@cat-factory/gatekeeper-worker 0.3.1

package/dist/policy/compile.js

@@ -0,0 +1,170 @@
+// Compiling a Gatekeeper policy: turning what an operator wrote into the exact set of methods a
+// capability will carry, plus a STATED account of everything it will not.
+//
+// The whole point of the generated table (`@cat-factory/gatekeeper-bindings`) is that policy is
+// enforced against the operations the deployment actually serves, at the scope floors it actually
+// enforces, rather than against a hand-curated list that drifts. So compilation starts from
+// `bindingsWithinScope(keyScope)` and only ever SUBTRACTS. A tier cannot grant its way above the
+// key backing it, and an attempt to is an operator error raised here rather than a method that
+// exists, looks granted, and 403s on every call.
+//
+// Nothing here decides transport, retry or auth: the SDK does, through each binding's own
+// `invoke` thunk.
+import { bindingByName, bindingsWithinScope, resolveConsequence, } from '@cat-factory/gatekeeper-bindings';
+import { PolicyError } from '../errors.js';
+/**
+ * `admin` is deliberately unreachable as a tier's `keyScope`.
+ *
+ * `POST /api/v1/keys` mints `read`, `write` or `decide` and never `admin`, so the platform already
+ * holds the chain to one link: a key provisioned over the API can never itself provision. A tier
+ * asking for `admin` is therefore asking for the Gatekeeper's OWN provisioning secret to be handed
+ * to a caller, which is the one thing this whole design exists to prevent. Refusing it here names
+ * that, rather than letting the mint fail per-actor at runtime with a platform error an operator
+ * would read as a bug.
+ */
+const MINTABLE_SCOPES = ['read', 'write', 'decide'];
+/**
+ * A binding whose result is an SSE reader or raw bytes cannot cross a Cap'n Web call, which
+ * carries structured-clone values. It is withheld rather than exposed-and-failing, and it is
+ * NAMED as withheld for transport rather than for policy, because the fix differs: a caller that
+ * wants a run's events polls `tasks_get_run`, while a caller that wants a denied operation asks
+ * its operator to change the policy.
+ */
+function relayable(binding) {
+    return binding.result === 'value';
+}
+function compileTier(name, tier) {
+    if (!MINTABLE_SCOPES.includes(tier.keyScope)) {
+        throw new PolicyError(`Tier '${name}' declares keyScope '${tier.keyScope}', which POST /api/v1/keys cannot mint ` +
+            `(it mints ${MINTABLE_SCOPES.join(', ')}). An admin-scoped tier would hand a caller the ` +
+            "Gatekeeper's own provisioning credential; grant the operations it needs at 'decide' instead.");
+    }
+    const withinScope = bindingsWithinScope(tier.keyScope);
+    const withinScopeNames = new Set(withinScope.map((binding) => binding.name));
+    const deny = new Set(tier.deny ?? []);
+    // Both lists are checked against the LIVE table first: a misspelled or retired name is an
+    // operator error with a fix, and silently ignoring it would make a deny read as enforced.
+    for (const [field, names] of [
+        ['allow', tier.allow === '*' ? [] : tier.allow],
+        ['deny', tier.deny ?? []],
+    ]) {
+        for (const bindingName of names) {
+            if (!bindingByName(bindingName)) {
+                throw new PolicyError(`Tier '${name}' names '${bindingName}' in ${field}, which this deployment's operation ` +
+                    'table does not carry. Check the spelling, or upgrade @cat-factory/gatekeeper-bindings ' +
+                    'if the operation is newer than this package.');
+            }
+        }
+    }
+    if (tier.allow !== '*') {
+        for (const bindingName of tier.allow) {
+            if (!withinScopeNames.has(bindingName) && !deny.has(bindingName)) {
+                const binding = bindingByName(bindingName);
+                throw new PolicyError(`Tier '${name}' allows '${bindingName}', whose scope floor is '${binding?.minScope}', but ` +
+                    `the tier's keyScope is '${tier.keyScope}'. Raise the tier's keyScope or drop the ` +
+                    'operation: a granted method its key cannot call would refuse on every call.');
+            }
+        }
+    }
+    const allowed = tier.allow === '*' ? withinScopeNames : new Set(tier.allow);
+    const granted = [];
+    const withheld = [];
+    for (const binding of withinScope) {
+        if (deny.has(binding.name)) {
+            withheld.push({
+                name: binding.name,
+                reason: 'denied_by_policy',
+                detail: `Tier '${name}' denies it.`,
+            });
+            continue;
+        }
+        if (!allowed.has(binding.name)) {
+            withheld.push({
+                name: binding.name,
+                reason: 'not_in_policy',
+                detail: `Tier '${name}' does not allow it.`,
+            });
+            continue;
+        }
+        if (!relayable(binding)) {
+            withheld.push({
+                name: binding.name,
+                reason: 'not_relayable',
+                detail: `Its result is a ${binding.result}, which a Cap'n Web call cannot carry.`,
+            });
+            continue;
+        }
+        granted.push(binding);
+    }
+    for (const binding of bindingByScopeGap(withinScopeNames)) {
+        withheld.push({
+            name: binding.name,
+            reason: 'above_key_scope',
+            detail: `Its floor is '${binding.minScope}'; this tier's key is '${tier.keyScope}'.`,
+        });
+    }
+    return {
+        name,
+        description: tier.description,
+        keyScope: tier.keyScope,
+        granted,
+        withheld,
+        mask: tier.mask ?? [],
+    };
+}
+/** Every binding the deployment serves that the tier's own key could not call. */
+function bindingByScopeGap(withinScope) {
+    return bindingsWithinScope('admin').filter((binding) => !withinScope.has(binding.name));
+}
+/**
+ * Compile a policy against the live operation table, or throw a {@link PolicyError} naming the
+ * first thing an operator has to fix.
+ */
+export function compilePolicy(policy) {
+    const tiers = new Map();
+    for (const [name, tier] of Object.entries(policy.tiers)) {
+        tiers.set(name, compileTier(name, tier));
+    }
+    if (policy.defaultTier !== null && !tiers.has(policy.defaultTier)) {
+        throw new PolicyError(`defaultTier is '${policy.defaultTier}', which is not one of the declared tiers ` +
+            `(${[...tiers.keys()].join(', ')}).`);
+    }
+    for (const [actor, tierName] of Object.entries(policy.grants)) {
+        if (!tiers.has(tierName)) {
+            throw new PolicyError(`Actor '${actor}' is granted tier '${tierName}', which is not declared.`);
+        }
+    }
+    return { defaultTier: policy.defaultTier, tiers, grants: new Map(Object.entries(policy.grants)) };
+}
+/**
+ * The tier an actor holds, or a refusal.
+ *
+ * Note what is NOT here: nothing the CALLER sends picks a tier. The OS authenticates the person
+ * and the Gatekeeper resolves what that person may do, so a compromised or confused agent cannot
+ * ask for a better one.
+ */
+export function tierForActor(policy, actorId) {
+    const name = policy.grants.get(actorId) ?? policy.defaultTier;
+    if (name === null)
+        return null;
+    return policy.tiers.get(name) ?? null;
+}
+/**
+ * What the OS needs to run its own approval governance over a call: the consequence the platform
+ * annotates, with the cautious default already applied.
+ */
+export function describeBinding(binding) {
+    const consequence = resolveConsequence(binding);
+    return {
+        name: binding.name,
+        summary: binding.summary,
+        minScope: binding.minScope,
+        readOnly: binding.readOnly,
+        destructive: consequence.destructive,
+        idempotent: consequence.idempotent,
+        pathParams: binding.pathParams,
+        queryParams: binding.queryParams,
+        hasBody: binding.hasBody,
+    };
+}
+//# sourceMappingURL=compile.js.map

package/dist/policy/compile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../src/policy/compile.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,0EAA0E;AAC1E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,iDAAiD;AACjD,EAAE;AACF,0FAA0F;AAC1F,kBAAkB;AAElB,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GAGnB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAsE1C;;;;;;;;;GASG;AACH,MAAM,eAAe,GAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAE9E;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,OAA0B;IAC3C,OAAO,OAAO,CAAC,MAAM,KAAK,OAAO,CAAA;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAgB;IACjD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,wBAAwB,IAAI,CAAC,QAAQ,yCAAyC;YACzF,aAAa,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;YACzF,8FAA8F,CACjG,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAErC,0FAA0F;IAC1F,0FAA0F;IAC1F,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/C,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;KACjB,EAAE,CAAC;QACX,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,YAAY,WAAW,QAAQ,KAAK,sCAAsC;oBACrF,wFAAwF;oBACxF,8CAA8C,CACjD,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjE,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;gBAC1C,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,aAAa,WAAW,4BAA4B,OAAO,EAAE,QAAQ,SAAS;oBACzF,2BAA2B,IAAI,CAAC,QAAQ,2CAA2C;oBACnF,6EAA6E,CAChF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IAEtC,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,SAAS,IAAI,cAAc;aACpC,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,SAAS,IAAI,sBAAsB;aAC5C,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,mBAAmB,OAAO,CAAC,MAAM,wCAAwC;aAClF,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,iBAAiB,OAAO,CAAC,QAAQ,0BAA0B,IAAI,CAAC,QAAQ,IAAI;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO;QACP,QAAQ;QACR,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;KACtB,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,WAAgC;IACzD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAwB;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,WAAW,CACnB,mBAAmB,MAAM,CAAC,WAAW,4CAA4C;YAC/E,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvC,CAAA;IACH,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACnB,UAAU,KAAK,sBAAsB,QAAQ,2BAA2B,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,OAAe;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,CAAA;IAC7D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B;IAWxD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC"}

package/dist/policy/decisions.d.ts

@@ -0,0 +1,93 @@
+import type { PublicApiScope } from '@cat-factory/gatekeeper-bindings';
+import type { PublicDecision } from '@cat-factory/sdk';
+/**
+ * Every kind of park the surface can list, taken from the SDK's own union.
+ *
+ * Typed rather than enumerated here so the table below is EXHAUSTIVE by construction: a kind the
+ * platform gains fails this package's build until it has an answerer, instead of arriving in
+ * production as a card whose first answer attempt reports it stale. That is the whole reason the
+ * table is a `Record` keyed on the kind rather than an array of entries carrying one.
+ */
+export type ParkedDecisionKind = PublicDecision['kind'];
+/**
+ * One entry in a run's decision list, read structurally.
+ *
+ * Deliberately NOT typed against the published `PublicDecision` union: this package reads a live
+ * deployment's JSON, and a deployment one release ahead sends a kind (or a field) the union has
+ * never heard of. Narrowing here would turn that into a decode failure at the one place whose job
+ * is to say "the platform is holding this run on something I do not know how to answer".
+ */
+export interface LiveDecision {
+    kind: string;
+    [field: string]: unknown;
+}
+/** What one verb, applied to one live decision, asks the platform to do. */
+export interface DecisionCall {
+    binding: string;
+    args: Record<string, unknown>;
+}
+/** One way of answering a kind of park. */
+export interface DecisionVerb {
+    /** What a caller passes as `action`. */
+    action: string;
+    /** The binding this verb forwards through. Policy is enforced there, and only there. */
+    binding: string;
+    /** One line an OS Gadget renders beside the verb. */
+    summary: string;
+    /**
+     * The caller-supplied fields this verb reads, with `required` naming the ones it refuses
+     * without. Published on `approvals_inspect` so a caller composes a valid answer from the
+     * capability itself rather than from a doc that can drift.
+     */
+    fields: readonly DecisionField[];
+    /** Build the call. Throws {@link GatekeeperError} `invalid_answer` on a field it cannot read. */
+    call: (decision: LiveDecision, input: AnswerFields) => DecisionCall;
+}
+/** One caller-supplied field a verb reads. */
+export interface DecisionField {
+    name: string;
+    required: boolean;
+    /** The closed set of values, when there is one. */
+    choices?: readonly string[];
+    detail: string;
+}
+/** What a caller sends beside `action`, by the platform's own field names. */
+export type AnswerFields = Readonly<Record<string, unknown>>;
+/** How one kind of park is answered. Keyed by kind in {@link ANSWERERS}. */
+export interface DecisionAnswerer {
+    /** Prose an OS Gadget shows above the verbs. */
+    summary: string;
+    /**
+     * Whether this entry is CURRENTLY holding the run.
+     *
+     * A decision list carries settled entries too (a resolved gate keeps its record), so answering
+     * the first entry of a kind would post against a park that is over. Every predicate reads the
+     * entry's own lifecycle field, and an entry whose field is missing or unrecognised reads as NOT
+     * pending: a park this package cannot confirm is one it must not answer blind.
+     */
+    pending: (decision: LiveDecision) => boolean;
+    verbs: readonly DecisionVerb[];
+}
+/** How a kind of park is answered, or `undefined` for one this package does not model. */
+export declare function answererFor(kind: string): DecisionAnswerer | undefined;
+/** Every kind this package can answer. */
+export declare const ANSWERABLE_DECISION_KINDS: readonly ParkedDecisionKind[];
+/**
+ * The binding names every answerer forwards through, plus the read that finds the park.
+ *
+ * Published so a policy author can grant "answer parked decisions" without transcribing forty
+ * operation names, and so `approvals_inspect` can say which verbs a tier actually holds. It is
+ * DERIVED from the table rather than restated, because a hand-kept copy is exactly the drift the
+ * generated binding table exists to prevent one layer down.
+ */
+export declare const DECISION_BINDINGS: readonly string[];
+/**
+ * The key scope every decision binding needs.
+ *
+ * Stated as a constant rather than read off the table because it is a POLICY fact a tier author
+ * needs before compiling: a tier granting these must mint `decide` keys. `policy.test.ts` pins it
+ * against the live table, so a surface that ever lowered a floor would fail there rather than
+ * leaving this comment quietly wrong.
+ */
+export declare const DECISION_KEY_SCOPE: PublicApiScope;
+//# sourceMappingURL=decisions.d.ts.map

package/dist/policy/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../../src/policy/decisions.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGtD;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CACzB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAA;IACd,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,MAAM,EAAE,SAAS,aAAa,EAAE,CAAA;IAChC,iGAAiG;IACjG,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,KAAK,YAAY,CAAA;CACpE;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,mDAAmD;IACnD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAE5D,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,OAAO,CAAA;IAC5C,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CAC/B;AAkpBD,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAEtE;AAED,0CAA0C;AAC1C,eAAO,MAAM,yBAAyB,EAAE,SAAS,kBAAkB,EAE1C,CAAA;AAEzB;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAO9C,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,cAAyB,CAAA"}