@graphty/graph-io 0.3.48 → 0.3.50

package/dist/chunks/sigv4-BXwVbza3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4-BXwVbza3.js","sources":["../../src/sources/sha256.ts","../../src/sources/sigv4.ts"],"sourcesContent":["/**\n * SHA-256 in plain JavaScript (FIPS 180-4), for the one place Web Crypto is missing: a browser page\n * that is not a secure context (plain http on a host other than localhost) has no\n * `crypto.subtle`. Only the content hash uses it; signing still needs Web Crypto.\n */\n\nconst K = new Uint32Array([\n    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98,\n    0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,\n    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8,\n    0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,\n    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819,\n    0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,\n    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7,\n    0xc67178f2,\n]);\n\n/**\n * Rotate a 32-bit word right.\n * @param x - the word\n * @param n - the bits\n * @returns the rotated word\n */\nfunction rotr(x: number, n: number): number {\n    return (x >>> n) | (x << (32 - n));\n}\n\n/**\n * Pad a message to whole 64-byte blocks, with its bit length at the end.\n * @param data - the message\n * @returns the padded message\n */\nfunction pad(data: Uint8Array): Uint8Array {\n    const blocks = Math.ceil((data.length + 9) / 64);\n    const out = new Uint8Array(blocks * 64);\n    out.set(data);\n    out[data.length] = 0x80;\n    const view = new DataView(out.buffer);\n    view.setUint32(out.length - 8, Math.floor(data.length / 0x20000000));\n    view.setUint32(out.length - 4, (data.length * 8) >>> 0);\n    return out;\n}\n\n/**\n * Run one 64-byte block through the compression function.\n * @param h - the running hash, updated in place\n * @param w - the 64-word schedule, scratch\n * @param view - the padded message\n * @param offset - where the block starts\n */\nfunction compress(h: Uint32Array, w: Uint32Array, view: DataView, offset: number): void {\n    for (let i = 0; i < 16; i++) {\n        w[i] = view.getUint32(offset + i * 4);\n    }\n    for (let i = 16; i < 64; i++) {\n        const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);\n        const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);\n        w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;\n    }\n    let [a, b, c, d, e, f, g, hh] = h;\n    for (let i = 0; i < 64; i++) {\n        const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0;\n        const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;\n        hh = g;\n        g = f;\n        f = e;\n        e = (d + t1) >>> 0;\n        d = c;\n        c = b;\n        b = a;\n        a = (t1 + t2) >>> 0;\n    }\n    const next = [a, b, c, d, e, f, g, hh];\n    for (let i = 0; i < 8; i++) {\n        h[i] = (h[i] + next[i]) >>> 0;\n    }\n}\n\n/**\n * SHA-256 of bytes.\n * @param data - the bytes\n * @returns the 32-byte digest\n */\nexport function sha256Bytes(data: Uint8Array): ArrayBuffer {\n    const h = new Uint32Array([\n        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,\n    ]);\n    const padded = pad(data);\n    const view = new DataView(padded.buffer);\n    const w = new Uint32Array(64);\n    for (let offset = 0; offset < padded.length; offset += 64) {\n        compress(h, w, view, offset);\n    }\n    const out = new DataView(new ArrayBuffer(32));\n    h.forEach((word, i) => {\n        out.setUint32(i * 4, word);\n    });\n    return out.buffer;\n}\n","/**\n * AWS Signature Version 4 over Web Crypto (design sections 6.3 and 12.4), loaded by\n * `credentials.awsSigV4` on first use. No AWS SDK: it signs the request `ctx.fetch` is about to\n * send, every header that request carries plus `host`, and is checked against AWS's published\n * signature test suite. graph-io never reads `~/.aws` or the environment.\n */\n\nimport { detectRuntime } from \"./context.js\";\nimport { type AwsSigV4Options } from \"./credentials.js\";\nimport { failAlone } from \"./fail.js\";\nimport { sha256Bytes } from \"./sha256.js\";\n\n/** Headers never signed: proxies and clients may change them in flight. */\nconst UNSIGNED = new Set([\"user-agent\", \"expect\", \"x-amzn-trace-id\", \"authorization\", \"content-length\"]);\n\n/**\n * The UTF-8 bytes of a string.\n * @param text - the text\n * @returns the bytes\n */\nfunction utf8(text: string): Uint8Array {\n    return new TextEncoder().encode(text);\n}\n\n/**\n * Code-unit order of two strings.\n * @param a - one string\n * @param b - another\n * @returns negative, zero or positive\n */\nfunction compareText(a: string, b: string): number {\n    if (a === b) {\n        return 0;\n    }\n    return a < b ? -1 : 1;\n}\n\n/**\n * Web Crypto: the global one, or Node 18's, which is not global without a flag. A browser page that\n * is not a secure context (plain http on a host other than localhost) has none.\n * @returns the subtle crypto, or null where there is none\n */\nasync function subtle(): Promise<SubtleCrypto | null> {\n    const global = (globalThis as { crypto?: Crypto }).crypto;\n    if (global?.subtle !== undefined) {\n        return global.subtle;\n    }\n    if (detectRuntime() !== \"node\") {\n        return null;\n    }\n    const name = \"node:crypto\";\n    return ((await import(/* @vite-ignore */ name)) as { webcrypto: Crypto }).webcrypto.subtle;\n}\n\n/**\n * Lowercase hex of bytes.\n * @param bytes - the bytes\n * @returns hex\n */\nfunction hex(bytes: ArrayBuffer): string {\n    return Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * SHA-256 of bytes, as hex.\n * @param data - the bytes\n * @returns the digest\n */\nasync function sha256(data: Uint8Array | ArrayBuffer): Promise<string> {\n    const s = await subtle();\n    if (s === null) {\n        return hex(sha256Bytes(data instanceof Uint8Array ? data : new Uint8Array(data)));\n    }\n    return hex(await s.digest(\"SHA-256\", data as BufferSource));\n}\n\n/**\n * SHA-256 as 64 lowercase hexadecimal digits: of bytes exactly as given, or of a text's UTF-8 bytes\n * (the Cypher source's content hash, a project file's record of a file it loaded). Web Crypto where\n * there is one, else plain JavaScript (a page that is not a secure context). Experimental.\n * @param data - the bytes or the text\n * @returns the digest\n */\nexport function sha256Hex(data: string | Uint8Array): Promise<string> {\n    return sha256(typeof data === \"string\" ? utf8(data) : data);\n}\n\n/**\n * HMAC-SHA-256.\n * @param key - the key\n * @param data - the message\n * @returns the MAC\n */\nasync function hmac(key: Uint8Array | ArrayBuffer, data: string): Promise<ArrayBuffer> {\n    const s = await subtle();\n    if (s === null) {\n        failAlone(\"E_SOURCE_RUNTIME\", \"AWS signing needs Web Crypto, which a browser has only on a secure page\", {\n            runtime: detectRuntime(),\n            reason: \"needs-secure-context\",\n        });\n    }\n    const k = await s.importKey(\"raw\", key as BufferSource, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n    return s.sign(\"HMAC\", k, utf8(data) as BufferSource);\n}\n\n/**\n * RFC 3986 encoding, as SigV4 asks: every byte but letters, digits and `-_.~`.\n * @param text - the text\n * @returns the encoded text\n */\nfunction encode(text: string): string {\n    return encodeURIComponent(text).replaceAll(\n        /[!'()*]/g,\n        (c) => `%${(c.codePointAt(0) ?? 0).toString(16).toUpperCase()}`,\n    );\n}\n\n/**\n * The canonical query string: every pair encoded, sorted by key then value.\n * @param url - the request URL\n * @returns the canonical query\n */\nfunction canonicalQuery(url: URL): string {\n    return [...url.searchParams]\n        .map(([k, v]) => [encode(k), encode(v)] as const)\n        .sort(([ak, av], [bk, bv]) => compareText(ak, bk) || compareText(av, bv))\n        .map(([k, v]) => `${k}=${v}`)\n        .join(\"&\");\n}\n\n/**\n * The `YYYYMMDDTHHMMSSZ` form of a time.\n * @param date - the time\n * @returns the AWS timestamp\n */\nfunction amzDate(date: Date): string {\n    return date\n        .toISOString()\n        .replaceAll(/[-:]/g, \"\")\n        .replace(/\\.\\d{3}/, \"\");\n}\n\n/**\n * Sign a request with AWS SigV4 (`Authorization`, `X-Amz-Date` and, for temporary credentials,\n * `X-Amz-Security-Token`). In a browser, long-term keys (no session token) are refused, since every\n * script on the page could read them: use temporary credentials from an identity pool.\n * @param request - the request\n * @param options - region, service (default \"neptune-db\") and the credentials or a provider\n * @param now - the signing time; tests fix it. An `X-Amz-Date` already on the request wins.\n * @returns the signed request\n */\nexport async function signRequest(\n    request: Request,\n    options: AwsSigV4Options,\n    now: Date = new Date(),\n): Promise<Request> {\n    const creds = typeof options.credentials === \"function\" ? await options.credentials() : options.credentials;\n    const runtime = detectRuntime();\n    if ((runtime === \"browser\" || runtime === \"worker\") && (creds.sessionToken ?? \"\") === \"\") {\n        failAlone(\"E_SOURCE_PARAM\", \"long-term AWS keys are never used in a browser\", {\n            name: \"credential\",\n            reason: \"long-term-key\",\n        });\n    }\n    const service = options.service ?? \"neptune-db\";\n    const url = new URL(request.url);\n    const headers = new Headers(request.headers);\n    const stamp = headers.get(\"x-amz-date\") ?? amzDate(now);\n    headers.set(\"x-amz-date\", stamp);\n    if (creds.sessionToken !== undefined && creds.sessionToken !== \"\") {\n        headers.set(\"x-amz-security-token\", creds.sessionToken);\n    }\n    const method = request.method.toUpperCase();\n    const body = method === \"GET\" || method === \"HEAD\" ? new Uint8Array(0) : await request.clone().arrayBuffer();\n\n    const signed = new Map<string, string>([[\"host\", url.host]]);\n    headers.forEach((value, name) => {\n        if (!UNSIGNED.has(name)) {\n            signed.set(name, value.trim().replaceAll(/\\s+/g, \" \"));\n        }\n    });\n    // SigV4 sorts header names by code unit, not by locale\n    const names = [...signed.keys()].sort((a, b) => Number(a > b) - Number(a < b));\n    const signedHeaders = names.join(\";\");\n    const canonical = [\n        method,\n        // non-S3 services encode the already-encoded path once more\n        url.pathname.split(\"/\").map(encode).join(\"/\"),\n        canonicalQuery(url),\n        ...names.map((n) => `${n}:${signed.get(n) ?? \"\"}`),\n        \"\",\n        signedHeaders,\n        await sha256(body),\n    ].join(\"\\n\");\n\n    const day = stamp.slice(0, 8);\n    const scope = `${day}/${options.region}/${service}/aws4_request`;\n    const toSign = [\"AWS4-HMAC-SHA256\", stamp, scope, await sha256(utf8(canonical))].join(\"\\n\");\n    let key: ArrayBuffer = await hmac(utf8(`AWS4${creds.secretAccessKey}`), day);\n    for (const part of [options.region, service, \"aws4_request\"]) {\n        key = await hmac(key, part);\n    }\n    const signature = hex(await hmac(key, toSign));\n    headers.set(\n        \"Authorization\",\n        `AWS4-HMAC-SHA256 Credential=${creds.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,\n    );\n    return new Request(request, { headers });\n}\n"],"names":[],"mappings":";;AAMA,MAAM,IAAI,IAAI,YAAY;AAAA,EACtB;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAChG;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAChG;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAChG;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAChG;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAChG;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAChG;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAChG;AACJ,CAAC;AAQD,SAAS,KAAK,GAAW,GAAmB;AACxC,SAAQ,MAAM,IAAM,KAAM,KAAK;AACnC;AAOA,SAAS,IAAI,MAA8B;AACvC,QAAM,SAAS,KAAK,MAAM,KAAK,SAAS,KAAK,EAAE;AAC/C,QAAM,MAAM,IAAI,WAAW,SAAS,EAAE;AACtC,MAAI,IAAI,IAAI;AACZ,MAAI,KAAK,MAAM,IAAI;AACnB,QAAM,OAAO,IAAI,SAAS,IAAI,MAAM;AACpC,OAAK,UAAU,IAAI,SAAS,GAAG,KAAK,MAAM,KAAK,SAAS,SAAU,CAAC;AACnE,OAAK,UAAU,IAAI,SAAS,GAAI,KAAK,SAAS,MAAO,CAAC;AACtD,SAAO;AACX;AASA,SAAS,SAAS,GAAgB,GAAgB,MAAgB,QAAsB;AACpF,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AACzB,MAAE,CAAC,IAAI,KAAK,UAAU,SAAS,IAAI,CAAC;AAAA,EACxC;AACA,WAAS,IAAI,IAAI,IAAI,IAAI,KAAK;AAC1B,UAAM,KAAK,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAK,EAAE,IAAI,EAAE,MAAM;AACrE,UAAM,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAK,EAAE,IAAI,CAAC,MAAM;AACnE,MAAE,CAAC,IAAK,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,OAAQ;AAAA,EAChD;AACA,MAAI,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,IAAI;AAChC,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AACzB,UAAM,KAAM,MAAM,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,MAAO,IAAI,IAAM,CAAC,IAAI,KAAM,EAAE,CAAC,IAAI,EAAE,CAAC,MAAO;AACpG,UAAM,MAAO,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,MAAO,IAAI,IAAM,IAAI,IAAM,IAAI,OAAS;AAC1F,SAAK;AACL,QAAI;AACJ,QAAI;AACJ,QAAK,IAAI,OAAQ;AACjB,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAK,KAAK,OAAQ;AAAA,EACtB;AACA,QAAM,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE;AACrC,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AACxB,MAAE,CAAC,IAAK,EAAE,CAAC,IAAI,KAAK,CAAC,MAAO;AAAA,EAChC;AACJ;AAOO,SAAS,YAAY,MAA+B;AACvD,QAAM,IAAI,IAAI,YAAY;AAAA,IACtB;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,EAAA,CACvF;AACD,QAAM,SAAS,IAAI,IAAI;AACvB,QAAM,OAAO,IAAI,SAAS,OAAO,MAAM;AACvC,QAAM,IAAI,IAAI,YAAY,EAAE;AAC5B,WAAS,SAAS,GAAG,SAAS,OAAO,QAAQ,UAAU,IAAI;AACvD,aAAS,GAAG,GAAG,MAAM,MAAM;AAAA,EAC/B;AACA,QAAM,MAAM,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;AAC5C,IAAE,QAAQ,CAAC,MAAM,MAAM;AACnB,QAAI,UAAU,IAAI,GAAG,IAAI;AAAA,EAC7B,CAAC;AACD,SAAO,IAAI;AACf;ACrFA,MAAM,+BAAe,IAAI,CAAC,cAAc,UAAU,mBAAmB,iBAAiB,gBAAgB,CAAC;AAOvG,SAAS,KAAK,MAA0B;AACpC,SAAO,IAAI,YAAA,EAAc,OAAO,IAAI;AACxC;AAQA,SAAS,YAAY,GAAW,GAAmB;AAC/C,MAAI,MAAM,GAAG;AACT,WAAO;AAAA,EACX;AACA,SAAO,IAAI,IAAI,KAAK;AACxB;AAOA,eAAe,SAAuC;AAClD,QAAM,SAAU,WAAmC;AACnD,MAAI,QAAQ,WAAW,QAAW;AAC9B,WAAO,OAAO;AAAA,EAClB;AACA,MAAI,cAAA,MAAoB,QAAQ;AAC5B,WAAO;AAAA,EACX;AACA,QAAM,OAAO;AACb,UAAS,MAAM;AAAA;AAAA,IAA0B;AAAA,KAAiC,UAAU;AACxF;AAOA,SAAS,IAAI,OAA4B;AACrC,SAAO,MAAM,KAAK,IAAI,WAAW,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC5F;AAOA,eAAe,OAAO,MAAiD;AACnE,QAAM,IAAI,MAAM,OAAA;AAChB,MAAI,MAAM,MAAM;AACZ,WAAO,IAAI,YAAY,gBAAgB,aAAa,OAAO,IAAI,WAAW,IAAI,CAAC,CAAC;AAAA,EACpF;AACA,SAAO,IAAI,MAAM,EAAE,OAAO,WAAW,IAAoB,CAAC;AAC9D;AASO,SAAS,UAAU,MAA4C;AAClE,SAAO,OAAO,OAAO,SAAS,WAAW,KAAK,IAAI,IAAI,IAAI;AAC9D;AAQA,eAAe,KAAK,KAA+B,MAAoC;AACnF,QAAM,IAAI,MAAM,OAAA;AAChB,MAAI,MAAM,MAAM;AACZ,cAAU,oBAAoB,2EAA2E;AAAA,MACrG,SAAS,cAAA;AAAA,MACT,QAAQ;AAAA,IAAA,CACX;AAAA,EACL;AACA,QAAM,IAAI,MAAM,EAAE,UAAU,OAAO,KAAqB,EAAE,MAAM,QAAQ,MAAM,UAAA,GAAa,OAAO,CAAC,MAAM,CAAC;AAC1G,SAAO,EAAE,KAAK,QAAQ,GAAG,KAAK,IAAI,CAAiB;AACvD;AAOA,SAAS,OAAO,MAAsB;AAClC,SAAO,mBAAmB,IAAI,EAAE;AAAA,IAC5B;AAAA,IACA,CAAC,MAAM,KAAK,EAAE,YAAY,CAAC,KAAK,GAAG,SAAS,EAAE,EAAE,YAAA,CAAa;AAAA,EAAA;AAErE;AAOA,SAAS,eAAe,KAAkB;AACtC,SAAO,CAAC,GAAG,IAAI,YAAY,EACtB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAU,EAC/C,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,YAAY,IAAI,EAAE,KAAK,YAAY,IAAI,EAAE,CAAC,EACvE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAC3B,KAAK,GAAG;AACjB;AAOA,SAAS,QAAQ,MAAoB;AACjC,SAAO,KACF,cACA,WAAW,SAAS,EAAE,EACtB,QAAQ,WAAW,EAAE;AAC9B;AAWA,eAAsB,YAClB,SACA,SACA,MAAY,oBAAI,QACA;AAChB,QAAM,QAAQ,OAAO,QAAQ,gBAAgB,aAAa,MAAM,QAAQ,gBAAgB,QAAQ;AAChG,QAAM,UAAU,cAAA;AAChB,OAAK,YAAY,aAAa,YAAY,cAAc,MAAM,gBAAgB,QAAQ,IAAI;AACtF,cAAU,kBAAkB,kDAAkD;AAAA,MAC1E,MAAM;AAAA,MACN,QAAQ;AAAA,IAAA,CACX;AAAA,EACL;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,QAAM,QAAQ,QAAQ,IAAI,YAAY,KAAK,QAAQ,GAAG;AACtD,UAAQ,IAAI,cAAc,KAAK;AAC/B,MAAI,MAAM,iBAAiB,UAAa,MAAM,iBAAiB,IAAI;AAC/D,YAAQ,IAAI,wBAAwB,MAAM,YAAY;AAAA,EAC1D;AACA,QAAM,SAAS,QAAQ,OAAO,YAAA;AAC9B,QAAM,OAAO,WAAW,SAAS,WAAW,SAAS,IAAI,WAAW,CAAC,IAAI,MAAM,QAAQ,MAAA,EAAQ,YAAA;AAE/F,QAAM,6BAAa,IAAoB,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;AAC3D,UAAQ,QAAQ,CAAC,OAAO,SAAS;AAC7B,QAAI,CAAC,SAAS,IAAI,IAAI,GAAG;AACrB,aAAO,IAAI,MAAM,MAAM,KAAA,EAAO,WAAW,QAAQ,GAAG,CAAC;AAAA,IACzD;AAAA,EACJ,CAAC;AAED,QAAM,QAAQ,CAAC,GAAG,OAAO,KAAA,CAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC;AAC7E,QAAM,gBAAgB,MAAM,KAAK,GAAG;AACpC,QAAM,YAAY;AAAA,IACd;AAAA;AAAA,IAEA,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC5C,eAAe,GAAG;AAAA,IAClB,GAAG,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE;AAAA,IACjD;AAAA,IACA;AAAA,IACA,MAAM,OAAO,IAAI;AAAA,EAAA,EACnB,KAAK,IAAI;AAEX,QAAM,MAAM,MAAM,MAAM,GAAG,CAAC;AAC5B,QAAM,QAAQ,GAAG,GAAG,IAAI,QAAQ,MAAM,IAAI,OAAO;AACjD,QAAM,SAAS,CAAC,oBAAoB,OAAO,OAAO,MAAM,OAAO,KAAK,SAAS,CAAC,CAAC,EAAE,KAAK,IAAI;AAC1F,MAAI,MAAmB,MAAM,KAAK,KAAK,OAAO,MAAM,eAAe,EAAE,GAAG,GAAG;AAC3E,aAAW,QAAQ,CAAC,QAAQ,QAAQ,SAAS,cAAc,GAAG;AAC1D,UAAM,MAAM,KAAK,KAAK,IAAI;AAAA,EAC9B;AACA,QAAM,YAAY,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC;AAC7C,UAAQ;AAAA,IACJ;AAAA,IACA,+BAA+B,MAAM,WAAW,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS;AAAA,EAAA;AAErH,SAAO,IAAI,QAAQ,SAAS,EAAE,SAAS;AAC3C;"}