@antasphere/chassis-server 1.0.0

package/dist/testing/fake-hub.d.ts

@@ -0,0 +1,425 @@
+/**
+ * A minimal in-process Antasphere-hub stand-in for tests, faithful to the
+ * USER-SCOPED federation contract (internal/federation.md; verified against the
+ * hub's Stage A `api/orgs.ts` + the pinned oauth-provider plugin):
+ *
+ *  - OIDC discovery + JWKS + token endpoint. The token endpoint honors
+ *    `grant_type=authorization_code` (one-shot codes via `mintCode`) AND
+ *    `grant_type=refresh_token` with ROTATION + RFC 9700 REUSE DETECTION:
+ *    every refresh rotates the token; presenting a rotated-out token
+ *    answers 400 `invalid_grant` and tears down the whole (sub, client)
+ *    family — the single most important fixture of the grant suite.
+ *  - RFC 8707 `resource` controls JWT minting on BOTH grants: with it the
+ *    access token is an RS256 JWT audienced `[<resource>, <userinfo>]`;
+ *    without it the token is OPAQUE (and dies at the fake's /api/v1 exactly
+ *    like at the real hub's).
+ *  - `GET /api/v1/orgs` is CALLER-SCOPED: the presented bearer must be a
+ *    live JWT this fake minted whose `aud` includes the HUB's own resource
+ *    (`<issuer>/mcp`) — pinning the tokenResource seam: a tool-audienced
+ *    token is refused 401. The answer is the token's SUBJECT's org list
+ *    (`setUserOrg`/`removeUserOrg`; a `mintCode` fixture seeds its own org).
+ *    There is NO target-user parameter anywhere.
+ *  - `POST /api/v1/auth/oauth2/introspect` (RFC 7662, client-credentialed)
+ *    answers `active` for a refresh token exactly like the pinned plugin:
+ *    unknown / rotated-out / torn-down → `active:false`, and — the property
+ *    the grant service's probe relies on — introspection is READ-ONLY: it
+ *    never rotates and never tears a family down.
+ *  - `GET /api/v1/teams` (PRDCT-2813): the org's whole team list for any
+ *    member of the org `X-Workspace-Id` names (`setOrgTeams`, else the
+ *    union of the members' own teams), paged; `teamsMode` adds `http404`
+ *    (an older hub without the route), `teamsRequests` logs each read.
+ *  - failure injection per surface: `orgsMode`/`tokenMode` ∈ ok | http500 |
+ *    network (+ token-only: invalid_grant | invalid_client | hang |
+ *    commit_then_hang — the latter ROTATES, then never answers: the
+ *    slow-but-alive hub of PRDCT-1370), `introspectMode`, plus delays.
+ *  - The billing rail's machine surface (`/api/v1/usage/*`, a
+ *    client_credentials token with `usage:write` only): the event ingest
+ *    (per-element judgement, dedupe by id), the plan read (`upgradeUrl`
+ *    included since phase 2) and, since phase 2 (PRDCT-2663/2664), the
+ *    credit check `POST /usage/check` over a price book (`setPrice`) and
+ *    per-organization balances (`setBalance`, `grant`, `balanceOf`, a
+ *    known organization holding the 5,000-credit sign-up grant like the
+ *    real hub). Ingest DEBITS: an accepted event is priced by the same rule
+ *    as the check, its `credits` returned on its result, the balance moved
+ *    and a `debit` appended to `ledger` with the event id as its source.
+ *    The check answers the hub's three reasons in the hub's order
+ *    (`account_suspended`, then `unpriceable` for a price past
+ *    `Number.MAX_SAFE_INTEGER`, `credits` clamped to it, then
+ *    `insufficient_credits`), and every answer of the three usage routes
+ *    goes through the chassis's own schema before it is sent (PRDCT-2677):
+ *    a fake answer the chassis could not parse throws in the test that
+ *    produced it.
+ *
+ * Access tokens still carry the TRANSITIONAL advisory org claims the real
+ * hub emits through the compat window ({role, workspace_id, …}) — the tool
+ * must ignore them, and the suites prove nothing reads them.
+ */
+export interface HubTokenOverrides {
+    /** Replace the access token's aud entirely (wrong-resource tests). */
+    accessAud?: string | string[] | undefined;
+    /** Replace iss on both tokens (wrong-issuer tests). */
+    iss?: string | undefined;
+    /** Seconds from now for exp; negative = already expired. */
+    expiresInSeconds?: number | undefined;
+    /** Return a non-JWT access token even when `resource` was sent. */
+    forceOpaque?: boolean | undefined;
+    /** Give the id_token a different sub (cross-pin tests). */
+    idTokenSub?: string | undefined;
+    /**
+     * Put a `sid` claim on the id_token — what the real hub mints once its
+     * tool client carries `enableEndSession` (RP-initiated logout). Absent by
+     * default: the pre-flip token shape, which the tool's logout must degrade
+     * on (sid-less hints hard-fail at the end-session endpoint).
+     */
+    idTokenSid?: string | undefined;
+    /**
+     * The scope string this user's grant carries, whatever the sign-in
+     * requested — e.g. `LEGACY_GRANT_SCOPE` for a person who signed in before
+     * the tool asked for `orgs:create`.
+     */
+    scope?: string | undefined;
+}
+/** What the tool requested before PRDCT-2443 — and what the hub's H3 connect grant carries. */
+export declare const LEGACY_GRANT_SCOPE = "openid profile email offline_access account:read";
+/** The hub's DEDICATED scope for POST /api/v1/orgs. `account:write` does NOT open it. */
+export declare const ORG_CREATE_SCOPE = "orgs:create";
+export interface HubUserFixture {
+    sub: string;
+    email: string;
+    emailVerified?: boolean | undefined;
+    name?: string | undefined;
+    /** The user's (first) hub org — seeded into the org registry at mintCode. */
+    workspaceId: string;
+    role: string;
+    /** Org display name; set null to simulate a hub without names. */
+    workspaceName?: string | null | undefined;
+    overrides?: HubTokenOverrides | undefined;
+}
+/** One entry of a user's org registry (what GET /orgs serves). */
+export interface HubOrgEntry {
+    name: string | null;
+    role: string;
+    status?: 'active' | 'suspended' | undefined;
+    isDefault?: boolean | undefined;
+    /** The caller's own teams in this org (served as the entry's `teams`; none when absent). */
+    teams?: Array<{
+        id: string;
+        slug: string;
+        name: string;
+    }> | undefined;
+}
+/** One row of the fake's price book (the hub's `tool_prices`, reduced to what the price rule reads). */
+export interface FakePriceRow {
+    creditsPerUnit: number;
+    unit: string;
+    /** How many units one `creditsPerUnit` buys; 1 when absent. */
+    per?: number | undefined;
+    /** The quantity each account uses free every month before the price applies; 0 when absent. */
+    freeQuantityPerMonth?: number | undefined;
+}
+export declare class FakeHub {
+    private readonly server;
+    readonly issuer: string;
+    private keys;
+    private readonly configuredClientId;
+    private readonly configuredClientSecret;
+    private readonly configuredToolSlug;
+    readonly codes: Map<string, HubUserFixture>;
+    /** code → the scope string the grant will carry (see mintCode). */
+    private readonly codeScopes;
+    /** Body of the most recent token request — pins the `resource` passthrough. */
+    lastTokenRequest: URLSearchParams | null;
+    /** sub → orgId → entry: the caller-scoped truth GET /orgs serves. */
+    private readonly userOrgs;
+    /**
+     * orgId → the organization's WHOLE team list (what GET /teams serves,
+     * PRDCT-2813). An org with no entry here serves the union of the teams its
+     * members' `GET /orgs` entries carry (the real hub's list always holds
+     * every team a member sits in), so a suite that seats teams through
+     * `setUserOrg` alone never sees them swept by the team-list read.
+     */
+    private readonly orgTeamRegistry;
+    /** sub → the orgs that do NOT open the tool to them (GET /orgs' top-level `denied`). */
+    private readonly userDenied;
+    /** Every JWT access token this fake minted (bearer lookup for /api/v1). */
+    private readonly accessTokens;
+    /** Live + rotated-out refresh tokens (rotation families). */
+    private readonly refreshTokens;
+    /** Families torn down by reuse detection (or `revokeGrants`). */
+    private readonly deadFamilies;
+    /** GET /api/v1/orgs behavior. */
+    orgsMode: 'ok' | 'http500' | 'network';
+    /** GET /api/v1/teams behavior (`http404` = an older hub without the route). */
+    teamsMode: 'ok' | 'http500' | 'network' | 'http404';
+    /** Hold every /orgs answer this long (single-flight/race tests). */
+    orgsDelayMs: number;
+    /** Hold every GET /api/v1/teams answer this long (the stale-delete race). */
+    teamsDelayMs: number;
+    /**
+     * The real hub's answer when the cursor's team was deleted between two page
+     * reads: an unknown keyset cursor answers an EMPTY page with no cursor. When
+     * true, every GET /api/v1/teams carrying a `cursor` answers exactly that;
+     * the first page is unaffected.
+     */
+    teamsCursorLost: boolean;
+    /**
+     * POST /api/v1/orgs behavior (the as-the-user org creation, PRDCT-2443).
+     * `limit` = the hub's per-user cap (403 org_limit_reached, the real hub's
+     * answer); `forbidden` = a hub that does not open creation to this grant;
+     * `commit_then_500` creates the org and THEN answers 500 — the ambiguity
+     * the tool must never resolve by re-posting.
+     */
+    orgCreateMode: 'ok' | 'limit' | 'forbidden' | 'http500' | 'network' | 'commit_then_500';
+    /** Every POST /api/v1/orgs: the presented Authorization header + parsed body. */
+    readonly orgCreateRequests: Array<{
+        auth: string | null;
+        body: unknown;
+    }>;
+    /**
+     * Token endpoint behavior (both grants). `hang` never answers (the request
+     * is parked, nothing consumed); `commit_then_hang` consumes the presented
+     * refresh token — rotation committed hub-side — and THEN never answers.
+     */
+    tokenMode: 'ok' | 'http500' | 'network' | 'invalid_grant' | 'invalid_client' | 'hang' | 'commit_then_hang';
+    /** Hold every token answer this long (refresh-race tests). */
+    tokenDelayMs: number;
+    /** How long a `hang` / `commit_then_hang` request is parked before the fake gives up on it. */
+    tokenHangMs: number;
+    /** Introspection endpoint behavior. */
+    introspectMode: 'ok' | 'http500' | 'network' | 'invalid_client' | 'malformed';
+    /** Hold every introspection answer this long (lock-hold tests). */
+    introspectDelayMs: number;
+    /** Lifetime of newly minted access tokens (seconds). */
+    accessTokenTtlSeconds: number;
+    /** Every GET /api/v1/teams request: the presented Authorization header and the org it named. */
+    readonly teamsRequests: Array<{
+        auth: string | null;
+        orgId: string | null;
+    }>;
+    /** Every /api/v1/orgs request: the presented Authorization header. */
+    readonly orgsRequests: Array<{
+        auth: string | null;
+    }>;
+    /** Every refresh-grant presentation (single-flight/rotation pins). */
+    readonly refreshRequests: Array<{
+        refreshToken: string;
+        resource: string | null;
+        clientId: string | null;
+    }>;
+    /** Every introspection call (the grant service's probe pins). */
+    readonly introspectRequests: Array<{
+        token: string;
+        hint: string | null;
+        clientId: string | null;
+    }>;
+    /**
+     * `grant_type=client_credentials` on a registry tool client, scope
+     * `usage:write`: the token carries a client and no subject, and the fake
+     * refuses it on every route but `/api/v1/usage/*` — exactly the hub's
+     * stance. Client auth is basic or post; the secret is checked when the
+     * fake was started with one.
+     */
+    private readonly machineTokens;
+    /** How many machine tokens were minted (single-flight and refresh pins). */
+    machineTokenMints: number;
+    /** Lifetime of a machine token (seconds; the real hub mints 900). */
+    machineTokenTtlSeconds: number;
+    /** `POST /api/v1/usage/events` behavior; `http401_once` refuses the first post with 401 (a dead token), then answers. */
+    usageMode: 'ok' | 'http404' | 'http500' | 'network' | 'http400' | 'http401_once';
+    /** Every usage post: the presented Authorization header + the parsed body. */
+    readonly usageRequests: Array<{
+        auth: string | null;
+        body: unknown;
+    }>;
+    /** id → the event as ingested (the dedupe table). */
+    readonly usageEvents: Map<string, Record<string, unknown>>;
+    /** `GET /api/v1/usage/entitlements` behavior. */
+    entitlementsMode: 'ok' | 'http404' | 'http500' | 'network';
+    /** Every entitlements read: the accountRef asked and the Authorization header. */
+    readonly entitlementsRequests: Array<{
+        accountRef: string | null;
+        auth: string | null;
+    }>;
+    /** accountRef → the profile the hub answers; an account not set here is `free` with no overrides. */
+    private readonly entitlementProfiles;
+    /** `POST /api/v1/usage/check` behavior; `hang` parks the request (`tokenHangMs`). */
+    checkMode: 'ok' | 'http404' | 'http500' | 'network' | 'hang';
+    /** Hold every check answer this long. */
+    checkDelayMs: number;
+    /** Every credit check: the presented Authorization header + the parsed body. */
+    readonly checkRequests: Array<{
+        auth: string | null;
+        body: unknown;
+    }>;
+    /** actionKey → its price row (the hub's price book for this tool). */
+    private readonly prices;
+    /** accountRef → credits; a known organization with no entry holds the sign-up grant. */
+    private readonly balances;
+    /** Every balance movement, in order: the sign-up grant, manual grants, ingest debits. */
+    readonly ledger: Array<{
+        accountRef: string;
+        kind: 'signup' | 'manual' | 'debit';
+        amount: number;
+        sourceRef: string;
+    }>;
+    private constructor();
+    /**
+     * `clientId` is the TOOL's OAuth client id at the hub (its `HUB_CLIENT_ID`):
+     * the client the fake mints a connect grant for, stamps as `azp`, and keys a
+     * grant family on when the request names none. The fake spells no tool's id:
+     * a suite that reaches one of those paths passes it, one that only needs an
+     * issuer may omit it.
+     */
+    static start(options?: {
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        /**
+         * The tool's REGISTRY slug at the hub (`TOOL_REGISTRY[].slug`, the
+         * name the hub records on every usage row and judges a body's
+         * `toolSlug` against). Defaults to the client id without its `tool-`
+         * prefix (`tool-things-cloud` → `things-cloud`), which is what
+         * the production recipe and the drill harness name it — and NOT the
+         * tool's identity slug, so a body that stamps its own name is refused
+         * here exactly as the real hub refuses it (PRDCT-2629).
+         */
+        toolSlug?: string | undefined;
+    }): Promise<FakeHub>;
+    /** The tool's client id, for the paths that need one the request did not carry. */
+    private get clientId();
+    stop(): Promise<void>;
+    /** Rotate the signing key: new tokens sign with the new key; old key drops out of the JWKS. */
+    rotateKey(): Promise<void>;
+    /** The hub's own API resource identifier — the aud /api/v1 requires. */
+    get apiResource(): string;
+    /** The tool's registry slug: what every usage row carries, from the token, never from the body. */
+    get toolSlug(): string;
+    setUserOrg(sub: string, orgId: string, entry: HubOrgEntry): void;
+    removeUserOrg(sub: string, orgId: string): void;
+    clearUserOrgs(sub: string): void;
+    /** The organization's whole team list, as GET /teams serves it. */
+    setOrgTeams(orgId: string, teams: Array<{
+        id: string;
+        slug: string;
+        name: string;
+    }>): void;
+    /** Back to the default: the union of the members' own teams. */
+    clearOrgTeams(orgId: string): void;
+    /** The orgs GET /orgs names in `denied` for this sub (default none). */
+    setUserDenied(sub: string, denied: Array<{
+        id: string;
+        name: string;
+    }>): void;
+    /**
+     * The hub-side "revoke this tool's access" action: tears down the user's
+     * refresh families AND forgets their live access tokens (emulating expiry
+     * — real JWTs die at their 15-minute exp; tests shouldn't wait).
+     */
+    revokeGrants(sub: string): void;
+    /** Number of refresh-grant presentations seen so far (single-flight pins). */
+    /** Whether reuse detection (or `revokeGrants`) tore this (sub, client) family down. */
+    isFamilyDead(sub: string, clientId?: string): boolean;
+    refreshCount(): number;
+    /** Register a one-shot authorization code for the given user fixture. */
+    /**
+     * `requestedScope` is the `scope` parameter of the tool's authorize URL
+     * (sso-helpers reads it off the real sign-in leg): like the real hub, the
+     * grant carries WHAT WAS REQUESTED and nothing else. A caller that skips
+     * it gets the legacy grant — the fake never hands out `orgs:create`
+     * unasked, so a tool that stops requesting it turns the create suites red.
+     */
+    mintCode(fixture: HubUserFixture, requestedScope?: string | null): string;
+    /** Sign an access token directly (no HTTP dance); recorded as a live bearer. */
+    signAccessToken(fixture: HubUserFixture, resource: string): Promise<string>;
+    /**
+     * Sign an H3 exchange token — what the real hub's `POST /sso/tool-token`
+     * mints for the tool's `/sso/cli-connect` (the P5 pinned contract): a
+     * 120 s RS256 JWT, `aud` = the TOOL's resource URL (single string, no
+     * userinfo entry — this is not an OIDC access token), the transitional
+     * org-claims payload (the tool must IGNORE it — suites prove nothing
+     * reads it), `purpose: 'sso-connect'`, and a unique `jti`. Like the real
+     * H3 response, a `hubRefreshToken` rides along: a RAW one-time
+     * offline-grant refresh token in the ordinary (sub, client) rotation
+     * family — redeemable at this fake's token endpoint under the TOOL
+     * CLIENT's credentials, rotation + reuse detection included. And like
+     * the real hub (whose H3 mint proves a live membership of the target
+     * org), the fixture's org is seeded into the sub's registry so a
+     * subsequent as-the-user `GET /orgs` asserts it. `opts` bends the
+     * connect-specific claims for negative tests; `fixture.overrides` still
+     * bends iss/exp/aud like everywhere else.
+     */
+    signConnectToken(fixture: HubUserFixture, resource: string, opts?: {
+        /** Explicit jti (replay tests share one); default = fresh unique. */
+        jti?: string | undefined;
+        /** true = omit the jti claim entirely. */
+        omitJti?: boolean | undefined;
+        /** Replacement purpose; null = omit the claim. Default 'sso-connect'. */
+        purpose?: string | null | undefined;
+    }): Promise<{
+        token: string;
+        jti: string;
+        hubRefreshToken: string;
+    }>;
+    private handle;
+    /** Set what `GET /usage/entitlements` answers for one account (the tier's defaults plus overrides). */
+    setEntitlements(accountRef: string, profile: {
+        plan: 'free' | 'pro';
+        limits?: Record<string, number | boolean>;
+        features?: string[];
+    }): void;
+    /** Set the price row of an action: `creditsPerUnit` credits per `per` units, after a monthly free allowance. */
+    setPrice(actionKey: string, row: FakePriceRow): void;
+    clearPrices(): void;
+    /** Set an organization's balance outright (no ledger entry). */
+    setBalance(accountRef: string, credits: number): void;
+    /** Add (or, negative, take) credits by hand: a `manual` ledger entry. */
+    grant(accountRef: string, delta: number): void;
+    /**
+     * An organization's balance. One the fake knows (an org registry entry)
+     * with no balance set holds the sign-up grant, 5,000 credits, recorded as
+     * a `signup` ledger entry the first time it is read — like the real hub,
+     * which grants it at the organization's creation. Unknown: 0.
+     */
+    balanceOf(accountRef: string): number;
+    private knownOrgs;
+    /**
+     * The price of a quantity of an action for an account, by the hub's rule:
+     * `ceil(max(0, quantity − freeLeft) / per) × creditsPerUnit`, where
+     * `freeLeft` is the monthly allowance minus the quantities already
+     * ingested for that account and action. The fake has NO month rollover:
+     * every event it ever ingested counts against the allowance.
+     */
+    private priceOf;
+    /**
+     * Forget every machine token: the next post answers 401 until re-minted.
+     * Models a REGISTRY REMOVAL or a rotated client secret, not a restart —
+     * the real hub persists its signing keys and never refuses a live JWT on
+     * restart (proven on the pair, lane C of the billing rail wave).
+     */
+    revokeMachineTokens(): void;
+    /** The machine-token check of `/api/v1/usage/*`: a live client_credentials token with `usage:write`. */
+    private machineBearer;
+    private handleUsageEvents;
+    private handleUsageEntitlements;
+    private handleUsageCheck;
+    private handleOrgs;
+    private handleTeams;
+    private handleOrgCreate;
+    /** The org ids the hub holds for a subject (what a test asserts creation against). */
+    orgIdsOf(sub: string): string[];
+    private handleToken;
+    /**
+     * The registry client's machine grant (the billing rail, §6): client auth
+     * (basic, or client_id + client_secret in the body) on THIS tool's client,
+     * scope `usage:write` only. Answers a bearer with no subject.
+     */
+    private handleClientCredentials;
+    private handleRefreshGrant;
+    /** Never answer; give up with a 504 long after any client timeout (nothing observes it). */
+    private park;
+    private handleIntrospect;
+    private mintRefreshToken;
+    private signingKey;
+    private accessToken;
+    private idToken;
+}
+//# sourceMappingURL=fake-hub.d.ts.map

package/dist/testing/fake-hub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-hub.d.ts","sourceRoot":"","sources":["../../src/testing/fake-hub.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAC1C,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,+FAA+F;AAC/F,eAAO,MAAM,kBAAkB,qDAAqD,CAAC;AACrF,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,SAAS,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC3C;AAED,kEAAkE;AAClE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,4FAA4F;IAC5F,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;CACvE;AAyBD,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,+FAA+F;IAC/F,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AASD,qBAAa,OAAO;IAkIhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAtIrC,QAAQ,CAAC,KAAK,8BAAqC;IACnD,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,+EAA+E;IAC/E,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAQ;IAEhD,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+C;IACxE;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAwE;IACxG,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0D;IACrF,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IACrE,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyC;IACvE,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAGlD,iCAAiC;IACjC,QAAQ,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,CAAQ;IAC9C,+EAA+E;IAC/E,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAQ;IAC3D,oEAAoE;IACpE,WAAW,SAAK;IAChB,6EAA6E;IAC7E,YAAY,SAAK;IACjB;;;;;OAKG;IACH,eAAe,UAAS;IACxB;;;;;;OAMG;IACH,aAAa,EAAE,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,iBAAiB,CAAQ;IAC/F,iFAAiF;IACjF,QAAQ,CAAC,iBAAiB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAM;IAC/E;;;;OAIG;IACH,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,gBAAgB,GAAG,MAAM,GAAG,kBAAkB,CACnG;IACP,8DAA8D;IAC9D,YAAY,SAAK;IACjB,+FAA+F;IAC/F,WAAW,SAAU;IACrB,uCAAuC;IACvC,cAAc,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAQ;IACrF,mEAAmE;IACnE,iBAAiB,SAAK;IACtB,wDAAwD;IACxD,qBAAqB,SAAO;IAE5B,gGAAgG;IAChG,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAM;IAClF,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAM;IAC3D,sEAAsE;IACtE,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC;QAC9B,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC,CAAM;IACR,iEAAiE;IACjE,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAM;IAGzG;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuD;IACrF,4EAA4E;IAC5E,iBAAiB,SAAK;IACtB,qEAAqE;IACrE,sBAAsB,SAAO;IAC7B,yHAAyH;IACzH,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,CAAQ;IACxF,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAM;IAC3E,qDAAqD;IACrD,QAAQ,CAAC,WAAW,uCAA8C;IAClE,iDAAiD;IACjD,gBAAgB,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAQ;IAClE,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAM;IAC9F,qGAAqG;IACrG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAGhC;IACJ,qFAAqF;IACrF,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAQ;IACpE,yCAAyC;IACzC,YAAY,SAAK;IACjB,gFAAgF;IAChF,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAM;IAC3E,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;QACpC,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAM;IAER,OAAO;IASP;;;;;;OAMG;WACU,KAAK,CAChB,OAAO,GAAE;QACP,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAClC;;;;;;;;WAQG;QACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC1B,GACL,OAAO,CAAC,OAAO,CAAC;IAkBnB,mFAAmF;IACnF,OAAO,KAAK,QAAQ,GAOnB;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,+FAA+F;IACzF,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,wEAAwE;IACxE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,mGAAmG;IACnG,IAAI,QAAQ,IAAI,MAAM,CAErB;IAID,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI;IAShE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAI/C,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIhC,mEAAmE;IACnE,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI;IAI1F,gEAAgE;IAChE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIlC,wEAAwE;IACxE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI;IAI7E;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAS/B,8EAA8E;IAC9E,uFAAuF;IACvF,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,SAAgB,GAAG,OAAO;IAI5D,YAAY,IAAI,MAAM;IAItB,yEAAyE;IACzE;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;IAOzE,gFAAgF;IAC1E,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIjF;;;;;;;;;;;;;;;;OAgBG;IACG,gBAAgB,CACpB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;QACJ,qEAAqE;QACrE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,0CAA0C;QAC1C,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC9B,yEAAyE;QACzE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;KAChC,GACL,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;YA4CrD,MAAM;IA+CpB,uGAAuG;IACvG,eAAe,CACb,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAChG,IAAI;IAMP,gHAAgH;IAChH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,IAAI;IAIpD,WAAW,IAAI,IAAI;IAInB,gEAAgE;IAChE,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAIrD,yEAAyE;IACzE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAU9C;;;;;OAKG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IASrC,OAAO,CAAC,SAAS;IAMjB;;;;;;OAMG;IACH,OAAO,CAAC,OAAO;IA0Bf;;;;;OAKG;IACH,mBAAmB,IAAI,IAAI;IAI3B,wGAAwG;IACxG,OAAO,CAAC,aAAa;YAOP,iBAAiB;YAsFjB,uBAAuB;YAsCvB,gBAAgB;YA8EhB,UAAU;YAkCV,WAAW;YAoDX,eAAe;IA0D7B,sFAAsF;IACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE;YAKjB,WAAW;IA+DzB;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAwC/B,OAAO,CAAC,kBAAkB;IAsD1B,4FAA4F;IAC5F,OAAO,CAAC,IAAI;YAQE,gBAAgB;IAqC9B,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,UAAU;YAMJ,WAAW;YA8BX,OAAO;CAkBtB"}