@antasphere/chassis-server 1.0.0

package/dist/env.d.ts

@@ -0,0 +1,293 @@
+import { z } from 'zod';
+/**
+ * The single entry point for configuration. Every env var the app reads is
+ * declared here; the docs env reference is generated from this schema.
+ * Parsing failures print a readable table and exit — the app never boots on a
+ * half-valid environment.
+ */
+/**
+ * Empty OR whitespace-only (e.g. `VAR=` or `VAR=" "` in compose) means unset.
+ * The trim matters: `Number(' ')` is 0, so an untrimmed blank would silently
+ * flip a `min(0)` numeric knob (like the API rate limit) to its 0/disabled
+ * meaning instead of the default — a security control off by a stray space.
+ */
+export declare const blankToUndefined: (v: unknown) => unknown;
+export declare const booleanish: z.ZodPreprocess<z.ZodPipe<z.ZodEnum<{
+    0: "0";
+    1: "1";
+    true: "true";
+    false: "false";
+}>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>;
+/** Optional string where an empty value (e.g. `VAR=` in compose) means unset. */
+export declare const optionalString: (inner: z.ZodString) => z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+/**
+ * Numeric knob where blank/whitespace means "use the default". EVERY numeric
+ * var goes through this: `Number('')` is 0, so an unwrapped `min(0)` knob
+ * (retention, quotas, sweeps) silently resolves to its 0/disabled meaning when
+ * compose passes `VAR=${VAR:-}`. `min(1)` knobs would merely fail the boot,
+ * but they ride the same preprocessor so a later `min(0)` cannot be added
+ * without it.
+ */
+export declare const numeric: <T extends z.ZodType>(inner: T) => z.ZodPreprocess<T>;
+/**
+ * URL where only http(s) is acceptable. `z.url()` alone delegates to the WHATWG
+ * parser, which happily accepts `javascript:alert(1)` and `data:…` (verified
+ * against the pinned zod 4.4.3) — and PUBLIC_BASE_URL becomes the OIDC issuer,
+ * the Better Auth baseURL, and the base of every link we mint, so a non-http
+ * scheme there is a stored-XSS/redirect primitive rather than a typo.
+ */
+export declare const httpUrl: () => z.ZodURL;
+/**
+ * Cheap, deterministic quality floor for operator-supplied secrets. `min(32)`
+ * on its own accepts `'x'.repeat(32)` and `'changeme'.repeat(4)` — 32 bytes of
+ * length with a handful of bits of entropy, which for AUTH_SECRET is forgeable
+ * session/JWKS material. Three independent smells, all cheap:
+ *
+ *  - Shannon entropy of the observed character distribution, in bits over the
+ *    whole string (a 32-char hex secret scores ~123 bits; `'x'.repeat(32)`
+ *    scores 0).
+ *  - distinct characters (a keyboard-mashed word list scores badly here even
+ *    when its entropy estimate looks acceptable).
+ *  - a short repeated pattern (`abcdefgh` × 4 passes both checks above).
+ *
+ * This is a floor, NOT a strength meter: it rejects the obviously-typed, it
+ * cannot bless the merely-random-looking. `openssl rand -hex 32` always passes.
+ */
+export declare function shannonEntropyBits(value: string): number;
+/** Human-readable reason a secret is too predictable, or null when acceptable. */
+export declare function weakSecretReason(value: string): string | null;
+/**
+ * The generic keys, in the order the env reference lists them. `version` is
+ * the TOOL's own package version: the chassis never reads a package.json, so
+ * the APP_VERSION default is handed in by the tool that boots it.
+ */
+declare const chassisEnvShape: (version: string) => {
+    /** Postgres connection string. The only required variable. */
+    DATABASE_URL: z.ZodString;
+    /** Port the single HTTP listener binds. */
+    PORT: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    /** Bind address. */
+    HOST: z.ZodDefault<z.ZodString>;
+    /** Public origin of this instance (scheme matters: https => Secure cookies). */
+    PUBLIC_BASE_URL: z.ZodDefault<z.ZodURL>;
+    /** Writable data directory (auto-generated secret, local file storage). */
+    DATA_DIR: z.ZodDefault<z.ZodString>;
+    /** Apply pending migrations at boot. When false the app only checks and refuses readiness while behind. */
+    AUTO_MIGRATE: z.ZodDefault<z.ZodPreprocess<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    /** all = API + workers in one process; api = HTTP only; worker = jobs only. */
+    SERVICE_ROLE: z.ZodDefault<z.ZodEnum<{
+        all: "all";
+        api: "api";
+        worker: "worker";
+    }>>;
+    /** Session/JWKS encryption secret. Auto-generated into DATA_DIR/secret when unset or empty. */
+    AUTH_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Versioned API-key peppers for secret rotation: `<version>:<secret>` entries joined by `;` (e.g. `1:<historical AUTH_SECRET>;2:<new pepper>`, secrets >=32 chars). Version 1 defaults to AUTH_SECRET and, when pinned here, MUST keep the historical AUTH_SECRET-derived value or every existing key stops resolving; new keys mint under the highest version. Rotation runbook: internal/security-runbooks.md. */
+    API_KEY_PEPPERS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** The credential POST /api/v1/setup requires (constant-time compared). setup.sh generates one into .env. Unset, the server generates a token into `$DATA_DIR/setup-token` at first boot and prints it to the container log — the first-boot claim is never free (PRDCT-1347). */
+    SETUP_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Allow POST /api/v1/setup over plaintext HTTP on a non-loopback PUBLIC_BASE_URL. Default false: the wizard 403s, because the owner password and the setup token would cross the network in the clear on the one request that decides who owns the instance. Reach a TLS-less server through an SSH tunnel (`ssh -L`) instead; set this true only on a trusted private network. */
+    ALLOW_INSECURE_SETUP: z.ZodDefault<z.ZodPreprocess<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    /** Break-glass operator allowlist: comma-separated emails. A caller is superadmin ONLY on a SESSION whose VERIFIED email is listed here — machine credentials (API keys, OAuth tokens) never qualify, they 403 fail-closed. Unset (default) = the break-glass endpoints are dormant and 403 for everyone. Runbook: internal/security-runbooks.md. */
+    SUPERADMIN_EMAILS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Demo sign-in (self-hosted edition only): an owner can mint a demo link that signs a chosen member in without a password, for a demonstration. Default false: no demo route exists and every demo path answers like any unknown path. The boot refuses the switch unless the host of PUBLIC_BASE_URL is loopback or listed in DEMO_SIGN_IN_HOSTS. A link only ever opens an address on a domain reserved for examples and tests (example.com/.net/.org, `.test`, `.example`, `.invalid`, `.localhost`) or listed in DEMO_SIGN_IN_EMAIL_DOMAINS, never an owner but the one minting, never an account with a second factor. On EDITION=cloud it has no effect (the hub owns identity). */
+    DEMO_SIGN_IN: z.ZodDefault<z.ZodPreprocess<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    /** The public hosts DEMO_SIGN_IN may be on, beside loopback: comma-separated bare hostnames, matched exactly against the host of PUBLIC_BASE_URL (e.g. `demo.example.io`). An entry with a scheme, a path, a port, a space, a wildcard or an empty label refuses the boot. Unset = loopback only. */
+    DEMO_SIGN_IN_HOSTS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Domains a demo link may open beside the reserved example and test ones: comma-separated, each one matching itself and its subdomains (e.g. `demo.acme.io`). Name only domains whose every mailbox is a demonstration account. Same entry rules as DEMO_SIGN_IN_HOSTS. Unset = the reserved domains only. */
+    DEMO_SIGN_IN_EMAIL_DOMAINS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Optional Google social login. */
+    GOOGLE_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    GOOGLE_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Edition selector (internal/federation.md): `oss` (default, self-host — zero hub surface at runtime) or `cloud` (federates human login + entitlements to the Antasphere hub; requires the HUB_* block). Any other value refuses to boot — the selector decides the identity binding, so a typo must fail loudly, never silently bind `oss`. Also surfaced in discovery + usage events. */
+    EDITION: z.ZodPreprocess<z.ZodDefault<z.ZodEnum<{
+        oss: "oss";
+        cloud: "cloud";
+    }>>>;
+    /** Hub OIDC issuer, e.g. https://account.antasphere.com — discovery, JWKS, and the authorize/token endpoints all derive from it. Required when EDITION=cloud; never read when EDITION=oss. */
+    HUB_ISSUER_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    /** OAuth client id from this tool's entry in the hub TOOL_REGISTRY (e.g. tool-acme-cloud). Required when EDITION=cloud. */
+    HUB_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** OAuth client secret matching the hub registry entry (confidential client; PKCE stays on regardless). Also authenticates the per-user refresh grant — there is NO service key: every hub read between logins presents the USER's own grant (internal/federation.md). Required when EDITION=cloud. */
+    HUB_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Name of the hub-set shared SSO hint cookie the dashboard reads client-side (internal/federation.md; NEVER a security input — it only gates whether a silent connect is attempted). Cloud-only; unset = the cross-repo default `ant_sso_hint`. Never read when EDITION=oss. */
+    HUB_HINT_COOKIE_NAME: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Domain the hint cookie lives on (the hub sets it, tools clear it — both sides must agree). Cloud-only; unset = the hub issuer host minus its first label (account.antasphere.com → antasphere.com). Never read when EDITION=oss. */
+    HUB_HINT_COOKIE_DOMAIN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** The restricted bit on the tool itself (PRDCT-2947): `true` on the cloud edition makes this instance refuse to create an organization (`POST /workspaces` answers 403 `restricted_tool`, `/me.canCreateWorkspace` is false) and advertise `restricted: true` in discovery, so a tool that Antasphere opens to organizations one by one does not rest on the hub registry's flag alone. No effect on the self-hosted edition, where workspaces are local. */
+    TOOL_RESTRICTED: z.ZodDefault<z.ZodPreprocess<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    /** R7 escape hatch (internal/federation.md): acknowledge an EDITION change on an already-set-up instance. Without it, boot refuses an EDITION that differs from the one stamped at setup — flipping editions under existing users/workspaces changes identity semantics and must be a conscious operator act. */
+    EDITION_CHANGE_ALLOWED: z.ZodDefault<z.ZodPreprocess<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    /** Reported version. Defaults to the code's own baked-in package version (PRDCT-1844) — the image knows its version intrinsically, CI injects nothing. The env var remains as a deliberate operator override only. */
+    APP_VERSION: z.ZodDefault<z.ZodString>;
+    /** RFC 7591 dynamic client registration on the built-in authorization server: unauthenticated `POST /api/v1/auth/oauth2/register`, which is how MCP clients self-register. Default true (the connector-friendly posture, rate-limited in api/index.ts). Set false on an instance whose OAuth clients are provisioned by hand — the endpoint then refuses every caller instead of minting client records for anyone who asks. */
+    OAUTH_DYNAMIC_CLIENT_REGISTRATION: z.ZodDefault<z.ZodPreprocess<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    /** `Strict-Transport-Security` max-age in seconds, sent on every response when PUBLIC_BASE_URL is https (browsers ignore HSTS over plain http per RFC 6797 §7.2, so an http instance is unaffected). Default 180 days; 0 disables the header — the escape hatch for an operator who is not yet certain every subdomain can serve TLS. */
+    HSTS_MAX_AGE: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    /** Instance-level cap read by the default AllowAllEntitlements. */
+    MAX_FILE_SIZE_MB: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    /** How many workspaces ONE person may own on this instance — the cap on creating another workspace from the dashboard (the first one comes from setup). Any signed-in member who is not a guest may create one until they own this many. 0 closes workspace creation for everyone. On the cloud edition the count is Antasphere's own organization limit; only the 0 switch applies here. */
+    MAX_WORKSPACES_PER_USER: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    /** General per-principal API quota: sustained requests/minute allowed to every authenticated /api/v1 principal (API key, OAuth token, session). 0 disables the general limiter. */
+    API_RATE_LIMIT_PER_MINUTE: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    /** Spike cap for the general API quota: max requests per principal in any 1-second burst. 0 disables burst smoothing (the per-minute window still applies). */
+    API_RATE_LIMIT_BURST: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    /** Cloud: CLI connects (`POST /sso/cli-connect`, what `<tool> login` and every first command after `antasphere login` call) one client address may make per 15 minutes. A venue's Wi-Fi is one address behind the proxy (TRUST_PROXY), so the default is sized for a room; each connect presents a one-time exchange token the hub minted for one person, which is what bounds a single account. Never disabled (minimum 1). */
+    CLI_CONNECT_IP_LIMIT_PER_15_MIN: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    /** Email delivery. `none` (default) never blocks a flow: links stay copyable. */
+    EMAIL_DRIVER: z.ZodPreprocess<z.ZodDefault<z.ZodEnum<{
+        none: "none";
+        smtp: "smtp";
+        resend: "resend";
+        brevo: "brevo";
+    }>>>;
+    /** smtp(s)://user:pass@host:port — required when EMAIL_DRIVER=smtp. */
+    SMTP_URL: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Required when EMAIL_DRIVER=resend. */
+    RESEND_API_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Required when EMAIL_DRIVER=brevo. */
+    BREVO_API_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Sender, e.g. `Acme <noreply@acme.example>`. Required when a driver delivers. */
+    EMAIL_FROM: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** When set, rate limits (and later caches) are shared across replicas. */
+    REDIS_URL: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** File storage: local (default; DATA_DIR volume, single replica) or s3 (MinIO/AWS/R2). */
+    STORAGE_DRIVER: z.ZodPreprocess<z.ZodDefault<z.ZodEnum<{
+        local: "local";
+        s3: "s3";
+    }>>>;
+    S3_BUCKET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    S3_REGION: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Endpoint override for MinIO/R2; leave unset for AWS. */
+    S3_ENDPOINT: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    S3_ACCESS_KEY_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    S3_SECRET_ACCESS_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Path-style addressing — required by MinIO and most S3-compatibles. */
+    S3_FORCE_PATH_STYLE: z.ZodDefault<z.ZodPreprocess<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    /**
+     * Trust x-forwarded-for for client IPs (rate limits, audit). The app reads
+     * the RIGHTMOST hop — the one your proxy appended or set (Caddy ≥2.5
+     * discards client-supplied X-Forwarded-* by default). Enable ONLY behind a
+     * reverse proxy you control; when false the socket address is used and
+     * spoofed headers are ignored.
+     */
+    TRUST_PROXY: z.ZodDefault<z.ZodPreprocess<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    /** OTLP/HTTP endpoint for trace export. Unset (default) = no export, zero phone-home. */
+    OTEL_EXPORTER_OTLP_ENDPOINT: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    /** GET /metrics requires `Authorization: Bearer <token>`; unset = /metrics disabled (401). */
+    METRICS_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    /** Days of audit_log to keep (nightly purge at 03:00). 0 = keep forever. */
+    AUDIT_RETENTION_DAYS: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    /** Grace period for orphaned users (accounts with ZERO workspace memberships, e.g. setup-race losers): the nightly 03:00 sweep deletes them once older than this many hours. A user with ANY membership row — even deactivated — is never touched. 0 = sweep disabled. */
+    ORPHAN_USER_RETENTION_HOURS: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    /** pino level. */
+    LOG_LEVEL: z.ZodDefault<z.ZodEnum<{
+        error: "error";
+        fatal: "fatal";
+        warn: "warn";
+        info: "info";
+        debug: "debug";
+        trace: "trace";
+    }>>;
+    NODE_ENV: z.ZodDefault<z.ZodEnum<{
+        test: "test";
+        development: "development";
+        production: "production";
+    }>>;
+};
+export type ChassisEnvShape = ReturnType<typeof chassisEnvShape>;
+export type ChassisEnvKey = keyof ChassisEnvShape;
+/**
+ * What a tool adds to the environment: its own keys, where each one sits in
+ * the merged schema, and its own cross-key checks. The env reference is
+ * generated from the merged shape, so placement is part of the contract.
+ */
+export interface EnvExtension<TShape extends z.ZodRawShape> {
+    shape: TShape;
+    /**
+     * The chassis key each tool key FOLLOWS. Tool keys naming the same chassis
+     * key keep the order they have in `shape`; a tool key naming none sits after
+     * the last chassis key, in `shape` order.
+     */
+    after?: Partial<Record<keyof TShape, ChassisEnvKey>>;
+    /** Cross-key checks of the tool's own keys. Runs BEFORE the chassis checks. */
+    refine?: (env: ToolEnv<TShape>, ctx: z.RefinementCtx) => void;
+}
+export interface EnvOptions<TShape extends z.ZodRawShape> {
+    /** The tool's package version: the default of APP_VERSION. */
+    version: string;
+    extension?: EnvExtension<TShape>;
+}
+export declare function buildEnvSchema<TShape extends z.ZodRawShape = {}>(options: EnvOptions<TShape>): z.ZodObject<ChassisEnvShape & TShape>;
+/** The parsed generic environment. A tool's env (`ChassisEnv & its own keys`) is assignable to it. */
+export type ChassisEnv = z.infer<z.ZodObject<ChassisEnvShape>>;
+/** A tool's parsed environment: the generic keys plus its own. */
+export type ToolEnv<TShape extends z.ZodRawShape> = ChassisEnv & z.infer<z.ZodObject<TShape>>;
+/** The name the chassis modules use for the environment they take. */
+export type Env = ChassisEnv;
+/**
+ * The hub half of the edition split (internal/federation.md), extracted once at
+ * boot. Returns null on EDITION=oss — the single switch every cloud seam
+ * hangs off, so the self-host edition provably reads no hub config. The
+ * tool's own OAuth resource URL is DERIVED (`<PUBLIC_BASE_URL>/mcp`, see
+ * mcpResourceUrl), never configured.
+ */
+export interface HubConfig {
+    issuerUrl: string;
+    clientId: string;
+    clientSecret: string;
+    /**
+     * The shared SSO hint cookie's name + domain (internal/federation.md,
+     * cross-repo contract with the hub): the HUB sets the cookie on any
+     * response that mints a session; this tool only READS it client-side (a
+     * silent-connect hint, never a security input) and CLEARS it on logout /
+     * login_required. Surfaced in `/instance` discovery so the dashboard
+     * needs no env of its own.
+     */
+    hintCookieName: string;
+    hintCookieDomain: string;
+}
+export declare function hubConfig(env: Env): HubConfig | null;
+export declare function parseEnv<TShape extends z.ZodRawShape = {}>(source: NodeJS.ProcessEnv, options: EnvOptions<TShape>): ToolEnv<TShape>;
+export {};
+//# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;GAKG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,GAAG,OAAO,YAA+D,CAAC;AAE3G,eAAO,MAAM,UAAU;;;;;2DAGtB,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,cAAc,GAAI,OAAO,CAAC,CAAC,SAAS,gDAAqD,CAAC;AAEvG;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,uBAA0C,CAAC;AAEhG;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,gBAAwC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAcD,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW7D;AAYD;;;;GAIG;AACH,QAAA,MAAM,eAAe,GAAI,SAAS,MAAM;IACtC,8DAA8D;;IAE9D,2CAA2C;;IAE3C,oBAAoB;;IAEpB,gFAAgF;;IAEhF,2EAA2E;;IAM3E,2GAA2G;;;;;;;IAE3G,+EAA+E;;;;;;IAE/E,+FAA+F;;IAE/F,qZAAqZ;;IAUrZ,kRAAkR;;IAElR,oXAAoX;;;;;;;IAEpX,qVAAqV;;IAUrV,2pBAA2pB;;;;;;;IAE3pB,qSAAqS;;IAUrS,+SAA+S;;IAU/S,oCAAoC;;;IAGpC,4XAA4X;;;;;IAE5X,8LAA8L;;IAE9L,2HAA2H;;IAE3H,uSAAuS;;IAEvS,iRAAiR;;IAEjR,uOAAuO;;IAEvO,8bAA8b;;;;;;;IAE9b,iTAAiT;;;;;;;IAEjT,sNAAsN;;IAEtN,gaAAga;;;;;;;IAEha,yUAAyU;;IAEzU,mEAAmE;;IAEnE,6XAA6X;;IAE7X,mLAAmL;;IAEnL,+JAA+J;;IAE/J,gaAAga;;IAEha,iFAAiF;;;;;;;IAEjF,uEAAuE;;IAEvE,yCAAyC;;IAEzC,wCAAwC;;IAExC,mFAAmF;;IAEnF,2EAA2E;;IAE3E,2FAA2F;;;;;;;IAI3F,2DAA2D;;;;IAI3D,yEAAyE;;;;;;;IAEzE;;;;;;OAMG;;;;;;;IAEH,yFAAyF;;IAEzF,8FAA8F;;IAE9F,4EAA4E;;IAE5E,0QAA0Q;;IAE1Q,kBAAkB;;;;;;;;;;;;;;CAGlB,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC;AA0ClD;;;;GAIG;AACH,MAAM,WAAW,YAAY,CAAC,MAAM,SAAS,CAAC,CAAC,WAAW;IACxD,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IACrD,+EAA+E;IAC/E,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,UAAU,CAAC,MAAM,SAAS,CAAC,CAAC,WAAW;IACtD,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;CAClC;AAGD,wBAAgB,cAAc,CAAC,MAAM,SAAS,CAAC,CAAC,WAAW,GAAG,EAAE,EAC9D,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAC1B,CAAC,CAAC,SAAS,CAAC,eAAe,GAAG,MAAM,CAAC,CAwCvC;AAED,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;AAC/D,kEAAkE;AAClE,MAAM,MAAM,OAAO,CAAC,MAAM,SAAS,CAAC,CAAC,WAAW,IAAI,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9F,sEAAsE;AACtE,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAgBD,wBAAgB,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,GAAG,IAAI,CAUpD;AAGD,wBAAgB,QAAQ,CAAC,MAAM,SAAS,CAAC,CAAC,WAAW,GAAG,EAAE,EACxD,MAAM,EAAE,MAAM,CAAC,UAAU,EACzB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAC1B,OAAO,CAAC,MAAM,CAAC,CAuBjB"}