@aws/agentcore 1.0.0-preview.12 → 1.0.0-preview.14

package/dist/schema/schemas/auth.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GatewayAuthorizerConfigSchema = exports.AuthorizerConfigSchema = exports.CustomJwtAuthorizerConfigSchema = exports.CustomClaimValidationSchema = exports.InboundTokenClaimValueTypeSchema = exports.ClaimMatchValueSchema = exports.ClaimMatchOperatorSchema = exports.RuntimeAuthorizerTypeSchema = exports.GatewayAuthorizerTypeSchema = void 0;
+exports.GatewayAuthorizerConfigSchema = exports.AuthorizerConfigSchema = exports.CustomJwtAuthorizerConfigSchema = exports.PrivateEndpointOverrideSchema = exports.PrivateEndpointSchema = exports.ManagedVpcResourceSchema = exports.SelfManagedLatticeResourceSchema = exports.EndpointIpAddressTypeSchema = exports.SECURITY_GROUP_ID_PATTERN = exports.SUBNET_ID_PATTERN = exports.VPC_ID_PATTERN = exports.LATTICE_RESOURCE_CONFIG_PATTERN = exports.CustomClaimValidationSchema = exports.InboundTokenClaimValueTypeSchema = exports.ClaimMatchValueSchema = exports.ClaimMatchOperatorSchema = exports.RuntimeAuthorizerTypeSchema = exports.GatewayAuthorizerTypeSchema = void 0;
+const tags_1 = require("./primitives/tags");
 const zod_1 = require("zod");
 // ============================================================================
 // Shared Authorization Schemas
@@ -26,6 +27,9 @@ const OidcDiscoveryUrlSchema = zod_1.z
 // ── Custom Claims Schemas (matches CFN CustomClaimValidationType) ──
 // API-documented patterns (from ClaimMatchValueType and CustomClaimValidationType)
 const MATCH_VALUE_PATTERN = /^[A-Za-z0-9_.-]+$/;
+// OAuth scope token: printable ASCII excluding space (0x20) and double-quote (0x22).
+// Mirrors CFN CustomJWTAuthorizerConfiguration.AllowedScopes.items pattern byte-for-byte.
+const ALLOWED_SCOPE_PATTERN = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
 const CLAIM_NAME_PATTERN = /^[A-Za-z0-9_.:-]+$/;
 // Server-side reserved claim names (not regex-documented; API rejects these at deploy time)
 const RESERVED_CLAIM_NAMES = ['client_id'];
@@ -68,6 +72,77 @@ exports.CustomClaimValidationSchema = zod_1.z
     }),
 })
     .strict();
+// ── PrivateLink Inbound — private endpoint for reaching the OIDC discovery URL ──
+//
+// Nested inside CustomJWTAuthorizerConfiguration ("PrivateLink inbound" GA-parity feature):
+// when a JWT IdP's discovery/JWKS endpoint is privately hosted, this tells the harness how to
+// reach it over a private network. Two mutually-exclusive arms. Patterns match the
+// AWS::BedrockAgentCore::Harness CFN spec byte-for-byte.
+// VPC Lattice resource-config id, or its full ARN. Exported so the TUI validators reuse the
+// schema regex (single source of truth) instead of hand-rolled checks that drift from it.
+exports.LATTICE_RESOURCE_CONFIG_PATTERN = /^((rcfg-[0-9a-z]{17})|(arn:[a-z0-9-]+:vpc-lattice:[a-zA-Z0-9-]+:\d{12}:resourceconfiguration\/rcfg-[0-9a-z]{17}))$/;
+exports.VPC_ID_PATTERN = /^vpc-(([0-9a-z]{8})|([0-9a-z]{17}))$/;
+exports.SUBNET_ID_PATTERN = /^subnet-[0-9a-zA-Z]{8,17}$/;
+exports.SECURITY_GROUP_ID_PATTERN = /^sg-(([0-9a-z]{8})|([0-9a-z]{17}))$/;
+exports.EndpointIpAddressTypeSchema = zod_1.z.enum(['IPV4', 'IPV6']);
+/** Reach the discovery endpoint via a self-managed VPC Lattice resource configuration. */
+exports.SelfManagedLatticeResourceSchema = zod_1.z
+    .object({
+    resourceConfigurationIdentifier: zod_1.z
+        .string()
+        .min(20)
+        .max(2048)
+        .regex(exports.LATTICE_RESOURCE_CONFIG_PATTERN, 'Must be a VPC Lattice resource-config id (rcfg-...) or its ARN'),
+})
+    .strict();
+/** Reach the discovery endpoint via a service-managed VPC interface endpoint. */
+exports.ManagedVpcResourceSchema = zod_1.z
+    .object({
+    vpcIdentifier: zod_1.z.string().regex(exports.VPC_ID_PATTERN, 'Must be a VPC id (vpc-...)'),
+    subnetIds: zod_1.z.array(zod_1.z.string().regex(exports.SUBNET_ID_PATTERN, 'Must be a subnet id (subnet-...)')).min(1),
+    endpointIpAddressType: exports.EndpointIpAddressTypeSchema,
+    securityGroupIds: zod_1.z
+        .array(zod_1.z.string().regex(exports.SECURITY_GROUP_ID_PATTERN, 'Must be a security group id (sg-...)'))
+        .max(5)
+        .optional(),
+    tags: tags_1.TagsSchema.optional(),
+    routingDomain: zod_1.z.string().min(3).max(255).optional(),
+})
+    .strict();
+/**
+ * A private endpoint: exactly one of selfManagedLatticeResource or managedVpcResource.
+ * The CFN spec dropped `oneOf` (contract-test antipattern) and enforces exactly-one structurally;
+ * we mirror that with a superRefine rather than a discriminated union.
+ */
+exports.PrivateEndpointSchema = zod_1.z
+    .object({
+    selfManagedLatticeResource: exports.SelfManagedLatticeResourceSchema.optional(),
+    managedVpcResource: exports.ManagedVpcResourceSchema.optional(),
+})
+    .strict()
+    .superRefine((data, ctx) => {
+    const count = [data.selfManagedLatticeResource, data.managedVpcResource].filter(v => v !== undefined).length;
+    if (count !== 1) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'A private endpoint must set exactly one of selfManagedLatticeResource or managedVpcResource',
+        });
+    }
+});
+/** Maps a specific domain to its own private endpoint (overrides the discovery-URL endpoint for that domain). */
+exports.PrivateEndpointOverrideSchema = zod_1.z
+    .object({
+    domain: zod_1.z.string().min(1).max(253),
+    privateEndpoint: exports.PrivateEndpointSchema,
+})
+    .strict();
+function privateEndpointArm(pe) {
+    if (pe.selfManagedLatticeResource)
+        return 'selfManagedLatticeResource';
+    if (pe.managedVpcResource)
+        return 'managedVpcResource';
+    return undefined;
+}
 // ── Custom JWT Authorizer Configuration ──
 /**
  * Custom JWT authorizer configuration.
@@ -84,10 +159,20 @@ exports.CustomJwtAuthorizerConfigSchema = zod_1.z
     allowedAudience: zod_1.z.array(zod_1.z.string().min(1)).optional(),
     /** List of allowed client IDs */
     allowedClients: zod_1.z.array(zod_1.z.string().min(1)).optional(),
-    /** List of allowed scopes */
-    allowedScopes: zod_1.z.array(zod_1.z.string().min(1)).optional(),
+    /** List of allowed scopes (printable ASCII, no space/quote; ≤255 chars each — CFN parity) */
+    allowedScopes: zod_1.z
+        .array(zod_1.z
+        .string()
+        .min(1)
+        .max(255)
+        .regex(ALLOWED_SCOPE_PATTERN, 'Scope must be printable ASCII with no spaces or quotes'))
+        .optional(),
     /** Custom claim validations */
     customClaims: zod_1.z.array(exports.CustomClaimValidationSchema).min(1).optional(),
+    /** PrivateLink inbound: how to reach the OIDC discovery endpoint over a private network. */
+    privateEndpoint: exports.PrivateEndpointSchema.optional(),
+    /** Per-domain private-endpoint overrides (≤5). */
+    privateEndpointOverrides: zod_1.z.array(exports.PrivateEndpointOverrideSchema).max(5).optional(),
 })
     .strict()
     .superRefine((data, ctx) => {
@@ -101,6 +186,44 @@ exports.CustomJwtAuthorizerConfigSchema = zod_1.z
             message: 'At least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided',
         });
     }
+    // PrivateEndpointOverrides coupling rules — mirror the AgentCore Identity service's deploy-time
+    // validation so the user fails fast here instead of mid-deploy.
+    const overrides = data.privateEndpointOverrides ?? [];
+    if (overrides.length > 0) {
+        // 1. Overrides require a base privateEndpoint.
+        if (!data.privateEndpoint) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'privateEndpointOverrides can only be used when privateEndpoint is also set',
+                path: ['privateEndpointOverrides'],
+            });
+        }
+        else {
+            // 2. The base endpoint and every override must use the same arm (all self-managed or all service-managed).
+            const baseArm = privateEndpointArm(data.privateEndpoint);
+            overrides.forEach((o, i) => {
+                if (privateEndpointArm(o.privateEndpoint) !== baseArm) {
+                    ctx.addIssue({
+                        code: zod_1.z.ZodIssueCode.custom,
+                        message: 'privateEndpoint and privateEndpointOverrides must all be the same kind — either all selfManagedLatticeResource or all managedVpcResource',
+                        path: ['privateEndpointOverrides', i, 'privateEndpoint'],
+                    });
+                }
+            });
+        }
+        // 3. Override domains must be unique.
+        const seen = new Set();
+        overrides.forEach((o, i) => {
+            if (seen.has(o.domain)) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    message: `Duplicate privateEndpointOverride domain: ${o.domain}`,
+                    path: ['privateEndpointOverrides', i, 'domain'],
+                });
+            }
+            seen.add(o.domain);
+        });
+    }
 });
 /**
  * Resource-agnostic authorizer configuration container.

package/dist/schema/schemas/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/schema/schemas/auth.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAElE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAGxE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAG7E,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,qBAAqB,CAAC;KAC1B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;IACzC,OAAO,EAAE,mCAAmC;CAC7C,CAAC;KACD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE;IACnD,OAAO,EAAE,qCAAqC,sBAAsB,GAAG;CACxE,CAAC,CAAC;AAEL,sEAAsE;AAEtE,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAChD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,CAAC,WAAW,CAAC,CAAC;AAE9B,QAAA,wBAAwB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAG1E,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,gBAAgB,EAAE,OAAC;SAChB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;SACpE,QAAQ,EAAE;IACb,oBAAoB,EAAE,OAAC;SACpB,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;SAC3G,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE;IAC9F,OAAO,EAAE,kEAAkE;CAC5E,CAAC;KACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC,EAAE;IACjG,OAAO,EAAE,sEAAsE;CAChF,CAAC,CAAC;AAGQ,QAAA,gCAAgC,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAGtE,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,qBAAqB,EAAE,OAAC;SACrB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,kBAAkB,EAAE,wCAAwC,CAAC;SACnE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpD,OAAO,EAAE,yCAAyC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACrF,CAAC;IACJ,0BAA0B,EAAE,wCAAgC;IAC5D,0BAA0B,EAAE,OAAC,CAAC,MAAM,CAAC;QACnC,kBAAkB,EAAE,gCAAwB;QAC5C,eAAe,EAAE,6BAAqB;KACvC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,4CAA4C;AAE5C;;;;;;GAMG;AACU,QAAA,+BAA+B,GAAG,OAAC;KAC7C,MAAM,CAAC;IACN,0HAA0H;IAC1H,YAAY,EAAE,sBAAsB;IACpC,uDAAuD;IACvD,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,iCAAiC;IACjC,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,6BAA6B;IAC7B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,+BAA+B;IAC/B,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,mCAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAEpE,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kGAAkG;SAC5G,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL;;;GAGG;AACU,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,mBAAmB,EAAE,uCAA+B,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC;AAIH,sFAAsF;AACzE,QAAA,6BAA6B,GAAG,8BAAsB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/schema/schemas/auth.ts"],"names":[],"mappings":";;;AAAA,4CAA+C;AAC/C,6BAAwB;AAExB,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAElE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAGxE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAG7E,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,qBAAqB,CAAC;KAC1B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;IACzC,OAAO,EAAE,mCAAmC;CAC7C,CAAC;KACD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE;IACnD,OAAO,EAAE,qCAAqC,sBAAsB,GAAG;CACxE,CAAC,CAAC;AAEL,sEAAsE;AAEtE,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAChD,qFAAqF;AACrF,0FAA0F;AAC1F,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAC5D,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,CAAC,WAAW,CAAC,CAAC;AAE9B,QAAA,wBAAwB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAG1E,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,gBAAgB,EAAE,OAAC;SAChB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;SACpE,QAAQ,EAAE;IACb,oBAAoB,EAAE,OAAC;SACpB,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;SAC3G,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE;IAC9F,OAAO,EAAE,kEAAkE;CAC5E,CAAC;KACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC,EAAE;IACjG,OAAO,EAAE,sEAAsE;CAChF,CAAC,CAAC;AAGQ,QAAA,gCAAgC,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAGtE,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,qBAAqB,EAAE,OAAC;SACrB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,kBAAkB,EAAE,wCAAwC,CAAC;SACnE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpD,OAAO,EAAE,yCAAyC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACrF,CAAC;IACJ,0BAA0B,EAAE,wCAAgC;IAC5D,0BAA0B,EAAE,OAAC,CAAC,MAAM,CAAC;QACnC,kBAAkB,EAAE,gCAAwB;QAC5C,eAAe,EAAE,6BAAqB;KACvC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,mFAAmF;AACnF,EAAE;AACF,4FAA4F;AAC5F,8FAA8F;AAC9F,mFAAmF;AACnF,yDAAyD;AAEzD,4FAA4F;AAC5F,0FAA0F;AAC7E,QAAA,+BAA+B,GAC1C,oHAAoH,CAAC;AAC1G,QAAA,cAAc,GAAG,sCAAsC,CAAC;AACxD,QAAA,iBAAiB,GAAG,4BAA4B,CAAC;AACjD,QAAA,yBAAyB,GAAG,qCAAqC,CAAC;AAElE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAGpE,0FAA0F;AAC7E,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,+BAA+B,EAAE,OAAC;SAC/B,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,KAAK,CAAC,uCAA+B,EAAE,gEAAgE,CAAC;CAC5G,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,iFAAiF;AACpE,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAc,EAAE,4BAA4B,CAAC;IAC7E,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAiB,EAAE,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,qBAAqB,EAAE,mCAA2B;IAClD,gBAAgB,EAAE,OAAC;SAChB,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iCAAyB,EAAE,sCAAsC,CAAC,CAAC;SAC1F,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;IACb,IAAI,EAAE,iBAAU,CAAC,QAAQ,EAAE;IAC3B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,0BAA0B,EAAE,wCAAgC,CAAC,QAAQ,EAAE;IACvE,kBAAkB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAC7G,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,iHAAiH;AACpG,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,eAAe,EAAE,6BAAqB;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAQZ,SAAS,kBAAkB,CAAC,EAAmB;IAC7C,IAAI,EAAE,CAAC,0BAA0B;QAAE,OAAO,4BAA4B,CAAC;IACvE,IAAI,EAAE,CAAC,kBAAkB;QAAE,OAAO,oBAAoB,CAAC;IACvD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4CAA4C;AAE5C;;;;;;GAMG;AACU,QAAA,+BAA+B,GAAG,OAAC;KAC7C,MAAM,CAAC;IACN,0HAA0H;IAC1H,YAAY,EAAE,sBAAsB;IACpC,uDAAuD;IACvD,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,iCAAiC;IACjC,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,6FAA6F;IAC7F,aAAa,EAAE,OAAC;SACb,KAAK,CACJ,OAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,qBAAqB,EAAE,wDAAwD,CAAC,CAC1F;SACA,QAAQ,EAAE;IACb,+BAA+B;IAC/B,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,mCAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpE,4FAA4F;IAC5F,eAAe,EAAE,6BAAqB,CAAC,QAAQ,EAAE;IACjD,kDAAkD;IAClD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAEpE,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kGAAkG;SAC5G,CAAC,CAAC;IACL,CAAC;IAED,gGAAgG;IAChG,gEAAgE;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,+CAA+C;QAC/C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,4EAA4E;gBACrF,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,2GAA2G;YAC3G,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACzB,IAAI,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,OAAO,EAAE,CAAC;oBACtD,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;wBAC3B,OAAO,EACL,0IAA0I;wBAC5I,IAAI,EAAE,CAAC,0BAA0B,EAAE,CAAC,EAAE,iBAAiB,CAAC;qBACzD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,OAAO,EAAE,6CAA6C,CAAC,CAAC,MAAM,EAAE;oBAChE,IAAI,EAAE,CAAC,0BAA0B,EAAE,CAAC,EAAE,QAAQ,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL;;;GAGG;AACU,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,mBAAmB,EAAE,uCAA+B,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC;AAIH,sFAAsF;AACzE,QAAA,6BAA6B,GAAG,8BAAsB,CAAC"}