@grest-ts/http 0.0.48 → 0.0.50

package/src/server/GGHttpServer.ts

@@ -6,14 +6,22 @@ import {GG_HTTP_SERVER} from "./GG_HTTP_SERVER";
 import {GGLog} from "@grest-ts/logger";
 import findMyWay, {HTTPMethod} from "find-my-way";
 import type {GGHttpSchema} from "../schema/GGHttpSchema";
-import {describePermission, GG_NO_PERMISSIONS, GGContractMethod, GGPermission} from "@grest-ts/schema";
+import {checkWiresImplemented} from "./checkers/checkWiresImplemented";
+import {checkPermissionsAtStart} from "./checkers/checkPermissionsAtStart";
+import {checkWireConflicts} from "./checkers/checkWireConflicts";
+import "../schema/GGWireContextKey.node";
+import {GGContractMethod, GGPermission} from "@grest-ts/schema";
+import type {GGTransportMiddleware} from "@grest-ts/context";
 // Forward declaration — actual type lives in @grest-ts/websocket to avoid circular dep.
 // GGHttpServer only stores the array; callers cast as needed.
 type AnyWebSocketSchema = {
     name: string;
     path: string;
-    contract: {clientToServer: {methods: Record<string, GGContractMethod>}};
-    middlewares: readonly unknown[];
+    contract: {
+        clientToServer: {methods: Record<string, GGContractMethod>};
+        serverToClient: {methods: Record<string, GGContractMethod>};
+    };
+    middlewares: readonly GGTransportMiddleware[];
     connectPermission?: GGPermission;
 };
 
@@ -73,16 +81,10 @@ export class GGHttpServer {
      * Framework-internal — only setupRoutes() (in GGHttpSchema.startServer.ts) should push here.
      */
     private readonly _registeredSchemas: GGHttpSchema<any, any>[] = [];
-
-    /**
-     * All GGHttpSchema instances registered on this server, in registration order.
-     * Available from the moment compose() begins; frozen (no further push allowed) once start() is called.
-     */
-    get registeredSchemas(): ReadonlyArray<GGHttpSchema<any, any>> {
-        return this._registeredSchemas;
-    }
+    private readonly _registeredWebSocketSchemas: AnyWebSocketSchema[] = [];
 
     public readonly httpServer: http.Server;
+    private readonly _routeOwners = new Map<string, string>();
     private activeRequests = 0;
     private router = findMyWay<findMyWay.HTTPVersion.V1>();
 
@@ -193,14 +195,12 @@ export class GGHttpServer {
         this._registeredSchemas.push(schema);
     }
 
-    private readonly _registeredWebSocketSchemas: AnyWebSocketSchema[] = [];
-
     /**
-     * All GGWebSocketSchema instances registered on this server, in registration order.
-     * Populated automatically by GGWebSocketSchema.startServer() / .register().
+     * All GGHttpSchema instances registered on this server, in registration order.
+     * Available from the moment compose() begins; frozen (no further push allowed) once start() is called.
      */
-    get registeredWebSocketSchemas(): ReadonlyArray<AnyWebSocketSchema> {
-        return this._registeredWebSocketSchemas;
+    get registeredSchemas(): ReadonlyArray<GGHttpSchema<any, any>> {
+        return this._registeredSchemas;
     }
 
     /** @internal Called by GGWebSocketSchema.startServer(). Do not call directly. */
@@ -208,88 +208,32 @@ export class GGHttpServer {
         this._registeredWebSocketSchemas.push(schema);
     }
 
-    private readonly _schemasWithResolver = new Set<object>();
-
-    /** @internal Called by HTTP / WS register paths when a scope resolver is wired. */
-    public _markResolverWired(schema: object): void {
-        this._schemasWithResolver.add(schema);
+    /**
+     * All GGWebSocketSchema instances registered on this server, in registration order.
+     * Populated automatically by GGWebSocketSchema.startServer() / .register().
+     */
+    get registeredWebSocketSchemas(): ReadonlyArray<AnyWebSocketSchema> {
+        return this._registeredWebSocketSchemas;
     }
 
-    private _checkPermissionsAtStart(): void {
-        type Surface = {label: string; permission: GGPermission | undefined; resolverWired: boolean};
-        const surfaces: Surface[] = [];
-
-        for (const schema of this._registeredSchemas) {
-            const resolverWired = this._schemasWithResolver.has(schema);
-            const methods = schema.contract?.methods ?? {};
-            for (const name of Object.keys(methods)) {
-                surfaces.push({
-                    label: `${schema.name}.${name}`,
-                    permission: (methods[name] as GGContractMethod).permission,
-                    resolverWired,
-                });
-            }
-        }
-        for (const ws of this._registeredWebSocketSchemas) {
-            const resolverWired = this._schemasWithResolver.has(ws);
-            const methods = ws.contract.clientToServer.methods;
-            for (const name of Object.keys(methods)) {
-                surfaces.push({
-                    label: `${ws.name}.${name}`,
-                    permission: methods[name].permission,
-                    resolverWired,
-                });
-            }
-            if (ws.connectPermission !== undefined) {
-                surfaces.push({
-                    label: `${ws.name} (connectPermission)`,
-                    permission: ws.connectPermission,
-                    resolverWired,
-                });
-            }
-        }
-
-        let strict = false;
-        const undeclared: Surface[] = [];
-        const orphaned: Surface[] = [];
-        for (const s of surfaces) {
-            if (s.permission !== undefined || s.resolverWired) strict = true;
-            if (s.permission === undefined) undeclared.push(s);
-            else if (s.permission !== GG_NO_PERMISSIONS && !s.resolverWired) orphaned.push(s);
-        }
-        if (!strict) return;
-
-        if (undeclared.length > 0) {
-            const lines = undeclared.map(s => `  ${s.label}`).join("\n");
+    public registerRoute(method: HttpMethod, path: string, handler: GGHttpRequestCallback, owner?: string): void {
+        const route = `${method} ${path}`;
+        const existing = this._routeOwners.get(route);
+        if (existing !== undefined) {
             throw new Error(
-                `GGHttpServer: permission strict mode is active on this server ` +
-                `(at least one route declares a permission or has .usePermissions(...) wired), ` +
-                `but the following routes have no \`permission\` declared:\n\n` +
-                lines +
-                `\n\nFix: declare \`permission\` on every route — use \`GG_NO_PERMISSIONS\` for intentionally public ones.`
+                `GGHttpServer: route ${route} is declared by both ${existing} and ${owner ?? "another route"}. ` +
+                `Give each route a distinct path (change a pathPrefix or route path).`
             );
         }
-        if (orphaned.length > 0) {
-            const lines = orphaned.map(s =>
-                `  ${s.label}   requires ${describePermission(s.permission)}`
-            ).join("\n");
-            throw new Error(
-                `GGHttpServer: these routes declare non-public permissions but their schema was ` +
-                `registered without a scope resolver:\n\n` +
-                lines +
-                `\n\nFix: call \`.usePermissions(yourResolver)\` on the GGHttp chain (or pass ` +
-                `\`permissionResolver\` to the WS schema config) before registering these routes.`
-            );
-        }
-    }
-
-    public registerRoute(method: HttpMethod, path: string, handler: GGHttpRequestCallback): void {
+        this._routeOwners.set(route, owner ?? path);
         this.router.on(method as HTTPMethod, path, handler as unknown as findMyWay.Handler<findMyWay.HTTPVersion.V1>);
     }
 
     public async start(): Promise<void> {
         Object.freeze(this._registeredSchemas);
-        this._checkPermissionsAtStart();
+        checkWireConflicts(this.registeredSchemas, this.registeredWebSocketSchemas);
+        checkWiresImplemented(this.registeredSchemas, this.registeredWebSocketSchemas);
+        checkPermissionsAtStart(this.registeredSchemas, this.registeredWebSocketSchemas);
         this._port = await new Promise((resolve) => {
             this.httpServer.listen(this.configuredPort, '0.0.0.0', () => {
                 const port = (this.httpServer.address() as any).port;

package/src/server/applyRequestMiddleware.ts

@@ -0,0 +1,40 @@
+import type http from "http";
+import type {GGInbound, GGTransportMiddleware} from "@grest-ts/context";
+
+/**
+ * Normalizes a Node request + parsed query into a GGInbound and runs the server-side
+ * pipeline: every parse() (populating context keys) before any process() (async
+ * validation), so a middleware can validate against a key an earlier one parsed.
+ * The cookie is taken only from the real request header — never from anywhere a
+ * client could forge — preserving the anti-spoof guarantee on every transport.
+ */
+export async function applyRequestMiddleware(
+    req: http.IncomingMessage,
+    queryArgs: Record<string, string | string[]>,
+    middlewares: readonly GGTransportMiddleware[]
+): Promise<void> {
+    if (middlewares.length === 0) return;
+    const inbound: GGInbound = {
+        headers: flatten(req.headers),
+        cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : undefined,
+        query: flatten(queryArgs)
+    };
+    for (const mw of middlewares) mw.parse?.(inbound);
+    // finally: a rejecting process() (e.g. anonymous → NOT_AUTHORIZED) must still drop every
+    // ephemeral credential — including those an earlier wire already parsed — so no raw token
+    // outlives the failed request in context.
+    try {
+        for (const mw of middlewares) await mw.process?.();
+    } finally {
+        for (const mw of middlewares) mw.clear?.();
+    }
+}
+
+function flatten(src: Record<string, string | string[] | undefined>): Record<string, string | undefined> {
+    const out: Record<string, string | undefined> = {};
+    for (const key in src) {
+        const value = src[key];
+        out[key] = Array.isArray(value) ? value[0] : value;
+    }
+    return out;
+}

package/src/server/applyResponseMiddleware.ts

@@ -1,5 +1,5 @@
 import type http from "http";
-import type {GGHttpResponse, GGHttpTransportMiddleware} from "../schema/GGHttpSchema";
+import type {GGResponse, GGTransportMiddleware} from "@grest-ts/context";
 
 /**
  * Runs the transport chain's server-side response hook and writes the collected
@@ -11,14 +11,14 @@ import type {GGHttpResponse, GGHttpTransportMiddleware} from "../schema/GGHttpSc
  */
 export function applyResponseMiddleware(
     res: http.ServerResponse,
-    middlewares: readonly GGHttpTransportMiddleware[] | undefined
+    middlewares: readonly GGTransportMiddleware[] | undefined
 ): void {
     if (!middlewares?.length || res.headersSent) return;
-    let response: GGHttpResponse | undefined;
+    let response: GGResponse | undefined;
     for (const mw of middlewares) {
-        if (!mw.updateResponse) continue;
+        if (!mw.respond) continue;
         response ??= {headers: {}};
-        mw.updateResponse(response);
+        mw.respond(response);
     }
     if (!response) return;
     for (const name in response.headers) {

package/src/server/checkers/checkPermissionsAtStart.ts

@@ -0,0 +1,112 @@
+/**
+ * Run at GGHttpServer.start() over the frozen schema graph. Three permission-coherence checks:
+ *
+ *  - strict-mode coverage: once any route declares a permission, every route on the server must
+ *    declare one (use GG_NO_PERMISSIONS for intentionally public routes).
+ *  - unsatisfiable route: a route requiring a non-public permission on a schema with no
+ *    permission-resolving wire (a .define()d wire whose handler exposes permissions()) can never
+ *    pass the gate — its pooled grants are always empty, so it is permanently FORBIDDEN.
+ *  - dead serverToClient permission: the gate has no caller identity for server-pushed messages,
+ *    so a non-public permission on a WS serverToClient method is silently ignored.
+ *
+ * Scopes come only from the schema's wires; there is no resolver wiring.
+ */
+import {GG_NO_PERMISSIONS, GGContractMethod, GGPermission} from "@grest-ts/schema"
+import type {GGTransportMiddleware} from "@grest-ts/context"
+import {GGWireContextKey} from "../../schema/GGWireContextKey"
+import "../../schema/GGWireContextKey.node"
+
+interface HttpSchemaLike {
+    name: string
+    apiMiddlewares: readonly GGTransportMiddleware[]
+    contract?: {methods: Record<string, GGContractMethod>}
+}
+
+interface WebSocketSchemaLike {
+    name: string
+    middlewares: readonly GGTransportMiddleware[]
+    contract: {
+        clientToServer: {methods: Record<string, GGContractMethod>}
+        serverToClient: {methods: Record<string, GGContractMethod>}
+    }
+    connectPermission?: GGPermission
+}
+
+function isNonPublic(permission: GGPermission | undefined): boolean {
+    return permission !== undefined && permission !== GG_NO_PERMISSIONS
+}
+
+function hasPermissionWire(wires: readonly GGTransportMiddleware[]): boolean {
+    return wires.some(mw => mw instanceof GGWireContextKey && mw.hasPermissions())
+}
+
+export function checkPermissionsAtStart(
+    httpSchemas: readonly HttpSchemaLike[],
+    webSocketSchemas: readonly WebSocketSchemaLike[],
+): void {
+    type Surface = {label: string; permission: GGPermission | undefined; hasWire: boolean}
+    const surfaces: Surface[] = []
+    const deadServerToClient: string[] = []
+
+    for (const schema of httpSchemas) {
+        const hasWire = hasPermissionWire(schema.apiMiddlewares)
+        const methods = schema.contract?.methods ?? {}
+        for (const name of Object.keys(methods)) {
+            surfaces.push({label: `${schema.name}.${name}`, permission: methods[name].permission, hasWire})
+        }
+    }
+    for (const ws of webSocketSchemas) {
+        const hasWire = hasPermissionWire(ws.middlewares)
+        const methods = ws.contract.clientToServer.methods
+        for (const name of Object.keys(methods)) {
+            surfaces.push({label: `${ws.name}.${name}`, permission: methods[name].permission, hasWire})
+        }
+        if (ws.connectPermission !== undefined) {
+            surfaces.push({label: `${ws.name} (connectPermission)`, permission: ws.connectPermission, hasWire})
+        }
+        const pushed = ws.contract.serverToClient.methods
+        for (const name of Object.keys(pushed)) {
+            if (isNonPublic(pushed[name].permission)) deadServerToClient.push(`  ${ws.name}.${name}`)
+        }
+    }
+
+    if (deadServerToClient.length > 0) {
+        throw new Error(
+            `GGHttpServer: these WebSocket serverToClient methods declare a non-public permission, ` +
+            `but server-pushed messages have no caller to gate — the permission is silently ignored:\n\n` +
+            deadServerToClient.join("\n") +
+            `\n\nFix: set \`permission: GG_NO_PERMISSIONS\` on serverToClient methods.`
+        )
+    }
+
+    const unsatisfiable = surfaces.filter(s => isNonPublic(s.permission) && !s.hasWire)
+    if (unsatisfiable.length > 0) {
+        const lines = unsatisfiable.map(s => `  ${s.label}`).join("\n")
+        throw new Error(
+            `GGHttpServer: these routes require a permission but their schema .use()s no wire that ` +
+            `resolves permissions — they can never pass the gate (permanently FORBIDDEN):\n\n` +
+            lines +
+            `\n\nFix: .use() an auth wire whose handler exposes permissions(), or set the route to ` +
+            `\`GG_NO_PERMISSIONS\` if it is meant to be public.`
+        )
+    }
+
+    let strict = false
+    const undeclared: Surface[] = []
+    for (const s of surfaces) {
+        if (s.permission !== undefined) strict = true
+        if (s.permission === undefined) undeclared.push(s)
+    }
+    if (!strict) return
+
+    if (undeclared.length > 0) {
+        const lines = undeclared.map(s => `  ${s.label}`).join("\n")
+        throw new Error(
+            `GGHttpServer: permission strict mode is active on this server ` +
+            `(at least one route declares a permission), ` +
+            `but the following routes have no \`permission\` declared:\n\n` +
+            lines +
+            `\n\nFix: declare \`permission\` on every route — use \`GG_NO_PERMISSIONS\` for intentionally public ones.`
+        )
+    }
+}

package/src/server/checkers/checkWireConflicts.ts

@@ -0,0 +1,65 @@
+/**
+ * Run at GGHttpServer.start() over the frozen schema graph: the wires a single schema .use()s
+ * must not conflict with each other. Two conflicts are caught:
+ *   - same context-key name → both wires resolve to one storage slot; parse() of one clobbers
+ *     the value the other read.
+ *   - same inbound header / cookie → both wires read (and a client writes) the same transport
+ *     field; one silently overwrites the other in parse()/update().
+ * Both are per-schema: the same wire reused across different schemas is fine.
+ */
+import type {GGTransportMiddleware} from "@grest-ts/context"
+import {GGWireContextKey} from "../../schema/GGWireContextKey"
+
+interface SchemaLike {
+    name: string
+    wires: readonly GGTransportMiddleware[]
+}
+
+function transportKeys(mw: GGTransportMiddleware): string[] {
+    return [
+        ...Object.keys(mw.headers ?? {}).map(h => `header "${h.toLowerCase()}"`),
+        ...Object.keys(mw.cookieParams ?? {}).map(c => `cookie "${c}"`),
+    ]
+}
+
+export function checkWireConflicts(
+    httpSchemas: readonly {name: string; apiMiddlewares: readonly GGTransportMiddleware[]}[],
+    webSocketSchemas: readonly {name: string; middlewares: readonly GGTransportMiddleware[]}[],
+): void {
+    const schemas: SchemaLike[] = [
+        ...httpSchemas.map(s => ({name: s.name, wires: s.apiMiddlewares})),
+        ...webSocketSchemas.map(s => ({name: s.name, wires: s.middlewares})),
+    ]
+
+    const conflicts: string[] = []
+    for (const schema of schemas) {
+        const names = new Map<string, GGWireContextKey>()
+        const fields = new Map<string, GGTransportMiddleware>()
+
+        for (const mw of schema.wires) {
+            if (mw instanceof GGWireContextKey) {
+                if (names.has(mw.name)) {
+                    conflicts.push(`  ${schema.name}: two wires share context-key name "${mw.name}"`)
+                } else {
+                    names.set(mw.name, mw)
+                }
+            }
+            for (const field of transportKeys(mw)) {
+                if (fields.has(field)) {
+                    conflicts.push(`  ${schema.name}: two wires bind the same ${field}`)
+                } else {
+                    fields.set(field, mw)
+                }
+            }
+        }
+    }
+
+    if (conflicts.length > 0) {
+        throw new Error(
+            `GGHttpServer: conflicting wires .use()d on one schema:\n\n` +
+            conflicts.join("\n") +
+            `\n\nFix: a schema must not .use() two wires that share a context-key name or read the ` +
+            `same header/cookie — one silently clobbers the other.`
+        )
+    }
+}

package/src/server/checkers/checkWiresImplemented.ts

@@ -0,0 +1,42 @@
+/**
+ * Run at GGHttpServer.start() over the frozen schema graph: every wire a schema
+ * .use()s and that is .define()d must have a .create()d handler on this runtime.
+ */
+import {GGWireContextKey} from "../../schema/GGWireContextKey"
+import {wireIsDefined} from "../../schema/GGWireContextKey.node"
+
+interface HttpSchemaLike {
+    name: string
+    apiMiddlewares: readonly unknown[]
+}
+
+interface WebSocketSchemaLike {
+    name: string
+    middlewares: readonly unknown[]
+}
+
+export function checkWiresImplemented(
+    httpSchemas: readonly HttpSchemaLike[],
+    webSocketSchemas: readonly WebSocketSchemaLike[],
+): void {
+    const surfaces: {name: string; wires: readonly unknown[]}[] = [
+        ...httpSchemas.map(s => ({name: s.name, wires: s.apiMiddlewares})),
+        ...webSocketSchemas.map(s => ({name: s.name, wires: s.middlewares})),
+    ]
+    const missing: string[] = []
+    for (const surface of surfaces) {
+        for (const mw of surface.wires) {
+            if (mw instanceof GGWireContextKey && wireIsDefined(mw) && !mw.hasHandler()) {
+                missing.push(`  ${surface.name}  uses wire "${mw.name}"`)
+            }
+        }
+    }
+    if (missing.length > 0) {
+        throw new Error(
+            `GGHttpServer: these schemas .use() a smart wire that was never implemented on this ` +
+            `runtime:\n\n` +
+            missing.join("\n") +
+            `\n\nFix: call \`${"<WIRE>"}.define(...).create(deps)\` in compose() before the server starts.`
+        )
+    }
+}

package/src/tsconfig.json

@@ -8,7 +8,8 @@
       "DOM"
     ],
     "types": [
-      "node"
+      "node",
+      "vitest/globals"
     ]
   },
   "include": [

package/dist/src/schema/cookieMiddleware.d.ts

@@ -1,71 +0,0 @@
-import { GGContextKey } from "@grest-ts/context";
-import { type GGSchema } from "@grest-ts/schema";
-import type { GGHttpTransportMiddleware } from "./GGHttpSchema";
-/**
- * Per-request set of context-key names the current route is permitted to write a cookie
- * for (declared via GGRpc.*(...).updatesCookie(key)). Populated by the server route
- * handler; read by setCookie() to reject undeclared cookie writes.
- */
-export declare const GG_COOKIE_WRITES: GGContextKey<Set<string>>;
-/**
- * Cookie write rules — passed to setCookie(key, value, options). They live at the write
- * call site (the handler that mints the cookie), never in the shared API.
- */
-export interface CookieOptions {
-    httpOnly?: boolean;
-    secure?: boolean;
-    sameSite?: "lax" | "strict" | "none";
-    path?: string;
-    domain?: string;
-    maxAgeSec?: number;
-}
-/**
- * Read a single named cookie out of a raw `Cookie` header value. Shared by the HTTP
- * binding (parseRequest) and the WebSocket binding (parseHandshake). A malformed
- * percent-encoding (e.g. "sid=%") must not crash — fall back to the raw value.
- */
-export declare function readCookie(rawCookieHeader: string | undefined, name: string): string | undefined;
-/**
- * Local structural copy of GGWebSocketHandshakeContext (defined in @grest-ts/websocket).
- * http must not import websocket; cookie()'s WS half is typed against this shape and
- * matches GGWebSocketMiddleware structurally at the webSocketSchema.use() call site.
- * `upgradeHeaders` is the real browser upgrade request (carries httpOnly cookies); the
- * in-band `headers` map cannot spoof it.
- */
-interface WsHandshakeContextLike {
-    headers: Record<string, string>;
-    upgradeHeaders?: Record<string, string>;
-    queryArgs: Record<string, string>;
-}
-export interface GGCookieBinding extends GGHttpTransportMiddleware {
-    /** The cookie this binding reads, mapped to its value schema — emitted as an `in: cookie` doc param. */
-    readonly cookieParams: Record<string, GGSchema<string | undefined>>;
-    parseHandshake(ctx: WsHandshakeContextLike): void;
-}
-/**
- * Bind a context key to a cookie, read-only on the wire. Reads ONLY the named cookie —
- * never a header — from the incoming HTTP Cookie (parseRequest) or the real WS upgrade
- * Cookie (parseHandshake), into key.get(). The cookie's wire name defaults to the key's
- * name. To write the cookie, call setCookie(key, …) from a route that declared
- * .updatesCookie(key); the matching binding flushes it as Set-Cookie (HTTP only — a
- * WebSocket has no response to set a cookie on).
- */
-export declare function cookie(key: GGContextKey<string | undefined>, opts?: {
-    name?: string;
-    schema?: GGSchema<string | undefined>;
-}): GGCookieBinding;
-/**
- * Schedule a Set-Cookie on the response (HTTP only). The value never touches key.get() —
- * inbound reads stay set-once. The route must declare .updatesCookie(key); an undeclared
- * call is invalid usage and throws SERVER_ERROR. The matching cookie() binding serializes
- * the pending write with these options (HttpOnly/Secure/SameSite/Path/Domain/Max-Age).
- */
-export declare function setCookie(key: GGContextKey<string | undefined>, value: string | undefined, options?: CookieOptions): void;
-/**
- * Clear the cookie — schedules a Set-Cookie with Max-Age=0. Pass path/domain to match a
- * scoped cookie (deletion only works when path+domain match what was set). Equivalent to
- * setCookie(key, undefined, options), but reads clearer at logout-style call sites.
- */
-export declare function clearCookie(key: GGContextKey<string | undefined>, options?: CookieOptions): void;
-export {};
-//# sourceMappingURL=cookieMiddleware.d.ts.map

package/dist/src/schema/cookieMiddleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookieMiddleware.d.ts","sourceRoot":"","sources":["../../../src/schema/cookieMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAgC,KAAK,QAAQ,EAAC,MAAM,kBAAkB,CAAA;AAC7E,OAAO,KAAK,EAAgC,yBAAyB,EAAC,MAAM,gBAAgB,CAAA;AAE5F;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,2BAA4F,CAAA;AAEzH;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACrB;AAsBD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAehG;AAYD;;;;;;GAMG;AACH,UAAU,sBAAsB;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,eAAgB,SAAQ,yBAAyB;IAC9D,wGAAwG;IACxG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IACnE,cAAc,CAAC,GAAG,EAAE,sBAAsB,GAAG,IAAI,CAAA;CACpD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,CAAC,EAAE;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAC,GAAG,eAAe,CA0B5I;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAiBzH;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAEhG"}