click autofill.
+                    .filter((i) => { const h = itemHost(i); return !domain || i.title.toLowerCase().includes(domain) || (!!h && (h.includes(domain) || domain === h || domain.endsWith(`.${h}`))); })
+                    .map((i) => ({ id: i.id, title: i.title, username: i.username ?? "", url: i.url ?? "", category: cats.get(i.categoryId ?? "") ?? "", favorite: i.favorite, hasTotp: Boolean(i.totp), icon: i.icon ?? "" }));
+                return json(res, 200, { items });
+            }
+            if (path.startsWith("/api/reveal/") && req.method === "GET") {
+                if (!session)
+                    return guard();
+                const role = session.vault.data.users[0]?.role ?? "viewer";
+                if (!canDo(role, "item.reveal"))
+                    return json(res, 403, { error: "Your role can't reveal secrets." });
+                const id = path.slice("/api/reveal/".length);
+                const item = session.vault.data.items.find((i) => i.id === id);
+                if (!item)
+                    return json(res, 404, { error: "Not found" });
+                return json(res, 200, { password: item.password ?? "", totp: item.totp ?? null });
+            }
+            if (path.startsWith("/api/totp/") && req.method === "GET") {
+                if (!session)
+                    return guard();
+                if (!canDo(session.vault.data.users[0]?.role ?? "viewer", "item.reveal"))
+                    return json(res, 403, { error: "Your role can't reveal secrets." });
+                const item = session.vault.data.items.find((i) => i.id === path.slice("/api/totp/".length));
+                if (!item?.totp)
+                    return json(res, 404, { error: "No 2FA on this item." });
+                try {
+                    return json(res, 200, totp(item.totp));
+                }
+                catch {
+                    return json(res, 400, { error: "Invalid 2FA secret." });
+                }
+            }
+            if (path === "/api/items" && req.method === "POST") {
+                if (!session)
+                    return guard();
+                const role = session.vault.data.users[0]?.role ?? "viewer";
+                if (!canDo(role, "item.create"))
+                    return json(res, 403, { error: "Your role can't add items." });
+                const body = await readBody(req);
+                if (typeof body.title !== "string" || !body.title.trim())
+                    return json(res, 400, { error: "title required" });
+                const now = new Date().toISOString();
+                let categoryId;
+                if (typeof body.category === "string" && body.category.trim()) {
+                    const name = body.category.trim();
+                    const existing = session.vault.data.categories.find((c) => c.name.toLowerCase() === name.toLowerCase());
+                    categoryId = existing?.id ?? newId();
+                    if (!existing)
+                        session.vault.data.categories.push({ id: categoryId, name });
+                }
+                const item = {
+                    id: newId(), title: body.title.trim(),
+                    username: typeof body.username === "string" ? body.username : undefined,
+                    url: typeof body.url === "string" ? body.url : undefined,
+                    password: typeof body.password === "string" ? body.password : "",
+                    icon: typeof body.icon === "string" && body.icon.trim() ? body.icon.trim().slice(0, 8) : undefined,
+                    categoryId, tags: [], favorite: false, createdAt: now, updatedAt: now, history: [],
+                };
+                session.vault.data.items.push(item);
+                persist(session);
+                return json(res, 200, { ok: true, id: item.id });
+            }
+            // ---- one-click import from Bitwarden / 1Password / Proton / LastPass / CSV ----
+            if (path === "/api/import" && req.method === "POST") {
+                if (!session)
+                    return guard();
+                const role = session.vault.data.users[0]?.role ?? "viewer";
+                if (!canDo(role, "item.create"))
+                    return json(res, 403, { error: "Your role can't add items." });
+                let content;
+                try {
+                    content = await readText(req);
+                }
+                catch (e) {
+                    return json(res, 413, { error: e.message });
+                }
+                if (!content.trim())
+                    return json(res, 400, { error: "That file looks empty." });
+                let parsed;
+                try {
+                    parsed = importAny(content, url.searchParams.get("name") ?? "");
+                }
+                catch {
+                    return json(res, 400, { error: "Couldn't read that file — is it a Bitwarden/1Password/Proton/CSV export?" });
+                }
+                const now = new Date().toISOString();
+                let added = 0;
+                for (const raw of parsed.items) {
+                    if (!raw || typeof raw.title !== "string" || !raw.title.trim())
+                        continue;
+                    session.vault.data.items.push({
+                        ...raw, id: newId(), tags: Array.isArray(raw.tags) ? raw.tags : [],
+                        favorite: Boolean(raw.favorite), createdAt: now, updatedAt: now,
+                        history: Array.isArray(raw.history) ? raw.history : [],
+                    });
+                    added++;
+                }
+                if (added)
+                    persist(session);
+                return json(res, 200, { ok: true, added, source: parsed.source });
+            }
+            // ---- static SPA (from disk, or the SEA blob when packaged) ----
+            if (req.method === "GET") {
+                const rel = path === "/" ? "index.html" : path.replace(/^\/+/, "");
+                const target = normalize(join(PUBLIC_DIR, rel));
+                if (!target.startsWith(PUBLIC_DIR)) {
+                    res.writeHead(404);
+                    return void res.end("Not found");
+                }
+                let bodyBuf;
+                if (isPackaged()) {
+                    try {
+                        bodyBuf = readAssetBuffer(`public/${rel}`, target);
+                    }
+                    catch {
+                        res.writeHead(404);
+                        return void res.end("Not found");
+                    }
+                }
+                else {
+                    if (!existsSync(target)) {
+                        res.writeHead(404);
+                        return void res.end("Not found");
+                    }
+                    bodyBuf = await readFile(target);
+                }
+                res.writeHead(200, { "Content-Type": MIME[extname(target)] ?? "application/octet-stream" });
+                return void res.end(bodyBuf);
+            }
+            res.writeHead(405);
+            res.end("Method not allowed");
+        }
+        catch (e) {
+            json(res, 500, { error: e instanceof Error ? e.message : "server error" });
+        }
+    });
+    return new Promise((resolvePromise) => {
+        // port 0 asks the OS for a free port (the desktop app uses this and reads it back).
+        server.listen(cfg.port, cfg.host, () => {
+            const actualPort = server.address()?.port ?? cfg.port;
+            process.stdout.write(`\n  \x1b[38;5;39m${BRAND.product}\x1b[0m server ready at \x1b[1mhttp://${cfg.host}:${actualPort}\x1b[0m\n`);
+            if (cfg.host === "0.0.0.0" || cfg.host === "::") {
+                for (const u of reachableUrls(actualPort))
+                    process.stdout.write(`    reachable at ${u}\n`);
+                process.stdout.write(`  \x1b[33m⚠ Bound to ALL interfaces.\x1b[0m Keep RageVault behind a VPN — never expose it to the Internet.\n`);
+            }
+            process.stdout.write(`  \x1b[2mAuto-locks after 15 min idle. Ctrl-C to stop.\x1b[0m\n\n`);
+            resolvePromise({ port: actualPort });
+        });
+    });
+}
+function reachableUrls(port) {
+    const urls = [`http://127.0.0.1:${port}`];
+    for (const addrs of Object.values(networkInterfaces())) {
+        for (const a of addrs ?? [])
+            if (a.family === "IPv4" && !a.internal)
+                urls.push(`http://${a.address}:${port}`);
+    }
+    return urls;
+}
+//# sourceMappingURL=server.js.map

package/dist/server/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAEpF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAa,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,IAAI,aAAa,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/H,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE3D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9E,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,yBAAyB;IACtE,KAAK,EAAE,gCAAgC,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,eAAe;IAC5G,cAAc,EAAE,2BAA2B,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc;IACxF,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW;CAC7C,CAAC;AAEF,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1G,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI;oBAAE,OAAO,cAAc,CAAC,EAAE,CAAC,CAAC;gBACrC,0EAA0E;gBAC1E,yEAAyE;gBACzE,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;gBACrG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,GAAoB,EAAE,GAAG,GAAG,SAAS;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjI,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,GAAmB;IAC7C,GAAG,CAAC,SAAS,CAAC,yBAAyB,EACrC,iFAAiF;QACjF,iFAAiF;QACjF,6DAA6D,CAAC,CAAC;IACjE,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,8DAA8D,CAAC,CAAC;IACpG,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IAC3D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,MAAM,CAAC,GAAoB;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC1C,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,kEAAkE;AAClE,SAAS,QAAQ,CAAC,IAAU;IAC1B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACrH,CAAC;AAED;;;8CAG8C;AAC9C,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,MAAM,OAAO,GAAG;QACd,oCAAoC,MAAM,MAAM;QAChD,mDAAmD,MAAM,EAAE;KAC5D,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACnF,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,SAAS;YACpB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/C,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC,CAAC,mCAAmC;QAC5E,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;AAChC,CAAC;AAQD,MAAM,UAAU,WAAW,CAAC,GAAgB;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,EAAE,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC/F,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,qBAAqB,EAAE;wBACpD,CAAC,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,yEAAyE;gBACzE,uEAAuE;gBACvE,6EAA6E;gBAC7E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAAC,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC;gBAC7G,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1F,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAAC,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC;gBAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;gBACrD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC;gBACxC,IAAI,CAAC;oBACH,IAAI,GAAW,CAAC;oBAChB,IAAI,UAAU,CAAC,IAAI,CAAC;wBAAE,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;yBAC5C,CAAC;wBAAC,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;wBAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;wBAAC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAAC,CAAC;oBAC7G,gFAAgF;oBAChF,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW;wBAC3D,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc;4BACxE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW;gCAClD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe;oCACnG,CAAC,CAAC,cAAc,CAAC;oBACnB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC,CAAC;oBAChF,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAAC,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC;YACxD,CAAC;YAED,IAAI,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClD,0EAA0E;gBAC1E,4DAA4D;gBAC5D,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;gBAChG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC/F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;gBAC5G,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACzG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACpD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACnC,CAAC;YAED,IAAI,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,QAAQ,EAAE,cAAc,CAAC;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;gBACxJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;gBAC5G,IAAI,CAAC;oBAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;gBAAC,CAAC;gBACvD,MAAM,CAAC;oBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBACpF,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;YAED,IAAI,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC7F,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACzD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAED,mDAAmD;YACnD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAE5E,IAAI,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAE9G,IAAI,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAClD,IAAI,CAAC,OAAO;oBAAE,OAAO,KAAK,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;oBACpC,0EAA0E;oBAC1E,6EAA6E;oBAC7E,qDAAqD;qBACpD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;qBAChL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9M,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACnC,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC5D,IAAI,CAAC,OAAO;oBAAE,OAAO,KAAK,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBACrG,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/D,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC1D,IAAI,CAAC,OAAO;oBAAE,OAAO,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,QAAQ,EAAE,aAAa,CAAC;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBAC9I,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5F,IAAI,CAAC,IAAI,EAAE,IAAI;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;gBAC1E,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC/C,MAAM,CAAC;oBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAAC,CAAC;YACpE,CAAC;YAED,IAAI,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACnD,IAAI,CAAC,OAAO;oBAAE,OAAO,KAAK,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBAChG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC7G,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,IAAI,UAA8B,CAAC;gBACnC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBACxG,UAAU,GAAG,QAAQ,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC;oBACrC,IAAI,CAAC,QAAQ;wBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM,IAAI,GAAS;oBACjB,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;oBACrC,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBACvE,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;oBACxD,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAChE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;oBAClG,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;iBACnF,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACjB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,kFAAkF;YAClF,IAAI,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACpD,IAAI,CAAC,OAAO;oBAAE,OAAO,KAAK,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBAChG,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBAAC,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBACtC,OAAO,CAAC,EAAE,CAAC;oBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBAAC,CAAC;gBACrE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAChF,IAAI,MAAyC,CAAC;gBAC9C,IAAI,CAAC;oBAAC,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;gBACxE,MAAM,CAAC;oBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0EAA0E,EAAE,CAAC,CAAC;gBAAC,CAAC;gBACvH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC/B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;wBAAE,SAAS;oBACzE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;wBAC5B,GAAG,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;wBAClE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG;wBAC/D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;qBACvD,CAAC,CAAC;oBACH,KAAK,EAAE,CAAC;gBACV,CAAC;gBACD,IAAI,KAAK;oBAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,kEAAkE;YAClE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACnE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;gBAChD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAAC,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAAC,CAAC;gBAC7F,IAAI,OAAe,CAAC;gBACpB,IAAI,UAAU,EAAE,EAAE,CAAC;oBACjB,IAAI,CAAC;wBAAC,OAAO,GAAG,eAAe,CAAC,UAAU,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;oBAAC,CAAC;oBAC3D,MAAM,CAAC;wBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBAAC,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBAAC,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBAAC,CAAC;oBAClF,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,0BAA0B,EAAE,CAAC,CAAC;gBAC5F,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,oFAAoF;QACpF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;YACrC,MAAM,UAAU,GAAI,MAAM,CAAC,OAAO,EAAyB,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;YAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,CAAC,OAAO,yCAAyC,GAAG,CAAC,IAAI,IAAI,UAAU,WAAW,CAAC,CAAC;YAClI,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAChD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8GAA8G,CAAC,CAAC;YACvI,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YAC1F,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/session.d.ts

@@ -0,0 +1,36 @@
+/**
+ * In-memory unlock sessions for the self-hosted server.
+ *
+ * The web UI / extension POST the master password once; the server derives the
+ * vault key, holds the *unlocked* vault in memory keyed by a random bearer
+ * token, and auto-locks after idle. The password itself is never stored, and
+ * only ciphertext is ever written back to disk.
+ *
+ * SECURITY TRADE-OFF (documented on purpose): in this model the server briefly
+ * sees the master password during unlock and holds the data key in memory — so
+ * run it **only on a host you trust, behind your VPN**. Browser-side
+ * (zero-knowledge) decryption is on the roadmap; it needs a KDF WebCrypto can do
+ * (the vault uses scrypt today).
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { type OpenVault } from "../store/vaultfile.js";
+interface Session {
+    vault: OpenVault;
+    path: string;
+    /** Epoch ms when this session lapses if untouched. */
+    expires: number;
+}
+/** Milliseconds remaining on the current lockout (0 if not locked). */
+export declare function lockoutRemainingMs(): number;
+/** Unlock the vault and start a session. Returns the bearer token. */
+export declare function unlock(path: string, password: string): Promise<string>;
+/** Resolve a token to its live session, sliding the idle timer. Null if gone. */
+export declare function resolve(token: string | undefined): Session | null;
+/** End a session (lock). */
+export declare function lock(token: string | undefined): void;
+/** Persist the current state of a session's vault. */
+export declare function persist(s: Session): void;
+export {};

package/dist/server/session.js

@@ -0,0 +1,89 @@
+/**
+ * In-memory unlock sessions for the self-hosted server.
+ *
+ * The web UI / extension POST the master password once; the server derives the
+ * vault key, holds the *unlocked* vault in memory keyed by a random bearer
+ * token, and auto-locks after idle. The password itself is never stored, and
+ * only ciphertext is ever written back to disk.
+ *
+ * SECURITY TRADE-OFF (documented on purpose): in this model the server briefly
+ * sees the master password during unlock and holds the data key in memory — so
+ * run it **only on a host you trust, behind your VPN**. Browser-side
+ * (zero-knowledge) decryption is on the roadmap; it needs a KDF WebCrypto can do
+ * (the vault uses scrypt today).
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readVaultFile, saveVault, unlockVault } from "../store/vaultfile.js";
+const sessions = new Map();
+const IDLE_MS = 15 * 60 * 1000; // auto-lock after 15 minutes idle
+/**
+ * Server-side brute-force lockout. This is the authoritative gate — the browser's
+ * shake/lockout is only cosmetic and can be bypassed (clear localStorage, or hit
+ * the API directly with a proxy). Enforced here, it can't be. After a few bad
+ * passwords the server refuses to even try for an escalating window.
+ */
+let failures = 0;
+let lockedUntil = 0;
+/** Milliseconds remaining on the current lockout (0 if not locked). */
+export function lockoutRemainingMs() { return Math.max(0, lockedUntil - Date.now()); }
+function sweep(now) {
+    for (const [token, s] of sessions)
+        if (s.expires <= now)
+            sessions.delete(token);
+}
+/** Unlock the vault and start a session. Returns the bearer token. */
+export async function unlock(path, password) {
+    if (!existsSync(path))
+        throw new Error("No vault on this server. Run `ragevault init` first.");
+    const now = Date.now();
+    const remaining = lockoutRemainingMs();
+    if (remaining > 0)
+        throw new Error(`Too many attempts — locked for ${Math.ceil(remaining / 1000)}s.`);
+    const file = readVaultFile(path);
+    let vault;
+    try {
+        vault = unlockVault(file, password);
+    }
+    catch {
+        failures++;
+        if (failures >= 5) {
+            // Escalating window, capped at 1 hour: 15s, 30s, 1m, 2m, 4m … 60m.
+            const secs = Math.min(3600, 15 * 2 ** (failures - 5));
+            lockedUntil = Date.now() + secs * 1000;
+            throw new Error(`Wrong master password. Too many attempts — locked for ${secs}s.`);
+        }
+        throw new Error(`Wrong master password. ${5 - failures} attempt${5 - failures === 1 ? "" : "s"} left before lockout.`);
+    }
+    failures = 0;
+    lockedUntil = 0;
+    const token = randomBytes(32).toString("base64url");
+    sessions.set(token, { vault, path, expires: now + IDLE_MS });
+    return token;
+}
+/** Resolve a token to its live session, sliding the idle timer. Null if gone. */
+export function resolve(token) {
+    if (!token)
+        return null;
+    const now = Date.now();
+    sweep(now);
+    const s = sessions.get(token);
+    if (!s)
+        return null;
+    s.expires = now + IDLE_MS;
+    return s;
+}
+/** End a session (lock). */
+export function lock(token) {
+    if (token)
+        sessions.delete(token);
+}
+/** Persist the current state of a session's vault. */
+export function persist(s) {
+    saveVault(s.path, s.vault);
+}
+//# sourceMappingURL=session.js.map

package/dist/server/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAkB,MAAM,uBAAuB,CAAC;AAS9F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;AAC5C,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,kCAAkC;AAElE;;;;;GAKG;AACH,IAAI,QAAQ,GAAG,CAAC,CAAC;AACjB,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,KAAa,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAE9F,SAAS,KAAK,CAAC,GAAW;IACxB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG;YAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,QAAgB;IACzD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtG,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC;QACX,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,mEAAmE;YACnE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;YACtD,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,GAAG,QAAQ,WAAW,CAAC,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC;IACzH,CAAC;IACD,QAAQ,GAAG,CAAC,CAAC;IAAC,WAAW,GAAG,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,OAAO,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,CAAC,GAAG,CAAC,CAAC;IACX,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,CAAC,CAAC,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,IAAI,CAAC,KAAyB;IAC5C,IAAI,KAAK;QAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,OAAO,CAAC,CAAU;IAChC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}