@fuzdev/fuz_app 0.1.0

package/dist/testing/integration_helpers.d.ts

@@ -0,0 +1,107 @@
+import './assert_dev_env.js';
+/**
+ * Integration test helpers — route lookup, response validation, and cookie utilities.
+ *
+ * @module
+ */
+import type { RouteSpec, RouteMethod } from '../http/route_spec.js';
+import type { Keyring } from '../auth/keyring.js';
+import { type SessionOptions } from '../auth/session_cookie.js';
+/**
+ * Find a route spec matching the given method and path.
+ *
+ * Supports both exact matches and parameterized paths (`:param` segments).
+ *
+ * @param specs - route specs to search
+ * @param method - HTTP method
+ * @param path - request path (exact or with concrete param values)
+ * @returns matching route spec, or `undefined`
+ */
+export declare const find_route_spec: (specs: Array<RouteSpec>, method: string, path: string) => RouteSpec | undefined;
+/**
+ * Find an auth route by suffix and method.
+ *
+ * Useful for discovering login/logout/verify/revoke paths regardless
+ * of consumer prefix (`/api/account/login`, `/api/auth/login`, etc.).
+ *
+ * @param specs - route specs to search
+ * @param suffix - path suffix to match (e.g. `'/login'`)
+ * @param method - HTTP method
+ * @returns matching route spec, or `undefined`
+ */
+export declare const find_auth_route: (specs: Array<RouteSpec>, suffix: string, method: RouteMethod) => RouteSpec | undefined;
+/**
+ * Validate a response body against the route spec's declared schemas.
+ *
+ * For 2xx responses, validates against `spec.output`.
+ * For error responses, validates against the merged error schema for that status code.
+ * Throws with details on mismatch.
+ *
+ * @param route_specs - route specs for schema lookup
+ * @param method - HTTP method of the request
+ * @param path - path of the request
+ * @param response - the Response to validate
+ */
+export declare const assert_response_matches_spec: (route_specs: Array<RouteSpec>, method: string, path: string, response: Response) => Promise<void>;
+/**
+ * Create an expired test cookie — validly signed but with an expiry timestamp in 1970.
+ *
+ * @param keyring - keyring for signing
+ * @param session_options - session config
+ * @returns signed cookie value with long-past expiry
+ */
+export declare const create_expired_test_cookie: (keyring: Keyring, session_options: SessionOptions<string>) => Promise<string>;
+/**
+ * Assert that an error response body contains no unexpected fields.
+ *
+ * Error schemas use `z.looseObject` (intentional — multiple producers), but
+ * test responses should be checked for fields that could leak information.
+ * Flags any field not in the known-safe set.
+ *
+ * @param body - parsed error response JSON
+ * @param context - description for error messages (e.g., `'POST /api/login 401'`)
+ * @returns array of unexpected field names (empty = clean)
+ */
+export declare const check_error_response_fields: (body: Record<string, unknown>) => Array<string>;
+/**
+ * Assert that an error response contains no leaky field values.
+ *
+ * Checks both field names and string values for patterns indicating
+ * stack traces, SQL, or internal paths.
+ *
+ * @param body - parsed error response JSON
+ * @param context - description for error messages
+ */
+export declare const assert_no_error_info_leakage: (body: Record<string, unknown>, context: string) => void;
+/**
+ * Assert that a 429 response includes a valid `Retry-After` header
+ * matching the JSON body's `retry_after` field.
+ *
+ * @param response - the 429 response
+ * @param body - parsed JSON body with `retry_after` field
+ */
+export declare const assert_rate_limit_retry_after_header: (response: Response, body: {
+    retry_after: number;
+}) => void;
+/** Field names that must never appear in any HTTP response body. */
+export declare const SENSITIVE_FIELD_BLOCKLIST: ReadonlyArray<string>;
+/** Field names that must not appear in non-admin HTTP response bodies. */
+export declare const ADMIN_ONLY_FIELD_BLOCKLIST: ReadonlyArray<string>;
+/**
+ * Recursively collect all key names from a parsed JSON value.
+ *
+ * Walks objects and arrays to find every property name at any nesting depth.
+ *
+ * @param value - parsed JSON value
+ * @returns set of all key names found
+ */
+export declare const collect_json_keys_recursive: (value: unknown) => Set<string>;
+/**
+ * Assert that a parsed JSON body contains no fields from the given blocklist.
+ *
+ * @param body - parsed response JSON
+ * @param blocklist - field names to check for
+ * @param context - description for error messages
+ */
+export declare const assert_no_sensitive_fields_in_json: (body: unknown, blocklist: ReadonlyArray<string>, context: string) => void;
+//# sourceMappingURL=integration_helpers.d.ts.map

package/dist/testing/integration_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;GAIG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAE,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAIlE,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAE3F;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAC3B,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,QAAQ,MAAM,EACd,MAAM,MAAM,KACV,SAAS,GAAG,SAad,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,GAC3B,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,QAAQ,MAAM,EACd,QAAQ,WAAW,KACjB,SAAS,GAAG,SAEd,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,QAAQ,MAAM,EACd,MAAM,MAAM,EACZ,UAAU,QAAQ,KAChB,OAAO,CAAC,IAAI,CAmDd,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACtC,SAAS,OAAO,EAChB,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,OAAO,CAAC,MAAM,CAGhB,CAAC;AAuCF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,MAAM,CAQvF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,MAAM,KACb,IAkBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,UAAU,QAAQ,EAClB,MAAM;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,KACzB,IAUF,CAAC;AAIF,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAAmC,CAAC;AAEhG,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,MAAM,CAAgC,CAAC;AAE9F;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GAAI,OAAO,OAAO,KAAG,GAAG,CAAC,MAAM,CAetE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,OAAO,EACb,WAAW,aAAa,CAAC,MAAM,CAAC,EAChC,SAAS,MAAM,KACb,IAKF,CAAC"}

package/dist/testing/integration_helpers.js

@@ -0,0 +1,246 @@
+import './assert_dev_env.js';
+import { is_null_schema, merge_error_schemas } from '../http/schema_helpers.js';
+import { assert } from 'vitest';
+import { create_session_cookie_value } from '../auth/session_cookie.js';
+/**
+ * Find a route spec matching the given method and path.
+ *
+ * Supports both exact matches and parameterized paths (`:param` segments).
+ *
+ * @param specs - route specs to search
+ * @param method - HTTP method
+ * @param path - request path (exact or with concrete param values)
+ * @returns matching route spec, or `undefined`
+ */
+export const find_route_spec = (specs, method, path) => {
+    // exact match first
+    const exact = specs.find((s) => s.method === method && s.path === path);
+    if (exact)
+        return exact;
+    // parameterized match — `:param` segments match any value
+    return specs.find((s) => {
+        if (s.method !== method)
+            return false;
+        const spec_parts = s.path.split('/');
+        const path_parts = path.split('/');
+        if (spec_parts.length !== path_parts.length)
+            return false;
+        return spec_parts.every((sp, i) => sp.startsWith(':') || sp === path_parts[i]);
+    });
+};
+/**
+ * Find an auth route by suffix and method.
+ *
+ * Useful for discovering login/logout/verify/revoke paths regardless
+ * of consumer prefix (`/api/account/login`, `/api/auth/login`, etc.).
+ *
+ * @param specs - route specs to search
+ * @param suffix - path suffix to match (e.g. `'/login'`)
+ * @param method - HTTP method
+ * @returns matching route spec, or `undefined`
+ */
+export const find_auth_route = (specs, suffix, method) => {
+    return specs.find((s) => s.method === method && s.path.endsWith(suffix));
+};
+/**
+ * Validate a response body against the route spec's declared schemas.
+ *
+ * For 2xx responses, validates against `spec.output`.
+ * For error responses, validates against the merged error schema for that status code.
+ * Throws with details on mismatch.
+ *
+ * @param route_specs - route specs for schema lookup
+ * @param method - HTTP method of the request
+ * @param path - path of the request
+ * @param response - the Response to validate
+ */
+export const assert_response_matches_spec = async (route_specs, method, path, response) => {
+    const spec = find_route_spec(route_specs, method, path);
+    if (!spec) {
+        throw new Error(`No route spec found for ${method} ${path}`);
+    }
+    const cloned = response.clone();
+    let body;
+    try {
+        body = await cloned.json();
+    }
+    catch {
+        // Non-JSON response — only acceptable when no schema applies.
+        // If the spec declares an output or error schema for this status,
+        // getting non-JSON is a real bug.
+        if (response.ok && !is_null_schema(spec.output)) {
+            throw new Error(`${method} ${path} (${response.status}) returned non-JSON but has output schema`);
+        }
+        if (!response.ok) {
+            const merged = merge_error_schemas(spec);
+            if (merged?.[response.status]) {
+                throw new Error(`${method} ${path} (${response.status}) returned non-JSON but has error schema for status ${response.status}`);
+            }
+        }
+        return;
+    }
+    if (response.ok) {
+        const result = spec.output.safeParse(body);
+        if (!result.success) {
+            throw new Error(`Output schema mismatch for ${method} ${path} (${response.status}): ${JSON.stringify(result.error.issues)}`);
+        }
+    }
+    else {
+        const merged = merge_error_schemas(spec);
+        if (merged) {
+            const status_schema = merged[response.status];
+            if (status_schema) {
+                const result = status_schema.safeParse(body);
+                if (!result.success) {
+                    throw new Error(`Error schema mismatch for ${method} ${path} (${response.status}): ${JSON.stringify(result.error.issues)}`);
+                }
+            }
+        }
+    }
+};
+/**
+ * Create an expired test cookie — validly signed but with an expiry timestamp in 1970.
+ *
+ * @param keyring - keyring for signing
+ * @param session_options - session config
+ * @returns signed cookie value with long-past expiry
+ */
+export const create_expired_test_cookie = async (keyring, session_options) => {
+    // now_seconds=1 puts the expiry at 1 + max_age seconds past epoch — still in 1970
+    return create_session_cookie_value(keyring, 'expired_test_token', session_options, 1);
+};
+/**
+ * Assert that a 429 response includes a valid `Retry-After` header
+ * matching the JSON body's `retry_after` field.
+ *
+ * @param response - the 429 response
+ * @param body - parsed JSON body with `retry_after` field
+ */
+/**
+ * Known safe fields that may appear in any error response.
+ *
+ * Error schemas use `z.looseObject` so extra context fields are allowed in production,
+ * but test responses should not contain fields that leak internal details (stack traces,
+ * SQL, file paths). This set lists the fields that are safe to appear.
+ */
+const KNOWN_SAFE_ERROR_FIELDS = new Set([
+    'error',
+    'issues',
+    'required_role',
+    'retry_after',
+    'credential_type',
+    'has_references',
+    'ok',
+]);
+/** Fields in error responses that indicate information leakage. */
+const LEAKY_FIELD_PATTERNS = [
+    'stack',
+    'trace',
+    'sql',
+    'query',
+    'internal',
+    'password',
+    'hash',
+    'secret',
+    'token',
+];
+/**
+ * Assert that an error response body contains no unexpected fields.
+ *
+ * Error schemas use `z.looseObject` (intentional — multiple producers), but
+ * test responses should be checked for fields that could leak information.
+ * Flags any field not in the known-safe set.
+ *
+ * @param body - parsed error response JSON
+ * @param context - description for error messages (e.g., `'POST /api/login 401'`)
+ * @returns array of unexpected field names (empty = clean)
+ */
+export const check_error_response_fields = (body) => {
+    const unexpected = [];
+    for (const key of Object.keys(body)) {
+        if (!KNOWN_SAFE_ERROR_FIELDS.has(key)) {
+            unexpected.push(key);
+        }
+    }
+    return unexpected;
+};
+/**
+ * Assert that an error response contains no leaky field values.
+ *
+ * Checks both field names and string values for patterns indicating
+ * stack traces, SQL, or internal paths.
+ *
+ * @param body - parsed error response JSON
+ * @param context - description for error messages
+ */
+export const assert_no_error_info_leakage = (body, context) => {
+    const body_str = JSON.stringify(body);
+    for (const pattern of LEAKY_FIELD_PATTERNS) {
+        // check field names (not values — 'error' legitimately contains error codes)
+        for (const key of Object.keys(body)) {
+            assert.ok(!key.toLowerCase().includes(pattern), `${context}: error response field '${key}' matches leaky pattern '${pattern}'`);
+        }
+    }
+    // check for stack traces and file paths in values
+    assert.ok(!body_str.includes('node_modules'), `${context}: error response contains node_modules path`);
+    assert.ok(!body_str.includes('at '), `${context}: error response contains stack trace`);
+    assert.ok(!/\.ts:\d+/.test(body_str), `${context}: error response contains .ts file reference`);
+};
+/**
+ * Assert that a 429 response includes a valid `Retry-After` header
+ * matching the JSON body's `retry_after` field.
+ *
+ * @param response - the 429 response
+ * @param body - parsed JSON body with `retry_after` field
+ */
+export const assert_rate_limit_retry_after_header = (response, body) => {
+    const header = response.headers.get('Retry-After');
+    assert.ok(header, 'Missing Retry-After header on 429 response');
+    const header_value = Number(header);
+    assert.ok(!Number.isNaN(header_value), `Retry-After header is not a number: ${header}`);
+    assert.strictEqual(header_value, Math.ceil(body.retry_after), `Retry-After header (${header_value}) should equal ceil(retry_after) (${Math.ceil(body.retry_after)})`);
+};
+// --- Data exposure helpers ---
+/** Field names that must never appear in any HTTP response body. */
+export const SENSITIVE_FIELD_BLOCKLIST = ['password_hash', 'token_hash'];
+/** Field names that must not appear in non-admin HTTP response bodies. */
+export const ADMIN_ONLY_FIELD_BLOCKLIST = ['updated_by', 'created_by'];
+/**
+ * Recursively collect all key names from a parsed JSON value.
+ *
+ * Walks objects and arrays to find every property name at any nesting depth.
+ *
+ * @param value - parsed JSON value
+ * @returns set of all key names found
+ */
+export const collect_json_keys_recursive = (value) => {
+    const keys = new Set();
+    const walk = (v) => {
+        if (v === null || v === undefined || typeof v !== 'object')
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                walk(item);
+            return;
+        }
+        for (const [key, val] of Object.entries(v)) {
+            keys.add(key);
+            walk(val);
+        }
+    };
+    walk(value);
+    return keys;
+};
+/**
+ * Assert that a parsed JSON body contains no fields from the given blocklist.
+ *
+ * @param body - parsed response JSON
+ * @param blocklist - field names to check for
+ * @param context - description for error messages
+ */
+export const assert_no_sensitive_fields_in_json = (body, blocklist, context) => {
+    const keys = collect_json_keys_recursive(body);
+    for (const field of blocklist) {
+        assert.ok(!keys.has(field), `${context}: response contains blocklisted field '${field}'`);
+    }
+};

package/dist/testing/middleware.d.ts

@@ -0,0 +1,125 @@
+import './assert_dev_env.js';
+/**
+ * Table-driven middleware test helpers.
+ *
+ * Provides mock builders for bearer auth middleware dependencies,
+ * a generic test runner that iterates case tables, and a reusable
+ * middleware stack factory for integration testing.
+ *
+ * @module
+ */
+import { vi } from 'vitest';
+import { Hono } from 'hono';
+import type { z } from 'zod';
+import type { RateLimiter } from '../rate_limiter.js';
+import { type RequestContext } from '../auth/request_context.js';
+/** Mock configuration for bearer auth middleware test setup. */
+export interface BearerAuthTestOptions {
+    /** Test description. */
+    name: string;
+    /** Request headers. */
+    headers?: Record<string, string>;
+    /** Pre-set request context (simulates session already resolved). */
+    pre_context?: RequestContext;
+    /** What `query_validate_api_token()` returns. */
+    mock_validate_result?: unknown;
+    /** What `query_account_by_id()` returns. */
+    mock_find_by_id_result?: unknown;
+    /** What `query_actor_by_account()` returns. */
+    mock_find_by_account_result?: unknown;
+    /** What `query_permit_find_active_for_actor()` returns. */
+    mock_permits_result?: unknown;
+    /** Expected HTTP status, or `'next'` if the middleware should call `next()`. */
+    expected_status: number | 'next';
+    /** Expected `error` field in JSON response body. */
+    expected_error?: string;
+    /** Zod schema to validate error response body against. Defaults to `ApiError` when `expected_error` is set. */
+    expected_error_schema?: z.ZodType;
+}
+/** A full test case for the table-driven bearer auth runner. */
+export interface BearerAuthTestCase extends BearerAuthTestOptions {
+    /** Whether the request should reach token validation or be short-circuited. */
+    validate_expectation: 'called' | 'not_called';
+    /** If true, assert `REQUEST_CONTEXT_KEY` and `CREDENTIAL_TYPE_KEY` were set to api_token values. */
+    assert_context_set?: boolean;
+    /** If true, assert the pre-existing session context and credential type are preserved. */
+    assert_context_preserved?: boolean;
+    /** Optional callback for custom spy assertions on the mocks bundle. */
+    assert_mocks?: (mocks: BearerAuthMocks) => void;
+}
+/** Mocks bundle returned by `create_bearer_auth_mocks`. */
+export interface BearerAuthMocks {
+    mock_validate: ReturnType<typeof vi.fn>;
+    mock_find_by_id: ReturnType<typeof vi.fn>;
+    mock_find_by_account: ReturnType<typeof vi.fn>;
+    mock_find_active_for_actor: ReturnType<typeof vi.fn>;
+}
+/**
+ * Create mock dependencies for `create_bearer_auth_middleware`, configured per test case.
+ *
+ * Configures the module-level mocks for `query_validate_api_token`,
+ * `query_account_by_id`, `query_actor_by_account`, and `query_permit_find_active_for_actor`
+ * so each test case controls return values independently.
+ *
+ * @param tc - the test config providing mock return values
+ * @returns mocks bundle with spy references
+ */
+export declare const create_bearer_auth_mocks: (tc: BearerAuthTestOptions) => BearerAuthMocks;
+/** Default client IP set by the proxy stub in test apps. */
+export declare const TEST_CLIENT_IP = "127.0.0.1";
+/**
+ * Create a Hono app wired with `create_bearer_auth_middleware` using mocked deps.
+ *
+ * The route handler at `/api/test` returns the resolved context in the response body,
+ * enabling assertions on `REQUEST_CONTEXT_KEY` and `CREDENTIAL_TYPE_KEY`.
+ *
+ * @param tc - the test config providing mock behavior
+ * @param ip_rate_limiter - optional rate limiter (null to disable)
+ * @returns the app and mocks bundle
+ */
+export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions, ip_rate_limiter?: RateLimiter | null) => {
+    app: Hono;
+    mocks: BearerAuthMocks;
+};
+/**
+ * Run a table of bearer auth middleware test cases.
+ *
+ * Generates one `test()` per case inside a `describe()` block.
+ *
+ * @param suite_name - the describe block name
+ * @param cases - the test case table
+ * @param ip_rate_limiter - optional rate limiter shared across cases
+ */
+export declare const describe_bearer_auth_cases: (suite_name: string, cases: Array<BearerAuthTestCase>, ip_rate_limiter?: RateLimiter | null) => void;
+/** Path used by the echo route in `create_test_middleware_stack_app`. */
+export declare const TEST_MIDDLEWARE_PATH = "/api/test";
+/** Options for `create_test_middleware_stack_app`. */
+export interface TestMiddlewareStackOptions {
+    /** Trusted proxy IPs. @default `['10.0.0.1']` */
+    trusted_proxies?: Array<string>;
+    /** Comma-separated allowed origin patterns. @default `'https://app.example.com'` */
+    allowed_origins?: string;
+    /** Connection IP or factory. @default first trusted proxy */
+    connection_ip?: string | (() => string | undefined);
+    /** Rate limiter for bearer auth. @default `null` */
+    ip_rate_limiter?: RateLimiter | null;
+}
+/** Return type of `create_test_middleware_stack_app`. */
+export interface TestMiddlewareStackApp {
+    app: Hono;
+    mock_validate: ReturnType<typeof vi.fn>;
+    mock_find_by_id: ReturnType<typeof vi.fn>;
+    mock_find_by_account: ReturnType<typeof vi.fn>;
+    mock_find_active_for_actor: ReturnType<typeof vi.fn>;
+}
+/**
+ * Create a Hono app with real proxy + origin + bearer middleware for integration testing.
+ *
+ * All DB queries return undefined (no real database needed).
+ * The echo route at `TEST_MIDDLEWARE_PATH` returns `{ok, client_ip, has_context}`.
+ *
+ * @param options - middleware stack configuration
+ * @returns the app and mock spies (reconfigure via `mockImplementation` for valid-token paths)
+ */
+export declare const create_test_middleware_stack_app: (options?: TestMiddlewareStackOptions) => TestMiddlewareStackApp;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/testing/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAC,EAAE,EAAyB,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAC1B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAU3B,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAsB,KAAK,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAqBpF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,+CAA+C;IAC/C,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0FAA0F;IAC1F,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,oBAAoB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/C,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoBpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,EACzB,kBAAiB,WAAW,GAAG,IAAW,KACxC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CA2CpC,CAAC;AAIF;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,EAChC,kBAAiB,WAAW,GAAG,IAAW,KACxC,IA0DF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,oDAAoD;IACpD,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,oBAAoB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/C,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBAiDF,CAAC"}