@aauth/proxy 0.5.0 → 1.0.1

package/dist/access-mode.d.ts

@@ -0,0 +1,21 @@
+export type KnownAccessMode = 'agent-token' | 'person-token' | 'session-token' | 'auth-token' | 'per-call';
+export declare const KNOWN_ACCESS_MODES: readonly KnownAccessMode[];
+export declare function isKnownAccessMode(v: string | undefined): v is KnownAccessMode;
+export interface AgentSetup {
+    /** false when the agent token carries no `ps` claim. */
+    hasPersonServer: boolean;
+}
+export type AccessModePlan = {
+    kind: 'undeclared';
+} | {
+    kind: 'satisfiable';
+    mode: KnownAccessMode;
+} | {
+    kind: 'unsatisfiable';
+    mode: KnownAccessMode;
+    reason: string;
+};
+export declare function planAccessMode(declared: string | undefined, setup: AgentSetup): AccessModePlan;
+/** One-line reason string for a plan, for surfacing to the LLM. */
+export declare function planReason(plan: AccessModePlan): string | undefined;
+//# sourceMappingURL=access-mode.d.ts.map

package/dist/access-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-mode.d.ts","sourceRoot":"","sources":["../src/access-mode.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,eAAe,GACvB,aAAa,GACb,cAAc,GACd,eAAe,GACf,YAAY,GACZ,UAAU,CAAA;AAEd,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAMxD,CAAA;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,CAAC,IAAI,eAAe,CAE7E;AAED,MAAM,WAAW,UAAU;IACzB,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAKpE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,cAAc,CA2B9F;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAEnE"}

package/dist/access-mode.js

@@ -0,0 +1,64 @@
+// access_mode planning.
+//
+// `access_mode` is an IANA registry (protocol §Resource Metadata, §AAuth Access
+// Mode Value Registry), not a closed list: -11 defines four values, R3 -02 adds
+// `per-call`, and extensions may add more. Three outcomes, and only three:
+//
+//   undeclared    — absent, or a value this agent does not recognize. Call the
+//                   resource and read the AAuth-Requirement it returns. NEVER an
+//                   error: the declaration is advisory, the runtime requirement
+//                   is authoritative.
+//   satisfiable   — recognized, and this agent's setup can complete it. Plan
+//                   against it and skip the speculative call.
+//   unsatisfiable — recognized, and this agent cannot complete it. Skip the
+//                   resource (or operation) and say why. An agent whose agent
+//                   token carries no `ps` claim cannot obtain a person token,
+//                   and so cannot complete person-token, auth-token or per-call
+//                   access — it should learn that here, not at a 401.
+//
+// Mirrors the `@aauth/protocol` surface named in the AAuth -11 package contract
+// (planAccessMode / AgentSetup / AccessModePlan / KnownAccessMode). Kept local
+// while @aauth/protocol is unpublished; swap the implementation for an import
+// when it ships — the types are identical by construction.
+export const KNOWN_ACCESS_MODES = [
+    'agent-token',
+    'person-token',
+    'session-token',
+    'auth-token',
+    'per-call',
+];
+export function isKnownAccessMode(v) {
+    return v !== undefined && KNOWN_ACCESS_MODES.includes(v);
+}
+const NO_PS = 'this agent token carries no `ps` claim, so the agent has no person server to obtain a person token from';
+export function planAccessMode(declared, setup) {
+    if (!isKnownAccessMode(declared))
+        return { kind: 'undeclared' };
+    switch (declared) {
+        // Identity only: every request already carries an agent token.
+        case 'agent-token':
+            return { kind: 'satisfiable', mode: declared };
+        // Resource-managed: the resource runs its own consent flow and hands back a
+        // session token via AAuth-Access. No PS involved.
+        case 'session-token':
+            return { kind: 'satisfiable', mode: declared };
+        // All three need a person token, which only a person server issues. A
+        // resource MUST have verified a person token before it issues a resource
+        // token, so auth-token and per-call are unreachable without one too.
+        case 'person-token':
+        case 'auth-token':
+        case 'per-call':
+            return setup.hasPersonServer
+                ? { kind: 'satisfiable', mode: declared }
+                : {
+                    kind: 'unsatisfiable',
+                    mode: declared,
+                    reason: `access_mode "${declared}" requires a person token, and ${NO_PS}`,
+                };
+    }
+}
+/** One-line reason string for a plan, for surfacing to the LLM. */
+export function planReason(plan) {
+    return plan.kind === 'unsatisfiable' ? plan.reason : undefined;
+}
+//# sourceMappingURL=access-mode.js.map

package/dist/access-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-mode.js","sourceRoot":"","sources":["../src/access-mode.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,sCAAsC;AACtC,6EAA6E;AAC7E,8DAA8D;AAC9D,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,sEAAsE;AACtE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,2DAA2D;AAS3D,MAAM,CAAC,MAAM,kBAAkB,GAA+B;IAC5D,aAAa;IACb,cAAc;IACd,eAAe;IACf,YAAY;IACZ,UAAU;CACX,CAAA;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAqB;IACrD,OAAO,CAAC,KAAK,SAAS,IAAK,kBAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AACjF,CAAC;AAYD,MAAM,KAAK,GACT,yGAAyG,CAAA;AAE3G,MAAM,UAAU,cAAc,CAAC,QAA4B,EAAE,KAAiB;IAC5E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;IAE/D,QAAQ,QAAQ,EAAE,CAAC;QACjB,+DAA+D;QAC/D,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QAEhD,4EAA4E;QAC5E,kDAAkD;QAClD,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QAEhD,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,KAAK,cAAc,CAAC;QACpB,KAAK,YAAY,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,eAAe;gBAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzC,CAAC,CAAC;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,gBAAgB,QAAQ,kCAAkC,KAAK,EAAE;iBAC1E,CAAA;IACT,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,IAAoB;IAC7C,OAAO,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAChE,CAAC"}

package/dist/agent.d.ts

@@ -1,10 +1,11 @@
 import { fetch as signedFetch } from '@hellocoop/httpsig';
-import type { L1Entry } from './store.js';
+import type { KnownAccessMode } from './access-mode.js';
+import type { L1Entry, PersonTokenStore } from './store.js';
 export type AgentSigningKey = Parameters<typeof signedFetch>[1]['signingKey'];
 /**
  * Optional hints forwarded verbatim as extra body parameters in every POST to
- * the PS token endpoint (AAuth spec §8.1). All fields are optional; include only
- * those the host has learned about the user.
+ * the PS auth token endpoint (protocol §Agent Token Request). All fields are
+ * optional; include only those the host has learned about the user.
  */
 export interface PSTokenHints {
     login_hint?: string;
@@ -18,12 +19,32 @@ export interface PSTokenHints {
     prompt?: string;
     capabilities?: string[];
 }
+/** Opaque per-resource session token from the AAuth-Access header. */
+export interface SessionTokenStore {
+    get(resource: string): Promise<string | undefined>;
+    set(resource: string, token: string): Promise<void>;
+}
 export interface ProxyConfig {
     psUrl: string;
     agentPrivateJwk: AgentSigningKey;
     agentToken: string;
-    /** Extra parameters forwarded to every PS token endpoint request. */
+    /**
+     * The mission this agent is operating under, as the base64url SHA-256 of the
+     * approved mission JSON. Forwarded to the PS's person token endpoint, which
+     * stamps it into the person token; from there the resource copies it into the
+     * resource token and the PS into the auth token. No PS implements
+     * `mission_endpoint` yet — the claim path is built regardless.
+     */
+    missionS256?: string;
+    /** Extra parameters forwarded to every PS auth token endpoint request. */
     psHints?: PSTokenHints;
+    /**
+     * Person-token cache. Keyed (resource, mission_s256); flushed whole when the
+     * agent's signing key changes. Defaults to a per-config in-memory store.
+     */
+    personTokens?: PersonTokenStore;
+    /** Session-token store for `session-token` resources. Defaults to per-config memory. */
+    sessionTokens?: SessionTokenStore;
     /**
      * Called with each auth_token received from the PS before it is used.
      * Hosts can use this to record or validate the PS sub across exchanges.
@@ -36,6 +57,10 @@ export interface InvokeArgs {
     body?: unknown;
     contentType?: string;
 }
+export interface InvokeOptions {
+    /** Overrides ProxyConfig.missionS256 for this call. */
+    missionS256?: string;
+}
 export interface Interaction {
     url: string;
     code: string;
@@ -48,13 +73,67 @@ export type InvokeResult = {
 } | {
     kind: 'interaction';
     interaction: Interaction;
+}
+/**
+ * The resource (or this operation) declares an access mode this agent's setup
+ * cannot complete — typically `auth-token` or `person-token` at an agent whose
+ * agent token carries no `ps` claim. No request was made. Case (c) of the
+ * three-way access_mode plan: the agent learns this before planning rather
+ * than at a 401.
+ */
+ | {
+    kind: 'skipped';
+    resource: string;
+    opId: string;
+    mode: KnownAccessMode;
+    reason: string;
 };
 export type InteractionHandler = (url: string, code: string) => Promise<void> | void;
 export declare function makeAgentPoll(cfg: ProxyConfig): (url: string) => Promise<Response>;
+interface PSMetadata {
+    /** Renamed from `token_endpoint` in -11. */
+    auth_token_endpoint: string;
+    /** New in -11, REQUIRED. */
+    person_token_endpoint?: string;
+    interaction_endpoint?: string;
+    mission_endpoint?: string;
+}
+type PersonTokenOutcome = {
+    kind: 'token';
+    personToken: string;
+} | {
+    kind: 'interaction';
+    interaction: Interaction;
+} | {
+    kind: 'result';
+    status: number;
+    body: unknown;
+};
+/**
+ * Obtain a person token for one resource, from cache or from the PS.
+ *
+ * A resource MUST have verified a person token before it issues a resource token,
+ * and the agent MUST present one on every authorization endpoint request
+ * (protocol §Person Token, §Authorization Endpoint Request) — so this sits in
+ * front of the whole authorize-first path, not only of `person-token` resources.
+ *
+ * The PS MAY require the user to approve the agent acting at this resource before
+ * issuing, and answers `202` with `requirement=interaction`. That is surfaced
+ * like any other interaction; the caller drives it and retries, and the second
+ * request gets a `200`.
+ */
+export declare function obtainPersonToken(cfg: ProxyConfig, ps: PSMetadata, resource: string, missionS256?: string): Promise<PersonTokenOutcome>;
+/**
+ * Drop every cached person token. Call when the agent's signing key rotates —
+ * every person token binds the same key through `cnf`, so none of them survive.
+ * `obtainPersonToken` also detects rotation on its own via the key thumbprint;
+ * this is the explicit hook for a host that knows a rotation happened.
+ */
+export declare function flushPersonTokens(cfg: ProxyConfig): Promise<void>;
 type Poller = (url: string) => Promise<Response>;
 export declare function pollUntilDone(poll: Poller, locationUrl: string, timeoutMs?: number, onPoll?: (elapsedMs: number) => void | Promise<void>): Promise<Response>;
-export declare function invokeAtResource(cfg: ProxyConfig, l1: L1Entry, operationId: string, args?: InvokeArgs): Promise<InvokeResult>;
-export declare function invokeAtResourceComplete(cfg: ProxyConfig, l1: L1Entry, operationId: string, onInteraction: InteractionHandler, args?: InvokeArgs, maxRounds?: number, pollTimeoutMs?: number, onPoll?: (elapsedMs: number) => void | Promise<void>): Promise<{
+export declare function invokeAtResource(cfg: ProxyConfig, l1: L1Entry, operationId: string, args?: InvokeArgs, opts?: InvokeOptions): Promise<InvokeResult>;
+export declare function invokeAtResourceComplete(cfg: ProxyConfig, l1: L1Entry, operationId: string, onInteraction: InteractionHandler, args?: InvokeArgs, maxRounds?: number, pollTimeoutMs?: number, onPoll?: (elapsedMs: number) => void | Promise<void>, opts?: InvokeOptions): Promise<{
     status: number;
     body: unknown;
 }>;

package/dist/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEzC,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;AAE7E;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,eAAe,CAAA;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE,CAAA;AAErD,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAOpF,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAGlF;AAoED,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAShD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,SAAU,EACnB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACnD,OAAO,CAAC,QAAQ,CAAC,CAUnB;AA8CD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,OAAO,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,YAAY,CAAC,CAgHvB;AAMD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,OAAO,EACX,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,kBAAkB,EACjC,IAAI,GAAE,UAAe,EACrB,SAAS,SAAI,EACb,aAAa,SAAU,EACvB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACnD,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAW5C;AAID,wBAAsB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAElG"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAIvE,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE3D,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;AAE7E;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAClD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,eAAe,CAAA;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,wFAAwF;IACxF,aAAa,CAAC,EAAE,iBAAiB,CAAA;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE;AACnD;;;;;;GAMG;GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9F,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAqEpF,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAGlF;AA6CD,UAAU,UAAU;IAClB,4CAA4C;IAC5C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,4BAA4B;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AA+CD,KAAK,kBAAkB,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAErD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC,CA4C7B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AA4BD,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAShD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,SAAU,EACnB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACnD,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAqFD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,OAAO,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,UAAe,EACrB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAkNvB;AAMD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,OAAO,EACX,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,kBAAkB,EACjC,IAAI,GAAE,UAAe,EACrB,SAAS,SAAI,EACb,aAAa,SAAU,EACvB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EACpD,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAY5C;AAID,wBAAsB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAElG"}