ysk-server-core 1.0.0

package/dist/email/roundcube-sso-plugin.js

@@ -0,0 +1,278 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Roundcube SSO plugin skeleton + optional system symlink into Roundcube plugins/.
+ */
+import { mkdirSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+export function writeRoundcubeSsoPlugin(input) {
+    const dir = join(input.dataDir, 'email', 'webmail', 'plugins', 'ysk_sso');
+    mkdirSync(dir, { recursive: true });
+    const written = [];
+    const notes = [];
+    const php = `<?php
+/**
+ * YSK Webmail SSO — Roundcube auto-login plugin
+ * Panel: POST /api/v1/email/webmail/sso with password → user opens ?_ysk_sso=TOKEN
+ * Plugin consumes token and calls $RCMAIL->login(email, password) when password present.
+ */
+class ysk_sso extends rcube_plugin {
+  public $task = 'login|mail';
+  function init() {
+    $this->add_hook('startup', array($this, 'startup'));
+  }
+  function startup($args) {
+    $token = isset($_GET['_ysk_sso']) ? $_GET['_ysk_sso'] : null;
+    if (!$token) return $args;
+    $url = ${JSON.stringify(input.panelBaseUrl.replace(/\/$/, '') + '/api/v1/email/webmail/sso/consume')};
+    $ctx = stream_context_create(array(
+      'http' => array(
+        'method' => 'POST',
+        'header' => "Content-Type: application/json\\r\\n",
+        'content' => json_encode(array('token' => $token)),
+        'timeout' => 8,
+        'ignore_errors' => true,
+      ),
+    ));
+    $raw = @file_get_contents($url, false, $ctx);
+    $data = $raw ? json_decode($raw, true) : null;
+    if (empty($data['ok']) || empty($data['email'])) {
+      error_log('YSK SSO consume failed');
+      return $args;
+    }
+    $email = $data['email'];
+    $pass = isset($data['password']) ? $data['password'] : null;
+    $rcmail = rcube::get_instance();
+    if ($pass && method_exists($rcmail, 'login')) {
+      $auth = $rcmail->login($email, $pass, $rcmail->config->get('default_host'), true);
+      if ($auth) {
+        $rcmail->session->set('user_id', $rcmail->get_user_id());
+        $rcmail->session->set('password', $rcmail->encrypt($pass));
+        header('Location: ./?_task=mail');
+        exit;
+      }
+      error_log('YSK SSO login() failed for ' . $email);
+    } else {
+      // No password — prefill username on login form
+      $_SESSION['ysk_sso_user'] = $email;
+      error_log('YSK SSO verified ' . $email . ' (no password for auto-login)');
+    }
+    return $args;
+  }
+}
+`;
+    const path = join(dir, 'ysk_sso.php');
+    writeFileSync(path, php, 'utf8');
+    written.push(path);
+    const conf = join(dir, 'config.inc.php.dist');
+    writeFileSync(conf, "<?php\n// $config['ysk_sso_panel'] = 'https://panel.example.com';\n", 'utf8');
+    written.push(conf);
+    const readme = join(dir, 'README.txt');
+    writeFileSync(readme, [
+        'YSK Roundcube SSO plugin skeleton',
+        `Panel consume: ${input.panelBaseUrl}/api/v1/email/webmail/sso/consume`,
+        tl('notes.auto.n0469'),
+        '',
+    ].join('\n'), 'utf8');
+    written.push(readme);
+    notes.push(tl('notes.auto.t0071', { v0: (dir) }));
+    notes.push(tl('notes.auto.n1233'));
+    if (!existsSync(path)) {
+        return { ok: false, written, notes: [...notes, tl('notes.auto.n0676')], pluginDir: dir };
+    }
+    return { ok: true, written, notes, pluginDir: dir };
+}
+/** Common Roundcube plugin directory candidates */
+export const ROUNDCUBE_PLUGIN_CANDIDATES = [
+    '/var/www/ysk-webmail',
+    '/var/lib/roundcube/plugins',
+    '/usr/share/roundcube/plugins',
+    '/var/www/roundcube/plugins',
+    '/opt/roundcube/plugins',
+];
+/**
+ * Symlink managed plugin into a Roundcube plugins/ tree (needs EXECUTE+root for system paths).
+ */
+export async function enableRoundcubeSsoPlugin(input) {
+    const base = writeRoundcubeSsoPlugin({
+        dataDir: input.dataDir,
+        panelBaseUrl: input.panelBaseUrl,
+    });
+    const notes = [...base.notes];
+    const written = [...base.written];
+    if (!input.host.executeEnabled()) {
+        return {
+            ok: false,
+            notes: [...notes, tl('notes.auto.n1138')],
+            written,
+            blocked: true,
+            blockMessage: tl('notes.auto.n1557'),
+            apply_status: 'blocked',
+        };
+    }
+    let pluginsDir = input.roundcubePluginsDir?.trim();
+    if (!pluginsDir) {
+        // Probe candidates: either .../plugins or .../webmail.domain/public/plugins
+        for (const c of ROUNDCUBE_PLUGIN_CANDIDATES) {
+            if (existsSync(c) && c.endsWith('plugins')) {
+                pluginsDir = c;
+                break;
+            }
+            if (existsSync(c)) {
+                // ysk-webmail multi-domain
+                try {
+                    for (const name of readdirSync(c)) {
+                        const p = join(c, name, 'plugins');
+                        if (existsSync(p)) {
+                            pluginsDir = p;
+                            break;
+                        }
+                        const p2 = join(c, name, 'public', 'plugins');
+                        if (existsSync(p2)) {
+                            pluginsDir = p2;
+                            break;
+                        }
+                    }
+                }
+                catch {
+                    /* skip */
+                }
+                if (pluginsDir)
+                    break;
+            }
+        }
+    }
+    // Also check managed download path under dataDir
+    if (!pluginsDir) {
+        const managed = join(input.dataDir, 'email', 'webmail');
+        if (existsSync(managed)) {
+            try {
+                for (const name of readdirSync(managed)) {
+                    const p = join(managed, name, 'public', 'plugins');
+                    if (existsSync(p)) {
+                        pluginsDir = p;
+                        break;
+                    }
+                }
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    if (!pluginsDir) {
+        notes.push(tl('notes.auto.n0847'));
+        return {
+            ok: true,
+            notes,
+            written,
+            apply_status: 'written',
+        };
+    }
+    const linkPath = join(pluginsDir, 'ysk_sso');
+    const r = await input.host.runCommand([
+        'bash',
+        '-c',
+        `mkdir -p ${JSON.stringify(pluginsDir)} && ln -sfn ${JSON.stringify(base.pluginDir)} ${JSON.stringify(linkPath)} 2>&1`,
+    ], { timeoutMs: 10_000 });
+    if (r.exitCode !== 0) {
+        notes.push(tl('notes.auto.t0072', { v0: ((r.stderr || r.stdout).slice(0, 200)) }));
+        return {
+            ok: false,
+            notes,
+            written,
+            apply_status: 'written',
+        };
+    }
+    notes.push(tl('notes.auto.t0073', { v0: (linkPath), v1: (base.pluginDir) }));
+    written.push(linkPath);
+    // Auto-enable in config.inc.php near this plugins tree
+    const configResult = await ensureRoundcubePluginInConfig({
+        host: input.host,
+        pluginsDir,
+        pluginName: 'ysk_sso',
+    });
+    notes.push(...configResult.notes);
+    written.push(...configResult.written);
+    // Symlink succeeded; config may be partial — ok reflects full apply only
+    notes.push(configResult.ok
+        ? tl('notes.auto.n1209')
+        : tl('notes.auto.n1221'));
+    return {
+        ok: configResult.ok,
+        notes,
+        written,
+        symlink: linkPath,
+        apply_status: configResult.ok ? 'applied' : 'written',
+    };
+}
+/**
+ * Ensure $config['plugins'][] = 'ysk_sso' in Roundcube config.inc.php
+ */
+export async function ensureRoundcubePluginInConfig(input) {
+    const notes = [];
+    const written = [];
+    const name = input.pluginName.replace(/[^a-z0-9_]/gi, '');
+    // pluginsDir = .../plugins → parent may hold config or config/
+    const candidates = [
+        join(input.pluginsDir, '..', 'config', 'config.inc.php'),
+        join(input.pluginsDir, '..', 'config.inc.php'),
+        join(input.pluginsDir, '..', '..', 'config', 'config.inc.php'),
+        '/etc/roundcube/config.inc.php',
+        '/var/lib/roundcube/config/config.inc.php',
+    ];
+    let configPath;
+    for (const c of candidates) {
+        if (existsSync(c)) {
+            configPath = c;
+            break;
+        }
+    }
+    if (!configPath) {
+        // probe via host find (best-effort)
+        const find = await input.host.runCommand([
+            'bash',
+            '-c',
+            `ls ${JSON.stringify(join(input.pluginsDir, '..', 'config', 'config.inc.php'))} 2>/dev/null; ls /etc/roundcube/config.inc.php 2>/dev/null; true`,
+        ], { timeoutMs: 5_000 });
+        const line = find.stdout.trim().split('\n').find((l) => l.includes('config.inc.php'));
+        if (line && existsSync(line.trim()))
+            configPath = line.trim();
+    }
+    if (!configPath) {
+        notes.push(tl('notes.auto.n0850'));
+        return { ok: false, notes, written };
+    }
+    // Idempotent append via bash (works even if path only on remote fs via host)
+    const snippet = `$config['plugins'][] = '${name}'; // YSK`;
+    const script = `
+set -e
+CFG=${JSON.stringify(configPath)}
+if grep -q "plugins'].*${name}" "$CFG" 2>/dev/null || grep -q "plugins\\]\\[\\].*${name}" "$CFG" 2>/dev/null || grep -q "'${name}'" "$CFG" 2>/dev/null; then
+  echo ALREADY
+  exit 0
+fi
+# Prefer inserting after plugins array if present
+if grep -q "\\$config\\['plugins'\\]" "$CFG" 2>/dev/null; then
+  printf '\\n// YSK auto-enable\\n%s\\n' ${JSON.stringify(snippet)} >> "$CFG"
+  echo APPENDED_AFTER_PLUGINS
+else
+  printf '\\n// YSK auto-enable SSO plugin\\n%s\\n' ${JSON.stringify(snippet)} >> "$CFG"
+  echo APPENDED_EOF
+fi
+`;
+    const r = await input.host.runCommand(['bash', '-c', script], { timeoutMs: 10_000 });
+    const out = (r.stdout || '').trim();
+    if (r.exitCode !== 0) {
+        notes.push(tl('notes.auto.t0074', { v0: ((r.stderr || r.stdout).slice(0, 200)) }));
+        return { ok: false, notes, written };
+    }
+    if (out.includes('ALREADY')) {
+        notes.push(tl('notes.auto.t0075', { v0: (name), v1: (configPath) }));
+    }
+    else {
+        notes.push(tl('notes.auto.t0076', { v0: (configPath), v1: (snippet) }));
+        written.push(configPath);
+    }
+    return { ok: true, notes, written };
+}
+//# sourceMappingURL=roundcube-sso-plugin.js.map

package/dist/email/roundcube-sso-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roundcube-sso-plugin.js","sourceRoot":"","sources":["../../src/email/roundcube-sso-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC1E,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG;;;;;;;;;;;;;;aAcD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,mCAAmC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCvG,CAAC;IACA,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACtC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EACJ,qEAAqE,EACrE,MAAM,CACP,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACvC,aAAa,CACX,MAAM,EACN;QACE,mCAAmC;QACnC,kBAAkB,KAAK,CAAC,YAAY,mCAAmC;QACvE,EAAE,CAAC,kBAAkB,CAAC;QACtB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,sBAAsB;IACtB,4BAA4B;IAC5B,8BAA8B;IAC9B,4BAA4B;IAC5B,wBAAwB;CACzB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAM9C;IASC,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAElC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,OAAO;YACP,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACpC,YAAY,EAAE,SAAS;SACxB,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,KAAK,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,4EAA4E;QAC5E,KAAK,MAAM,CAAC,IAAI,2BAA2B,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3C,UAAU,GAAG,CAAC,CAAC;gBACf,MAAM;YACR,CAAC;YACD,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClB,2BAA2B;gBAC3B,IAAI,CAAC;oBACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;wBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;wBACnC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;4BAClB,UAAU,GAAG,CAAC,CAAC;4BACf,MAAM;wBACR,CAAC;wBACD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;wBAC9C,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;4BACnB,UAAU,GAAG,EAAE,CAAC;4BAChB,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU;gBACZ,CAAC;gBACD,IAAI,UAAU;oBAAE,MAAM;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;oBACnD,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;wBAClB,UAAU,GAAG,CAAC,CAAC;wBACf,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,CAAC,CACvB,CAAC;QACF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK;YACL,OAAO;YACP,YAAY,EAAE,SAAS;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACnC;QACE,MAAM;QACN,IAAI;QACJ,YAAY,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO;KACvH,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,OAAO;YACP,YAAY,EAAE,SAAS;SACxB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvB,uDAAuD;IACvD,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU;QACV,UAAU,EAAE,SAAS;KACtB,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAEtC,yEAAyE;IACzE,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,EAAE;QACb,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;QACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,OAAO;QACL,EAAE,EAAE,YAAY,CAAC,EAAE;QACnB,KAAK;QACL,OAAO;QACP,OAAO,EAAE,QAAQ;QACjB,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACtD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1D,+DAA+D;IAC/D,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,gBAAgB,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC;QAC9D,+BAA+B;QAC/B,0CAA0C;KAC3C,CAAC;IAEF,IAAI,UAA8B,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,UAAU,GAAG,CAAC,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,oCAAoC;QACpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACtC;YACE,MAAM;YACN,IAAI;YACJ,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,kEAAkE;SACjJ,EACD,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtF,IAAI,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,2BAA2B,IAAI,WAAW,CAAC;IAC3D,MAAM,MAAM,GAAG;;MAEX,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;yBACP,IAAI,sDAAsD,IAAI,qCAAqC,IAAI;;;;;;2CAMrF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;;sDAGZ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;;CAG5E,CAAC;IACA,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/email/sender-rate-policy.d.ts

@@ -0,0 +1,24 @@
+import type { HostExecutor } from '../host/executor.js';
+/** Build domain → msgs/hour map from policy rate.cf files */
+export declare function loadDomainRateMap(dataDir: string): Record<string, number>;
+export declare function writeSenderRatePolicyDaemon(dataDir: string): {
+    written: string[];
+    notes: string[];
+    scriptPath: string;
+    ratesPath: string;
+};
+/**
+ * Install policy service into Postfix (EXECUTE+root).
+ */
+export declare function applySenderRatePolicyService(input: {
+    dataDir: string;
+    host: HostExecutor;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    written: string[];
+    blocked?: boolean;
+    blockMessage?: string;
+    apply_status: 'written' | 'applied' | 'blocked';
+}>;
+//# sourceMappingURL=sender-rate-policy.d.ts.map

package/dist/email/sender-rate-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-rate-policy.d.ts","sourceRoot":"","sources":["../../src/email/sender-rate-policy.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAoBzE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAgHA;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;CACjD,CAAC,CAuGD"}

package/dist/email/sender-rate-policy.js

@@ -0,0 +1,245 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Per-sender (envelope from domain) rate policy via Postfix check_policy_service.
+ * Generates a small Python3 policy daemon + master.cf / main.cf hooks.
+ */
+import { mkdirSync, writeFileSync, readdirSync, existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** Build domain → msgs/hour map from policy rate.cf files */
+export function loadDomainRateMap(dataDir) {
+    const root = join(dataDir, 'email', 'policy');
+    const out = {};
+    if (!existsSync(root))
+        return out;
+    try {
+        for (const name of readdirSync(root)) {
+            const f = join(root, name, 'rate.cf');
+            if (!existsSync(f))
+                continue;
+            for (const line of readFileSync(f, 'utf8').split('\n')) {
+                const t = line.trim();
+                if (!t || t.startsWith('#'))
+                    continue;
+                const [dom, n] = t.split(/\s+/);
+                const rate = Number(n);
+                if (dom && Number.isFinite(rate) && rate > 0)
+                    out[dom.toLowerCase()] = Math.floor(rate);
+            }
+        }
+    }
+    catch {
+        /* empty */
+    }
+    return out;
+}
+export function writeSenderRatePolicyDaemon(dataDir) {
+    const dir = join(dataDir, 'email', 'policy');
+    mkdirSync(dir, { recursive: true });
+    const rates = loadDomainRateMap(dataDir);
+    const ratesPath = join(dir, 'sender-rates.json');
+    writeFileSync(ratesPath, JSON.stringify(rates, null, 2), 'utf8');
+    const scriptPath = join(dir, 'ysk-sender-rate-policy.py');
+    // Minimal Postfix policy protocol server (reads one request, answers action=)
+    writeFileSync(scriptPath, `#!/usr/bin/env python3
+"""YSK per-sender domain rate policy for Postfix check_policy_service.
+Reads sender-rates.json (domain -> msgs/hour). State in state.json under same dir.
+"""
+import json, os, sys, time
+from pathlib import Path
+
+DIR = Path(__file__).resolve().parent
+RATES = DIR / "sender-rates.json"
+STATE = Path(os.environ.get("YSK_RATE_STATE", "/var/lib/ysk-server/sender-rate-state.json"))
+DEFAULT = int(os.environ.get("YSK_RATE_DEFAULT", "500"))
+
+def load_rates():
+    try:
+        return json.loads(RATES.read_text())
+    except Exception:
+        return {}
+
+def load_state():
+    try:
+        return json.loads(STATE.read_text())
+    except Exception:
+        return {}
+
+def save_state(st):
+    try:
+        STATE.parent.mkdir(parents=True, exist_ok=True)
+        STATE.write_text(json.dumps(st))
+    except Exception:
+        pass
+
+def domain_of(addr: str) -> str:
+    addr = (addr or "").strip().lower()
+    if "@" in addr:
+        return addr.split("@", 1)[1]
+    return addr
+
+def decide(attrs: dict) -> str:
+    # Only enforce on end-of-data / mail path with sasl or sender
+    sender = attrs.get("sender") or attrs.get("sasl_username") or ""
+    dom = domain_of(sender)
+    if not dom:
+        return "DUNNO"
+    rates = load_rates()
+    limit = int(rates.get(dom, DEFAULT))
+    if limit <= 0:
+        return "DUNNO"
+    now = int(time.time())
+    hour = now // 3600
+    st = load_state()
+    key = f"{dom}:{hour}"
+    # prune old keys
+    st = {k: v for k, v in st.items() if k.endswith(f":{hour}") or k.endswith(f":{hour-1}")}
+    count = int(st.get(key, 0)) + 1
+    st[key] = count
+    save_state(st)
+    if count > limit:
+        return f"DEFER_IF_PERMIT YSK rate limit {limit}/h for {dom} (#{count})"
+    return "DUNNO"
+
+def main():
+    attrs = {}
+    while True:
+        line = sys.stdin.readline()
+        if not line:
+            break
+        line = line.rstrip("\\r\\n")
+        if line == "":
+            action = decide(attrs)
+            sys.stdout.write(f"action={action}\\n\\n")
+            sys.stdout.flush()
+            attrs = {}
+            continue
+        if "=" in line:
+            k, v = line.split("=", 1)
+            attrs[k.strip()] = v.strip()
+
+if __name__ == "__main__":
+    main()
+`, 'utf8');
+    const masterSnippet = join(dir, 'master.cf.ysk-rate.snippet');
+    writeFileSync(masterSnippet, `# YSK — append to master.cf (applySystem installs)
+ysk_rate  unix  -       n       n       -       0       spawn
+  user=nobody argv=/usr/bin/python3 ${scriptPath}
+`, 'utf8');
+    return {
+        written: [ratesPath, scriptPath, masterSnippet],
+        notes: [
+            tl('notes.auto.t0069', { v0: (Object.keys(rates).length) }),
+            scriptPath,
+        ],
+        scriptPath,
+        ratesPath
+    };
+}
+/**
+ * Install policy service into Postfix (EXECUTE+root).
+ */
+export async function applySenderRatePolicyService(input) {
+    const gen = writeSenderRatePolicyDaemon(input.dataDir);
+    const notes = [...gen.notes];
+    const written = [...gen.written];
+    if (!input.host.executeEnabled() || !input.host.isRoot()) {
+        notes.push(tl('notes.auto.n1216'));
+        return {
+            ok: false,
+            notes,
+            written,
+            blocked: true,
+            blockMessage: tl('notes.auto.n1586'),
+            apply_status: 'blocked'
+        };
+    }
+    const sysDir = '/etc/ysk-server/email/policy';
+    const stateDir = '/var/lib/ysk-server';
+    const scriptSys = `${sysDir}/ysk-sender-rate-policy.py`;
+    const ratesSys = `${sysDir}/sender-rates.json`;
+    // Stepwise — never mask postconf/reload with || true
+    const steps = [
+        {
+            name: 'mkdir+copy',
+            argv: [
+                'bash',
+                '-c',
+                [
+                    `mkdir -p ${JSON.stringify(sysDir)} ${JSON.stringify(stateDir)}`,
+                    `cp -f ${JSON.stringify(gen.scriptPath)} ${JSON.stringify(scriptSys)}`,
+                    `cp -f ${JSON.stringify(gen.ratesPath)} ${JSON.stringify(ratesSys)}`,
+                    `chmod 755 ${JSON.stringify(scriptSys)}`,
+                ].join(' && '),
+            ]
+        },
+        {
+            name: 'master.cf ysk_rate',
+            argv: [
+                'bash',
+                '-c',
+                `grep -q '^ysk_rate' /etc/postfix/master.cf 2>/dev/null || printf '\\n# YSK sender rate\\nysk_rate  unix  -       n       n       -       0       spawn\\n  user=nobody argv=/usr/bin/python3 %s\\n' ${JSON.stringify(scriptSys)} >> /etc/postfix/master.cf`,
+            ]
+        },
+        {
+            name: 'postconf end_of_data',
+            argv: [
+                'postconf',
+                '-e',
+                'smtpd_end_of_data_restrictions=check_policy_service unix:private/ysk_rate',
+            ]
+        },
+        {
+            name: 'postconf recipient (optional soft)',
+            argv: [
+                'bash',
+                '-c',
+                `grep -q 'private/ysk_rate' /etc/postfix/main.cf 2>/dev/null || postconf -e "smtpd_recipient_restrictions=\$smtpd_recipient_restrictions, check_policy_service unix:private/ysk_rate"`,
+            ]
+        },
+        {
+            name: 'postfix check',
+            argv: ['bash', '-c', 'postfix check 2>&1 | tail -20; exit ${PIPESTATUS[0]:-0}']
+        },
+        {
+            name: 'reload postfix',
+            argv: [
+                'bash',
+                '-c',
+                'systemctl reload postfix 2>&1 || service postfix reload 2>&1',
+            ]
+        },
+    ];
+    let failed = 0;
+    for (const step of steps) {
+        const r = await input.host.runCommand(step.argv, { timeoutMs: 30_000 });
+        if (r.exitCode !== 0) {
+            failed += 1;
+            notes.push(tl('notes.auto.t0070', { v0: (step.name), v1: (r.exitCode), v2: ((r.stderr || r.stdout).slice(0, 200)) }));
+            // Hard fail on copy / postconf end_of_data / reload
+            if (step.name === 'mkdir+copy' ||
+                step.name === 'postconf end_of_data' ||
+                step.name === 'reload postfix') {
+                notes.push(tl('notes.auto.n1224'));
+                return {
+                    ok: false,
+                    notes,
+                    written: [...written, scriptSys, ratesSys],
+                    apply_status: 'written'
+                };
+            }
+        }
+        else {
+            notes.push(`${step.name} ok`);
+        }
+    }
+    notes.push(tl('notes.auto.n0155'));
+    const ok = failed === 0;
+    notes.push(ok ? tl('notes.auto.n0001') : tl('notes.tpl.statusWrittenPartial'));
+    return {
+        ok,
+        notes,
+        written: [...written, scriptSys, ratesSys],
+        apply_status: ok ? 'applied' : 'written'
+    };
+}
+//# sourceMappingURL=sender-rate-policy.js.map

package/dist/email/sender-rate-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-rate-policy.js","sourceRoot":"","sources":["../../src/email/sender-rate-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACtC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAe;IAMzD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACjD,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEjE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IAC1D,8EAA8E;IAC9E,aAAa,CACX,UAAU,EACV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+EH,EACG,MAAM,CACP,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC9D,aAAa,CACX,aAAa,EACb;;sCAEkC,UAAU;CAC/C,EACG,MAAM,CACP,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC;QAC/C,KAAK,EAAE;YACL,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,UAAU;SACX;QACD,UAAU;QACV,SAAS;KAAE,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAGlD;IAQC,MAAM,GAAG,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAEjC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,OAAO;YACP,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACpC,YAAY,EAAE,SAAS;SAAE,CAAC;IAC9B,CAAC;IAED,MAAM,MAAM,GAAG,8BAA8B,CAAC;IAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,MAAM,4BAA4B,CAAC;IACxD,MAAM,QAAQ,GAAG,GAAG,MAAM,oBAAoB,CAAC;IAE/C,qDAAqD;IACrD,MAAM,KAAK,GAA4C;QACrD;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE;gBACJ,MAAM;gBACN,IAAI;gBACJ;oBACE,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;oBAChE,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;oBACtE,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;oBACpE,aAAa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;iBACzC,CAAC,IAAI,CAAC,MAAM,CAAC;aACf;SAAE;QACL;YACE,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE;gBACJ,MAAM;gBACN,IAAI;gBACJ,uMAAuM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,4BAA4B;aAC7P;SAAE;QACL;YACE,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE;gBACJ,UAAU;gBACV,IAAI;gBACJ,2EAA2E;aAC5E;SAAE;QACL;YACE,IAAI,EAAE,oCAAoC;YAC1C,IAAI,EAAE;gBACJ,MAAM;gBACN,IAAI;gBACJ,sLAAsL;aACvL;SAAE;QACL;YACE,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,yDAAyD,CAAC;SAAE;QACnF;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE;gBACJ,MAAM;gBACN,IAAI;gBACJ,8DAA8D;aAC/D;SAAE;KACN,CAAC;IAEF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,CAAC;YACZ,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAC1G,CAAC;YACF,oDAAoD;YACpD,IACE,IAAI,CAAC,IAAI,KAAK,YAAY;gBAC1B,IAAI,CAAC,IAAI,KAAK,sBAAsB;gBACpC,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAC9B,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACnC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK;oBACL,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;oBAC1C,YAAY,EAAE,SAAS;iBAAE,CAAC;YAC9B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAE/E,OAAO;QACL,EAAE;QACF,KAAK;QACL,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC1C,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAAE,CAAC;AAC/C,CAAC"}