@cotal-ai/workspace 0.13.2 → 0.14.1

package/dist/auth-paths.d.ts

@@ -1,19 +1,50 @@
-import { type SecretStore, type SpaceAuth } from "@cotal-ai/core";
+import { type BrokerAuth, type SecretStore, type SpaceAccountAuth, type SpaceAuth } from "@cotal-ai/core";
 export declare function authDir(root: string): string;
-/** THE per-space path/key segment — the single guarded encoder every space-keyed surface consumes
- *  (this state dir AND the auth secret-store key builders). `encodeURIComponent` keeps any real
- *  name one flat segment (`a/b` → `a%2Fb`) but leaves dots alone, so `.`/`..`/empty would alias a
- *  parent (`auth/..` normalizes OUT of the space's own segment) — refused HERE, before any path is
- *  built or state touched. Two independently-guarded encoders were the defect generator (one gains
- *  a rule the other doesn't); keep exactly one. */
+/** The ONE injective, case-safe space key: lowercase hex of the space's UTF-8 bytes. Every
+ *  tenant-keyed namespace derives its key from this — the account filename, the user-auth state
+ *  dir, the auth secret-store keys, and the machine mesh registry — because every namespace that
+ *  invented its own encoding (raw name, `encodeURIComponent`) turned out to alias: ASCII case is
+ *  preserved by those, so on a case-insensitive filesystem (the macOS/Windows default) `alpha` and
+ *  `Alpha` addressed ONE path and the second tenant silently absorbed the first. Hex over
+ *  `[0-9a-f]` cannot case-fold-collide, cannot contain a separator, and round-trips exactly. */
+export declare function spaceKey(space: string): string;
+/** THE per-space path/key segment — `space.<hex>`, the {@link spaceKey} under a fixed prefix so a
+ *  segment is self-describing on disk and can never collide with a reserved sibling of the auth
+ *  dir (`broker.json`, `account.<hex>.json`, `server.conf`, `creds/`): none of those start with
+ *  `space.`, and the hex body cannot smuggle one in. Consumed by the state dir AND the auth
+ *  secret-store key builders; two independently-guarded encoders were the defect generator (one
+ *  gains a rule the other doesn't), so keep exactly one. */
 export declare function spaceSegment(space: string): string;
-/** The SPACE-SCOPED user-auth state dir (`<root>/.cotal/auth/<space>`) — the one layout fact the
- *  workstation layer owns about user auth: the auth provider persists its material under this dir
- *  (opaque to us), and its EXISTENCE marks the space as user-auth-enabled on disk. Space-keyed now
- *  so multi-space-per-root is a caller change, never an on-disk migration; a (broker, space) key
- *  later extends the same shape. Fails loud on a degenerate space (see {@link spaceSegment}) —
- *  BEFORE any caller can mutate at an aliased path. */
+/** The space a canonical segment encodes, or undefined when the name is not one {@link spaceSegment}
+ *  wrote (wrong prefix, non-hex body, or a body that does not round-trip). Enumeration and the
+ *  legacy-layout shim both need this to tell the canonical namespace from strays. */
+export declare function spaceFromSegment(name: string): string | undefined;
+/** The SPACE-SCOPED user-auth state dir (`<root>/.cotal/auth/space.<hex>`) — the one layout fact
+ *  the workstation layer owns about user auth: the auth provider persists its material under this
+ *  dir (opaque to us), and its EXISTENCE marks the space as user-auth-enabled on disk. Keyed by
+ *  {@link spaceSegment} so two case-differing tenants can never share one state dir and no space
+ *  name can alias a reserved sibling of the auth dir. Fails loud on a degenerate space — BEFORE
+ *  any caller can mutate at an aliased path.
+ *
+ *  Also the ONE migration point for pre-hex layouts (`<authDir>/<encodeURIComponent(space)>`):
+ *  every consumer of a space's user-auth state — the marker check, the provider's `dir`, and the
+ *  secret-store keys resolved beside it — obtains this path first, so renaming the legacy dir to
+ *  the canonical segment HERE means no flow can ever read (or worse, `ensure*`-REGENERATE) beside
+ *  material the old layout still holds. Deliberately not in {@link hasUserAuthState} alone: a
+ *  user-mode connect through a registry record never consults the marker before minting. */
 export declare function userAuthStateDir(root: string, space: string): string;
+/** Whether `space` is user-auth-enabled ON DISK under `root` — the authoritative marker, NOT a bare
+ *  `existsSync` on {@link userAuthStateDir}: only a real provider pin inside a real directory
+ *  counts. The state-dir read goes through {@link userAuthStateDir}, so a pre-hex legacy layout
+ *  has already been migrated by the time the marker is checked. */
+export declare function hasUserAuthState(root: string, space: string): boolean;
+/** Every space with user-auth state under this auth dir, detectable WITHOUT `broker.json`/accounts:
+ *  each enabled space is a `space.<hex>` subdirectory carrying a provider pin. The enumerating
+ *  companion to {@link hasUserAuthState}; both share {@link pathHasUserAuthMarker} so a single
+ *  space and the whole-dir sweep can never disagree on what "user-auth on disk" means. Pre-hex
+ *  legacy dirs are reported too (decoded from their verbatim names), so a guard reading this stays
+ *  fail-closed before the one-time migration has run. */
+export declare function userAuthSpacesOnDisk(dir: string): string[];
 /** The dir every per-agent standing secret materializes under (`<root>/.cotal/auth/creds`) —
  *  space-INDEPENDENT today (one root serves one space); multi-space-per-root re-keys this layout
  *  as a caller change, same as {@link userAuthStateDir}'s note. */
@@ -60,10 +91,141 @@ export declare function materializeSecretToFile(store: SecretStore, key: string,
  *  directory that *contains* `.cotal/`. Falls back to `start` when none is found up the tree (a
  *  fresh setup creates `.cotal/` there). Lets `cotal` run from any subdirectory of a project. */
 export declare function findCotalRoot(start?: string): string;
-/** Persist the space trust material. The file holds the data-account signing seed — treat as a secret.
- *  The system-account `sys.signingSeed` is STRIPPED before writing: it is broker-admin minting capability,
- *  so it never lands on disk (it lives only in the in-memory {@link createSpaceAuth} result). */
+/** Where the one broker trust record lives. */
+export declare function brokerAuthPath(dir: string): string;
+/** Where one space's own account record lives: a FLAT file beside `broker.json`, keyed by
+ *  {@link accountFileKey}. Flat (not `<space>/account.json`) because `<authDir>/<space>/` is
+ *  {@link userAuthStateDir}; hex-keyed because a raw space name in the filename both aliased that
+ *  user-auth marker and case-folded on macOS/Windows. The name of a space is authoritative in the
+ *  document, so enumeration never has to trust the filename beyond finding the record. */
+export declare function spaceAccountPath(dir: string, space: string): string;
+/** Persist BROKER trust. `sys.signingSeed` is STRIPPED before writing: it is broker-admin minting
+ *  capability, so it never lands on disk (it lives only in the in-memory {@link createBrokerAuth}
+ *  result). A composition that must add spaces after first boot has to hold that seed in a
+ *  BROKER-scoped secret store instead; see core's `BrokerAuth`. */
+export declare function saveBrokerAuth(dir: string, broker: BrokerAuth): void;
+/** Load BROKER trust, or undefined if auth was never set up here. Reads the pre-W4 monolith as
+ *  MIGRATION INPUT when the broker record does not exist yet. */
+export declare function loadBrokerAuth(dir: string): BrokerAuth | undefined;
+/** Persist ONE space's account record. Never carries broker material. Refuses to overwrite a record
+ *  that already holds a DIFFERENT space: with an injective hex key that only happens on a corrupted
+ *  or hand-swapped file, and silently replacing one tenant's signing authority with another's must
+ *  fail loud. */
+export declare function saveSpaceAccountAuth(dir: string, spaceAccount: SpaceAccountAuth): void;
+/** Load ONE space's account record, or undefined. Reads the pre-W4 monolith as MIGRATION INPUT when
+ *  the per-space record does not exist yet AND that monolith is for this same space - a monolith for
+ *  a DIFFERENT space must never satisfy a load for this one. */
+export declare function loadSpaceAccountAuth(dir: string, space: string): SpaceAccountAuth | undefined;
+/** Load the COMPOSED read view of one space's trust chain, or undefined if either authority is
+ *  missing. The space key is REQUIRED: once a broker holds N accounts, a root-wide "the auth" load is
+ *  intrinsically ambiguous, and picking a default silently would let (for example) a manager bound to
+ *  space B mint B's agents into space A's account. Composition also asserts that this account really
+ *  was signed by this broker's operator. */
+export declare function loadSpaceAuth(dir: string, space: string): SpaceAuth | undefined;
+/** The composed trust of the ONE space this auth dir holds - the space-blind convenience for callers
+ *  that predate multi-space (a folder's own mesh, `mint` in a checkout, a status read). Fails loud
+ *  when the root holds several, via {@link soleSpaceOf}. Prefer {@link loadSpaceAuth} with an
+ *  explicit space wherever the caller can know it. */
+export declare function loadSoleSpaceAuth(dir: string): SpaceAuth | undefined;
+/** Persist a composed value by DECOMPOSING it into its two authorities. This is the migration-era
+ *  writer for the many existing callers that hold a composed {@link SpaceAuth}; it is safe because
+ *  there is exactly ONE broker record, so writing broker trust through any space updates the single
+ *  owner rather than a per-space copy. It refuses a stripped value outright: `stripSpaceAuth` blanks
+ *  the operator and system account, and decomposing that would blank broker persistence. */
 export declare function saveSpaceAuth(dir: string, auth: SpaceAuth): void;
-/** Load the space trust material, or undefined if auth was never set up here. */
-export declare function loadSpaceAuth(dir: string): SpaceAuth | undefined;
+/** The ONE space this auth dir holds, for the legacy paths that predate multi-space and carry no
+ *  explicit space (a folder's "its own" space, a root-wide daemon remint). Undefined when the root
+ *  has no auth at all.
+ *
+ *  FAILS LOUD when the root holds several, rather than picking the first or a "current": a
+ *  space-blind caller that silently picks is exactly how a component bound to space B mints into
+ *  space A's account. Callers that can know their space must pass it explicitly instead of using
+ *  this; this exists so the remaining space-blind paths become a loud error rather than a wrong
+ *  answer the day a root holds two. */
+export declare function soleSpaceOf(dir: string): string | undefined;
+/** Refuse a BROKER-WIDE operation on a root that hosts several spaces - or whose tenant list cannot
+ *  be read with certainty.
+ *
+ *  Distinct from {@link soleSpaceOf}'s ambiguity, and the distinction is the whole point: the
+ *  broker process, its JetStream store and the single `.cotal/auth` broker record are shared by
+ *  every space on the root, so naming a space cannot scope `down`, `clean store|all`, `backup` or a
+ *  restore - they would apply to all of them regardless. Sending the operator after a `--space` they
+ *  cannot use (two of these commands do not even take one) is a dead end dressed as advice, so this
+ *  refusal names the blast radius and stops, and stays a refusal until per-space teardown exists.
+ *
+ *  A corrupt/foreign account record is refused too, NOT skipped: an under-count is the fail-open
+ *  this guard exists to prevent - a file that occupies the account namespace but will not validate
+ *  might be a real tenant, so the blast radius is unknown and a broker-wide delete must not proceed. */
+export declare function assertSingleSpaceBroker(dir: string, operation: string): void;
+/** The VALIDATED tenant inventory of an auth dir - the ONE read of "how many tenants" every other
+ *  surface derives from (the broker-wide guards, `soleSpaceOf`, `cotal status`, the target
+ *  resolver). Four surfaces each reading the disk their own way is how an under-count slips past
+ *  exactly one of them; there must be a single answer.
+ *
+ *  `spaces` are the tenants whose account records are regular files that parse, carry a `space`
+ *  equal to their own injective filename key, and round-trip. `corrupt` is every entry that
+ *  OCCUPIES the account namespace (`account.*.json`) yet fails any of that - including a
+ *  non-regular entry (symlink, directory): `Dirent.isFile()` is lstat-semantics, so skipping those
+ *  would drop a tenant whose record was symlinked while `loadSpaceAccountAuth`'s path still
+ *  resolved it - the exact under-count the guards exist to refuse. The authoritative name is the
+ *  record's own `space`, never inferred from the filename. `corrupt` is what turns the guards
+ *  fail-CLOSED: an unreadable record is uncertainty about how many tenants exist, and a
+ *  broker-wide operation must not proceed on an under-count. */
+export declare function accountInventory(dir: string): {
+    spaces: string[];
+    corrupt: string[];
+};
+/** Every space that has a VALID account record under this auth dir. The broker's tenant list on disk;
+ *  names come from each record's authoritative `space`. Callers that must act on the blast radius use
+ *  {@link assertSingleSpaceBroker} / {@link soleSpaceOf}, which also refuse on an unreadable record. */
+export declare function listSpaceAccounts(dir: string): string[];
+/** THE store key of the broker trust record. Under the workspace store (rooted at `.cotal`) it
+ *  resolves byte-for-byte to `.cotal/auth/broker.json`. One source for every signer-bearing tier -
+ *  a drifted literal would silently split the kind. */
+export declare const BROKER_AUTH_KEY = "auth/broker.json";
+/** The LEGACY monolith store key (`auth/auth.json`) - migration INPUT and the container signer
+ *  mount only; nothing writes this shape now (see the layout note above). */
+export declare const SPACE_AUTH_KEY = "auth/auth.json";
+/** THE store key of one space's account record - `auth/account.<key>.json`, the same injective
+ *  {@link spaceKey} filename the FS layout uses. */
+export declare function spaceAccountKey(space: string): string;
+/** Load one space's COMPOSED trust view through the seam - THE reader for signer-bearing paths (the
+ *  manager's signer hold, the renewal owner, CLI mint/backup/restore/…). The store is the sole
+ *  authority for the material; the space is REQUIRED for the same reason as {@link loadSpaceAuth}'s:
+ *  a root-wide "the auth" read is ambiguous the moment a broker holds two accounts (space-blind CLI
+ *  paths resolve theirs first via {@link getSoleSpaceAuth}). Mirrors the FS reader's shapes exactly -
+ *  split records compose (and verify the account really was signed by this broker's operator), either
+ *  half may still come from the legacy monolith during migration, and with both split records absent
+ *  the monolith is read whole (full bundle or the stripped container signer) and validated against
+ *  the caller's space; there a wrong-space or malformed value fails LOUD rather than reading as
+ *  absent, because the monolith names exactly one tenant. Every error names only store keys and the
+ *  caller's own space label, never the stored bytes. */
+export declare function getSpaceAuth(store: SecretStore, space: string): Promise<SpaceAuth | undefined>;
+/** The seam companion of {@link loadSoleSpaceAuth} for the space-blind CLI paths: the FS inventory
+ *  (tenant NAMES only - non-secret) supplies the one space this root holds, failing loud on several
+ *  via {@link soleSpaceOf}, and the store stays the sole authority for the trust material itself.
+ *  Every space-blind caller is a workstation CLI verb with the root's auth dir on this disk; a
+ *  hosted composition knows its space and calls {@link getSpaceAuth} directly. */
+export declare function getSoleSpaceAuth(store: SecretStore, dir: string): Promise<SpaceAuth | undefined>;
+/** Persist a composed value through the seam by DECOMPOSING it into its two records - the seam
+ *  writer with the SAME refusals as the FS pair ({@link saveBrokerAuth}/{@link saveSpaceAccountAuth},
+ *  shared via {@link guardBrokerOverwrite}): a stripped value, a foreign-operator overwrite, a stale
+ *  or rolled-back system-account generation, and another tenant's account record all refuse loud.
+ *  All guards run BEFORE either put, so a refusal never leaves a half-written pair. `sys.signingSeed`
+ *  never lands at rest (broker-admin minting capability; the record shape drops it).
+ *
+ *  With NO broker record in the store, the FS writer's whole-inventory orphan check cannot run - a
+ *  {@link SecretStore} has no enumeration - so it ranges over the ADDRESSABLE records instead: this
+ *  space's own account and the legacy monolith, each of which the incoming operator must have signed.
+ *  That is complete for a hosted store (scoped per-tenant inside its own resolve, per the seam's
+ *  design) and for every same-space local repair; a lost broker.json beside a DIFFERENT tenant's
+ *  account on the local FS stays covered by the FS writer wherever {@link saveSpaceAuth} is the
+ *  writer (accepted residual, documented here rather than silently absorbed). */
+export declare function putSpaceAuth(store: SecretStore, auth: SpaceAuth): Promise<void>;
+/** Remove the space trust material through the seam - the authoritative delete for a non-FS store.
+ *  BROKER-WIDE by nature (the broker record dies with its last space's account), so its one caller
+ *  is `clean all` AFTER the failure gate and the {@link assertSingleSpaceBroker} guard - on a
+ *  multi-tenant root that guard refuses long before this runs. Deletes the space's account record,
+ *  the broker record, and the legacy monolith. Idempotent. */
+export declare function deleteSpaceAuth(store: SecretStore, space: string): Promise<void>;
 //# sourceMappingURL=auth-paths.d.ts.map

package/dist/auth-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-paths.d.ts","sourceRoot":"","sources":["../src/auth-paths.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuD,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAevH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;;mDAKmD;AACnD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED;;;;;uDAKuD;AACvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAID;;mEAEmE;AACnE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;mDAImD;AACnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIvD;AAUD;;;;yCAIyC;AACzC,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAA+C,CAAC;AAC7F,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MAAoD,CAAC;AACvG,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,MAAuD,CAAC;AAE7G;;;qFAGqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAChE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;CAC1E,CAQA;AAED;;;;oEAIoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB3D;AAED;;;;;;2BAM2B;AAC3B,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1G;AAED;;iGAEiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,CAQnE;AAED;;iGAEiG;AACjG,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAIhE;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAIhE"}
+{"version":3,"file":"auth-paths.d.ts","sourceRoot":"","sources":["../src/auth-paths.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAexB,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;;;gGAMgG;AAChG,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa9C;AAqBD;;;;;4DAK4D;AAC5D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAID;;qFAEqF;AACrF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMjE;AAED;;;;;;;;;;;;4FAY4F;AAC5F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIpE;AAwFD;;;mEAGmE;AACnE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;;;yDAKyD;AACzD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB1D;AAID;;mEAEmE;AACnE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;mDAImD;AACnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIvD;AAUD;;;;yCAIyC;AACzC,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAA+C,CAAC;AAC7F,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MAAoD,CAAC;AACvG,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,MAAuD,CAAC;AAE7G;;;qFAGqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAChE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;CAC1E,CAQA;AAED;;;;oEAIoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB3D;AAED;;;;;;2BAM2B;AAC3B,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1G;AAED;;iGAEiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,CAQnE;AAkBD,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAwDD;;;;0FAI0F;AAC1F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAyED;;;mEAGmE;AACnE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAqCpE;AAED;iEACiE;AACjE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAKlE;AAED;;;iBAGiB;AACjB,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAQtF;AAED;;gEAEgE;AAChE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAY7F;AAOD;;;;4CAI4C;AAC5C,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAiB/E;AAED;;;sDAGsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAGpE;AAED;;;;4FAI4F;AAC5F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAGhE;AAED;;;;;;;;uCAQuC;AACvC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAY3D;AAED;;;;;;;;;;;;wGAYwG;AACxG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU5E;AAED;;;;;;;;;;;;;gEAagE;AAChE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAwCrF;AAED;;wGAEwG;AACxG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvD;AAYD;;uDAEuD;AACvD,eAAO,MAAM,eAAe,qBAAwB,CAAC;AAErD;6EAC6E;AAC7E,eAAO,MAAM,cAAc,mBAAsB,CAAC;AAElD;oDACoD;AACpD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AA4BD;;;;;;;;;;wDAUwD;AACxD,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAoCpG;AAED;;;;kFAIkF;AAClF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAGtG;AAED;;;;;;;;;;;;;iFAaiF;AACjF,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCrF;AAED;;;;8DAI8D;AAC9D,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAItF"}