@atlasauth/emulator-core 0.1.0 → 0.2.0

package/dist/handlers/approvals.js

@@ -0,0 +1,365 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.approvalsHandlers = approvalsHandlers;
+const crypto_util_1 = require("../crypto-util");
+const errors_1 = require("../errors");
+const jws_1 = require("../jws");
+const store_1 = require("../store");
+const support_1 = require("./support");
+const util_1 = require("./util");
+/**
+ * Approvals v2: an application asks a person (or several, by user list or by organization role) to approve one concrete
+ * action. The request is rendered to a canonical string and hashed (`digest`), so what the approver saw is what they
+ * signed (what you see is what you sign). The default flow is the number-matching prompt for the subject; naming
+ * `approvers` or `require_signature` needs an ES256 device-key signature over the digest from every approver. Enough
+ * approvals produce a signed receipt a backend can verify offline; `consume` spends an approved request exactly once.
+ */
+const MIN_TTL_S = 60;
+const MAX_TTL_S = 3600;
+const DEFAULT_TTL_S = 300;
+const MAX_WAIT_S = 25;
+const DECISION_TYP = 'atlas-approval-decision+jws';
+const st = (0, support_1.engineState)((e) => ({ requests: new store_1.Table('approval_requests', e.clock.now, 'apr'), keys: new store_1.Table('approval_keys', e.clock.now, 'apk') }));
+const canonical = (v) => (Array.isArray(v) ? `[${v.map(canonical).join(',')}]` : v && typeof v === 'object' ? `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}` : JSON.stringify(v ?? null));
+const bad = (message, param) => new errors_1.EmulatorError('VALIDATION_FAILED', message, param);
+/** The state a request is in now: a pending request past its expiry becomes `expired` (and says so once). */
+function settle(e, r) {
+    if (r.status === 'pending' && r.expires_at <= e.clock.now()) {
+        r.status = 'expired';
+        e.webhooks.emit('approval_request.expired', { object: 'approval_request', id: r.id, user_id: r.user_id });
+    }
+    return r;
+}
+const approverIds = (e, r) => {
+    if (r.approvers.mode === 'subject')
+        return [r.user_id];
+    if (r.approvers.mode === 'users')
+        return r.approvers.user_ids;
+    return e.db.memberships.filter((m) => m.organization_id === r.approvers.organization_id && m.role === r.approvers.role).map((m) => m.user_id);
+};
+const presentCreated = (r) => ({
+    object: 'approval_request',
+    id: r.id,
+    status: r.status,
+    user_id: r.user_id,
+    match_number: r.match_number,
+    expires_at: r.expires_at,
+    approvers: r.approvers,
+    require_signature: r.require_signature,
+    digest: r.digest,
+    reference: r.reference,
+    binding: r.binding,
+});
+const presentFull = (r) => ({
+    ...presentCreated(r),
+    description: r.description,
+    context: r.context,
+    created_at: r.created_at,
+    approvals_received: r.decisions.filter((d) => d.decision === 'approve').length,
+    decisions: r.decisions.map((d) => ({ approver_user_id: d.approver_user_id, decision: d.decision, signed: d.signed, decided_at: d.at })),
+    consumed_at: r.consumed_at ?? null,
+    receipt: r.status === 'approved' && !r.consumed_at ? r.receipt : null,
+});
+async function create(c, userId) {
+    const e = c.engine;
+    const b = c.body;
+    const user = e.db.users.get(userId);
+    if (!user || user.deleted)
+        throw (0, errors_1.notFound)('User');
+    if (typeof b.description !== 'string' || !b.description.trim())
+        throw bad('A description is required.', 'description');
+    if (b.description.length > 4000)
+        throw bad('description must be 4000 characters or fewer.', 'description');
+    let context = {};
+    if (b.context !== undefined) {
+        if (!b.context || typeof b.context !== 'object' || Array.isArray(b.context))
+            throw bad('context must be an object of string values.', 'context');
+        const entries = Object.entries(b.context);
+        if (entries.length > 50)
+            throw bad('context may hold at most 50 entries.', 'context');
+        for (const [k, v] of entries)
+            if (typeof v !== 'string' || k.length > 128 || v.length > 2000)
+                throw bad(`context.${k} must be a string of at most 2000 characters.`, 'context');
+        context = b.context;
+    }
+    const ttl = (0, support_1.intIn)(b.ttl_seconds, 'ttl_seconds', MIN_TTL_S, MAX_TTL_S, DEFAULT_TTL_S);
+    if (b.require_signature !== undefined && typeof b.require_signature !== 'boolean')
+        throw bad('require_signature must be true or false.', 'require_signature');
+    for (const k of ['binding', 'reference'])
+        if (b[k] !== undefined && b[k] !== null && (typeof b[k] !== 'string' || !b[k] || b[k].length > 200))
+            throw bad(`${k} must be a non-empty string of at most 200 characters.`, k);
+    let approvers = { mode: 'subject', user_ids: [userId], organization_id: null, role: null, required: 1 };
+    if (b.approvers !== undefined) {
+        const a = b.approvers;
+        if (!a || typeof a !== 'object' || Array.isArray(a))
+            throw bad('approvers must be an object.', 'approvers');
+        if (Array.isArray(a.user_ids) === (a.organization_id !== undefined))
+            throw bad('approvers takes user_ids, or organization_id with role.', 'approvers');
+        if (Array.isArray(a.user_ids)) {
+            if (!a.user_ids.length || a.user_ids.length > 20 || a.user_ids.some((u) => typeof u !== 'string' || !e.db.users.get(u)))
+                throw bad('approvers.user_ids is 1 to 20 existing users.', 'approvers.user_ids');
+            approvers = { mode: 'users', user_ids: [...new Set(a.user_ids)], organization_id: null, role: null, required: 1 };
+        }
+        else {
+            if (!e.db.organizations.get(a.organization_id))
+                throw bad('approvers.organization_id is not an organization.', 'approvers.organization_id');
+            if (typeof a.role !== 'string' || !a.role)
+                throw bad('approvers.role is required with organization_id.', 'approvers.role');
+            approvers = { mode: 'org_role', user_ids: [], organization_id: a.organization_id, role: a.role, required: 1 };
+        }
+        const pool = approvers.mode === 'users' ? approvers.user_ids.length : e.db.memberships.filter((m) => m.organization_id === approvers.organization_id && m.role === approvers.role).length;
+        approvers.required = (0, support_1.intIn)(a.required, 'approvers.required', 1, Math.max(1, pool), 1);
+        if (!pool)
+            throw bad('No one holds that role in the organization.', 'approvers');
+    }
+    const requireSignature = b.require_signature === true || approvers.mode !== 'subject';
+    const now = e.clock.now();
+    const digest = (0, crypto_util_1.bytesToB64url)(await (0, crypto_util_1.sha256)(canonical({ v: 1, user_id: userId, description: b.description.trim(), context, binding: b.binding ?? null, reference: b.reference ?? null })));
+    const row = st(e).requests.insert({
+        user_id: userId,
+        description: b.description.trim(),
+        context,
+        status: 'pending',
+        match_number: approvers.mode === 'subject' ? String(10 + Math.floor(Math.random() * 90)) : null,
+        approvers,
+        require_signature: requireSignature,
+        binding: b.binding ?? null,
+        reference: b.reference ?? null,
+        digest,
+        decisions: [],
+        created_at: now,
+        expires_at: now + ttl * 1000,
+        receipt: null,
+    });
+    return { status: 201, body: presentCreated(row) };
+}
+const requestOf = (e, id, userId) => {
+    const r = st(e).requests.get(id);
+    if (!r || (userId !== undefined && r.user_id !== userId))
+        throw (0, errors_1.notFound)('Approval request');
+    return settle(e, r);
+};
+async function receiptFor(e, r) {
+    return e.tokens.signClaims({ sub: r.user_id, jti: e.db.newId('aprcpt'), token_use: 'approval_receipt', approval_id: r.id, digest: r.digest, reference: r.reference, binding: r.binding, approvers: r.decisions.filter((d) => d.decision === 'approve').map((d) => d.approver_user_id) }, 3600);
+}
+function cancel(e, r) {
+    if (r.status !== 'pending')
+        throw new errors_1.EmulatorError('CONFLICT', `This request is ${r.status}; only a pending request can be cancelled.`);
+    r.status = 'cancelled';
+    e.webhooks.emit('approval_request.cancelled', { object: 'approval_request', id: r.id, user_id: r.user_id });
+    return r;
+}
+/** Verify a device-key decision signature: ES256 JWS typ atlas-approval-decision+jws over { approval_id, digest, decision, iat } by a key this approver registered. */
+async function verifySignature(e, r, approverId, decision, sig) {
+    if (!sig || typeof sig !== 'object' || sig.type !== 'device_key' || typeof sig.key_id !== 'string' || typeof sig.jws !== 'string')
+        throw bad('signature must be { type: "device_key", key_id, jws }.', 'signature');
+    const key = st(e).keys.get(sig.key_id);
+    if (!key || key.user_id !== approverId)
+        throw new errors_1.EmulatorError('VERIFICATION_FAILED', 'That signing key is not registered to this approver.', 'signature');
+    const jwt = (0, jws_1.decodeJwt)(sig.jws);
+    if (!jwt || jwt.header.typ !== DECISION_TYP || jwt.header.alg !== 'ES256')
+        throw new errors_1.EmulatorError('VERIFICATION_FAILED', 'The decision must be an ES256 JWS with typ atlas-approval-decision+jws.', 'signature');
+    if (!(await (0, jws_1.verifyJws)(jwt, key.jwk)))
+        throw new errors_1.EmulatorError('VERIFICATION_FAILED', 'The decision signature does not verify.', 'signature');
+    const p = jwt.payload;
+    if (p.approval_id !== r.id || p.digest !== r.digest || p.decision !== decision)
+        throw new errors_1.EmulatorError('VERIFICATION_FAILED', 'The signed decision is for a different request, digest or decision.', 'signature');
+    if (typeof p.iat !== 'number' || Math.abs(e.clock.now() / 1000 - p.iat) > 300)
+        throw new errors_1.EmulatorError('VERIFICATION_FAILED', 'The signed decision is too old.', 'signature');
+}
+async function decide(c) {
+    const e = c.engine;
+    const { userId } = await (0, support_1.sessionFromBearer)(c);
+    const r = requestOf(e, c.params.id);
+    if (!approverIds(e, r).includes(userId))
+        throw (0, errors_1.notFound)('Approval request');
+    if (r.status !== 'pending')
+        throw new errors_1.EmulatorError('CONFLICT', `This request is ${r.status}.`);
+    if (r.decisions.some((d) => d.approver_user_id === userId))
+        throw new errors_1.EmulatorError('CONFLICT', 'You already answered this request.');
+    const decision = c.body.decision;
+    if (decision !== 'approve' && decision !== 'deny')
+        throw bad('decision must be approve or deny.', 'decision');
+    let signed = false;
+    if (decision === 'approve') {
+        if (r.approvers.mode === 'subject' && !r.require_signature) {
+            if (String(c.body.number ?? '') !== r.match_number)
+                throw new errors_1.EmulatorError('VERIFICATION_FAILED', 'That is not the number shown to the requester.', 'number');
+        }
+        else {
+            await verifySignature(e, r, userId, decision, c.body.signature);
+            signed = true;
+        }
+    }
+    r.decisions.push({ approver_user_id: userId, decision, signed, at: e.clock.now() });
+    e.webhooks.emit('approval_request.approver_decided', { object: 'approval_request', id: r.id, user_id: r.user_id, approver_user_id: userId, decision });
+    if (decision === 'deny') {
+        r.status = 'denied';
+        e.webhooks.emit('approval_request.denied', { object: 'approval_request', id: r.id, user_id: r.user_id });
+    }
+    else if (r.decisions.filter((d) => d.decision === 'approve').length >= r.approvers.required) {
+        r.status = 'approved';
+        r.receipt = await receiptFor(e, r);
+        e.webhooks.emit('approval_request.approved', { object: 'approval_request', id: r.id, user_id: r.user_id });
+    }
+    return { body: { object: 'approval_decision', approval_id: r.id, status: r.status, decision } };
+}
+function approvalsHandlers() {
+    const createFor = (pattern, userOf) => ({ method: 'POST', pattern, handler: (c) => create(c, userOf(c)) });
+    return [
+        createFor('/v1/approval_requests', (c) => {
+            if (typeof c.body.user_id !== 'string' || !c.body.user_id)
+                throw bad('A user_id is required.', 'user_id');
+            return c.body.user_id;
+        }),
+        createFor('/v1/users/:id/approval_requests', (c) => c.params.id ?? ''),
+        {
+            method: 'GET',
+            pattern: '/v1/approval_requests',
+            handler: (c) => {
+                const e = c.engine;
+                const q = (k) => c.query.get(k);
+                const status = q('status');
+                if (status && !['pending', 'approved', 'denied', 'expired', 'cancelled'].includes(status))
+                    throw bad('status must be pending, approved, denied, expired or cancelled.', 'status');
+                const epoch = (k) => {
+                    const v = q(k);
+                    if (v === null)
+                        return undefined;
+                    const n = Number(v);
+                    if (!Number.isFinite(n) || n < 0)
+                        throw bad(`${k} must be epoch milliseconds.`, k);
+                    return n;
+                };
+                const [after, before] = [epoch('created_after'), epoch('created_before')];
+                const rows = st(e).requests.all().map((r) => settle(e, r)).filter((r) => (!status || r.status === status) && (!q('user_id') || r.user_id === q('user_id')) && (!q('reference') || r.reference === q('reference')) && (!q('approver_user_id') || approverIds(e, r).includes(q('approver_user_id'))) && (after === undefined || r.created_at >= after) && (before === undefined || r.created_at <= before));
+                return (0, util_1.listReply)(c, rows, (r) => ({ ...presentFull(r), receipt: undefined }));
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/approval_requests/:id',
+            handler: async (c) => {
+                const e = c.engine;
+                const wait = c.query.get('wait_seconds') === null ? 0 : Number(c.query.get('wait_seconds'));
+                if (!Number.isFinite(wait) || wait < 0 || wait > MAX_WAIT_S)
+                    throw bad(`wait_seconds must be 0 to ${MAX_WAIT_S}.`, 'wait_seconds');
+                const deadline = Date.now() + wait * 1000;
+                for (;;) {
+                    const r = requestOf(e, c.params.id);
+                    if (r.status !== 'pending' || Date.now() >= deadline)
+                        return { body: presentFull(r) };
+                    await new Promise((res) => setTimeout(res, Math.min(50, Math.max(1, deadline - Date.now()))));
+                }
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/users/:id/approval_requests/:approvalId',
+            handler: (c) => ({ body: presentFull(requestOf(c.engine, c.params.approvalId, c.params.id)) }),
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/users/:id/approval_requests/:approvalId/cancel',
+            handler: (c) => ({ body: presentFull(cancel(c.engine, requestOf(c.engine, c.params.approvalId, c.params.id))) }),
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/approval_requests/:id/cancel',
+            handler: (c) => ({ body: presentFull(cancel(c.engine, requestOf(c.engine, c.params.id))) }),
+        },
+        {
+            // Spend an approved request once. A request made with a `binding` needs the same `binding` here.
+            method: 'POST',
+            pattern: '/v1/approval_requests/:id/consume',
+            handler: (c) => {
+                const e = c.engine;
+                const r = requestOf(e, c.params.id);
+                if (c.body.binding !== undefined && typeof c.body.binding !== 'string')
+                    throw bad('binding must be a string.', 'binding');
+                if (r.status !== 'approved')
+                    throw new errors_1.EmulatorError('CONFLICT', `This request is ${r.status}; only an approved request can be consumed.`);
+                if (r.consumed_at)
+                    throw new errors_1.EmulatorError('CONFLICT', 'This approval was already consumed.');
+                if (r.binding && c.body.binding !== r.binding)
+                    throw bad('binding does not match the binding the request was created with.', 'binding');
+                const out = presentFull(r);
+                r.consumed_at = e.clock.now();
+                return { body: { ...out, consumed_at: r.consumed_at } };
+            },
+        },
+        // ── the approver's side (a session, never a secret key) ──
+        {
+            method: 'GET',
+            pattern: '/v1/client/me/approvals',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                const rows = st(e).requests.all().map((r) => settle(e, r)).filter((r) => r.status === 'pending' && approverIds(e, r).includes(userId) && !r.decisions.some((d) => d.approver_user_id === userId));
+                return { body: { object: 'list', data: rows.map((r) => ({ object: 'approval', id: r.id, description: r.description, context: r.context, digest: r.digest, require_signature: r.require_signature, expires_at: r.expires_at })), has_more: false } };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/client/me/approvals/:id',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                const r = requestOf(e, c.params.id);
+                if (!approverIds(e, r).includes(userId))
+                    throw (0, errors_1.notFound)('Approval request');
+                return { body: { object: 'approval', id: r.id, status: r.status, description: r.description, context: r.context, digest: r.digest, require_signature: r.require_signature, expires_at: r.expires_at } };
+            },
+        },
+        { method: 'POST', pattern: '/v1/client/me/approvals/:id/decision', public: true, handler: (c) => decide(c) },
+        {
+            method: 'GET',
+            pattern: '/v1/client/me/approval_keys',
+            public: true,
+            handler: async (c) => {
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                return { body: { object: 'list', data: st(c.engine).keys.filter((k) => k.user_id === userId).map((k) => ({ object: 'approval_key', id: k.id, label: k.label, thumbprint: k.thumbprint, created_at: k.created_at })), has_more: false } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/client/me/approval_keys',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                const jwk = c.body.public_jwk;
+                if (!jwk || typeof jwk !== 'object' || jwk.kty !== 'EC' || jwk.crv !== 'P-256' || 'd' in jwk)
+                    throw bad('public_jwk must be a P-256 public key.', 'public_jwk');
+                if (c.body.label !== undefined && (typeof c.body.label !== 'string' || c.body.label.length > 100))
+                    throw bad('label is up to 100 characters.', 'label');
+                const thumbprint = await (0, jws_1.jwkThumbprintOf)(jwk);
+                if (!thumbprint)
+                    throw bad('public_jwk could not be read.', 'public_jwk');
+                const s = st(e);
+                if (s.keys.find((k) => k.user_id === userId && k.thumbprint === thumbprint))
+                    throw new errors_1.EmulatorError('CONFLICT', 'That key is already registered.', 'public_jwk');
+                if (s.keys.filter((k) => k.user_id === userId).length >= 10)
+                    throw new errors_1.EmulatorError('CONFLICT', 'At most 10 approval keys per user.');
+                const k = s.keys.insert({ user_id: userId, jwk, thumbprint, label: c.body.label ?? null, created_at: e.clock.now() });
+                return { status: 201, body: { object: 'approval_key', id: k.id, label: k.label, thumbprint, created_at: k.created_at } };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/client/me/approval_keys/:id',
+            public: true,
+            handler: async (c) => {
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                const k = st(c.engine).keys.get(c.params.id);
+                if (!k || k.user_id !== userId)
+                    throw (0, errors_1.notFound)('Approval key');
+                st(c.engine).keys.delete(k.id);
+                return { body: { object: 'approval_key', id: k.id, deleted: true } };
+            },
+        },
+    ];
+}
+//# sourceMappingURL=approvals.js.map

package/dist/handlers/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../src/handlers/approvals.ts"],"names":[],"mappings":";;AA+LA,8CA4IC;AAzUD,gDAAuD;AACvD,sCAAoD;AACpD,gCAA+D;AAE/D,oCAAiC;AACjC,uCAAkE;AAClE,iCAAmC;AAEnC;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,YAAY,GAAG,6BAA6B,CAAC;AAMnD,MAAM,EAAE,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAS,EAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,aAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,aAAK,CAAC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAE/K,MAAM,SAAS,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAE,CAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AAEzQ,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAEvG,6GAA6G;AAC7G,SAAS,MAAM,CAAC,CAAS,EAAE,CAAM;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5D,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAM,EAAY,EAAE;IAClD,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;IAC9D,OAAO,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAChJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC;IACvC,MAAM,EAAE,kBAAkB;IAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,YAAY,EAAE,CAAC,CAAC,YAAY;IAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO;CACnB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC;IACpC,GAAG,cAAc,CAAC,CAAC,CAAC;IACpB,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,kBAAkB,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;IACnF,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5I,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;CACtE,CAAC,CAAC;AAEH,KAAK,UAAU,MAAM,CAAC,CAAe,EAAE,MAAc;IACnD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACjB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,IAAA,iBAAQ,EAAC,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;QAAE,MAAM,GAAG,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IACvH,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,GAAG,CAAC,+CAA+C,EAAE,aAAa,CAAC,CAAC;IAC3G,IAAI,OAAO,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,MAAM,GAAG,CAAC,6CAA6C,EAAE,SAAS,CAAC,CAAC;QACjJ,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAc,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,GAAG,CAAC,sCAAsC,EAAE,SAAS,CAAC,CAAC;QACtF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,GAAG,CAAC,WAAW,CAAC,+CAA+C,EAAE,SAAS,CAAC,CAAC;QAChL,OAAO,GAAG,CAAC,CAAC,OAAiC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACrF,IAAI,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,0CAA0C,EAAE,mBAAmB,CAAC,CAAC;IAC9J,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAU;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC,GAAG,CAAC,wDAAwD,EAAE,CAAC,CAAC,CAAC;IACnO,IAAI,SAAS,GAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC7G,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,8BAA8B,EAAE,WAAW,CAAC,CAAC;QAC5G,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC;YAAE,MAAM,GAAG,CAAC,yDAAyD,EAAE,WAAW,CAAC,CAAC;QACvJ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC,+CAA+C,EAAE,oBAAoB,CAAC,CAAC;YACnN,SAAS,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC5H,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;gBAAE,MAAM,GAAG,CAAC,mDAAmD,EAAE,2BAA2B,CAAC,CAAC;YAC5I,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,MAAM,GAAG,CAAC,kDAAkD,EAAE,gBAAgB,CAAC,CAAC;YAC3H,SAAS,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAChH,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAC1L,SAAS,CAAC,QAAQ,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI;YAAE,MAAM,GAAG,CAAC,6CAA6C,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,CAAC,iBAAiB,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC;IACtF,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAA,2BAAa,EAAC,MAAM,IAAA,oBAAM,EAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzL,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;QACjC,OAAO;QACP,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/F,SAAS;QACT,iBAAiB,EAAE,gBAAgB;QACnC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,MAAM;QACN,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI;QAC5B,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAsB,EAAE,MAAe,EAAO,EAAE;IAC5E,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;QAAE,MAAM,IAAA,iBAAQ,EAAC,kBAAkB,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC,CAAC;AAEF,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,CAAM;IACzC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAC3S,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,EAAE,CAAM;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,MAAM,4CAA4C,CAAC,CAAC;IACzI,CAAC,CAAC,MAAM,GAAG,WAAW,CAAC;IACvB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5G,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uKAAuK;AACvK,KAAK,UAAU,eAAe,CAAC,CAAS,EAAE,CAAM,EAAE,UAAkB,EAAE,QAAgB,EAAE,GAAY;IAClG,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAK,GAAW,CAAC,IAAI,KAAK,YAAY,IAAI,OAAQ,GAAW,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAQ,GAAW,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,wDAAwD,EAAE,WAAW,CAAC,CAAC;IAC/O,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAE,GAAW,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU;QAAE,MAAM,IAAI,sBAAa,CAAC,qBAAqB,EAAE,sDAAsD,EAAE,WAAW,CAAC,CAAC;IAC5J,MAAM,GAAG,GAAG,IAAA,eAAS,EAAE,GAAW,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,sBAAa,CAAC,qBAAqB,EAAE,yEAAyE,EAAE,WAAW,CAAC,CAAC;IAClN,IAAI,CAAC,CAAC,MAAM,IAAA,eAAS,EAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,qBAAqB,EAAE,yCAAyC,EAAE,WAAW,CAAC,CAAC;IAC7I,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,sBAAa,CAAC,qBAAqB,EAAE,qEAAqE,EAAE,WAAW,CAAC,CAAC;IACnN,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG;QAAE,MAAM,IAAI,sBAAa,CAAC,qBAAqB,EAAE,iCAAiC,EAAE,WAAW,CAAC,CAAC;AAChL,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,CAAe;IACnC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAA,iBAAQ,EAAC,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAChG,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,MAAM,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;IAC3I,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM;QAAE,MAAM,GAAG,CAAC,mCAAmC,EAAE,UAAU,CAAC,CAAC;IAC9G,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;YAC3D,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY;gBAAE,MAAM,IAAI,sBAAa,CAAC,qBAAqB,EAAE,gDAAgD,EAAE,QAAQ,CAAC,CAAC;QACjK,CAAC;aAAM,CAAC;YACN,MAAM,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChE,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IACD,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvJ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3G,CAAC;SAAM,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QACnG,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC;QACtB,CAAC,CAAC,OAAO,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;AAClG,CAAC;AAED,SAAgB,iBAAiB;IAC/B,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,MAAmC,EAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1J,OAAO;QACL,SAAS,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;YACvC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YAC1G,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC;QACF,SAAS,CAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QACtE;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,uBAAuB;YAChC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxC,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC3B,IAAI,MAAM,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,MAAM,GAAG,CAAC,iEAAiE,EAAE,QAAQ,CAAC,CAAC;gBAClL,MAAM,KAAK,GAAG,CAAC,CAAS,EAAsB,EAAE;oBAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBACf,IAAI,CAAC,KAAK,IAAI;wBAAE,OAAO,SAAS,CAAC;oBACjC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,MAAM,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;oBACnF,OAAO,CAAC,CAAC;gBACX,CAAC,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC1E,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAE,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC;gBAC3Y,OAAO,IAAA,gBAAS,EAAC,CAAC,EAAE,IAAmC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC/G,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,2BAA2B;YACpC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;gBAC5F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,UAAU;oBAAE,MAAM,GAAG,CAAC,6BAA6B,UAAU,GAAG,EAAE,cAAc,CAAC,CAAC;gBACnI,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;gBAC1C,SAAS,CAAC;oBACR,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACpC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;wBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtF,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChG,CAAC;YACH,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,6CAA6C;YACtD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;SAC/F;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oDAAoD;YAC7D,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjH;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kCAAkC;YAC3C,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD;YACE,iGAAiG;YACjG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mCAAmC;YAC5C,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAC;gBAC1H,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,MAAM,6CAA6C,CAAC,CAAC;gBAC3I,IAAI,CAAC,CAAC,WAAW;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;gBAC9F,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;oBAAE,MAAM,GAAG,CAAC,kEAAkE,EAAE,SAAS,CAAC,CAAC;gBACxI,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC3B,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1D,CAAC;SACF;QACD,4DAA4D;QAC5D;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,yBAAyB;YAClC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACvM,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YACtP,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,6BAA6B;YACtC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,kBAAkB,CAAC,CAAC;gBAC5E,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;YAC1M,CAAC;SACF;QACD,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sCAAsC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAC5G;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,6BAA6B;YACtC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3O,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6BAA6B;YACtC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC9B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,IAAI,GAAG;oBAAE,MAAM,GAAG,CAAC,wCAAwC,EAAE,YAAY,CAAC,CAAC;gBAChK,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC,gCAAgC,EAAE,OAAO,CAAC,CAAC;gBACxJ,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAe,EAAC,GAAG,CAAC,CAAC;gBAC9C,IAAI,CAAC,UAAU;oBAAE,MAAM,GAAG,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAC;gBAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,iCAAiC,EAAE,YAAY,CAAC,CAAC;gBAClK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,IAAI,EAAE;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;gBACvI,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACtH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;YAC3H,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,iCAAiC;YAC1C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;oBAAE,MAAM,IAAA,iBAAQ,EAAC,cAAc,CAAC,CAAC;gBAC/D,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC/B,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACvE,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/authz.d.ts

@@ -0,0 +1,2 @@
+import type { RouteDef } from '../engine';
+export declare function authzHandlers(): RouteDef[];