@andesine/sdk 0.4.0 → 0.5.0

package/dist/extensions.js

@@ -0,0 +1,220 @@
+import { n as AndesineAPIError } from "./answer-stream-7N_gLhVS.js";
+import { t as createClient } from "./client-DioqVOxl.js";
+//#region src/extensions/jwt.ts
+const TOKEN_LIFETIME = 300;
+const RENEWAL_MARGIN = 60;
+const MAX_CACHED_TOKENS = 1e3;
+const ALGORITHMS = {
+	"Ed25519": {
+		alg: "EdDSA",
+		importParams: { name: "Ed25519" },
+		signParams: { name: "Ed25519" }
+	},
+	"P-256": {
+		alg: "ES256",
+		importParams: {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		},
+		signParams: {
+			name: "ECDSA",
+			hash: "SHA-256"
+		}
+	}
+};
+const encodeBase64URL = (bytes) => {
+	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+const encodeJSON = (value) => {
+	return encodeBase64URL(new TextEncoder().encode(JSON.stringify(value)));
+};
+const parsePrivateKey = (input) => {
+	if (typeof input !== "string") return input;
+	try {
+		return JSON.parse(input);
+	} catch {
+		throw new TypeError("privateKey must be a JSON Web Key");
+	}
+};
+/**
+* Signs extension JWTs with a private JWK (Ed25519 for EdDSA, or P-256 for ES256) that has the
+* registry key ID in `kid`. Tokens are cached per instance and installation until shortly
+* before they expire.
+*/
+const createExtensionSigner = (name, privateKey) => {
+	const jwk = parsePrivateKey(privateKey);
+	const algorithm = ALGORITHMS[jwk.crv];
+	const cache = /* @__PURE__ */ new Map();
+	if (!algorithm || !jwk.d || !jwk.kid) throw new TypeError("privateKey must be a private Ed25519 or P-256 JWK with a kid");
+	let key = null;
+	const getKey = () => {
+		key ??= crypto.subtle.importKey("jwk", {
+			kty: jwk.kty,
+			crv: jwk.crv,
+			x: jwk.x,
+			y: jwk.y,
+			d: jwk.d
+		}, algorithm.importParams, false, ["sign"]);
+		return key;
+	};
+	return { async sign({ audience, subject }) {
+		const now = Math.floor(Date.now() / 1e3);
+		const cacheKey = `${audience} ${subject ?? ""}`;
+		const cached = cache.get(cacheKey);
+		if (cached && cached.expiresAt - RENEWAL_MARGIN > now) return cached.token;
+		const header = encodeJSON({
+			alg: algorithm.alg,
+			kid: jwk.kid,
+			typ: "JWT"
+		});
+		const payload = encodeJSON({
+			iss: name,
+			...subject && { sub: subject },
+			aud: audience,
+			iat: now,
+			exp: now + TOKEN_LIFETIME
+		});
+		const signature = await crypto.subtle.sign(algorithm.signParams, await getKey(), new TextEncoder().encode(`${header}.${payload}`));
+		const token = `${header}.${payload}.${encodeBase64URL(new Uint8Array(signature))}`;
+		if (cache.size >= MAX_CACHED_TOKENS) cache.clear();
+		cache.set(cacheKey, {
+			token,
+			expiresAt: now + TOKEN_LIFETIME
+		});
+		return token;
+	} };
+};
+//#endregion
+//#region src/extensions.ts
+var ExtensionSessionError = class extends Error {
+	code;
+	constructor(code) {
+		super(`Extension session verification failed: ${code}`);
+		this.code = code;
+	}
+};
+var ExtensionNotificationError = class extends Error {
+	code;
+	constructor(code) {
+		super(`Extension notification failed: ${code}`);
+		this.code = code;
+	}
+};
+const isRejection = (error) => {
+	return error instanceof AndesineAPIError && [
+		401,
+		403,
+		404
+	].includes(error.status);
+};
+const parseJSON = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+};
+const getString = (value, key) => {
+	const field = value[key];
+	return typeof field === "string" && field ? field : null;
+};
+const normalizeInstance = (instance) => {
+	try {
+		const url = new URL(instance);
+		return url.protocol === "https:" || url.protocol === "http:" ? `${url.origin}${url.pathname}`.replace(/\/+$/, "") : null;
+	} catch {
+		return null;
+	}
+};
+const getHeader = (headers, name) => {
+	if (headers instanceof Headers) return headers.get(name);
+	const value = headers[name.toLowerCase()];
+	return (Array.isArray(value) ? value[0] : value) ?? null;
+};
+/**
+* Creates the helpers of an extension backend. They sign and cache extension JWTs, and accept
+* only the trusted instances; the backend stores no per-installation state.
+* @example
+* const extension = createExtensionBackend({
+*   name: "acme/publish",
+*   privateKey: process.env.ANDESINE_EXTENSION_KEY!,
+*   trustedInstances: ["https://api.andesine.app"]
+* });
+* const session = await extension.verifySession(request.headers);
+*/
+const createExtensionBackend = (options) => {
+	const signer = createExtensionSigner(options.name, options.privateKey);
+	const trusted = new Set(options.trustedInstances.map(normalizeInstance));
+	const fetcher = options.client?.fetch ?? globalThis.fetch;
+	const getTrustedInstance = (instance) => {
+		const normalized = normalizeInstance(instance);
+		return normalized && trusted.has(normalized) ? normalized : null;
+	};
+	const createBackendClient = (instance, extensionID) => {
+		const audience = getTrustedInstance(instance);
+		if (!audience) throw new TypeError("The instance is not trusted");
+		return createClient({
+			...options.client,
+			baseURL: audience,
+			apiKey: "",
+			fetch: async (input, init) => {
+				const request = new Request(input, init);
+				const token = await signer.sign({
+					audience,
+					subject: extensionID ?? null
+				});
+				request.headers.set("Authorization", `Bearer ${token}`);
+				return fetcher(request);
+			}
+		});
+	};
+	return {
+		createClient: createBackendClient,
+		async verifySession(headers) {
+			const token = /^Bearer\s+(\S+)$/i.exec(getHeader(headers, "Authorization") ?? "")?.[1];
+			const extensionID = getHeader(headers, "Andesine-Extension");
+			const instance = getHeader(headers, "Andesine-Instance");
+			if (!token || !extensionID || !instance) throw new ExtensionSessionError("MISSING_SESSION");
+			const audience = getTrustedInstance(instance);
+			if (!audience) throw new ExtensionSessionError("UNTRUSTED_INSTANCE");
+			const client = createBackendClient(audience, extensionID);
+			try {
+				return {
+					...await client.extensions.verifySession({ token }),
+					extensionID,
+					instance: audience,
+					client
+				};
+			} catch (error) {
+				if (isRejection(error)) throw new ExtensionSessionError("INVALID_SESSION");
+				throw error;
+			}
+		},
+		async receive(body) {
+			const notification = typeof body === "string" ? parseJSON(body) : body;
+			const isObject = typeof notification === "object" && notification !== null;
+			const deliveryID = isObject ? getString(notification, "deliveryID") : null;
+			const extensionID = isObject ? getString(notification, "extensionID") : null;
+			const instance = isObject ? getString(notification, "instance") : null;
+			if (!deliveryID || !extensionID || !instance) throw new ExtensionNotificationError("INVALID_NOTIFICATION");
+			const audience = getTrustedInstance(instance);
+			if (!audience) throw new ExtensionNotificationError("UNTRUSTED_INSTANCE");
+			const client = createBackendClient(audience, extensionID);
+			try {
+				return {
+					...await client.extensions.getSelfDelivery({ deliveryID }),
+					extensionID,
+					instance: audience,
+					client
+				};
+			} catch (error) {
+				if (isRejection(error)) throw new ExtensionNotificationError("UNKNOWN_DELIVERY");
+				throw error;
+			}
+		}
+	};
+};
+//#endregion
+export { ExtensionNotificationError, ExtensionSessionError, createExtensionBackend };
+
+//# sourceMappingURL=extensions.js.map

package/dist/extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.js","names":[],"sources":["../src/extensions/jwt.ts","../src/extensions.ts"],"sourcesContent":["interface ExtensionPrivateKey extends JsonWebKey {\n  kid?: string;\n}\ninterface ExtensionTokenClaims {\n  /** The instance API URL. */\n  audience: string;\n  /** The installation's `ext_` ID; null for app-level tokens. */\n  subject: string | null;\n}\ninterface ExtensionSigner {\n  sign(claims: ExtensionTokenClaims): Promise<string>;\n}\ninterface CachedToken {\n  token: string;\n  expiresAt: number;\n}\n\n// Andesine accepts tokens up to 300 seconds old; cached tokens renew a minute before that.\nconst TOKEN_LIFETIME = 300;\nconst RENEWAL_MARGIN = 60;\nconst MAX_CACHED_TOKENS = 1_000;\nconst ALGORITHMS = {\n  \"Ed25519\": {\n    alg: \"EdDSA\",\n    importParams: { name: \"Ed25519\" },\n    signParams: { name: \"Ed25519\" }\n  },\n  \"P-256\": {\n    alg: \"ES256\",\n    importParams: { name: \"ECDSA\", namedCurve: \"P-256\" },\n    signParams: { name: \"ECDSA\", hash: \"SHA-256\" }\n  }\n} as const;\n\nconst encodeBase64URL = (bytes: Uint8Array): string => {\n  return btoa(String.fromCharCode(...bytes))\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n};\nconst encodeJSON = (value: object): string => {\n  return encodeBase64URL(new TextEncoder().encode(JSON.stringify(value)));\n};\n// Errors never include the key, which can come from an environment variable.\nconst parsePrivateKey = (input: string | ExtensionPrivateKey): ExtensionPrivateKey => {\n  if (typeof input !== \"string\") return input;\n\n  try {\n    return JSON.parse(input) as ExtensionPrivateKey;\n  } catch {\n    throw new TypeError(\"privateKey must be a JSON Web Key\");\n  }\n};\n/**\n * Signs extension JWTs with a private JWK (Ed25519 for EdDSA, or P-256 for ES256) that has the\n * registry key ID in `kid`. Tokens are cached per instance and installation until shortly\n * before they expire.\n */\nconst createExtensionSigner = (\n  name: string,\n  privateKey: string | ExtensionPrivateKey\n): ExtensionSigner => {\n  const jwk = parsePrivateKey(privateKey);\n  const algorithm = ALGORITHMS[jwk.crv as keyof typeof ALGORITHMS];\n  const cache = new Map<string, CachedToken>();\n\n  if (!algorithm || !jwk.d || !jwk.kid) {\n    throw new TypeError(\"privateKey must be a private Ed25519 or P-256 JWK with a kid\");\n  }\n\n  let key: Promise<CryptoKey> | null = null;\n\n  // Imported on first use, so an invalid key fails the first request, not module loading.\n  const getKey = (): Promise<CryptoKey> => {\n    key ??= crypto.subtle.importKey(\n      \"jwk\",\n      { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y, d: jwk.d },\n      algorithm.importParams,\n      false,\n      [\"sign\"]\n    );\n\n    return key;\n  };\n\n  return {\n    async sign({ audience, subject }) {\n      const now = Math.floor(Date.now() / 1000);\n      const cacheKey = `${audience} ${subject ?? \"\"}`;\n      const cached = cache.get(cacheKey);\n\n      if (cached && cached.expiresAt - RENEWAL_MARGIN > now) return cached.token;\n\n      const header = encodeJSON({ alg: algorithm.alg, kid: jwk.kid, typ: \"JWT\" });\n      const payload = encodeJSON({\n        iss: name,\n        ...(subject && { sub: subject }),\n        aud: audience,\n        iat: now,\n        exp: now + TOKEN_LIFETIME\n      });\n      const signature = await crypto.subtle.sign(\n        algorithm.signParams,\n        await getKey(),\n        new TextEncoder().encode(`${header}.${payload}`)\n      );\n      const token = `${header}.${payload}.${encodeBase64URL(new Uint8Array(signature))}`;\n\n      if (cache.size >= MAX_CACHED_TOKENS) cache.clear();\n\n      cache.set(cacheKey, { token, expiresAt: now + TOKEN_LIFETIME });\n\n      return token;\n    }\n  };\n};\n\nexport { createExtensionSigner };\nexport type { ExtensionPrivateKey, ExtensionSigner };\n","import { createClient, type AndesineClient, type ClientOptions } from \"./client\";\nimport { AndesineAPIError } from \"./error\";\nimport { createExtensionSigner, type ExtensionPrivateKey } from \"./extensions/jwt\";\n\ninterface ExtensionBackendOptions {\n  /** The extension's registry name, e.g. `acme/publish`. */\n  name: string;\n  /**\n   * The private JSON Web Key (a JSON string or an object) whose public key is in the registry:\n   * Ed25519 (EdDSA) or P-256 (ES256), with the registry key ID in `kid`. Keep it on the server.\n   */\n  privateKey: string | ExtensionPrivateKey;\n  /** API URLs of the Andesine instances that the backend works with, e.g. `https://api.andesine.app`. */\n  trustedInstances: string[];\n  /** Options for the API clients; the backend sets the base URL and the credential. */\n  client?: Omit<ClientOptions, \"baseURL\" | \"apiKey\" | \"accessToken\">;\n}\ninterface ExtensionSessionContext extends VerifiedSession {\n  /** The installation's `ext_` ID. */\n  extensionID: string;\n  /** The instance API URL. */\n  instance: string;\n  /** An API client for the installation, with the extension's permissions. */\n  client: AndesineClient;\n}\ninterface ExtensionDeliveryContext extends ReceivedDelivery {\n  /** The installation's `ext_` ID. */\n  extensionID: string;\n  /** The instance API URL. */\n  instance: string;\n  /** An API client for the installation, with the extension's permissions. */\n  client: AndesineClient;\n}\ninterface ExtensionBackend {\n  /**\n   * An API client for an installation on a trusted instance, authenticated with extension JWTs.\n   * Without `extensionID`, the client is app-level: it can only list installations.\n   * @throws TypeError if the instance is not trusted.\n   */\n  createClient(instance: string, extensionID?: string): AndesineClient;\n  /**\n   * Verifies a session token from the extension frontend (`backend.fetch` sends the\n   * `Authorization`, `Andesine-Extension`, and `Andesine-Instance` headers).\n   * @throws ExtensionSessionError if the headers are missing, the instance is not trusted, or\n   * the token is invalid or expired. Other API failures throw AndesineAPIError.\n   */\n  verifySession(headers: HeaderSource): Promise<ExtensionSessionContext>;\n  /**\n   * Handles the body of an extension webhook request: checks the instance allowlist and fetches\n   * the delivery with the installation's JWT, which confirms the notification. Respond with a\n   * 2xx status once the event is handled; other responses are retried.\n   * @throws ExtensionNotificationError if the body is invalid, the instance is not trusted, or\n   * the delivery does not exist for the installation. Other API failures throw AndesineAPIError.\n   */\n  receive(body: unknown): Promise<ExtensionDeliveryContext>;\n}\n\ntype VerifiedSession = Awaited<ReturnType<AndesineClient[\"extensions\"][\"verifySession\"]>>;\ntype ReceivedDelivery = Awaited<ReturnType<AndesineClient[\"extensions\"][\"getSelfDelivery\"]>>;\ntype HeaderSource = Headers | Record<string, string | string[] | undefined>;\ntype ExtensionSessionErrorCode = \"MISSING_SESSION\" | \"UNTRUSTED_INSTANCE\" | \"INVALID_SESSION\";\ntype ExtensionNotificationErrorCode =\n  \"INVALID_NOTIFICATION\" | \"UNTRUSTED_INSTANCE\" | \"UNKNOWN_DELIVERY\";\n\nclass ExtensionSessionError extends Error {\n  constructor(readonly code: ExtensionSessionErrorCode) {\n    super(`Extension session verification failed: ${code}`);\n  }\n}\n\nclass ExtensionNotificationError extends Error {\n  constructor(readonly code: ExtensionNotificationErrorCode) {\n    super(`Extension notification failed: ${code}`);\n  }\n}\n\nconst isRejection = (error: unknown): boolean => {\n  return error instanceof AndesineAPIError && [401, 403, 404].includes(error.status);\n};\nconst parseJSON = (text: string): unknown => {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return null;\n  }\n};\nconst getString = (value: object, key: string): string | null => {\n  const field = (value as Record<string, unknown>)[key];\n\n  return typeof field === \"string\" && field ? field : null;\n};\nconst normalizeInstance = (instance: string): string | null => {\n  try {\n    const url = new URL(instance);\n    const isHTTP = url.protocol === \"https:\" || url.protocol === \"http:\";\n\n    return isHTTP ? `${url.origin}${url.pathname}`.replace(/\\/+$/, \"\") : null;\n  } catch {\n    return null;\n  }\n};\nconst getHeader = (headers: HeaderSource, name: string): string | null => {\n  if (headers instanceof Headers) return headers.get(name);\n\n  const value = headers[name.toLowerCase()];\n\n  return (Array.isArray(value) ? value[0] : value) ?? null;\n};\n/**\n * Creates the helpers of an extension backend. They sign and cache extension JWTs, and accept\n * only the trusted instances; the backend stores no per-installation state.\n * @example\n * const extension = createExtensionBackend({\n *   name: \"acme/publish\",\n *   privateKey: process.env.ANDESINE_EXTENSION_KEY!,\n *   trustedInstances: [\"https://api.andesine.app\"]\n * });\n * const session = await extension.verifySession(request.headers);\n */\nconst createExtensionBackend = (options: ExtensionBackendOptions): ExtensionBackend => {\n  const signer = createExtensionSigner(options.name, options.privateKey);\n  const trusted = new Set(options.trustedInstances.map(normalizeInstance));\n  const fetcher = options.client?.fetch ?? globalThis.fetch;\n  const getTrustedInstance = (instance: string): string | null => {\n    const normalized = normalizeInstance(instance);\n\n    return normalized && trusted.has(normalized) ? normalized : null;\n  };\n  const createBackendClient = (instance: string, extensionID?: string): AndesineClient => {\n    const audience = getTrustedInstance(instance);\n\n    if (!audience) throw new TypeError(\"The instance is not trusted\");\n\n    return createClient({\n      ...options.client,\n      baseURL: audience,\n      apiKey: \"\",\n      fetch: async (input, init) => {\n        const request = new Request(input, init);\n        const token = await signer.sign({ audience, subject: extensionID ?? null });\n\n        request.headers.set(\"Authorization\", `Bearer ${token}`);\n\n        return fetcher(request);\n      }\n    });\n  };\n\n  return {\n    createClient: createBackendClient,\n    async verifySession(headers) {\n      const token = /^Bearer\\s+(\\S+)$/i.exec(getHeader(headers, \"Authorization\") ?? \"\")?.[1];\n      const extensionID = getHeader(headers, \"Andesine-Extension\");\n      const instance = getHeader(headers, \"Andesine-Instance\");\n\n      if (!token || !extensionID || !instance) throw new ExtensionSessionError(\"MISSING_SESSION\");\n\n      const audience = getTrustedInstance(instance);\n\n      if (!audience) throw new ExtensionSessionError(\"UNTRUSTED_INSTANCE\");\n\n      const client = createBackendClient(audience, extensionID);\n\n      try {\n        const session = await client.extensions.verifySession({ token });\n\n        return { ...session, extensionID, instance: audience, client };\n      } catch (error) {\n        if (isRejection(error)) throw new ExtensionSessionError(\"INVALID_SESSION\");\n\n        throw error;\n      }\n    },\n    async receive(body) {\n      const notification = typeof body === \"string\" ? parseJSON(body) : body;\n      const isObject = typeof notification === \"object\" && notification !== null;\n      const deliveryID = isObject ? getString(notification, \"deliveryID\") : null;\n      const extensionID = isObject ? getString(notification, \"extensionID\") : null;\n      const instance = isObject ? getString(notification, \"instance\") : null;\n\n      if (!deliveryID || !extensionID || !instance) {\n        throw new ExtensionNotificationError(\"INVALID_NOTIFICATION\");\n      }\n\n      const audience = getTrustedInstance(instance);\n\n      if (!audience) throw new ExtensionNotificationError(\"UNTRUSTED_INSTANCE\");\n\n      const client = createBackendClient(audience, extensionID);\n\n      try {\n        const delivery = await client.extensions.getSelfDelivery({ deliveryID });\n\n        return { ...delivery, extensionID, instance: audience, client };\n      } catch (error) {\n        if (isRejection(error)) throw new ExtensionNotificationError(\"UNKNOWN_DELIVERY\");\n\n        throw error;\n      }\n    }\n  };\n};\n\nexport { createExtensionBackend, ExtensionNotificationError, ExtensionSessionError };\nexport type {\n  ExtensionBackend,\n  ExtensionBackendOptions,\n  ExtensionDeliveryContext,\n  ExtensionNotificationErrorCode,\n  ExtensionPrivateKey,\n  ExtensionSessionContext,\n  ExtensionSessionErrorCode\n};\n"],"mappings":";;;AAkBA,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,aAAa;CACjB,WAAW;EACT,KAAK;EACL,cAAc,EAAE,MAAM,UAAU;EAChC,YAAY,EAAE,MAAM,UAAU;CAChC;CACA,SAAS;EACP,KAAK;EACL,cAAc;GAAE,MAAM;GAAS,YAAY;EAAQ;EACnD,YAAY;GAAE,MAAM;GAAS,MAAM;EAAU;CAC/C;AACF;AAEA,MAAM,mBAAmB,UAA8B;CACrD,OAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,CAAC,CACvC,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EAAE;AACtB;AACA,MAAM,cAAc,UAA0B;CAC5C,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC;AACxE;AAEA,MAAM,mBAAmB,UAA6D;CACpF,IAAI,OAAO,UAAU,UAAU,OAAO;CAEtC,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN,MAAM,IAAI,UAAU,mCAAmC;CACzD;AACF;;;;;;AAMA,MAAM,yBACJ,MACA,eACoB;CACpB,MAAM,MAAM,gBAAgB,UAAU;CACtC,MAAM,YAAY,WAAW,IAAI;CACjC,MAAM,wBAAQ,IAAI,IAAyB;CAE3C,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,KAC/B,MAAM,IAAI,UAAU,8DAA8D;CAGpF,IAAI,MAAiC;CAGrC,MAAM,eAAmC;EACvC,QAAQ,OAAO,OAAO,UACpB,OACA;GAAE,KAAK,IAAI;GAAK,KAAK,IAAI;GAAK,GAAG,IAAI;GAAG,GAAG,IAAI;GAAG,GAAG,IAAI;EAAE,GAC3D,UAAU,cACV,OACA,CAAC,MAAM,CACT;EAEA,OAAO;CACT;CAEA,OAAO,EACL,MAAM,KAAK,EAAE,UAAU,WAAW;EAChC,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW;EAC3C,MAAM,SAAS,MAAM,IAAI,QAAQ;EAEjC,IAAI,UAAU,OAAO,YAAY,iBAAiB,KAAK,OAAO,OAAO;EAErE,MAAM,SAAS,WAAW;GAAE,KAAK,UAAU;GAAK,KAAK,IAAI;GAAK,KAAK;EAAM,CAAC;EAC1E,MAAM,UAAU,WAAW;GACzB,KAAK;GACL,GAAI,WAAW,EAAE,KAAK,QAAQ;GAC9B,KAAK;GACL,KAAK;GACL,KAAK,MAAM;EACb,CAAC;EACD,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,UAAU,YACV,MAAM,OAAO,GACb,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,SAAS,CACjD;EACA,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,gBAAgB,IAAI,WAAW,SAAS,CAAC;EAE/E,IAAI,MAAM,QAAQ,mBAAmB,MAAM,MAAM;EAEjD,MAAM,IAAI,UAAU;GAAE;GAAO,WAAW,MAAM;EAAe,CAAC;EAE9D,OAAO;CACT,EACF;AACF;;;ACnDA,IAAM,wBAAN,cAAoC,MAAM;CACnB;CAArB,YAAY,MAA0C;EACpD,MAAM,0CAA0C,MAAM;EADnC,KAAA,OAAA;CAErB;AACF;AAEA,IAAM,6BAAN,cAAyC,MAAM;CACxB;CAArB,YAAY,MAA+C;EACzD,MAAM,kCAAkC,MAAM;EAD3B,KAAA,OAAA;CAErB;AACF;AAEA,MAAM,eAAe,UAA4B;CAC/C,OAAO,iBAAiB,oBAAoB;EAAC;EAAK;EAAK;CAAG,CAAC,CAAC,SAAS,MAAM,MAAM;AACnF;AACA,MAAM,aAAa,SAA0B;CAC3C,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ;EACN,OAAO;CACT;AACF;AACA,MAAM,aAAa,OAAe,QAA+B;CAC/D,MAAM,QAAS,MAAkC;CAEjD,OAAO,OAAO,UAAU,YAAY,QAAQ,QAAQ;AACtD;AACA,MAAM,qBAAqB,aAAoC;CAC7D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,QAAQ;EAG5B,OAFe,IAAI,aAAa,YAAY,IAAI,aAAa,UAE7C,GAAG,IAAI,SAAS,IAAI,WAAW,QAAQ,QAAQ,EAAE,IAAI;CACvE,QAAQ;EACN,OAAO;CACT;AACF;AACA,MAAM,aAAa,SAAuB,SAAgC;CACxE,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI;CAEvD,MAAM,QAAQ,QAAQ,KAAK,YAAY;CAEvC,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,UAAU;AACtD;;;;;;;;;;;;AAYA,MAAM,0BAA0B,YAAuD;CACrF,MAAM,SAAS,sBAAsB,QAAQ,MAAM,QAAQ,UAAU;CACrE,MAAM,UAAU,IAAI,IAAI,QAAQ,iBAAiB,IAAI,iBAAiB,CAAC;CACvE,MAAM,UAAU,QAAQ,QAAQ,SAAS,WAAW;CACpD,MAAM,sBAAsB,aAAoC;EAC9D,MAAM,aAAa,kBAAkB,QAAQ;EAE7C,OAAO,cAAc,QAAQ,IAAI,UAAU,IAAI,aAAa;CAC9D;CACA,MAAM,uBAAuB,UAAkB,gBAAyC;EACtF,MAAM,WAAW,mBAAmB,QAAQ;EAE5C,IAAI,CAAC,UAAU,MAAM,IAAI,UAAU,6BAA6B;EAEhE,OAAO,aAAa;GAClB,GAAG,QAAQ;GACX,SAAS;GACT,QAAQ;GACR,OAAO,OAAO,OAAO,SAAS;IAC5B,MAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;IACvC,MAAM,QAAQ,MAAM,OAAO,KAAK;KAAE;KAAU,SAAS,eAAe;IAAK,CAAC;IAE1E,QAAQ,QAAQ,IAAI,iBAAiB,UAAU,OAAO;IAEtD,OAAO,QAAQ,OAAO;GACxB;EACF,CAAC;CACH;CAEA,OAAO;EACL,cAAc;EACd,MAAM,cAAc,SAAS;GAC3B,MAAM,QAAQ,oBAAoB,KAAK,UAAU,SAAS,eAAe,KAAK,EAAE,CAAC,GAAG;GACpF,MAAM,cAAc,UAAU,SAAS,oBAAoB;GAC3D,MAAM,WAAW,UAAU,SAAS,mBAAmB;GAEvD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,UAAU,MAAM,IAAI,sBAAsB,iBAAiB;GAE1F,MAAM,WAAW,mBAAmB,QAAQ;GAE5C,IAAI,CAAC,UAAU,MAAM,IAAI,sBAAsB,oBAAoB;GAEnE,MAAM,SAAS,oBAAoB,UAAU,WAAW;GAExD,IAAI;IAGF,OAAO;KAAE,GAAG,MAFU,OAAO,WAAW,cAAc,EAAE,MAAM,CAAC;KAE1C;KAAa,UAAU;KAAU;IAAO;GAC/D,SAAS,OAAO;IACd,IAAI,YAAY,KAAK,GAAG,MAAM,IAAI,sBAAsB,iBAAiB;IAEzE,MAAM;GACR;EACF;EACA,MAAM,QAAQ,MAAM;GAClB,MAAM,eAAe,OAAO,SAAS,WAAW,UAAU,IAAI,IAAI;GAClE,MAAM,WAAW,OAAO,iBAAiB,YAAY,iBAAiB;GACtE,MAAM,aAAa,WAAW,UAAU,cAAc,YAAY,IAAI;GACtE,MAAM,cAAc,WAAW,UAAU,cAAc,aAAa,IAAI;GACxE,MAAM,WAAW,WAAW,UAAU,cAAc,UAAU,IAAI;GAElE,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,UAClC,MAAM,IAAI,2BAA2B,sBAAsB;GAG7D,MAAM,WAAW,mBAAmB,QAAQ;GAE5C,IAAI,CAAC,UAAU,MAAM,IAAI,2BAA2B,oBAAoB;GAExE,MAAM,SAAS,oBAAoB,UAAU,WAAW;GAExD,IAAI;IAGF,OAAO;KAAE,GAAG,MAFW,OAAO,WAAW,gBAAgB,EAAE,WAAW,CAAC;KAEjD;KAAa,UAAU;KAAU;IAAO;GAChE,SAAS,OAAO;IACd,IAAI,YAAY,KAAK,GAAG,MAAM,IAAI,2BAA2B,kBAAkB;IAE/E,MAAM;GACR;EACF;CACF;AACF"}