{"version":3,"file":"security.config.mjs","sources":["../../src/config/security.config.ts"],"sourcesContent":["/**\n * @fileoverview Security Configuration\n * @module @/config/security.config\n *\n * Centralized security settings for the Harbor React Framework.\n * This configuration file defines security policies, CSP rules,\n * CSRF protection settings, and secure storage options.\n *\n * IMPORTANT: Review these settings for your specific deployment environment.\n * Production deployments should use strict security policies.\n *\n * @author Harbor Security Team\n * @version 1.0.0\n */\n\nimport type {\n CSPPolicy,\n CSPManagerConfig,\n CSRFConfig,\n SecureStorageConfig,\n SecurityConfiguration,\n} from '@/lib/security/types';\nimport { env } from './env';\n\n// ============================================================================\n// Content Security Policy Configuration\n// ============================================================================\n\n/**\n * Base CSP policy for development environment\n * More permissive to allow hot reload and dev tools\n */\nconst developmentCSPPolicy: CSPPolicy = {\n 'default-src': [\"'self'\"],\n 'script-src': [\"'self'\", \"'unsafe-eval'\"], // unsafe-eval needed for HMR\n 'script-src-elem': [\"'self'\"],\n 'style-src': [\"'self'\", \"'unsafe-inline'\"], // unsafe-inline for dev styles\n 'style-src-elem': [\"'self'\", \"'unsafe-inline'\"],\n 'img-src': [\"'self'\", 'data:', 'blob:', 'https:'],\n 'font-src': [\"'self'\", 'data:'],\n 'connect-src': [\n \"'self'\",\n 'ws://localhost:*', // WebSocket for HMR\n 'wss://localhost:*',\n 'http://localhost:*',\n 'https://localhost:*',\n ],\n 'media-src': [\"'self'\", 'blob:'],\n 'object-src': ['none'],\n 'frame-src': [\"'self'\"],\n 'worker-src': [\"'self'\", 'blob:'],\n 'child-src': [\"'self'\", 'blob:'],\n 'form-action': [\"'self'\"],\n 'frame-ancestors': [\"'self'\"],\n 'base-uri': [\"'self'\"],\n 'manifest-src': [\"'self'\"],\n};\n\n/**\n * Base CSP policy for staging environment\n * Moderately strict with reporting enabled\n */\nconst stagingCSPPolicy: CSPPolicy = {\n 'default-src': [\"'self'\"],\n 'script-src': [\"'self'\", \"'strict-dynamic'\"],\n 'script-src-elem': [\"'self'\"],\n 'style-src': [\"'self'\"],\n 'style-src-elem': [\"'self'\"],\n 'img-src': [\"'self'\", 'data:', 'https:'],\n 'font-src': [\"'self'\"],\n 'connect-src': [\"'self'\", env.apiBaseUrl, env.wsUrl, env.sseUrl],\n 'media-src': [\"'self'\"],\n 'object-src': ['none'],\n 'frame-src': [\"'self'\"],\n 'worker-src': [\"'self'\", 'blob:'],\n 'child-src': [\"'self'\"],\n 'form-action': [\"'self'\"],\n 'frame-ancestors': [\"'self'\"],\n 'base-uri': [\"'self'\"],\n 'manifest-src': [\"'self'\"],\n 'upgrade-insecure-requests': [],\n};\n\n/**\n * Base CSP policy for production environment\n * Maximum security with strict policies\n */\nconst productionCSPPolicy: CSPPolicy = {\n 'default-src': [\"'self'\"],\n 'script-src': [\"'self'\", \"'strict-dynamic'\"],\n 'script-src-elem': [\"'self'\"],\n 'style-src': [\"'self'\"],\n 'style-src-elem': [\"'self'\"],\n 'img-src': [\"'self'\", 'data:', 'https:'],\n 'font-src': [\"'self'\"],\n 'connect-src': [\"'self'\", env.apiBaseUrl, env.wsUrl, env.sseUrl],\n 'media-src': [\"'self'\"],\n 'object-src': ['none'],\n 'frame-src': ['none'],\n 'worker-src': [\"'self'\"],\n 'child-src': [\"'self'\"],\n 'form-action': [\"'self'\"],\n 'frame-ancestors': ['none'],\n 'base-uri': [\"'self'\"],\n 'manifest-src': [\"'self'\"],\n 'upgrade-insecure-requests': [],\n 'block-all-mixed-content': [],\n};\n\n/**\n * Get the appropriate CSP policy based on environment\n */\nfunction getCSPPolicy(): CSPPolicy {\n if (env.isDev) {\n return developmentCSPPolicy;\n }\n if (env.isStaging) {\n return stagingCSPPolicy;\n }\n return productionCSPPolicy;\n}\n\n/**\n * CSP Manager configuration\n */\nexport const cspConfig: CSPManagerConfig = {\n basePolicy: getCSPPolicy(),\n enableNonces: true,\n nonceTtl: 1000 * 60 * 60, // 1 hour\n reportViolations: true,\n reportUri: env.isProd ? '/api/security/csp-report' : undefined,\n reportOnly: env.isDev, // Report-only mode in development\n violationHandlers: [],\n} as const;\n\n// ============================================================================\n// CSRF Protection Configuration\n// ============================================================================\n\n/**\n * CSRF protection configuration\n */\nexport const csrfConfig: CSRFConfig = {\n mode: 'double-submit-cookie',\n cookieName: '__Host-csrf-token',\n headerName: 'X-CSRF-Token',\n fieldName: '_csrf',\n tokenTtl: 1000 * 60 * 60 * 24, // 24 hours\n rotateAfterUse: false, // Can cause issues with concurrent requests\n excludePaths: ['/api/health', '/api/public/*', '/api/webhooks/*'],\n protectedMethods: ['POST', 'PUT', 'PATCH', 'DELETE'],\n validateOrigin: true,\n allowedOrigins: env.isProd\n ? [\n // Add your production origins here\n 'https://your-domain.com',\n ]\n : [\n 'http://localhost:3000',\n 'http://localhost:5173',\n 'http://127.0.0.1:3000',\n 'http://127.0.0.1:5173',\n ],\n secureCookies: env.isProd,\n sameSite: env.isProd ? 'strict' : 'lax',\n} as const;\n\n// ============================================================================\n// Secure Storage Configuration\n// ============================================================================\n\n/**\n * Secure storage configuration for encrypted data\n */\nexport const secureStorageConfig: SecureStorageConfig = {\n algorithm: 'AES-GCM',\n keyLength: 256,\n kdf: 'PBKDF2',\n iterations: env.isProd ? 600000 : 100000, // OWASP recommended\n saltLength: 32,\n ivLength: 12, // 96 bits for AES-GCM\n storagePrefix: '__secure_',\n compress: true,\n maxItemSize: 1024 * 1024 * 5, // 5MB\n storageQuota: 1024 * 1024 * 50, // 50MB\n useIndexedDB: true,\n keyTtl: 1000 * 60 * 30, // 30 minutes\n} as const;\n\n// ============================================================================\n// Main Security Configuration\n// ============================================================================\n\n/**\n * Complete security configuration for the application\n */\nexport const securityConfig: SecurityConfiguration = {\n csp: cspConfig,\n csrf: csrfConfig,\n storage: secureStorageConfig,\n enableLogging: env.isDev,\n reportToServer: env.isProd || env.isStaging,\n reportEndpoint: '/api/security/violations',\n maxViolationHistory: 100,\n blockOnViolation: env.isProd,\n} as const;\n\n// ============================================================================\n// Security Constants\n// ============================================================================\n\n/**\n * Security-related timing constants\n */\nexport const SECURITY_TIMING = {\n /** Nonce regeneration interval */\n NONCE_REGENERATION_INTERVAL: 1000 * 60 * 30, // 30 minutes\n /** CSRF token refresh interval */\n CSRF_TOKEN_REFRESH_INTERVAL: 1000 * 60 * 60, // 1 hour\n /** Secure storage key cache TTL */\n STORAGE_KEY_CACHE_TTL: 1000 * 60 * 30, // 30 minutes\n /** Violation report debounce */\n VIOLATION_REPORT_DEBOUNCE: 1000, // 1 second\n /** Maximum time to wait for encryption */\n ENCRYPTION_TIMEOUT: 5000, // 5 seconds\n} as const;\n\n/**\n * Security header names\n */\nexport const SECURITY_HEADERS = {\n /** Content Security Policy header */\n CSP: 'Content-Security-Policy',\n /** CSP Report-Only header */\n CSP_REPORT_ONLY: 'Content-Security-Policy-Report-Only',\n /** CSRF token header */\n CSRF_TOKEN: csrfConfig.headerName,\n /** Strict Transport Security */\n HSTS: 'Strict-Transport-Security',\n /** X-Content-Type-Options */\n X_CONTENT_TYPE_OPTIONS: 'X-Content-Type-Options',\n /** X-Frame-Options */\n X_FRAME_OPTIONS: 'X-Frame-Options',\n /** X-XSS-Protection */\n X_XSS_PROTECTION: 'X-XSS-Protection',\n /** Referrer-Policy */\n REFERRER_POLICY: 'Referrer-Policy',\n /** Permissions-Policy */\n PERMISSIONS_POLICY: 'Permissions-Policy',\n} as const;\n\n/**\n * Allowed HTML tags for sanitization (default safe set)\n */\nexport const ALLOWED_HTML_TAGS = [\n 'a',\n 'abbr',\n 'address',\n 'article',\n 'aside',\n 'b',\n 'bdi',\n 'bdo',\n 'blockquote',\n 'br',\n 'caption',\n 'cite',\n 'code',\n 'col',\n 'colgroup',\n 'data',\n 'dd',\n 'del',\n 'details',\n 'dfn',\n 'div',\n 'dl',\n 'dt',\n 'em',\n 'figcaption',\n 'figure',\n 'footer',\n 'h1',\n 'h2',\n 'h3',\n 'h4',\n 'h5',\n 'h6',\n 'header',\n 'hgroup',\n 'hr',\n 'i',\n 'img',\n 'ins',\n 'kbd',\n 'li',\n 'main',\n 'mark',\n 'nav',\n 'ol',\n 'p',\n 'picture',\n 'pre',\n 'q',\n 'rp',\n 'rt',\n 'ruby',\n 's',\n 'samp',\n 'section',\n 'small',\n 'source',\n 'span',\n 'strong',\n 'sub',\n 'summary',\n 'sup',\n 'table',\n 'tbody',\n 'td',\n 'tfoot',\n 'th',\n 'thead',\n 'time',\n 'tr',\n 'u',\n 'ul',\n 'var',\n 'wbr',\n] as const;\n\n/**\n * Allowed HTML attributes per tag\n */\nexport const ALLOWED_HTML_ATTRIBUTES: Record = {\n '*': ['class', 'id', 'title', 'lang', 'dir', 'aria-*', 'data-*', 'role'],\n a: ['href', 'target', 'rel', 'hreflang'],\n abbr: ['title'],\n blockquote: ['cite'],\n col: ['span'],\n colgroup: ['span'],\n data: ['value'],\n del: ['cite', 'datetime'],\n img: ['src', 'alt', 'width', 'height', 'loading', 'decoding', 'srcset', 'sizes'],\n ins: ['cite', 'datetime'],\n ol: ['reversed', 'start', 'type'],\n q: ['cite'],\n source: ['src', 'srcset', 'sizes', 'type', 'media'],\n table: ['summary'],\n td: ['colspan', 'rowspan', 'headers'],\n th: ['colspan', 'rowspan', 'headers', 'scope', 'abbr'],\n time: ['datetime'],\n} as const;\n\n/**\n * Allowed URL schemes for href/src attributes\n */\nexport const ALLOWED_URL_SCHEMES = ['http', 'https', 'mailto', 'tel'] as const;\n\n// ============================================================================\n// Security Validation Utilities\n// ============================================================================\n\n/**\n * Validate that a URL uses an allowed scheme\n */\nexport function isAllowedUrlScheme(url: string): boolean {\n try {\n const parsed = new URL(url, window.location.origin);\n return ALLOWED_URL_SCHEMES.some((scheme) => parsed.protocol === `${scheme}:`);\n } catch {\n // Relative URLs are allowed\n return !url.includes(':') || url.startsWith('/');\n }\n}\n\n/**\n * Check if a hostname is in the allowed origins list\n */\nexport function isAllowedOrigin(origin: string): boolean {\n return csrfConfig.allowedOrigins.some((allowed) => {\n if (allowed.includes('*')) {\n const pattern = new RegExp(`^${allowed.replace(/\\*/g, '.*')}$`);\n return pattern.test(origin);\n }\n return allowed === origin;\n });\n}\n\n/**\n * Check if a path is excluded from CSRF protection\n */\nexport function isCSRFExcludedPath(path: string): boolean {\n return csrfConfig.excludePaths.some((excluded) => {\n if (excluded.endsWith('/*')) {\n return path.startsWith(excluded.slice(0, -1));\n }\n return path === excluded;\n });\n}\n\n/**\n * Check if an HTTP method requires CSRF protection\n */\nexport function requiresCSRFProtection(method: string): boolean {\n return csrfConfig.protectedMethods.includes(method.toUpperCase());\n}\n\n// ============================================================================\n// Exports\n// ============================================================================\n\nexport type { CSPPolicy, CSPManagerConfig, CSRFConfig, SecureStorageConfig, SecurityConfiguration };\n\n/**\n * Get security configuration summary for diagnostics\n * Sensitive values are redacted\n */\nexport function getSecurityConfigSummary(): Record {\n return {\n csp: {\n enableNonces: cspConfig.enableNonces,\n reportOnly: cspConfig.reportOnly,\n reportViolations: cspConfig.reportViolations,\n },\n csrf: {\n mode: csrfConfig.mode,\n protectedMethods: csrfConfig.protectedMethods,\n sameSite: csrfConfig.sameSite,\n secureCookies: csrfConfig.secureCookies,\n excludedPathCount: csrfConfig.excludePaths.length,\n },\n storage: {\n algorithm: secureStorageConfig.algorithm,\n keyLength: secureStorageConfig.keyLength,\n compress: secureStorageConfig.compress,\n maxItemSize: `${secureStorageConfig.maxItemSize / 1024 / 1024}MB`,\n storageQuota: `${secureStorageConfig.storageQuota / 1024 / 1024}MB`,\n },\n logging: securityConfig.enableLogging,\n reportToServer: securityConfig.reportToServer,\n environment: env.appEnv,\n };\n}\n"],"names":["developmentCSPPolicy","stagingCSPPolicy","env","productionCSPPolicy","getCSPPolicy","cspConfig","csrfConfig","secureStorageConfig","securityConfig","SECURITY_TIMING","SECURITY_HEADERS","ALLOWED_HTML_TAGS","ALLOWED_HTML_ATTRIBUTES","ALLOWED_URL_SCHEMES","isAllowedUrlScheme","url","parsed","scheme","isAllowedOrigin","origin","allowed","isCSRFExcludedPath","path","excluded","requiresCSRFProtection","method","getSecurityConfigSummary"],"mappings":";AAgCA,MAAMA,IAAkC;AAAA,EACtC,eAAe,CAAC,QAAQ;AAAA,EACxB,cAAc,CAAC,UAAU,eAAe;AAAA;AAAA,EACxC,mBAAmB,CAAC,QAAQ;AAAA,EAC5B,aAAa,CAAC,UAAU,iBAAiB;AAAA;AAAA,EACzC,kBAAkB,CAAC,UAAU,iBAAiB;AAAA,EAC9C,WAAW,CAAC,UAAU,SAAS,SAAS,QAAQ;AAAA,EAChD,YAAY,CAAC,UAAU,OAAO;AAAA,EAC9B,eAAe;AAAA,IACb;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAAA,EAEF,aAAa,CAAC,UAAU,OAAO;AAAA,EAC/B,cAAc,CAAC,MAAM;AAAA,EACrB,aAAa,CAAC,QAAQ;AAAA,EACtB,cAAc,CAAC,UAAU,OAAO;AAAA,EAChC,aAAa,CAAC,UAAU,OAAO;AAAA,EAC/B,eAAe,CAAC,QAAQ;AAAA,EACxB,mBAAmB,CAAC,QAAQ;AAAA,EAC5B,YAAY,CAAC,QAAQ;AAAA,EACrB,gBAAgB,CAAC,QAAQ;AAC3B,GAMMC,IAA8B;AAAA,EAClC,eAAe,CAAC,QAAQ;AAAA,EACxB,cAAc,CAAC,UAAU,kBAAkB;AAAA,EAC3C,mBAAmB,CAAC,QAAQ;AAAA,EAC5B,aAAa,CAAC,QAAQ;AAAA,EACtB,kBAAkB,CAAC,QAAQ;AAAA,EAC3B,WAAW,CAAC,UAAU,SAAS,QAAQ;AAAA,EACvC,YAAY,CAAC,QAAQ;AAAA,EACrB,eAAe,CAAC,UAAUC,EAAI,YAAYA,EAAI,OAAOA,EAAI,MAAM;AAAA,EAC/D,aAAa,CAAC,QAAQ;AAAA,EACtB,cAAc,CAAC,MAAM;AAAA,EACrB,aAAa,CAAC,QAAQ;AAAA,EACtB,cAAc,CAAC,UAAU,OAAO;AAAA,EAChC,aAAa,CAAC,QAAQ;AAAA,EACtB,eAAe,CAAC,QAAQ;AAAA,EACxB,mBAAmB,CAAC,QAAQ;AAAA,EAC5B,YAAY,CAAC,QAAQ;AAAA,EACrB,gBAAgB,CAAC,QAAQ;AAAA,EACzB,6BAA6B,CAAA;AAC/B,GAMMC,IAAiC;AAAA,EACrC,eAAe,CAAC,QAAQ;AAAA,EACxB,cAAc,CAAC,UAAU,kBAAkB;AAAA,EAC3C,mBAAmB,CAAC,QAAQ;AAAA,EAC5B,aAAa,CAAC,QAAQ;AAAA,EACtB,kBAAkB,CAAC,QAAQ;AAAA,EAC3B,WAAW,CAAC,UAAU,SAAS,QAAQ;AAAA,EACvC,YAAY,CAAC,QAAQ;AAAA,EACrB,eAAe,CAAC,UAAUD,EAAI,YAAYA,EAAI,OAAOA,EAAI,MAAM;AAAA,EAC/D,aAAa,CAAC,QAAQ;AAAA,EACtB,cAAc,CAAC,MAAM;AAAA,EACrB,aAAa,CAAC,MAAM;AAAA,EACpB,cAAc,CAAC,QAAQ;AAAA,EACvB,aAAa,CAAC,QAAQ;AAAA,EACtB,eAAe,CAAC,QAAQ;AAAA,EACxB,mBAAmB,CAAC,MAAM;AAAA,EAC1B,YAAY,CAAC,QAAQ;AAAA,EACrB,gBAAgB,CAAC,QAAQ;AAAA,EACzB,6BAA6B,CAAA;AAAA,EAC7B,2BAA2B,CAAA;AAC7B;AAKA,SAASE,IAA0B;AACjC,SAAIF,EAAI,QACCF,IAELE,EAAI,YACCD,IAEFE;AACT;AAKO,MAAME,IAA8B;AAAA,EACzC,YAAYD,EAAA;AAAA,EACZ,cAAc;AAAA,EACd,UAAU,MAAO,KAAK;AAAA;AAAA,EACtB,kBAAkB;AAAA,EAClB,WAAWF,EAAI,SAAS,6BAA6B;AAAA,EACrD,YAAYA,EAAI;AAAA;AAAA,EAChB,mBAAmB,CAAA;AACrB,GASaI,IAAyB;AAAA,EACpC,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,UAAU,MAAO,KAAK,KAAK;AAAA;AAAA,EAC3B,gBAAgB;AAAA;AAAA,EAChB,cAAc,CAAC,eAAe,iBAAiB,iBAAiB;AAAA,EAChE,kBAAkB,CAAC,QAAQ,OAAO,SAAS,QAAQ;AAAA,EACnD,gBAAgB;AAAA,EAChB,gBAAgBJ,EAAI,SAChB;AAAA;AAAA,IAEE;AAAA,EAAA,IAEF;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAAA,EAEN,eAAeA,EAAI;AAAA,EACnB,UAAUA,EAAI,SAAS,WAAW;AACpC,GASaK,IAA2C;AAAA,EACtD,WAAW;AAAA,EACX,WAAW;AAAA,EACX,KAAK;AAAA,EACL,YAAYL,EAAI,SAAS,MAAS;AAAA;AAAA,EAClC,YAAY;AAAA,EACZ,UAAU;AAAA;AAAA,EACV,eAAe;AAAA,EACf,UAAU;AAAA,EACV,aAAa,OAAO,OAAO;AAAA;AAAA,EAC3B,cAAc,OAAO,OAAO;AAAA;AAAA,EAC5B,cAAc;AAAA,EACd,QAAQ,MAAO,KAAK;AAAA;AACtB,GASaM,IAAwC;AAAA,EACnD,KAAKH;AAAA,EACL,MAAMC;AAAA,EACN,SAASC;AAAA,EACT,eAAeL,EAAI;AAAA,EACnB,gBAAgBA,EAAI,UAAUA,EAAI;AAAA,EAClC,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,kBAAkBA,EAAI;AACxB,GASaO,IAAkB;AAAA;AAAA,EAE7B,6BAA6B,MAAO,KAAK;AAAA;AAAA;AAAA,EAEzC,6BAA6B,MAAO,KAAK;AAAA;AAAA;AAAA,EAEzC,uBAAuB,MAAO,KAAK;AAAA;AAAA;AAAA,EAEnC,2BAA2B;AAAA;AAAA;AAAA,EAE3B,oBAAoB;AAAA;AACtB,GAKaC,IAAmB;AAAA;AAAA,EAE9B,KAAK;AAAA;AAAA,EAEL,iBAAiB;AAAA;AAAA,EAEjB,YAAYJ,EAAW;AAAA;AAAA,EAEvB,MAAM;AAAA;AAAA,EAEN,wBAAwB;AAAA;AAAA,EAExB,iBAAiB;AAAA;AAAA,EAEjB,kBAAkB;AAAA;AAAA,EAElB,iBAAiB;AAAA;AAAA,EAEjB,oBAAoB;AACtB,GAKaK,IAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKaC,IAA6D;AAAA,EACxE,KAAK,CAAC,SAAS,MAAM,SAAS,QAAQ,OAAO,UAAU,UAAU,MAAM;AAAA,EACvE,GAAG,CAAC,QAAQ,UAAU,OAAO,UAAU;AAAA,EACvC,MAAM,CAAC,OAAO;AAAA,EACd,YAAY,CAAC,MAAM;AAAA,EACnB,KAAK,CAAC,MAAM;AAAA,EACZ,UAAU,CAAC,MAAM;AAAA,EACjB,MAAM,CAAC,OAAO;AAAA,EACd,KAAK,CAAC,QAAQ,UAAU;AAAA,EACxB,KAAK,CAAC,OAAO,OAAO,SAAS,UAAU,WAAW,YAAY,UAAU,OAAO;AAAA,EAC/E,KAAK,CAAC,QAAQ,UAAU;AAAA,EACxB,IAAI,CAAC,YAAY,SAAS,MAAM;AAAA,EAChC,GAAG,CAAC,MAAM;AAAA,EACV,QAAQ,CAAC,OAAO,UAAU,SAAS,QAAQ,OAAO;AAAA,EAClD,OAAO,CAAC,SAAS;AAAA,EACjB,IAAI,CAAC,WAAW,WAAW,SAAS;AAAA,EACpC,IAAI,CAAC,WAAW,WAAW,WAAW,SAAS,MAAM;AAAA,EACrD,MAAM,CAAC,UAAU;AACnB,GAKaC,IAAsB,CAAC,QAAQ,SAAS,UAAU,KAAK;AAS7D,SAASC,EAAmBC,GAAsB;AACvD,MAAI;AACF,UAAMC,IAAS,IAAI,IAAID,GAAK,OAAO,SAAS,MAAM;AAClD,WAAOF,EAAoB,KAAK,CAACI,MAAWD,EAAO,aAAa,GAAGC,CAAM,GAAG;AAAA,EAC9E,QAAQ;AAEN,WAAO,CAACF,EAAI,SAAS,GAAG,KAAKA,EAAI,WAAW,GAAG;AAAA,EACjD;AACF;AAKO,SAASG,EAAgBC,GAAyB;AACvD,SAAOb,EAAW,eAAe,KAAK,CAACc,MACjCA,EAAQ,SAAS,GAAG,IACN,IAAI,OAAO,IAAIA,EAAQ,QAAQ,OAAO,IAAI,CAAC,GAAG,EAC/C,KAAKD,CAAM,IAErBC,MAAYD,CACpB;AACH;AAKO,SAASE,EAAmBC,GAAuB;AACxD,SAAOhB,EAAW,aAAa,KAAK,CAACiB,MAC/BA,EAAS,SAAS,IAAI,IACjBD,EAAK,WAAWC,EAAS,MAAM,GAAG,EAAE,CAAC,IAEvCD,MAASC,CACjB;AACH;AAKO,SAASC,EAAuBC,GAAyB;AAC9D,SAAOnB,EAAW,iBAAiB,SAASmB,EAAO,aAAa;AAClE;AAYO,SAASC,IAAoD;AAClE,SAAO;AAAA,IACL,KAAK;AAAA,MACH,cAAcrB,EAAU;AAAA,MACxB,YAAYA,EAAU;AAAA,MACtB,kBAAkBA,EAAU;AAAA,IAAA;AAAA,IAE9B,MAAM;AAAA,MACJ,MAAMC,EAAW;AAAA,MACjB,kBAAkBA,EAAW;AAAA,MAC7B,UAAUA,EAAW;AAAA,MACrB,eAAeA,EAAW;AAAA,MAC1B,mBAAmBA,EAAW,aAAa;AAAA,IAAA;AAAA,IAE7C,SAAS;AAAA,MACP,WAAWC,EAAoB;AAAA,MAC/B,WAAWA,EAAoB;AAAA,MAC/B,UAAUA,EAAoB;AAAA,MAC9B,aAAa,GAAGA,EAAoB,cAAc,OAAO,IAAI;AAAA,MAC7D,cAAc,GAAGA,EAAoB,eAAe,OAAO,IAAI;AAAA,IAAA;AAAA,IAEjE,SAASC,EAAe;AAAA,IACxB,gBAAgBA,EAAe;AAAA,IAC/B,aAAaN,EAAI;AAAA,EAAA;AAErB;"}