wind-agent-cli 1.37.2

package/dist-server/server/modules/auth/auth.middleware.js

@@ -0,0 +1,133 @@
+// @ts-nocheck -- JWT request augmentation is narrowed by Auth route contracts.
+import jwt from 'jsonwebtoken';
+import { IS_PLATFORM } from '../../shared/utils.js';
+import { userDb, appConfigDb } from '../database/index.js';
+// Use env var if set, otherwise auto-generate a unique secret per installation
+const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
+// Optional API key middleware
+const validateApiKey = (req, res, next) => {
+    // Skip API key validation if not configured
+    if (!process.env.API_KEY) {
+        return next();
+    }
+    const apiKey = req.headers['x-api-key'];
+    if (apiKey !== process.env.API_KEY) {
+        return res.status(401).json({ error: 'Invalid API key' });
+    }
+    next();
+};
+// JWT authentication middleware
+const authenticateToken = async (req, res, next) => {
+    // Platform mode:  use single database user
+    if (IS_PLATFORM) {
+        try {
+            const user = userDb.getFirstUser();
+            if (!user) {
+                return res.status(500).json({ error: 'Platform mode: No user found in database' });
+            }
+            req.user = user;
+            return next();
+        }
+        catch (error) {
+            console.error('Platform mode error:', error);
+            return res.status(500).json({ error: 'Platform mode: Failed to fetch user' });
+        }
+    }
+    // Normal OSS JWT validation
+    const authHeader = req.headers['authorization'];
+    let token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN
+    // Also check query param for SSE endpoints (EventSource can't set headers)
+    if (!token && req.query.token) {
+        token = req.query.token;
+    }
+    if (!token) {
+        res.setHeader('X-Auth-Error', 'invalid-token');
+        return res.status(401).json({
+            error: 'Access denied. No token provided.',
+            code: 'AUTH_TOKEN_INVALID',
+        });
+    }
+    try {
+        const decoded = jwt.verify(token, JWT_SECRET);
+        // Verify user still exists and is active
+        const user = userDb.getUserById(decoded.userId);
+        if (!user) {
+            res.setHeader('X-Auth-Error', 'invalid-token');
+            return res.status(401).json({
+                error: 'Invalid token. User not found.',
+                code: 'AUTH_TOKEN_INVALID',
+            });
+        }
+        // Auto-refresh: if token is past halfway through its lifetime, issue a new one
+        if (decoded.exp && decoded.iat) {
+            const now = Math.floor(Date.now() / 1000);
+            const halfLife = (decoded.exp - decoded.iat) / 2;
+            if (now > decoded.iat + halfLife) {
+                const newToken = generateToken(user);
+                res.setHeader('X-Refreshed-Token', newToken);
+            }
+        }
+        req.user = user;
+        next();
+    }
+    catch (error) {
+        if (error instanceof jwt.TokenExpiredError) {
+            res.setHeader('X-Auth-Error', 'session-expired');
+            return res.status(401).json({
+                error: 'Session expired. Please log in again.',
+                code: 'AUTH_TOKEN_EXPIRED',
+            });
+        }
+        console.warn('Token verification failed:', error instanceof Error ? error.message : String(error));
+        res.setHeader('X-Auth-Error', 'invalid-token');
+        return res.status(401).json({
+            error: 'Invalid token',
+            code: 'AUTH_TOKEN_INVALID',
+        });
+    }
+};
+// Generate JWT token
+const generateToken = (user) => {
+    return jwt.sign({
+        userId: user.id,
+        username: user.username
+    }, JWT_SECRET, { expiresIn: '7d' });
+};
+// WebSocket authentication function
+const authenticateWebSocket = (token) => {
+    // Platform mode: bypass token validation, return first user
+    if (IS_PLATFORM) {
+        try {
+            const user = userDb.getFirstUser();
+            if (user) {
+                return { id: user.id, userId: user.id, username: user.username };
+            }
+            return null;
+        }
+        catch (error) {
+            console.error('Platform mode WebSocket error:', error);
+            return null;
+        }
+    }
+    // Normal OSS JWT validation
+    if (!token) {
+        return null;
+    }
+    try {
+        const decoded = jwt.verify(token, JWT_SECRET);
+        // Verify user actually exists in database (matches REST authenticateToken behavior)
+        const user = userDb.getUserById(decoded.userId);
+        if (!user) {
+            return null;
+        }
+        return { userId: user.id, username: user.username };
+    }
+    catch (error) {
+        if (!(error instanceof jwt.TokenExpiredError)) {
+            console.warn('WebSocket token verification failed:', error instanceof Error ? error.message : String(error));
+        }
+        return null;
+    }
+};
+export { validateApiKey, authenticateToken, generateToken, authenticateWebSocket, JWT_SECRET };
+//# sourceMappingURL=auth.middleware.js.map

package/dist-server/server/modules/auth/auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../../../server/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE3D,+EAA+E;AAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC,oBAAoB,EAAE,CAAC;AAEhF,8BAA8B;AAC9B,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACxC,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACjD,2CAA2C;IAC3C,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,KAAK,GAAG,UAAU,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;IAEnE,2EAA2E;IAC3E,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,mCAAmC;YAC1C,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAE9C,yCAAyC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,gCAAgC;gBACvC,IAAI,EAAE,oBAAoB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,+EAA+E;QAC/E,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;YACjD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,uCAAuC;gBAC9C,IAAI,EAAE,oBAAoB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CACV,4BAA4B,EAC5B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,qBAAqB;AACrB,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,EAAE;IAC7B,OAAO,GAAG,CAAC,IAAI,CACb;QACE,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,EACD,UAAU,EACV,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;AACJ,CAAC,CAAC;AAEF,oCAAoC;AACpC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,EAAE;IACtC,4DAA4D;IAC5D,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC9C,oFAAoF;QACpF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CACV,sCAAsC,EACtC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,UAAU,EACX,CAAC"}

package/dist-server/server/modules/auth/auth.module.js

@@ -0,0 +1,29 @@
+import { createRequire } from 'node:module';
+import { getConnection, userDb } from '../../modules/database/index.js';
+import { authenticateToken, generateToken } from './auth.middleware.js';
+import { createAuthRouter } from './auth.routes.js';
+import { createAuthService } from './auth.service.js';
+// bcrypt does not ship TypeScript declarations in this project, so the
+// composition root narrows its CommonJS runtime surface before injecting it.
+const require = createRequire(import.meta.url);
+const bcrypt = require('bcrypt');
+const databaseConnection = getConnection();
+const authService = createAuthService({
+    users: {
+        hasUsers: () => userDb.hasUsers(),
+        createUser: (username, passwordHash) => userDb.createUser(username, passwordHash),
+        getUserByUsername: (username) => userDb.getUserByUsername(username),
+        updateLastLogin: (userId) => userDb.updateLastLogin(userId),
+    },
+    transaction: {
+        begin: () => databaseConnection.prepare('BEGIN').run(),
+        commit: () => databaseConnection.prepare('COMMIT').run(),
+        rollback: () => databaseConnection.prepare('ROLLBACK').run(),
+    },
+    hashPassword: (password) => bcrypt.hash(password, 12),
+    comparePassword: (password, passwordHash) => bcrypt.compare(password, passwordHash),
+    generateToken,
+});
+/** Auth router assembled for the server entrypoint. */
+export const authRoutes = createAuthRouter(authService, authenticateToken);
+//# sourceMappingURL=auth.module.js.map

package/dist-server/server/modules/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../../../server/modules/auth/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAOtD,uEAAuE;AACvE,6EAA6E;AAC7E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAkB,CAAC;AAClD,MAAM,kBAAkB,GAAG,aAAa,EAAE,CAAC;AAE3C,MAAM,WAAW,GAAG,iBAAiB,CAAC;IACpC,KAAK,EAAE;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC;QACjF,iBAAiB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QACnE,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC;KAC5D;IACD,WAAW,EAAE;QACX,KAAK,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;QACtD,MAAM,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE;QACxD,QAAQ,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE;KAC7D;IACD,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrD,eAAe,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC;IACnF,aAAa;CACd,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC"}

package/dist-server/server/modules/auth/auth.routes.js

@@ -0,0 +1,45 @@
+import express from 'express';
+/**
+ * Creates the Auth transport adapter. Handlers only parse request data and
+ * delegate authentication behavior to the injected application service.
+ */
+export function createAuthRouter(service, authenticateToken) {
+    const router = express.Router();
+    router.get('/status', (_req, res, next) => {
+        try {
+            res.json(service.getStatus());
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    router.post('/register', async (req, res, next) => {
+        try {
+            const body = req.body;
+            res.json(await service.register(body.username, body.password));
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    router.post('/login', async (req, res, next) => {
+        try {
+            const body = req.body;
+            res.json(await service.login(body.username, body.password));
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    router.get('/user', authenticateToken, (req, res) => {
+        res.json(service.getCurrentUser(req.user));
+    });
+    router.post('/refresh', authenticateToken, (req, res) => {
+        res.json(service.refreshSession(req.user));
+    });
+    router.post('/logout', authenticateToken, (_req, res) => {
+        res.json(service.logout());
+    });
+    return router;
+}
+//# sourceMappingURL=auth.routes.js.map

package/dist-server/server/modules/auth/auth.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.routes.js","sourceRoot":"","sources":["../../../../server/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA6C,EAC7C,iBAAiC;IAEjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAkD,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAkD,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAE,GAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAE,GAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACtD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist-server/server/modules/auth/auth.service.js

@@ -0,0 +1,113 @@
+import { AppError } from '../../shared/utils.js';
+function numericUserId(userId) {
+    return Number(userId);
+}
+function isUniqueConstraintError(error) {
+    return typeof error === 'object'
+        && error !== null
+        && 'code' in error
+        && error.code === 'SQLITE_CONSTRAINT_UNIQUE';
+}
+/**
+ * Creates the Auth application service around explicit persistence, crypto,
+ * transaction, and token dependencies.
+ */
+export function createAuthService(dependencies) {
+    return {
+        getStatus() {
+            return {
+                needsSetup: !dependencies.users.hasUsers(),
+                isAuthenticated: false,
+            };
+        },
+        async register(usernameInput, passwordInput) {
+            const username = typeof usernameInput === 'string' ? usernameInput : '';
+            const password = typeof passwordInput === 'string' ? passwordInput : '';
+            if (!username || !password) {
+                throw new AppError('Username and password are required', {
+                    code: 'AUTH_CREDENTIALS_REQUIRED',
+                    statusCode: 400,
+                });
+            }
+            if (username.length < 3 || password.length < 6) {
+                throw new AppError('Username must be at least 3 characters, password at least 6 characters', { code: 'AUTH_CREDENTIALS_TOO_SHORT', statusCode: 400 });
+            }
+            dependencies.transaction.begin();
+            try {
+                if (dependencies.users.hasUsers()) {
+                    throw new AppError('User already exists. This is a single-user system.', {
+                        code: 'AUTH_USER_ALREADY_CONFIGURED',
+                        statusCode: 403,
+                    });
+                }
+                const passwordHash = await dependencies.hashPassword(password);
+                const user = dependencies.users.createUser(username, passwordHash);
+                const token = dependencies.generateToken(user);
+                dependencies.transaction.commit();
+                dependencies.users.updateLastLogin(numericUserId(user.id));
+                return {
+                    success: true,
+                    user: { id: user.id, username: user.username },
+                    token,
+                };
+            }
+            catch (error) {
+                dependencies.transaction.rollback();
+                if (isUniqueConstraintError(error)) {
+                    throw new AppError('Username already exists', {
+                        code: 'AUTH_USERNAME_CONFLICT',
+                        statusCode: 409,
+                    });
+                }
+                throw error;
+            }
+        },
+        async login(usernameInput, passwordInput) {
+            const username = typeof usernameInput === 'string' ? usernameInput : '';
+            const password = typeof passwordInput === 'string' ? passwordInput : '';
+            if (!username || !password) {
+                throw new AppError('Username and password are required', {
+                    code: 'AUTH_CREDENTIALS_REQUIRED',
+                    statusCode: 400,
+                });
+            }
+            const user = dependencies.users.getUserByUsername(username);
+            const validPassword = user
+                ? await dependencies.comparePassword(password, user.password_hash)
+                : false;
+            if (!user || !validPassword) {
+                throw new AppError('Invalid username or password', {
+                    code: 'AUTH_INVALID_CREDENTIALS',
+                    statusCode: 401,
+                });
+            }
+            dependencies.users.updateLastLogin(numericUserId(user.id));
+            return {
+                success: true,
+                user: { id: user.id, username: user.username },
+                token: dependencies.generateToken(user),
+            };
+        },
+        getCurrentUser(user) {
+            return { user };
+        },
+        refreshSession(user) {
+            if (typeof user !== 'object'
+                || user === null
+                || !('id' in user)
+                || !('username' in user)
+                || (typeof user.id !== 'number' && typeof user.id !== 'bigint')
+                || typeof user.username !== 'string') {
+                throw new AppError('Authenticated user is required', {
+                    code: 'AUTH_USER_REQUIRED',
+                    statusCode: 401,
+                });
+            }
+            return { token: dependencies.generateToken(user) };
+        },
+        logout() {
+            return { success: true, message: 'Logged out successfully' };
+        },
+    };
+}
+//# sourceMappingURL=auth.service.js.map

package/dist-server/server/modules/auth/auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../../server/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AA0B7C,SAAS,aAAa,CAAC,MAAuB;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,KAAK,IAAI;WACd,MAAM,IAAI,KAAK;WACf,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAA8B;IAC9D,OAAO;QACL,SAAS;YACP,OAAO;gBACL,UAAU,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAC1C,eAAe,EAAE,KAAK;aACvB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,aAAsB,EAAE,aAAsB;YAC3D,MAAM,QAAQ,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YAExE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,QAAQ,CAAC,oCAAoC,EAAE;oBACvD,IAAI,EAAE,2BAA2B;oBACjC,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,QAAQ,CAChB,wEAAwE,EACxE,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CACxD,CAAC;YACJ,CAAC;YAED,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;oBAClC,MAAM,IAAI,QAAQ,CAAC,oDAAoD,EAAE;wBACvE,IAAI,EAAE,8BAA8B;wBACpC,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,KAAK,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC/C,YAAY,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBAClC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAE3D,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;oBAC9C,KAAK;iBACN,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;wBAC5C,IAAI,EAAE,wBAAwB;wBAC9B,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,aAAsB,EAAE,aAAsB;YACxD,MAAM,QAAQ,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,QAAQ,CAAC,oCAAoC,EAAE;oBACvD,IAAI,EAAE,2BAA2B;oBACjC,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,aAAa,GAAG,IAAI;gBACxB,CAAC,CAAC,MAAM,YAAY,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC;gBAClE,CAAC,CAAC,KAAK,CAAC;YACV,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC5B,MAAM,IAAI,QAAQ,CAAC,8BAA8B,EAAE;oBACjD,IAAI,EAAE,0BAA0B;oBAChC,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;gBAC9C,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC;aACxC,CAAC;QACJ,CAAC;QAED,cAAc,CAAC,IAAa;YAC1B,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;QAED,cAAc,CAAC,IAAa;YAC1B,IACE,OAAO,IAAI,KAAK,QAAQ;mBACrB,IAAI,KAAK,IAAI;mBACb,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;mBACf,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;mBACrB,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC;mBAC5D,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EACpC,CAAC;gBACD,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE;oBACnD,IAAI,EAAE,oBAAoB;oBAC1B,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC,IAAgB,CAAC,EAAE,CAAC;QACjE,CAAC;QAED,MAAM;YACJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist-server/server/modules/auth/index.js

@@ -0,0 +1,9 @@
+// authRoutes: used by the server entrypoint to mount public authentication endpoints.
+export { authRoutes } from './auth.module.js';
+// authenticateToken: used by the server entrypoint to protect authenticated API modules.
+export { authenticateToken } from './auth.middleware.js';
+// authenticateWebSocket: used by WebSocket setup to verify connection tokens.
+export { authenticateWebSocket } from './auth.middleware.js';
+// validateApiKey: used by the server entrypoint for optional API-wide key validation.
+export { validateApiKey } from './auth.middleware.js';
+//# sourceMappingURL=index.js.map

package/dist-server/server/modules/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../server/modules/auth/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,yFAAyF;AACzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,8EAA8E;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,sFAAsF;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}

package/dist-server/server/modules/auth/tests/auth.service.test.js

@@ -0,0 +1,80 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { AppError } from '../../../shared/utils.js';
+import { createAuthService } from '../auth.service.js';
+function createDependencies(overrides = {}) {
+    return {
+        users: {
+            hasUsers: () => false,
+            createUser: (username, passwordHash) => ({ id: 1, username, password_hash: passwordHash }),
+            getUserByUsername: () => undefined,
+            updateLastLogin: () => undefined,
+        },
+        transaction: {
+            begin: () => undefined,
+            commit: () => undefined,
+            rollback: () => undefined,
+        },
+        hashPassword: async () => 'hashed-password',
+        comparePassword: async () => false,
+        generateToken: () => 'signed-token',
+        ...overrides,
+    };
+}
+test('register hashes credentials and commits through injected dependencies', async () => {
+    const operations = [];
+    const service = createAuthService(createDependencies({
+        transaction: {
+            begin: () => operations.push('begin'),
+            commit: () => operations.push('commit'),
+            rollback: () => operations.push('rollback'),
+        },
+        hashPassword: async (password) => {
+            operations.push(`hash:${password}`);
+            return 'hash';
+        },
+        users: {
+            hasUsers: () => false,
+            createUser: (username, passwordHash) => {
+                operations.push(`create:${username}:${passwordHash}`);
+                return { id: 1, username, password_hash: passwordHash };
+            },
+            getUserByUsername: () => undefined,
+            updateLastLogin: (userId) => operations.push(`login:${userId}`),
+        },
+    }));
+    const result = await service.register('alice', 'secret12');
+    assert.equal(result.token, 'signed-token');
+    assert.deepEqual(operations, ['begin', 'hash:secret12', 'create:alice:hash', 'commit', 'login:1']);
+});
+test('login rejects an invalid password without issuing a token', async () => {
+    let tokenIssued = false;
+    const service = createAuthService(createDependencies({
+        users: {
+            hasUsers: () => true,
+            createUser: () => { throw new Error('unused'); },
+            getUserByUsername: () => ({ id: 1, username: 'alice', password_hash: 'hash' }),
+            updateLastLogin: () => undefined,
+        },
+        comparePassword: async () => false,
+        generateToken: () => {
+            tokenIssued = true;
+            return 'token';
+        },
+    }));
+    await assert.rejects(service.login('alice', 'wrong-password'), (error) => error instanceof AppError && error.code === 'AUTH_INVALID_CREDENTIALS');
+    assert.equal(tokenIssued, false);
+});
+test('refreshSession issues a replacement token for the authenticated user', () => {
+    let tokenUser;
+    const service = createAuthService(createDependencies({
+        generateToken: (user) => {
+            tokenUser = user;
+            return 'replacement-token';
+        },
+    }));
+    const result = service.refreshSession({ id: 7, username: 'alice' });
+    assert.deepEqual(result, { token: 'replacement-token' });
+    assert.deepEqual(tokenUser, { id: 7, username: 'alice' });
+});
+//# sourceMappingURL=auth.service.test.js.map

package/dist-server/server/modules/auth/tests/auth.service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.test.js","sourceRoot":"","sources":["../../../../../server/modules/auth/tests/auth.service.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAIvD,SAAS,kBAAkB,CAAC,YAAuC,EAAE;IACnE,OAAO;QACL,KAAK,EAAE;YACL,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;YACrB,UAAU,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;YAC1F,iBAAiB,EAAE,GAAG,EAAE,CAAC,SAAS;YAClC,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS;SACjC;QACD,WAAW,EAAE;YACX,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;YACtB,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;YACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;SAC1B;QACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB;QAC3C,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAClC,aAAa,EAAE,GAAG,EAAE,CAAC,cAAc;QACnC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACvF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,iBAAiB,CAAC,kBAAkB,CAAC;QACnD,WAAW,EAAE;YACX,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YACvC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;SAC5C;QACD,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC/B,UAAU,CAAC,IAAI,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE;YACL,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;YACrB,UAAU,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE;gBACrC,UAAU,CAAC,IAAI,CAAC,UAAU,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC;gBACtD,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;YAC1D,CAAC;YACD,iBAAiB,EAAE,GAAG,EAAE,CAAC,SAAS;YAClC,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,MAAM,EAAE,CAAC;SAChE;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE3D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC3C,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;IAC3E,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,iBAAiB,CAAC,kBAAkB,CAAC;QACnD,KAAK,EAAE;YACL,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;YACpB,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChD,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;YAC9E,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS;SACjC;QACD,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAClC,aAAa,EAAE,GAAG,EAAE;YAClB,WAAW,GAAG,IAAI,CAAC;YACnB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,EACxC,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAC3F,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,IAAI,SAAgE,CAAC;IACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,kBAAkB,CAAC;QACnD,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAEpE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC"}