@atlasauth/emulator-core 0.2.0 → 0.3.1

package/dist/handlers/emu4-actions.js

@@ -0,0 +1,506 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emu4ActionsHandlers = emu4ActionsHandlers;
+const errors_1 = require("../errors");
+const store_1 = require("../store");
+const crypto_util_1 = require("../crypto-util");
+const support_1 = require("./support");
+const emu4_actions_sandbox_1 = require("./emu4-actions-sandbox");
+const emu4_actions_catalog_1 = require("./emu4-actions-catalog");
+const emu4_actions_def_1 = require("./emu4-actions-def");
+const emu4_actions_typegen_1 = require("./emu4-actions-typegen");
+const emu4_actions_access_1 = require("./emu4-actions-access");
+const connections_1 = require("./connections");
+/**
+ * Actions and typed connection depth. Action code runs in the sandbox (`POST /v1/actions/{id}/test` is the dry run); a
+ * connection's typed actions (first-party packs plus your own definitions) run through the connection relay, every answer is
+ * checked against the action's declared output and observed by the provider change radar; connection access rules limit who
+ * may use a credential; connection OAuth clients can be created at the provider by dynamic registration. The provider is
+ * answered by the engine's `fetch` option or by a stub registered at `/__emulator/connections/provider_stubs`.
+ */
+const bad = (message, param) => new errors_1.EmulatorError('VALIDATION_FAILED', message, param);
+const PROVIDER = /^[a-z0-9][a-z0-9_.-]{0,63}$/;
+const OWNER_TYPES = ['organization', 'user', 'external'];
+const st = (0, support_1.engineState)((e) => ({ defs: new Map(), changes: new store_1.Table('connection_provider_changes', e.clock.now, 'cpc'), audit: [] }));
+const audit = (e, action, targetType, targetId, extra = {}) => {
+    st(e).audit.push({ id: e.db.newId('audit'), action: `connection.${action}`, target_type: targetType, target_id: targetId, metadata: extra, created_at: e.clock.now() });
+};
+const connOf = (e, id) => {
+    const c = e.generic.get('connections')?.get(id);
+    if (!c)
+        throw (0, errors_1.notFound)('Connection');
+    return c;
+};
+// ── the action catalog ──
+const sameDef = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+const isBuiltIn = (a) => emu4_actions_catalog_1.BUILT_IN_ACTIONS.some((b) => b.provider === a.provider && b.name === a.name && sameDef(b, a));
+/** The actions of a provider: the first-party pack, with any custom definition of the same name replacing it. */
+function actionsFor(e, provider) {
+    const byName = new Map(emu4_actions_catalog_1.BUILT_IN_ACTIONS.filter((a) => a.provider === provider).map((a) => [a.name, a]));
+    for (const d of st(e).defs.values())
+        if (d.provider === provider)
+            byName.set(d.name, d);
+    return [...byName.values()].sort((a, b) => (a.name < b.name ? -1 : 1));
+}
+const providersOf = (e) => [...new Set([...emu4_actions_catalog_1.BUILT_IN_ACTIONS.map((a) => a.provider), ...[...st(e).defs.values()].map((d) => d.provider)])].sort();
+const present = (a) => ({ object: 'connection_action', provider: a.provider, name: a.name, description: a.description, input_schema: a.input, output_schema: a.output ?? null, method: a.request.method, mutating: a.mutating, scopes: a.scopes ?? [], source: isBuiltIn(a) ? 'first_party' : 'custom' });
+// ── provider change radar ──
+const CHANGE_KINDS = ['output_drift', 'deprecation', 'endpoint_gone'];
+const CHANGE_STATUSES = ['open', 'acknowledged', 'resolved'];
+const cap = (v, n = 200) => (v === undefined ? null : v.slice(0, n));
+const changeView = (c) => ({ object: 'connection_provider_change', id: c.id, provider: c.provider, kind: c.kind, action: c.subject, detail: c.detail, status: c.status, occurrences: c.occurrences, first_seen_at: c.first_seen_at, last_seen_at: c.last_seen_at, handled_by: c.handled_by ?? null, handled_at: c.handled_at ?? null });
+/** One observation of an action run: names, header values and the schema path that failed, never a request or a body. */
+function observe(e, o) {
+    const found = [];
+    const deprecation = cap(o.headers.deprecation);
+    const sunset = cap(o.headers.sunset);
+    if (deprecation || sunset)
+        found.push({ kind: 'deprecation', fingerprint: `${o.action}:${sunset ?? deprecation}`, detail: { deprecation, sunset } });
+    if (o.drift)
+        found.push({ kind: 'output_drift', fingerprint: `${o.action}:${o.drift.slice(0, 300)}`, detail: { problem: o.drift.slice(0, 300) } });
+    if (o.status === 410)
+        found.push({ kind: 'endpoint_gone', fingerprint: `${o.action}:410`, detail: { status: 410 } });
+    const t = st(e).changes;
+    const now = e.clock.now();
+    for (const c of found) {
+        const row = t.find((r) => r.provider === o.provider && r.kind === c.kind && r.fingerprint === c.fingerprint);
+        if (row) {
+            row.occurrences++;
+            row.last_seen_at = now;
+            // A change marked resolved that happens again is open again.
+            if (row.status === 'resolved')
+                row.status = 'open';
+            continue;
+        }
+        const made = t.insert({ provider: o.provider, kind: c.kind, subject: o.action, fingerprint: c.fingerprint, detail: c.detail, status: 'open', occurrences: 1, first_seen_at: now, last_seen_at: now, handled_by: null, handled_at: null });
+        e.webhooks.emit('connection.provider_change', changeView(made));
+    }
+}
+// ── running an action ──
+async function runAction(e, conn, def, b) {
+    const input = (b.input ?? {});
+    const badInput = (0, emu4_actions_def_1.validateInput)(def.input, input);
+    if (badInput)
+        throw bad(badInput, 'input');
+    const granted = Array.isArray(conn.scopes) ? conn.scopes : [];
+    const missing = (def.scopes ?? []).filter((s) => granted.length > 0 && !granted.includes(s));
+    if (missing.length)
+        throw new errors_1.EmulatorError('FORBIDDEN', `The connection lacks the provider scopes this action needs: ${missing.join(' ')}. Reconnect with them.`, undefined, { meta: { missing_scopes: missing, connection_id: conn.id } });
+    const req = (0, emu4_actions_def_1.buildActionRequest)(def, input);
+    if (b.dry_run === true)
+        return { object: 'connection_action_result', action: def.name, connection_id: conn.id, ok: true, status: null, data: null, error: null, truncated: false, attempts: 0, dry_run: req };
+    const call = async (url) => {
+        const headers = { ...req.headers, ...(req.body !== undefined && !Object.keys(req.headers).some((h) => h.toLowerCase() === 'content-type') ? { 'content-type': 'application/json' } : {}) };
+        return (0, connections_1.relayCall)(e, conn, { method: req.method, url, headers, ...(req.body !== undefined ? { body: req.body } : {}) });
+    };
+    const parse = (text) => {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return text;
+        }
+    };
+    const pg = def.paginate;
+    if (b.all_pages === true && pg && pg.type === 'cursor' && typeof pg.cursor_path === 'string' && typeof pg.cursor_param === 'string' && typeof pg.items_path === 'string') {
+        const items = [];
+        let url = req.url;
+        let last = {};
+        for (let page = 0; page < 10 && items.length < 1000; page++) {
+            last = await call(url);
+            const body = parse(last.body);
+            const got = (0, emu4_actions_def_1.pick)(body, pg.items_path);
+            if (Array.isArray(got))
+                items.push(...got);
+            const next = (0, emu4_actions_def_1.pick)(body, pg.cursor_path);
+            if (last.status < 200 || last.status >= 300 || typeof next !== 'string' || !next)
+                break;
+            const u = new URL(url);
+            u.searchParams.set(pg.cursor_param, next);
+            url = u.toString();
+        }
+        return { object: 'connection_action_result', action: def.name, connection_id: conn.id, ok: last.status >= 200 && last.status < 300, status: last.status, data: items.slice(0, 1000), error: null, truncated: false, attempts: 1 };
+    }
+    const out = await call(req.url);
+    const data = parse(out.body);
+    let ok = out.status >= 200 && out.status < 300;
+    let error = ok ? null : `The provider answered ${out.status}.`;
+    const r = def.response;
+    if (ok && r?.ok_field && typeof data === 'object' && data !== null && (0, emu4_actions_def_1.pick)(data, r.ok_field) === false) {
+        ok = false;
+        const x = r.error_field ? (0, emu4_actions_def_1.pick)(data, r.error_field) : undefined;
+        error = typeof x === 'string' ? x : 'The provider reported an error.';
+    }
+    const answer = ok && r?.path ? (0, emu4_actions_def_1.pick)(data, r.path) : data;
+    const drift = ok && def.output ? (0, emu4_actions_def_1.validateInput)(def.output, answer, 'output') : null;
+    observe(e, { provider: def.provider, action: def.name, status: out.status, headers: out.headers ?? {}, drift });
+    return { object: 'connection_action_result', action: def.name, connection_id: conn.id, ok, status: out.status, data: answer, error, truncated: false, attempts: 1, output_valid: ok && def.output ? drift === null : null };
+}
+// ── Action dry run (the sandbox) ──
+function testEvent(sample, trigger, ip) {
+    const u = (sample.user ?? {});
+    const org = sample.organization;
+    return {
+        user: { id: u.id ?? 'user_sample', email: u.email ?? 'sample@example.com', emailVerified: u.emailVerified ?? true, firstName: u.firstName ?? null, lastName: u.lastName ?? null, username: u.username ?? null, metadata: u.metadata ?? {}, organizations: Array.isArray(u.organizations) ? u.organizations : [] },
+        connection: { strategy: sample.connection?.strategy ?? 'password', ...(sample.connection?.method ? { method: sample.connection.method } : {}) },
+        request: { ip: sample.request?.ip ?? ip, userAgent: sample.request?.user_agent ?? 'action-test', country: sample.request?.country ?? null },
+        context: { trigger, ...(sample.context ?? {}) },
+        ...(sample.sign_up_fields ? { signUpFields: sample.sign_up_fields } : {}),
+        ...(org ? { organization: { id: org.id ?? null, name: org.name ?? 'Sample org', slug: org.slug ?? 'sample-org' } } : {}),
+        secrets: {},
+    };
+}
+/** What a dry run shows of a queued request: query values masked, header names only, whether there is a body. */
+const maskedRequest = (r) => {
+    const u = new URL(r.url);
+    for (const k of [...u.searchParams.keys()])
+        u.searchParams.set(k, '\u2026');
+    return { method: r.method, url: u.toString(), header_names: Object.keys(r.headers ?? {}), has_body: r.body !== null, save_response_as: r.saveResponseAs ?? null };
+};
+// ── dynamic client registration ──
+const DCR_METHODS = ['client_secret_basic', 'client_secret_post', 'private_key_jwt'];
+const clientsTable = (e) => {
+    let t = e.generic.get('connections/oauth_clients');
+    if (!t)
+        e.generic.set('connections/oauth_clients', (t = new store_1.Table('connections/oauth_clients', e.clock.now, 'oauthclient')));
+    return t;
+};
+function emu4ActionsHandlers() {
+    const openAction = (e, id) => {
+        const a = e.generic.get('actions')?.get(id);
+        if (!a)
+            throw (0, errors_1.notFound)('Action');
+        return a;
+    };
+    const provider = (c) => {
+        const p = c.query.get('provider');
+        if (p !== null && !PROVIDER.test(p))
+            throw bad('provider must be a short lowercase key.', 'provider');
+        return p ?? '';
+    };
+    const changeOf = (e, id) => {
+        const r = st(e).changes.get(id);
+        if (!r)
+            throw (0, errors_1.notFound)('Change');
+        return r;
+    };
+    function handleChange(c, verb) {
+        const row = changeOf(c.engine, c.params.id);
+        row.status = verb === 'acknowledge' ? 'acknowledged' : 'resolved';
+        row.handled_by = 'emulator';
+        row.handled_at = c.engine.clock.now();
+        audit(c.engine, `provider_change_${row.status}`, 'connection_provider_change', row.id, { provider: row.provider, kind: row.kind, action: row.subject });
+        return { body: changeView(row) };
+    }
+    return [
+        // ── Action dry run ──
+        {
+            method: 'POST',
+            pattern: '/v1/actions/:id/test',
+            scope: 'actions:write',
+            handler: (c) => {
+                const a = openAction(c.engine, c.params.id);
+                const event = testEvent((c.body.event ?? {}), String(a.trigger ?? ''), '127.0.0.1');
+                const base = { object: 'action_test_result', id: a.id };
+                const none = { denied: false, deny_reason: null, access_token_claims: {}, id_token_claims: {}, app_metadata: {}, lock_reason: null, pause_reason: null, challenge: null, challenge_accepted: null, suppressed_access_claims: [], suppressed_id_claims: [], user_edits: {}, sign_up_prefill: {}, sign_up_modify: {}, logs: [], http_requests: [] };
+                if (a.runtime === 'http')
+                    return { body: { ...base, ...none, error: 'An http Action is not called by the emulator; answer it with your own endpoint test.' } };
+                const r = (0, emu4_actions_sandbox_1.runActionCode)(event, String(a.code ?? ''));
+                if (!r)
+                    return { body: { ...base, ...none, error: 'This Action is not in the runtime form (a function body using `api` and `event`), so it was not run.' } };
+                return {
+                    body: { ...base, denied: r.denied, deny_reason: r.denyReason, access_token_claims: r.accessTokenClaims, id_token_claims: r.idTokenClaims, app_metadata: r.appMetadata, lock_reason: r.lockReason, pause_reason: r.pauseReason, challenge: null, challenge_accepted: null, suppressed_access_claims: r.suppressedAccessClaims, suppressed_id_claims: r.suppressedIdClaims, user_edits: r.userEdits, sign_up_prefill: r.signUpPrefill, sign_up_modify: r.signUpModify, logs: r.logs, http_requests: r.httpRequests.map(maskedRequest), error: r.error },
+                };
+            },
+        },
+        // ── helpers for tests ──
+        {
+            method: 'GET',
+            pattern: '/__emulator/actions/runs',
+            public: true,
+            handler: (c) => {
+                const rows = (0, emu4_actions_sandbox_1.actionRuns)(c.engine).all().filter((r) => (!c.query.get('action_id') || r.action_id === c.query.get('action_id')) && (!c.query.get('trigger') || r.trigger === c.query.get('trigger')));
+                return { body: { object: 'list', data: rows.map((r) => ({ object: 'emulator_action_run', ...r })), has_more: false, next_cursor: null } };
+            },
+        },
+        { method: 'DELETE', pattern: '/__emulator/actions/runs', public: true, handler: (c) => ((0, emu4_actions_sandbox_1.actionRuns)(c.engine).clear(), { body: { ok: true } }) },
+        { method: 'GET', pattern: '/__emulator/connections/audit', public: true, handler: (c) => ({ body: { object: 'list', data: [...st(c.engine).audit].reverse(), has_more: false, next_cursor: null } }) },
+        {
+            // Answer a provider call: `url` is an exact origin + path, or a prefix ending in `*`; `times` limits the uses.
+            method: 'POST',
+            pattern: '/__emulator/connections/provider_stubs',
+            public: true,
+            handler: (c) => ({ status: 201, body: { object: 'emulator_provider_stub', ...(0, emu4_actions_access_1.addProviderStub)(c.engine, c.body) } }),
+        },
+        { method: 'GET', pattern: '/__emulator/connections/provider_stubs', public: true, handler: (c) => ({ body: { object: 'list', data: (0, emu4_actions_access_1.providerStubs)(c.engine).list.map((s) => ({ object: 'emulator_provider_stub', ...s })), has_more: false, next_cursor: null } }) },
+        { method: 'DELETE', pattern: '/__emulator/connections/provider_stubs', public: true, handler: (c) => (((0, emu4_actions_access_1.providerStubs)(c.engine).list.length = 0), { body: { ok: true } }) },
+        {
+            // Feed the radar an observation without a provider call: { provider, action, status?, headers?, drift? }.
+            method: 'POST',
+            pattern: '/__emulator/connections/radar_observation',
+            public: true,
+            handler: (c) => {
+                if (typeof c.body.provider !== 'string' || typeof c.body.action !== 'string')
+                    throw bad('provider and action are required.', 'provider');
+                observe(c.engine, { provider: c.body.provider, action: c.body.action, status: Number(c.body.status ?? 200), headers: Object.fromEntries(Object.entries((c.body.headers ?? {})).map(([k, v]) => [k.toLowerCase(), String(v)])), drift: typeof c.body.drift === 'string' ? c.body.drift : null });
+                return { body: { ok: true, open: st(c.engine).changes.filter((r) => r.status === 'open').length } };
+            },
+        },
+        // ── catalog ──
+        {
+            method: 'GET',
+            pattern: '/v1/connection_actions',
+            scope: 'organizations:read',
+            handler: (c) => {
+                const p = provider(c);
+                const data = (p ? [p] : providersOf(c.engine)).flatMap((x) => actionsFor(c.engine, x)).map(present);
+                return { body: { object: 'list', data, has_more: false } };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/connection_actions/types',
+            scope: 'organizations:read',
+            handler: (c) => {
+                const p = provider(c);
+                const actions = (p ? [p] : providersOf(c.engine)).flatMap((x) => actionsFor(c.engine, x));
+                return { body: { object: 'connection_action_types', provider: p || null, actions: actions.length, source: (0, emu4_actions_typegen_1.actionTypesSource)(actions) } };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/connection_actions/:provider/:name',
+            scope: 'organizations:read',
+            handler: (c) => {
+                const a = actionsFor(c.engine, c.params.provider ?? '').find((x) => x.name === c.params.name);
+                if (!a)
+                    throw (0, errors_1.notFound)('Action');
+                return { body: present(a) };
+            },
+        },
+        {
+            method: 'PUT',
+            pattern: '/v1/connection_actions/:provider/:name',
+            scope: 'organizations:write',
+            handler: (c) => {
+                const { provider: p = '', name = '' } = c.params;
+                const def = (0, emu4_actions_def_1.parseActionDef)(p, name, c.body);
+                st(c.engine).defs.set(`${p}/${name}`, def);
+                audit(c.engine, 'action_defined', 'connection_action', `${p}/${name}`);
+                return { body: present(def) };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/connection_actions/:provider/:name',
+            scope: 'organizations:write',
+            handler: (c) => {
+                const key = `${c.params.provider}/${c.params.name}`;
+                if (!st(c.engine).defs.delete(key))
+                    throw (0, errors_1.notFound)('Custom definition');
+                audit(c.engine, 'action_removed', 'connection_action', key);
+                return { status: 204 };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/connections/:id/actions',
+            scope: 'organizations:read',
+            handler: (c) => ({ body: { object: 'list', data: actionsFor(c.engine, String(connOf(c.engine, c.params.id).provider)).map(present), has_more: false } }),
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/connections/:id/actions/:name',
+            scope: 'oauth_tokens:read',
+            handler: async (c) => {
+                const e = c.engine;
+                const conn = connOf(e, c.params.id);
+                const def = actionsFor(e, String(conn.provider)).find((a) => a.name === c.params.name);
+                if (!def)
+                    throw (0, errors_1.notFound)('Action for this connection\'s provider');
+                (0, emu4_actions_access_1.assertConnectionAccess)(e, conn.id, c.key, 'run_actions');
+                for (const f of ['dry_run', 'all_pages'])
+                    if (c.body[f] !== undefined && typeof c.body[f] !== 'boolean')
+                        throw bad(`${f} must be true or false.`, f);
+                const out = await runAction(e, conn, def, c.body);
+                // Action, provider status and attempts only: never the input or the answer.
+                audit(e, 'action_ran', 'connection', conn.id, { action: def.name, provider: conn.provider, ok: out.ok, status: out.status, dry_run: c.body.dry_run === true });
+                return { headers: { 'x-atlas-attempts': String(out.attempts) }, body: out };
+            },
+        },
+        // ── provider change radar ──
+        {
+            method: 'GET',
+            pattern: '/v1/connection_provider_changes',
+            scope: 'organizations:read',
+            handler: (c) => {
+                const e = c.engine;
+                const status = c.query.get('status');
+                const kind = c.query.get('kind');
+                if (status !== null && status !== 'all' && !CHANGE_STATUSES.includes(status))
+                    throw bad('status must be open, acknowledged, resolved or all.', 'status');
+                if (kind !== null && !CHANGE_KINDS.includes(kind))
+                    throw bad(`kind must be one of ${CHANGE_KINDS.join(', ')}.`, 'kind');
+                const limit = Math.min(Math.max(Number(c.query.get('limit')) || 100, 1), 200);
+                const after = c.query.get('starting_after');
+                if (after && !st(e).changes.get(after))
+                    throw bad('Unknown starting_after cursor.', 'starting_after');
+                const want = status === 'all' ? null : (status ?? 'open');
+                const rows = st(e).changes.all().filter((r) => (!c.query.get('provider') || r.provider === c.query.get('provider')) && (!want || r.status === want) && (!kind || r.kind === kind)).sort((a, b) => b.last_seen_at - a.last_seen_at || (a.id < b.id ? 1 : -1));
+                const page = (0, store_1.paginate)(rows, { limit, startingAfter: after ?? undefined });
+                return { body: { object: 'list', data: page.data.map(changeView), has_more: page.has_more, next_cursor: page.next_cursor } };
+            },
+        },
+        { method: 'GET', pattern: '/v1/connection_provider_changes/:id', scope: 'organizations:read', handler: (c) => ({ body: changeView(changeOf(c.engine, c.params.id)) }) },
+        { method: 'POST', pattern: '/v1/connection_provider_changes/:id/acknowledge', scope: 'organizations:write', handler: (c) => handleChange(c, 'acknowledge') },
+        { method: 'POST', pattern: '/v1/connection_provider_changes/:id/resolve', scope: 'organizations:write', handler: (c) => handleChange(c, 'resolve') },
+        // ── access rules ──
+        {
+            method: 'GET',
+            pattern: '/v1/connections/:id/access_rules',
+            scope: 'organizations:read',
+            handler: (c) => {
+                const conn = connOf(c.engine, c.params.id);
+                const rules = (0, emu4_actions_access_1.rulesOf)(c.engine, conn.id);
+                return { body: { object: 'connection_access_rules', connection_id: conn.id, restricted: rules.length > 0, rules: rules.map(emu4_actions_access_1.accessRuleView) } };
+            },
+        },
+        {
+            method: 'PUT',
+            pattern: '/v1/connections/:id/access_rules',
+            scope: 'organizations:write',
+            handler: (c) => {
+                const e = c.engine;
+                const conn = connOf(e, c.params.id);
+                const saved = (0, emu4_actions_access_1.replaceAccessRules)(e, conn.id, (0, emu4_actions_access_1.parseAccessRules)(c.body));
+                audit(e, 'access_rules_set', 'connection', conn.id, { provider: conn.provider, rules: saved.length, restricted: saved.length > 0 });
+                return { body: { object: 'connection_access_rules', connection_id: conn.id, restricted: saved.length > 0, rules: saved.map(emu4_actions_access_1.accessRuleView) } };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/connections/:id/access_rules',
+            scope: 'organizations:write',
+            handler: (c) => {
+                const conn = connOf(c.engine, c.params.id);
+                (0, emu4_actions_access_1.replaceAccessRules)(c.engine, conn.id, []);
+                audit(c.engine, 'access_rules_cleared', 'connection', conn.id, { provider: conn.provider });
+                return { status: 204 };
+            },
+        },
+        // ── dynamic client registration (RFC 7591) ──
+        {
+            method: 'POST',
+            pattern: '/v1/connections/oauth_clients/register',
+            scope: 'organizations:write',
+            handler: async (c) => {
+                const e = c.engine;
+                const b = c.body;
+                const owner = (b.owner ?? {});
+                const instanceWide = b.owner === undefined || b.owner === null || owner.type === 'instance';
+                if (!instanceWide && (!OWNER_TYPES.includes(owner.type) || typeof owner.id !== 'string' || !owner.id))
+                    throw bad('owner must be omitted, {type: "instance"}, or {type: "organization" | "user" | "external", id}.', 'owner');
+                if (typeof b.provider !== 'string' || !PROVIDER.test(b.provider))
+                    throw bad('provider must be a short lowercase key.', 'provider');
+                if (!instanceWide && owner.type === 'organization' && !e.db.organizations.get(owner.id))
+                    throw (0, errors_1.notFound)('Organization');
+                if (!instanceWide && owner.type === 'user' && !e.db.users.get(owner.id))
+                    throw (0, errors_1.notFound)('User');
+                if (b.environment !== undefined && b.environment !== 'production' && b.environment !== 'sandbox')
+                    throw bad('environment must be production or sandbox.', 'environment');
+                const environment = b.environment ?? 'production';
+                const method = b.token_endpoint_auth_method ?? 'client_secret_basic';
+                if (!DCR_METHODS.includes(method))
+                    throw bad(`token_endpoint_auth_method must be one of ${DCR_METHODS.join(', ')}.`, 'token_endpoint_auth_method');
+                if (b.initial_access_token !== undefined && (typeof b.initial_access_token !== 'string' || !b.initial_access_token || b.initial_access_token.length > 4096))
+                    throw bad('initial_access_token must be a token string.', 'initial_access_token');
+                if (b.client_name !== undefined && (typeof b.client_name !== 'string' || !b.client_name.trim() || b.client_name.length > 200))
+                    throw bad('client_name must be 1 to 200 characters.', 'client_name');
+                if (b.scopes !== undefined && (!Array.isArray(b.scopes) || b.scopes.length > 50 || b.scopes.some((s) => typeof s !== 'string' || !s || /\s/.test(s))))
+                    throw bad('scopes must be up to 50 scope strings.', 'scopes');
+                let endpoint;
+                try {
+                    if (typeof b.registration_endpoint !== 'string' || b.registration_endpoint.length > 2048)
+                        throw new Error('x');
+                    endpoint = new URL(b.registration_endpoint);
+                    if (endpoint.protocol !== 'https:' || endpoint.username || endpoint.password || endpoint.hash)
+                        throw new Error('x');
+                }
+                catch {
+                    throw bad('registration_endpoint must be an https URL without credentials or a fragment.', 'registration_endpoint');
+                }
+                const ownerType = instanceWide ? 'instance' : owner.type;
+                const ownerId = instanceWide ? 'instance' : owner.id;
+                const clients = clientsTable(e);
+                // An existing client is never silently replaced: its connections would lose the client that issued their tokens.
+                if (clients.find((r) => r.owner_type === ownerType && r.owner_id === ownerId && r.provider === b.provider && r.environment === environment)) {
+                    throw new errors_1.EmulatorError('CONFLICT', 'That owner already has a client for this provider and environment. Delete it first to register a new one.');
+                }
+                const redirectUri = typeof b.redirect_uri === 'string' ? b.redirect_uri : `${e.issuer}/v1/oauth/callback/${b.provider}`;
+                const metadata = { client_name: b.client_name?.trim() ?? `Atlas (${b.provider})`, redirect_uris: [redirectUri], grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], application_type: 'web', token_endpoint_auth_method: method, ...(b.scopes?.length ? { scope: b.scopes.join(' ') } : {}) };
+                let publicJwk = null;
+                if (method === 'private_key_jwt') {
+                    const pair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+                    const jwk = (await crypto.subtle.exportKey('jwk', pair.publicKey));
+                    const kid = (0, crypto_util_1.bytesToB64url)(crypto.getRandomValues(new Uint8Array(9)));
+                    publicJwk = { ...jwk, kid, alg: 'ES256', use: 'sig' };
+                    // The private half is never kept: the emulator holds only the public key it publishes.
+                    metadata.token_endpoint_auth_signing_alg = 'ES256';
+                    metadata.jwks = { keys: [publicJwk] };
+                }
+                const url = endpoint.toString();
+                const init = { method: 'POST', headers: { 'content-type': 'application/json', accept: 'application/json', ...(b.initial_access_token ? { authorization: `Bearer ${b.initial_access_token}` } : {}) }, body: JSON.stringify(metadata), redirect: 'manual' };
+                let res;
+                try {
+                    const stub = (0, emu4_actions_access_1.matchProviderStub)(e, url, 'POST');
+                    if (!stub && !e.options.fetch)
+                        throw new Error('no fetch');
+                    res = stub ?? (await e.options.fetch(url, init));
+                }
+                catch {
+                    throw bad('The registration endpoint could not be reached.', 'registration_endpoint');
+                }
+                let reply = {};
+                try {
+                    reply = (await res.json());
+                }
+                catch {
+                    /* not JSON */
+                }
+                const str = (v) => (typeof v === 'string' && v !== '' ? v : null);
+                if (res.status !== 201 && res.status !== 200)
+                    throw bad(`The provider refused the registration: ${(str(reply.error_description) ?? str(reply.error) ?? `HTTP ${res.status}`).slice(0, 300)}`, 'registration_endpoint');
+                const clientId = str(reply.client_id);
+                if (!clientId || clientId.length > 512)
+                    throw bad('The provider did not return a client_id.', 'registration_endpoint');
+                if (method !== 'private_key_jwt' && !str(reply.client_secret))
+                    throw bad('The provider did not return a client_secret for a secret-based client.', 'registration_endpoint');
+                const uri = str(reply.registration_client_uri);
+                const expires = typeof reply.client_secret_expires_at === 'number' && reply.client_secret_expires_at > 0 ? reply.client_secret_expires_at : null;
+                const now = e.clock.now();
+                const row = clients.insert({ owner_type: ownerType, owner_id: ownerId, provider: b.provider, environment, client_id: clientId, auth_method: publicJwk ? 'private_key_jwt' : 'client_secret', key_alg: publicJwk ? 'ES256' : null, public_jwk: publicJwk, key_id: publicJwk?.kid ?? null, scopes: b.scopes ?? [], registration_client_uri: uri && /^https:\/\//.test(uri) ? uri : null, redirect_uri: typeof b.redirect_uri === 'string' ? b.redirect_uri : null, registered_via: 'dcr', enabled: true, created_at: now, updated_at: now });
+                // The secret, the registration token and the initial access token are never stored in the row, the audit log or the answer.
+                audit(e, 'oauth_client_registered', 'connection', row.id, { provider: row.provider, owner_type: ownerType, owner_id: ownerId, environment, auth_method: row.auth_method });
+                return {
+                    status: 201,
+                    body: {
+                        object: 'connection_oauth_client', id: row.id, owner: instanceWide ? { type: 'instance' } : { type: ownerType, id: ownerId }, provider: row.provider, environment, client_id: clientId, has_secret: true, auth_method: row.auth_method, key_id: row.key_id, key_alg: row.key_alg, public_jwk: publicJwk, jwks_url: publicJwk ? `${e.issuer}/v1/connection_client_jwks/${e.instanceId}/${row.id}` : null, mtls_cert: null, registered_via: 'dcr', registration_client_uri: row.registration_client_uri, scopes: row.scopes, host_params: {}, enabled: true, redirect_uri: row.redirect_uri, callback_url: row.redirect_uri ?? `${e.issuer}/v1/oauth/callback/${b.provider}`, forward_url: `${e.issuer}/v1/oauth/callback/${b.provider}`, created_at: now, updated_at: now, secret_expires_at: expires ? expires * 1000 : null,
+                    },
+                };
+            },
+        },
+        {
+            // The public key of a private_key_jwt client; unknown, disabled and wrong-method clients all answer 404.
+            method: 'GET',
+            pattern: '/v1/connection_client_jwks/:instanceId/:clientId',
+            public: true,
+            handler: (c) => {
+                const row = c.params.instanceId === c.engine.instanceId ? clientsTable(c.engine).get(c.params.clientId) : undefined;
+                if (!row || row.enabled === false || row.auth_method !== 'private_key_jwt' || !row.public_jwk)
+                    throw (0, errors_1.notFound)('Client');
+                return { headers: { 'cache-control': 'public, max-age=300' }, body: { keys: [row.public_jwk] } };
+            },
+        },
+    ];
+}
+//# sourceMappingURL=emu4-actions.js.map

package/dist/handlers/emu4-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-actions.js","sourceRoot":"","sources":["../../src/handlers/emu4-actions.ts"],"names":[],"mappings":";;AA+KA,kDAqTC;AAleD,sCAAoD;AAEpD,oCAA2C;AAC3C,gDAA+C;AAC/C,uCAAwC;AACxC,iEAAmE;AACnE,iEAA0D;AAC1D,yDAA6G;AAC7G,iEAA2D;AAC3D,+DAAiL;AACjL,+CAA0C;AAE1C;;;;;;GAMG;AACH,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAc,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACxG,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAOzD,MAAM,EAAE,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAS,EAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,aAAK,CAAC,6BAA6B,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEtJ,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,MAAc,EAAE,UAAkB,EAAE,QAAgB,EAAE,QAAa,EAAE,EAAQ,EAAE;IACvG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,cAAc,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1K,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAsB,EAAO,EAAE;IACxD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,MAAM,IAAA,iBAAQ,EAAC,YAAY,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,2BAA2B;AAC3B,MAAM,OAAO,GAAG,CAAC,CAAY,EAAE,CAAY,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACjG,MAAM,SAAS,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,uCAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3I,iHAAiH;AACjH,SAAS,UAAU,CAAC,CAAS,EAAE,QAAgB;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,uCAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AACD,MAAM,WAAW,GAAG,CAAC,CAAS,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,uCAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnK,MAAM,OAAO,GAAG,CAAC,CAAY,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE1T,8BAA8B;AAC9B,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;AACtE,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;AAC7D,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,CAAC,GAAG,GAAG,EAAiB,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACxG,MAAM,UAAU,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;AASlV,yHAAyH;AACzH,SAAS,OAAO,CAAC,CAAS,EAAE,CAAc;IACxC,MAAM,KAAK,GAA8D,EAAE,CAAC;IAC5E,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,WAAW,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,MAAM,IAAI,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACrJ,IAAI,CAAC,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACnJ,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACrH,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC;QAC7G,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,WAAW,EAAE,CAAC;YAClB,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC;YACvB,6DAA6D;YAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;gBAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACnD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1O,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,4BAA4B,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,0BAA0B;AAC1B,KAAK,UAAU,SAAS,CAAC,CAAS,EAAE,IAAS,EAAE,GAAc,EAAE,CAAM;IACnE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAQ,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAA,gCAAa,EAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,MAAM,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAa,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,+DAA+D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7O,MAAM,GAAG,GAAG,IAAA,qCAAkB,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC9M,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAgB,EAAE;QAC/C,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3L,OAAO,IAAA,uBAAS,EAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAW,EAAE;QACtC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,GAAG,CAAC,QAA2B,CAAC;IAC3C,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACzK,MAAM,KAAK,GAAc,EAAE,CAAC;QAC5B,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAClB,IAAI,IAAI,GAAQ,EAAE,CAAC;QACnB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5D,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAA,uBAAI,EAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAA,uBAAI,EAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;gBAAE,MAAM;YACxF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAC1C,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACpO,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IAC/C,IAAI,KAAK,GAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,GAAG,CAAC,MAAM,GAAG,CAAC;IAC9E,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;IACvB,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAA,uBAAI,EAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACvG,EAAE,GAAG,KAAK,CAAC;QACX,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,uBAAI,EAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,KAAK,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAA,uBAAI,EAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,gCAAa,EAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,OAAO,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9N,CAAC;AAED,qCAAqC;AACrC,SAAS,SAAS,CAAC,MAAW,EAAE,OAAe,EAAE,EAAU;IACzD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAQ,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,YAA+B,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,oBAAoB,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE;QACjT,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC/I,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE;QAC3I,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;QAC/C,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AACD,iHAAiH;AACjH,MAAM,aAAa,GAAG,CAAC,CAAM,EAAO,EAAE;IACpC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;AACpK,CAAC,CAAC;AAEF,oCAAoC;AACpC,MAAM,WAAW,GAAG,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;AACrF,MAAM,YAAY,GAAG,CAAC,CAAS,EAAS,EAAE;IACxC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC;QAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC,GAAG,IAAI,aAAK,CAAC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC7H,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,SAAgB,mBAAmB;IACjC,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAsB,EAAO,EAAE;QAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC;YAAE,MAAM,IAAA,iBAAQ,EAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,CAAe,EAAU,EAAE;QAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAsB,EAAO,EAAE;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAA,iBAAQ,EAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,SAAS,YAAY,CAAC,CAAe,EAAE,IAA+B;QACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,MAAM,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;QAClE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;QAC5B,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,4BAA4B,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxJ,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,OAAO;QACL,uBAAuB;QACvB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sBAAsB;YAC/B,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;gBAC3F,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;gBAClV,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,sFAAsF,EAAE,EAAE,CAAC;gBAC/J,MAAM,CAAC,GAAG,IAAA,oCAAa,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,sGAAsG,EAAE,EAAE,CAAC;gBAC7J,OAAO;oBACL,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,iBAAiB,EAAE,eAAe,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC,sBAAsB,EAAE,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;iBACthB,CAAC;YACJ,CAAC;SACF;QACD,0BAA0B;QAC1B;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,IAAI,GAAG,IAAA,iCAAU,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACpM,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5I,CAAC;SACF;QACD,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,iCAAU,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;QAC/I,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;QACtM;YACE,+GAA+G;YAC/G,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wCAAwC;YACjD,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,IAAA,qCAAe,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;SACpH;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAA,mCAAa,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;QACnQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAA,mCAAa,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;QAC1K;YACE,0GAA0G;YAC1G,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2CAA2C;YACpD,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,mCAAmC,EAAE,UAAU,CAAC,CAAC;gBACzI,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvS,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtG,CAAC;SACF;QAED,gBAAgB;QAChB;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,wBAAwB;YACjC,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACtB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpG,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACtB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1F,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAA,wCAAiB,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAC3I,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,wCAAwC;YACjD,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9F,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,wCAAwC;YACjD,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;gBACjD,MAAM,GAAG,GAAG,IAAA,iCAAc,EAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5C,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3C,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBACvE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,wCAAwC;YACjD,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpD,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,mBAAmB,CAAC,CAAC;gBACxE,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;gBAC5D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzB,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,6BAA6B;YACtC,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;SACzJ;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACvF,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAA,iBAAQ,EAAC,wCAAwC,CAAC,CAAC;gBACnE,IAAA,4CAAsB,EAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACzD,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;oBAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;wBAAE,MAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;gBACrJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,4EAA4E;gBAC5E,KAAK,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/J,OAAO,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YAC9E,CAAC;SACF;QAED,8BAA8B;QAC9B;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,iCAAiC;YAC1C,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,MAAM,GAAG,CAAC,qDAAqD,EAAE,QAAQ,CAAC,CAAC;gBACzJ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACxH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC5C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,MAAM,GAAG,CAAC,gCAAgC,EAAE,gBAAgB,CAAC,CAAC;gBACtG,MAAM,IAAI,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;gBAC1D,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7P,MAAM,IAAI,GAAG,IAAA,gBAAQ,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;gBAC1E,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/H,CAAC;SACF;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;QACvK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iDAAiD,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE;QAC5J,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,6CAA6C,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE;QAEpJ,qBAAqB;QACrB;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,kCAAkC;YAC3C,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAA,6BAAO,EAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBACzC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,oCAAc,CAAC,EAAE,EAAE,CAAC;YACjJ,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,kCAAkC;YAC3C,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAA,wCAAkB,EAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAA,sCAAgB,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvE,KAAK,CAAC,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpI,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,oCAAc,CAAC,EAAE,EAAE,CAAC;YACjJ,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,kCAAkC;YAC3C,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAA,wCAAkB,EAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC1C,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,sBAAsB,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5F,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzB,CAAC;SACF;QAED,+CAA+C;QAC/C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wCAAwC;YACjD,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAQ,CAAC;gBACrC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;gBAC5F,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAE,MAAM,GAAG,CAAC,iGAAiG,EAAE,OAAO,CAAC,CAAC;gBAC7N,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAAE,MAAM,GAAG,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;gBACnI,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,cAAc,CAAC,CAAC;gBACxH,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,MAAM,CAAC,CAAC;gBAChG,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,YAAY,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;oBAAE,MAAM,GAAG,CAAC,4CAA4C,EAAE,aAAa,CAAC,CAAC;gBACzK,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,YAAY,CAAC;gBAClD,MAAM,MAAM,GAAG,CAAC,CAAC,0BAA0B,IAAI,qBAAqB,CAAC;gBACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,MAAM,GAAG,CAAC,6CAA6C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;gBACnJ,IAAI,CAAC,CAAC,oBAAoB,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC,8CAA8C,EAAE,sBAAsB,CAAC,CAAC;gBAC/O,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC,0CAA0C,EAAE,aAAa,CAAC,CAAC;gBACpM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,CAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC;gBAC9N,IAAI,QAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,IAAI,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,IAAI,CAAC,CAAC,qBAAqB,CAAC,MAAM,GAAG,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC/G,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;oBAC5C,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,CAAC,+EAA+E,EAAE,uBAAuB,CAAC,CAAC;gBACtH,CAAC;gBACD,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACzD,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAChC,iHAAiH;gBACjH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,EAAE,CAAC;oBAC5I,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,2GAA2G,CAAC,CAAC;gBACnJ,CAAC;gBACD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACxH,MAAM,QAAQ,GAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,QAAQ,GAAG,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC/T,IAAI,SAAS,GAAe,IAAI,CAAC;gBACjC,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;oBACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;oBAC/G,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAQ,CAAC;oBAC1E,MAAM,GAAG,GAAG,IAAA,2BAAa,EAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACrE,SAAS,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;oBACtD,uFAAuF;oBACvF,QAAQ,CAAC,+BAA+B,GAAG,OAAO,CAAC;oBACnD,QAAQ,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,CAAC;gBACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAiB,EAAE,CAAC;gBACpQ,IAAI,GAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAA,uCAAiB,EAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;oBAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;oBAC3D,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,CAAC,iDAAiD,EAAE,uBAAuB,CAAC,CAAC;gBACxF,CAAC;gBACD,IAAI,KAAK,GAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;gBACD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,GAAG,CAAC,0CAA0C,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;gBACvN,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACtC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;oBAAE,MAAM,GAAG,CAAC,0CAA0C,EAAE,uBAAuB,CAAC,CAAC;gBACvH,IAAI,MAAM,KAAK,iBAAiB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;oBAAE,MAAM,GAAG,CAAC,wEAAwE,EAAE,uBAAuB,CAAC,CAAC;gBAC5K,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC/C,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,wBAAwB,KAAK,QAAQ,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC;gBACjJ,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,uBAAuB,EAAE,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3gB,4HAA4H;gBAC5H,KAAK,CAAC,CAAC,EAAE,yBAAyB,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC3K,OAAO;oBACL,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE;wBACJ,MAAM,EAAE,yBAAyB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,8BAA8B,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC,MAAM,sBAAsB,CAAC,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,sBAAsB,CAAC,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;qBAC7xB;iBACF,CAAC;YACJ,CAAC;SACF;QACD;YACE,yGAAyG;YACzG,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,kDAAkD;YAC3D,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACpH,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,iBAAiB,IAAI,CAAC,GAAG,CAAC,UAAU;oBAAE,MAAM,IAAA,iBAAQ,EAAC,QAAQ,CAAC,CAAC;gBACxH,OAAO,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnG,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/emu4-authz-trust.d.ts

@@ -0,0 +1,40 @@
+import type { Engine, RouteDef } from '../engine';
+import type { Obj } from '../openapi';
+export declare const EVALUATION_VALID_FOR_SECONDS = 30;
+declare const RISK: {
+    readonly low: 0;
+    readonly medium: 1;
+    readonly high: 2;
+};
+type Risk = keyof typeof RISK;
+export interface Fabric {
+    continuousEvaluation: boolean;
+    maxMfaAgeSeconds: number | null;
+    maxRiskLevel: Risk | null;
+    requireTrustedDevice: boolean;
+    onFailure: 'revoke' | 'deny';
+    maxDelegationDepth: number;
+    defaultDelegationTtlSeconds: number;
+}
+/** Audit rows for every authorization-surface mutation (read back with `GET /__emulator/authz/audit`). */
+export declare function auditAuthz(e: Engine, action: string, targetType: string, targetId: string, metadata?: Obj): void;
+export declare const authzAuditRows: (e: Engine) => Obj[];
+export declare const delegationView: (d: Obj) => Obj;
+/**
+ * Called by every machine-token mint. A machine with no delegation is unaffected. One that has any must hold a live delegation:
+ * the one named by `delegation_id`, or the newest live one. Returns what the mint must apply: scopes narrowed to the delegated
+ * scopes (never widened), a lifetime cap and the `delegation`, `act` and `posture` claims. Refuses (403) when none is live or
+ * the continuous evaluation fails.
+ */
+export declare function delegationForMint(e: Engine, machineId: string, req: Obj): {
+    scopes: string[];
+    ttlSeconds: number;
+    claims: Obj;
+} | null;
+/** What `POST /v1/m2m_tokens/verify` adds for a token minted under a delegation: null when it has none, `revoked` when it is no longer live. */
+export declare function delegationOfToken(e: Engine, claims: Obj): {
+    live: boolean;
+    delegation: Obj;
+} | null;
+export declare function emu4TrustAuthzHandlers(): RouteDef[];
+export {};