@cef-ai/vault-sdk 4.1.0 → 4.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { Signer } from "@cef-ai/signer";
|
|
2
2
|
import type { VaultHttpClient } from "../core/http.js";
|
|
3
|
+
import type { PrivacyCeilingName } from "../core/grant-doc.js";
|
|
3
4
|
import type { Member, MemberRole, MembershipSummary, ScopeGrants, SignedRoster } from "../core/types.js";
|
|
4
5
|
/**
|
|
5
6
|
* What the caller already knows about the membership's OTHER half, so the
|
|
@@ -15,6 +16,17 @@ import type { Member, MemberRole, MembershipSummary, ScopeGrants, SignedRoster }
|
|
|
15
16
|
export interface PutMemberOptions {
|
|
16
17
|
/** The scope grants this member ALREADY holds. Default: read back. */
|
|
17
18
|
scopes?: ScopeGrants;
|
|
19
|
+
/**
|
|
20
|
+
* The most sensitive class of fact this membership may see. Default: send
|
|
21
|
+
* no `privacyCeiling` field and sign the v1 document — byte-identical to
|
|
22
|
+
* the request 4.1.0 sent, which is the property that keeps this option
|
|
23
|
+
* additive.
|
|
24
|
+
*
|
|
25
|
+
* `NO_PRIVACY_CEILING` is deliberately not a settable value here (see its
|
|
26
|
+
* own doc): "no ceiling was ever signed" has exactly one spelling, absence,
|
|
27
|
+
* and admitting `""` at the writer would give the state two.
|
|
28
|
+
*/
|
|
29
|
+
privacyCeiling?: PrivacyCeilingName;
|
|
18
30
|
}
|
|
19
31
|
/** @see PutMemberOptions */
|
|
20
32
|
export interface PutScopesOptions {
|
|
@@ -240,6 +252,14 @@ export declare class Memberships {
|
|
|
240
252
|
* member with grants signs those grants too. They are read back with `scopes()` (a 404 — the new
|
|
241
253
|
* member case — is `{}`); pass `{ scopes }` to skip that GET when they are
|
|
242
254
|
* already in hand.
|
|
255
|
+
*
|
|
256
|
+
* `{ privacyCeiling }` widens the SAME document to v2 rather than adding a
|
|
257
|
+
* second one: the ceiling joins `expiresAt` as the last field, the schema
|
|
258
|
+
* string flips to `cere.vault.grant.v2`, and the body carries the ceiling
|
|
259
|
+
* beside the role it constrains. The scopes in the document are STILL the
|
|
260
|
+
* held ones and the expiry is STILL the body's exact string — the ceiling
|
|
261
|
+
* changes which encoder builds the document, never what the document is
|
|
262
|
+
* built FROM.
|
|
243
263
|
*/
|
|
244
264
|
put(vaultId: string, memberPubkey: string, role: MemberRole, expiresAt?: string, opts?: PutMemberOptions): Promise<Member>;
|
|
245
265
|
/**
|
|
@@ -320,6 +340,13 @@ export declare class Memberships {
|
|
|
320
340
|
* sr25519), so an sr25519 owner can authenticate the request and still
|
|
321
341
|
* never produce a document the server will accept. Named up front rather
|
|
322
342
|
* than left to surface as an opaque signature refusal.
|
|
343
|
+
*
|
|
344
|
+
* `ceiling` is the ONE input that changes which encoder runs, because it is
|
|
345
|
+
* the one field whose absence is a document VERSION: unset builds the v1
|
|
346
|
+
* bytes exactly as before this option existed, set appends the ceiling and
|
|
347
|
+
* flips the schema string. An invalid value never gets this far — `put()`
|
|
348
|
+
* vets it before its read-back — and the encoder re-checks regardless, so
|
|
349
|
+
* a typo cannot become a stored grant on any path in.
|
|
323
350
|
*/
|
|
324
351
|
private grantHeader;
|
|
325
352
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"memberships.d.ts","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"memberships.d.ts","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAevD,OAAO,KAAK,EAA+B,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE5F,OAAO,KAAK,EACV,MAAM,EACN,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACb,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,qBAAa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAV1B;;;;;;;OAOG;gBAEgB,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,MAAM,YAAA;IAGlC;;;;;;;;;;;;;OAaG;IACH,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAIpC;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACG,GAAG,CACP,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC;IAuClB;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAI/E;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUhB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,WAAW;IAgEzB;;;;;;;;;;;OAWG;YACW,UAAU;IASxB;;;;;;;;;;;;;;;;;;;OAmBG;YACW,YAAY;CAkB3B"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { endpoints } from "../core/endpoints.js";
|
|
2
2
|
import { bytesToHex } from "../core/canonical.js";
|
|
3
|
-
import { GRANT_SIGNATURE_HEADER, GRANT_ISSUED_AT_HEADER, NO_GRANT_EXPIRY, canonicalGrantBytes, canonicalPubkeyHex, grantExpiry, } from "../core/grant-doc.js";
|
|
3
|
+
import { GRANT_SIGNATURE_HEADER, GRANT_ISSUED_AT_HEADER, NO_GRANT_EXPIRY, PRIVACY_CEILINGS, canonicalGrantBytes, canonicalGrantBytesWithCeiling, canonicalPubkeyHex, grantExpiry, isValidPrivacyCeiling, privacyCeiling, } from "../core/grant-doc.js";
|
|
4
4
|
import { VaultRequestError, VaultSignerRequiredError } from "../core/errors.js";
|
|
5
5
|
/**
|
|
6
6
|
* Who belongs to a vault, in what role, holding which scope grants — and,
|
|
@@ -212,8 +212,30 @@ export class Memberships {
|
|
|
212
212
|
* member with grants signs those grants too. They are read back with `scopes()` (a 404 — the new
|
|
213
213
|
* member case — is `{}`); pass `{ scopes }` to skip that GET when they are
|
|
214
214
|
* already in hand.
|
|
215
|
+
*
|
|
216
|
+
* `{ privacyCeiling }` widens the SAME document to v2 rather than adding a
|
|
217
|
+
* second one: the ceiling joins `expiresAt` as the last field, the schema
|
|
218
|
+
* string flips to `cere.vault.grant.v2`, and the body carries the ceiling
|
|
219
|
+
* beside the role it constrains. The scopes in the document are STILL the
|
|
220
|
+
* held ones and the expiry is STILL the body's exact string — the ceiling
|
|
221
|
+
* changes which encoder builds the document, never what the document is
|
|
222
|
+
* built FROM.
|
|
215
223
|
*/
|
|
216
224
|
async put(vaultId, memberPubkey, role, expiresAt, opts = {}) {
|
|
225
|
+
// Branded and VETTED before anything else this method does. The brand is
|
|
226
|
+
// a COMPILE-TIME distinction only — `privacyCeiling()` casts and accepts
|
|
227
|
+
// any string at runtime — so the `isValidPrivacyCeiling` check is the
|
|
228
|
+
// actual refusal, and it runs ahead of the read-back GET because a caller
|
|
229
|
+
// error must cost no round trip (the encoder re-checks at the document,
|
|
230
|
+
// for whoever builds one without passing through here). It refuses `""`
|
|
231
|
+
// as well: NO_PRIVACY_CEILING is not a value a caller may SET — see the
|
|
232
|
+
// option — and the encoder alone would treat it as "unset" while the body
|
|
233
|
+
// below still carried the key.
|
|
234
|
+
const ceiling = opts.privacyCeiling === undefined ? undefined : privacyCeiling(opts.privacyCeiling);
|
|
235
|
+
if (ceiling !== undefined && !isValidPrivacyCeiling(ceiling)) {
|
|
236
|
+
throw new Error(`put: privacyCeiling ${JSON.stringify(ceiling)} must be one of ` +
|
|
237
|
+
PRIVACY_CEILINGS.map((c) => `"${c}"`).join(", "));
|
|
238
|
+
}
|
|
217
239
|
const scopes = opts.scopes ?? (await this.heldScopes(vaultId, memberPubkey));
|
|
218
240
|
// ONE STRING, SENT AND SIGNED. `expiresAt` goes into the body and into the
|
|
219
241
|
// signed bytes unchanged; absent is NO_GRANT_EXPIRY, which is the empty
|
|
@@ -221,8 +243,17 @@ export class Memberships {
|
|
|
221
243
|
// expiry" has a spelling of its own rather than being a missing key.
|
|
222
244
|
const expiry = expiresAt === undefined ? NO_GRANT_EXPIRY : grantExpiry(expiresAt);
|
|
223
245
|
return this.http.send("PUT", endpoints.vaultMember(vaultId, memberPubkey), {
|
|
224
|
-
|
|
225
|
-
|
|
246
|
+
// The ceiling key rides ALONGSIDE the fields 4.1.0 sent, and only when
|
|
247
|
+
// set: an unconditional `privacyCeiling: undefined` would rely on every
|
|
248
|
+
// downstream serialiser (auth canonicalisation included) dropping it to
|
|
249
|
+
// keep the no-ceiling request byte-identical.
|
|
250
|
+
body: {
|
|
251
|
+
role,
|
|
252
|
+
expiresAt,
|
|
253
|
+
...(ceiling === undefined ? {} : { privacyCeiling: ceiling }),
|
|
254
|
+
timestamp: new Date().toISOString(),
|
|
255
|
+
},
|
|
256
|
+
headers: await this.grantHeader(vaultId, memberPubkey, role, scopes, expiry, ceiling),
|
|
226
257
|
});
|
|
227
258
|
}
|
|
228
259
|
/**
|
|
@@ -314,8 +345,15 @@ export class Memberships {
|
|
|
314
345
|
* sr25519), so an sr25519 owner can authenticate the request and still
|
|
315
346
|
* never produce a document the server will accept. Named up front rather
|
|
316
347
|
* than left to surface as an opaque signature refusal.
|
|
348
|
+
*
|
|
349
|
+
* `ceiling` is the ONE input that changes which encoder runs, because it is
|
|
350
|
+
* the one field whose absence is a document VERSION: unset builds the v1
|
|
351
|
+
* bytes exactly as before this option existed, set appends the ceiling and
|
|
352
|
+
* flips the schema string. An invalid value never gets this far — `put()`
|
|
353
|
+
* vets it before its read-back — and the encoder re-checks regardless, so
|
|
354
|
+
* a typo cannot become a stored grant on any path in.
|
|
317
355
|
*/
|
|
318
|
-
async grantHeader(vaultId, memberPubkey, role, scopes, expiresAt) {
|
|
356
|
+
async grantHeader(vaultId, memberPubkey, role, scopes, expiresAt, ceiling) {
|
|
319
357
|
const signer = this.signer;
|
|
320
358
|
if (signer === undefined || typeof signer.sign !== "function") {
|
|
321
359
|
throw new VaultSignerRequiredError(`A membership write must carry the VAULT OWNER's signature over the grant's ` +
|
|
@@ -340,7 +378,12 @@ export class Memberships {
|
|
|
340
378
|
// two copies drift by a trimmed fractional zero and the signature fails
|
|
341
379
|
// as though the key were wrong.
|
|
342
380
|
const issuedAt = new Date().toISOString();
|
|
343
|
-
|
|
381
|
+
// The ceiling decides the document's VERSION, and only that: the v1 call
|
|
382
|
+
// stays literally the 4.1.0 line (not merely byte-equal to it), so the
|
|
383
|
+
// no-ceiling path keeps the exact code history has exercised.
|
|
384
|
+
const doc = ceiling === undefined
|
|
385
|
+
? canonicalGrantBytes(vaultId, canonicalPubkeyHex(memberPubkey), role, scopes, issuedAt, expiresAt)
|
|
386
|
+
: canonicalGrantBytesWithCeiling(vaultId, canonicalPubkeyHex(memberPubkey), role, scopes, issuedAt, expiresAt, ceiling);
|
|
344
387
|
return {
|
|
345
388
|
[GRANT_SIGNATURE_HEADER]: bytesToHex(await signer.sign(doc, "data")),
|
|
346
389
|
[GRANT_ISSUED_AT_HEADER]: issuedAt,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"memberships.js","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,
|
|
1
|
+
{"version":3,"file":"memberships.js","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,8BAA8B,EAC9B,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAyDhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,MAAM,OAAO,WAAW;IAUH;IACA;IAVnB;;;;;;;OAOG;IACH,YACmB,IAAqB,EACrB,MAAe;QADf,SAAI,GAAJ,IAAI,CAAiB;QACrB,WAAM,GAAN,MAAM,CAAS;IAC/B,CAAC;IAEJ;;;;;;;;;;;;;OAaG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,KAAK,CAAC,GAAG,CACP,OAAe,EACf,YAAoB,EACpB,IAAgB,EAChB,SAAkB,EAClB,OAAyB,EAAE;QAE3B,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,OAAO,GACX,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB;gBAC9D,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7E,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,8CAA8C;YAC9C,IAAI,EAAE;gBACJ,IAAI;gBACJ,SAAS;gBACT,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;gBAC7D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;YACD,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;SACtF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,OAAe,EAAE,YAAoB;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YAC5E,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAe,EAAE,YAAoB;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,YAAoB,EACpB,MAAmB,EACnB,OAAyB,EAAE;QAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACnF,MAAM,MAAM,GACV,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YAC/E,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;YACpF,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;SACtF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,WAAW,CACvB,OAAe,EACf,YAAoB,EACpB,IAAgB,EAChB,MAAmB,EACnB,SAAsB,EACtB,OAAwB;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9D,MAAM,IAAI,wBAAwB,CAChC,6EAA6E;gBAC3E,8BAA8B,sBAAsB,yBAAyB;gBAC7E,+EAA+E;gBAC/E,gFAAgF;gBAChF,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,wBAAwB,CAChC,+EAA+E;gBAC7E,0CAA0C,MAAM,CAAC,IAAI,wBAAwB;gBAC7E,+DAA+D,CAClE,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,mDAAmD;QACnD,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,gCAAgC;QAChC,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,yEAAyE;QACzE,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,GAAG,GACP,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,mBAAmB,CACjB,OAAO,EACP,kBAAkB,CAAC,YAAY,CAAC,EAChC,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,CACV;YACH,CAAC,CAAC,8BAA8B,CAC5B,OAAO,EACP,kBAAkB,CAAC,YAAY,CAAC,EAChC,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,OAAO,CACR,CAAC;QACR,OAAO;YACL,CAAC,sBAAsB,CAAC,EAAE,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpE,CAAC,sBAAsB,CAAC,EAAE,QAAQ;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,YAAoB;QAC5D,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,YAAY,CACxB,OAAe,EACf,YAAoB;QAEpB,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,CAC9E,CAAC;QACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,6BAA6B,OAAO,wBAAwB;gBACjF,+DAA+D;gBAC/D,8EAA8E;gBAC9E,oBAAoB,CACvB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IACtD,CAAC;CACF"}
|