@ledgerhq/revault-sdk 0.23.1 → 0.24.1

package/lib/engine.js

@@ -5,6 +5,8 @@ import {
 } from "./chunk-AXI72NFY.js";
 import {
   APPID_VAULT_ADMINISTRATOR,
+  DisconnectedDevice,
+  LockedDeviceError,
   PAGINATED_STATUS,
   PATHS,
   SCRIPT_IDS,
@@ -15,13 +17,12 @@ import {
   createApiDevice,
   isTransportStatusError,
   withDevicePolling
-} from "./chunk-QWC3M2RL.js";
+} from "./chunk-XQ4BT4HB.js";
 
 // src/engine/index.ts
 import invariant2 from "invariant";
 
 // src/device/real-device.ts
-import { DisconnectedDevice, LockedDeviceError } from "@ledgerhq/errors";
 import invariant from "invariant";
 import { from, lastValueFrom } from "rxjs";
 var MAX_CHUNK_LENGTH = 250;
@@ -550,6 +551,12 @@ function createEngine(options, logger) {
             const { pubKey } = await device.getU2FPubKey();
             const { workspaceNames } = await client2.auth.psd.findWorkspaceNames.query({ pubKey });
             return workspaceNames;
+          },
+          getWorkspacesForSso: async () => {
+            const { device, client: client2 } = engine2;
+            const { pubKey } = await device.getU2FPubKey();
+            const { workspaces } = await client2.auth.sso.findWorkspaces.query({ pubKey });
+            return workspaces;
           }
         })
       );
@@ -726,6 +733,7 @@ function createEngine(options, logger) {
                 workspaceName: __workspaceName,
                 pubKey,
                 authentication,
+                challengeId: challenge.challengeId,
                 validityDurationSecs: opts?.validityDurationSecs
               };
               const { token } = await client2.auth.psd.authenticate.mutate(

package/lib/engine.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/engine/index.ts","../src/device/real-device.ts","../src/trpc.ts"],"sourcesContent":["import type {\n  ApiChallenge,\n  ClaimedRole,\n  OnboardingSeedChallenge,\n  PsdChallenge,\n  UserRegistrationChallenge,\n  UserRegistrationChallengeResponse,\n  UserRegistrationDeviceData,\n  UserRegistrationResponse,\n  VaultRequestResponse,\n  WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type TRPCClientOptions } from \"@/trpc\";\n\nimport { buildTrpcContext } from \"../utils\";\nimport type {\n  ApproveRequestParams,\n  CorrelationIdOpts,\n  DecorateWithApiUserAndWorkspaceUnauthenticated,\n  DecorateWithDevice,\n  DecorateWithDeviceAndOnboarding,\n  DecorateWithDeviceAndWorkspaceUnauthenticated,\n  DecorateWithWorkspaceApiAuthenticated,\n  DecorateWithWorkspacePsdAuthenticated,\n  DecorateWithWorkspaceUnauthenticated,\n  Engine,\n  EngineBase,\n  EngineOptions,\n  OnboardingOperationParams,\n  RegisterOnboardingDeviceParams,\n  WithApiAuth,\n  WithApiUser,\n  WithDevice,\n  WithOnboarding,\n  WithPsdAuth,\n  WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n  device,\n  name,\n  role,\n  getChallenge,\n  submitChallenge,\n  onScreenDisplayed,\n}: {\n  device: Device;\n  name: string;\n  role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n  getChallenge: (p: {\n    pubKey: string;\n    deviceData: UserRegistrationDeviceData;\n  }) => Promise<UserRegistrationChallenge>;\n  submitChallenge: (p: {\n    pubKey: string;\n    challengeResponse: UserRegistrationChallengeResponse;\n  }) => Promise<T>;\n  onScreenDisplayed?: () => void | Promise<void>;\n}): Promise<T> {\n  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n    device.getAttestation(),\n    device.getU2FPubKey(),\n    device.getConfidentialityPubKey(),\n  ]);\n  const ephemeralPubKey = await device.initPairingHandshake();\n  const deviceData: UserRegistrationDeviceData = {\n    name,\n    pubKey: u2fPubKey.pubKey,\n    psdModel: \"STAX\",\n    confidentialityKey: confidentialityKey.pubKey,\n    psdEphemeralKey: ephemeralPubKey.pubKey,\n    psdEphemeralKeyAttestation: {\n      ...attestation.attestation,\n      signature: ephemeralPubKey.signature,\n    },\n  };\n  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n  const pairingPayload = await device.finalizePairingHandshake({\n    handshake: challenge.handshake,\n    partitionId: challenge.ciphertext,\n    handshakeAttestation: challenge.handshakeAttestation,\n  });\n  await onScreenDisplayed?.();\n  const register = await device.register({\n    challenge: challenge.challenge,\n    u2fRegisterData: challenge.u2fRegisterData,\n    name,\n    role,\n  });\n  const validationPubKey = await device.getValidationPubKey();\n  const registerData = await device.registerData({ challenge: challenge.challenge });\n  const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n  const u2fRegister = Buffer.concat([\n    register.u2fRegister.slice(0, attestationOffset),\n    Buffer.from([attestation.buffer.length]),\n    attestation.buffer,\n    register.u2fRegister.slice(attestationOffset),\n  ]).toString(\"hex\");\n  const challengeResponse: UserRegistrationChallengeResponse = {\n    registerData,\n    certificate: {\n      ...attestation.attestation,\n      signature: validationPubKey.signature,\n    },\n    u2fRegister,\n    u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n    validationKey: validationPubKey.pubKey,\n    pairingPayload,\n  };\n  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n  const clientOptions: TRPCClientOptions = {\n    baseUrl: options.baseUrl,\n  };\n  const client = createClient(clientOptions);\n  const apiDevice = createApiDevice(options, logger);\n\n  const base: EngineBase = {\n    client,\n    createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n    __options: options,\n  };\n\n  const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n    this: Engine<T>,\n    deviceIndex: number,\n  ) {\n    const device = apiDevice.with(deviceIndex);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withTransportId: Engine[\"withTransportId\"] = function <T>(\n    this: Engine<T>,\n    transportId: string,\n  ) {\n    const device = createRealDevice({ transportId }, logger);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n    const withApiUser: WithApiUser = { __isApiUser: true };\n    return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n  };\n\n  const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n    this: Engine<T>,\n    workspaceName: string,\n  ) {\n    const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n    return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n  };\n\n  const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n    this: Engine<T>,\n    onboardingId: string,\n  ) {\n    const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n    return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n  };\n\n  function decorateEngine<T>(\n    engine: Engine<\n      T &\n        Partial<\n          WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n        >\n    >,\n  ): Engine<T> {\n    function decorate<TEnhanced, TDecoration>(\n      decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n    ): void {\n      Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n    }\n\n    // DecorateWithDevice\n    // -------------------------------------------------------------------------\n    if (engine.device) {\n      decorate<WithDevice, DecorateWithDevice<T>>(\n        (engine) =>\n          ({\n            getWorkspaces: async (): Promise<string[]> => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n              return workspaceNames;\n            },\n          }) satisfies DecorateWithDevice<T>,\n      );\n    }\n\n    // DecorateWithWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n      decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n        const { __workspaceName } = engine;\n        return {\n          withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n            const withPsdAuth: WithPsdAuth = { __psdToken: token };\n            const psdAuth = `${__workspaceName}:${token}`;\n            const client = engine.createClient({ psdAuth });\n            return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n          },\n        } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n      });\n    }\n\n    // DecorateWithDeviceAndOnboarding\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__onboardingId) {\n      decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n        const { device, client, __onboardingId } = engine;\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const [{ pubKey }, confidentialityKey] = await Promise.all([\n            device.getU2FPubKey(),\n            device.getConfidentialityKey(),\n          ]);\n          const pairing = await client.onboarding.pairDevicePartition.mutate({\n            pubKey,\n            onboardingId: __onboardingId,\n            data: {\n              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n            },\n          });\n          await device.setPairing({ pairing });\n        }\n        return {\n          claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n            const { role, deviceName } = params;\n            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await client.onboarding.claimDevice.mutate({\n              onboardingId: __onboardingId,\n              claim: { role, pubKey, deviceName, confidentialityKey },\n            });\n          },\n\n          collectWrappingKeyFragment: async (\n            wrappingKey: WrappingKeyResponse,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const [{ pubKey }, confidentialityKey] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await device.openSession({\n              secureChannel: {\n                pubKey: wrappingKey.ephemeralPubKey,\n                certificate: wrappingKey.ephemeralCertificate,\n              },\n            });\n            const { attestation } = await device.getAttestation();\n            await params?.onScreenDisplayed?.();\n            const blob = await device.generateWrappingKeyFragment();\n            await client.onboarding.submitWrappingKeyFragment.mutate({\n              pubKey,\n              onboardingId: __onboardingId,\n              fragment: {\n                blob,\n                ephemeralPubKey: confidentialityKey.pubKey,\n                ephemeralCertificate: {\n                  ...attestation,\n                  signature: confidentialityKey.signature,\n                },\n              },\n            });\n          },\n\n          registerDevice: async (\n            registerParams: RegisterOnboardingDeviceParams,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const { role, name } = registerParams;\n            const getChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.generateMasterAdminRegistrationChallenge\n                : client.onboarding.generateSharedOwnerRegistrationChallenge;\n            const submitChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.submitMasterAdminRegistration\n                : client.onboarding.submitSharedOwnerRegistration;\n            await genericRegister({\n              device: device,\n              name,\n              role,\n              getChallenge: ({ pubKey, deviceData }) =>\n                getChallengeMutation.mutate({\n                  onboardingId: __onboardingId,\n                  pubKey,\n                  deviceData,\n                }),\n              submitChallenge: ({ pubKey, challengeResponse }) =>\n                submitChallengeMutation.mutate({\n                  onboardingId: engine.__onboardingId,\n                  pubKey,\n                  // FIXME this should be renamed to `challengeResponse` on backend side\n                  response: challengeResponse,\n                }),\n              onScreenDisplayed: params?.onScreenDisplayed,\n            });\n          },\n\n          reviewSharedOwner: async (\n            challenge: PsdChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          collectSeedFragment: async (\n            challenge: OnboardingSeedChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const [{ pubKey }, { attestation }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getAttestation(),\n            ]);\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const challengeResponse = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            const kkPattern = await device.startKKPatternAsResponder({\n              partitionId: challenge.partitionId,\n              handshake: challenge.kkHandshake,\n              handshakeAttestation: challenge.kkHandshakeAttestation,\n            });\n            const approverBlob = await device.generateSeedFragment();\n            await client.onboarding.submitSeedFragment.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              seedFragment: {\n                challengeResponse,\n                approverBlob,\n                handshake: kkPattern.handshake,\n                handshakeAttestation: {\n                  ...attestation,\n                  signature: kkPattern.signature,\n                },\n              },\n            });\n          },\n        } satisfies DecorateWithDeviceAndOnboarding;\n      });\n    }\n\n    // DecorateWithDeviceAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { device, client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              opts?: {\n                validityDurationSecs?: number;\n                onScreenDisplayed?: () => void | Promise<void>;\n                correlationId?: string;\n              },\n            ): Promise<Engine<T & WithPsdAuth>> {\n              const { pubKey } = await device.getU2FPubKey();\n              const challenge = await client.auth.psd.generateChallenge.mutate(\n                {\n                  pubKey,\n                  workspaceName: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              await opts?.onScreenDisplayed?.();\n              const authentication = await device.authenticate({\n                challenge,\n                workspaceName: __workspaceName,\n              });\n              const authPayload = {\n                workspaceName: __workspaceName,\n                pubKey,\n                authentication,\n                validityDurationSecs: opts?.validityDurationSecs,\n              };\n              const { token } = await client.auth.psd.authenticate.mutate(\n                { ...authPayload },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withPsdAuth: WithPsdAuth = {\n                __psdToken: token,\n              };\n              const psdAuth = `${engine.__workspaceName}:${token}`;\n              const __authClient = engine.createClient({ psdAuth });\n              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n                T & WithPsdAuth\n              >);\n            },\n\n            register: (\n              registration: UserRegistrationResponse,\n            ): Promise<UserRegistrationResponse> => {\n              return genericRegister({\n                device,\n                name: registration.name,\n                role: registration.role,\n                getChallenge: async ({ deviceData }) => {\n                  const challenge = await client.userRegistrations.generateChallenge.mutate({\n                    id: registration.id,\n                    workspaceName: __workspaceName,\n                    deviceData,\n                  });\n                  return challenge;\n                },\n                submitChallenge: ({ challengeResponse }) =>\n                  client.userRegistrations.submitChallenge.mutate({\n                    workspaceName: __workspaceName,\n                    id: registration.id,\n                    challengeResponse,\n                  }),\n              });\n            },\n          } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithApiUserAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              credentials: {\n                apiKeyId: string;\n                apiKeySecret: string;\n              },\n              opts?: { correlationId?: string },\n            ): Promise<Engine<T & WithApiAuth>> {\n              const res = await client.auth.authenticate.mutate(\n                {\n                  apiKeyId: credentials.apiKeyId,\n                  apiKeySecret: credentials.apiKeySecret,\n                  workspace: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withApiAuth: WithApiAuth = {\n                __apiAuth: res,\n              };\n              const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n              return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n                T & WithApiAuth\n              >);\n            },\n          } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithWorkspacePsdAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n        const { client, device } = engine;\n\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const confidentialityKey = await device.getConfidentialityKey();\n          const pairing = await client.debug.pairDevicePartition.mutate({\n            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n          });\n          await device.setPairing({ pairing });\n        }\n\n        const approveChallenge = async (\n          challenge: PsdChallenge,\n          params?: ApproveRequestParams,\n        ): Promise<string> => {\n          await enforcePairing();\n          await device.startKPatternAsResponder({\n            handshake: challenge.handshake,\n            handshakeAttestation: challenge.handshakeAttestation,\n            partitionId: challenge.partitionId,\n          });\n          await params?.onScreenDisplayed?.();\n          const signature = await device.validateVaultOperation({\n            actions: challenge.wActions,\n          });\n          return signature;\n        };\n\n        return {\n          approve: async (\n            request: VaultRequestResponse,\n            params?: ApproveRequestParams,\n          ): Promise<VaultRequestResponse> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            if (challenge.challengeType === \"PSD\") {\n              const signature = await approveChallenge(challenge, params);\n              await params?.onPsdChallengeSigned?.();\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"PSD\", signature },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            if (challenge.challengeType === \"SOFT\") {\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"SOFT\" },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            throw new Error(\"Challenge type must be either PSD or SOFT\");\n          },\n\n          approveChallenge,\n\n          reject: (\n            request: VaultRequestResponse,\n            opts?: CorrelationIdOpts,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate(\n              { id: request.id, data: null },\n              buildTrpcContext(opts),\n            );\n          },\n        } satisfies DecorateWithWorkspacePsdAuthenticated;\n      });\n    }\n\n    // DecorateWithWorkspaceApiAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n        const { client } = engine;\n        return {\n          getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n            return challenge.payload;\n          },\n\n          approve: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.approve.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n\n          reject: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n        } satisfies DecorateWithWorkspaceApiAuthenticated;\n      });\n    }\n\n    return engine;\n  }\n\n  return {\n    ...base,\n    withDeviceIndex,\n    withTransportId,\n    withApiUser,\n    withWorkspace,\n    withOnboarding,\n  };\n}\n","import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate, PubKey } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n  APPID_VAULT_ADMINISTRATOR,\n  PAGINATED_STATUS,\n  PATHS,\n  SCRIPT_IDS,\n  STATUS_LENGTH,\n  STR_ROLES,\n  STREAMING_NEXT_ACTION,\n  STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n  transportId: string;\n};\n\nconst getPathFromPathString = (pathString: string): number[] => {\n  const parts = pathString.split(\"'/\").map((part) => Number.parseInt(part, 10));\n  return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n  const chunks = [];\n  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n    chunks.push(buffer.slice(i, i + size));\n  }\n  return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n  transport: Transport,\n  command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n  data: Buffer,\n  chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n  const chunks = splitChunks(chunkSize, data);\n  let response = Buffer.from([]);\n  for (let i = 0; i < chunks.length; i++) {\n    const chunk = chunks[i];\n    const apdu = [...command];\n    // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n    /* v8 ignore next -- @preserve */\n    apdu[2] = i && 0x80;\n    response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n      0x9000,\n      ...PAGINATED_STATUS,\n    ])) as Buffer<ArrayBuffer>;\n  }\n  return response;\n};\n\nconst buildAttestation = (params: {\n  handshake: string;\n  handshakeAttestation: HsmCertificate;\n  partitionId: string;\n}): Buffer => {\n  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n  const sigLengthBuffer = Buffer.alloc(1);\n  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n  const certLengthBuffer = Buffer.alloc(1);\n  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n  const certChainData = Buffer.concat([\n    sigLengthBuffer,\n    sigBuffer,\n    pubBuffer,\n    certLengthBuffer,\n    certBuffer,\n  ]);\n\n  const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n  const cliMsgLengthBuffer = Buffer.alloc(1);\n  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n  const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n  const pidLengthBuffer = Buffer.alloc(1);\n  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n  const certChainDataLengthBuff = Buffer.alloc(2);\n  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n  const data = Buffer.concat([\n    cliMsgLengthBuffer,\n    cliMsgBuffer,\n    certChainDataLengthBuff,\n    certChainData,\n    pidLengthBuffer,\n    pidBuffer,\n  ]);\n\n  const totalLengthBuffer = Buffer.alloc(2);\n  totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n  const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n  return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n  // device is locked\n  if (err instanceof LockedDeviceError) return true;\n  // user is on dashboard when receiving a Vault app apdu\n  if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n  // VG-24797 error that can happen in BLE in some situations (still unclear)\n  if (err instanceof DisconnectedDevice) return true;\n\n  // for everything else, we don't want to retry\n  return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n  const { transportId } = options;\n\n  async function run<T>(\n    job: (transport: Transport) => Promise<T>,\n    retryOnError: RetryOnError = genericRetryOnError,\n  ): Promise<T> {\n    return lastValueFrom(\n      withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n    );\n  }\n\n  /* v8 ignore next -- @preserve */\n  const noRetry = (): boolean => false;\n  /* v8 ignore next -- @preserve */\n  const alwaysRetry = (): boolean => true;\n  const poll = async (\n    opts: { retryOnError?: RetryOnError } = {},\n  ): Promise<{ isAppOpened: boolean }> => {\n    // waiting for device to be turned on\n    await run(\n      // eslint-disable-next-line  @typescript-eslint/no-empty-function\n      async (_transport) => {},\n      opts.retryOnError ?? alwaysRetry,\n    );\n    // checking if app is opened: should return directly on getPubKey\n    try {\n      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n      return { isAppOpened: true };\n    } catch (err) {\n      if (isTransportStatusError(err) && genericRetryOnError(err)) {\n        return { isAppOpened: false };\n      }\n      throw err;\n    }\n  };\n\n  const pollApp = async (appName: string): Promise<string> => {\n    const res = await run((transport) =>\n      transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n    );\n    // little delay to give time to the app to be fully opened\n    await new Promise((r) => setTimeout(r, 1e3));\n    return res.toString(\"hex\");\n  };\n\n  const getPublicKey = async (\n    pathString: string,\n    { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n  ): Promise<{ pubKey: string; signature: string }> => {\n    logger.info(`[device] getPublicKey (${pathString})`);\n    const path = getPathFromPathString(pathString);\n    const data = Buffer.concat([\n      Buffer.from([path.length]),\n      ...path.map((derivation) => {\n        const buf = Buffer.alloc(4);\n        buf.writeUInt32BE(derivation, 0);\n        return buf;\n      }),\n    ]);\n    const curve = secp256k1 ? 0x01 : 0x02;\n    const response = await run(\n      (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n      retryOnError ?? genericRetryOnError,\n    );\n    const pubKeyLength = response.readInt8(0);\n    const pubKey = response\n      .slice(1, pubKeyLength + 1)\n      .toString(\"hex\")\n      .toUpperCase();\n    const signature = response\n      .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n      .toString(\"base64\");\n    return { pubKey, signature };\n  };\n\n  const device: Device = {\n    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n      logger.info(`[device] Authenticate`);\n      invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      const nameBuffer = Buffer.from(name);\n      const workspaceBuffer = Buffer.from(workspaceName);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([nameBuffer.length]),\n        nameBuffer,\n        Buffer.from([workspaceBuffer.length]),\n        workspaceBuffer,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([\n        Buffer.from(challenge, \"base64\"),\n        applicationBuffer,\n        Buffer.from([keyHandle.length]),\n        Buffer.from(keyHandle, \"hex\"),\n        keyHandleDataLength,\n        keyHandleData,\n      ]);\n\n      const authentication = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n      );\n\n      return removeStatus(authentication).toString(\"hex\");\n    },\n\n    finalizePairingHandshake: async (params: {\n      handshake: string;\n      partitionId: string;\n      handshakeAttestation: HsmCertificate;\n    }): Promise<string> => {\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n      );\n      return removeStatus(bufWithStatus).toString(\"hex\");\n    },\n\n    generateSeedFragment: async (): Promise<string> => {\n      logger.info(`[device] generateSeedFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x00, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    generateWrappingKeyFragment: async (): Promise<string> => {\n      logger.info(`[device] generateWrappingKeyFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x01, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    getAttestation: async (): Promise<{\n      attestation: {\n        codeHash: string;\n        attestationPub: string;\n        certificate: string;\n      };\n      buffer: Buffer;\n    }> => {\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n      const buffer = removeStatus(bufWithStatus);\n      const certLen = buffer.readInt8(32 + 65 + 1);\n      return {\n        attestation: {\n          codeHash: buffer.slice(0, 32).toString(\"base64\"),\n          attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n          certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n        },\n        buffer,\n      };\n    },\n    getConfidentialityKey: async () => {\n      logger.info(`[device] getConfidentialityKey`);\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n      const buf = removeStatus(bufWithStatus);\n      const keyLength = buf[0]!;\n      const key = buf.slice(1, 1 + keyLength);\n      const sig = buf.slice(1 + keyLength + 1);\n      return {\n        confidentialityKeyCurve25519: key.toString(\"hex\"),\n        confidentialityKeySignature: sig.toString(\"hex\"),\n      };\n    },\n    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n    getDeviceUserId: async (): Promise<string> => {\n      logger.info(`[device] getDeviceUserId`);\n      const response = await run((transport) => transport.send(0xe0, 0x52, 0x00, 0x00));\n      return removeStatus(response).toString(\"hex\").toUpperCase();\n    },\n    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n    hasPairing: async () => {\n      logger.info(`[device] hasPairing`);\n      const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n      const hex = Buffer.from(res).toString(\"hex\");\n\n      // 6f45 => this error means that there is no partition ID on the device\n      // if no error, it means there is (at least) one\n      //\n      // 6a87 => TEMPORARY hack because Stax apparently does not implement\n      //         the \"get partition id\" APDU, so it returns \"incorrect length\"\n      //         easier to just assume that in this case there is no partition,\n      //         and try to insert one anyway (done on revault onboarding)\n      //\n      return hex !== \"6f45\" && hex !== \"6a87\";\n    },\n\n    initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n      const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n      const pubKeyLength = res.readInt8(0);\n      const pubKey = res\n        .slice(1, pubKeyLength + 1)\n        .toString(\"hex\")\n        .toUpperCase();\n      const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n      return { pubKey, signature };\n    },\n\n    openSession: async (params: {\n      secureChannel: { pubKey: PubKey; certificate: HsmCertificate };\n    }): Promise<void> => {\n      logger.info(`[device] openSession`);\n      const { secureChannel } = params;\n\n      const path = getPathFromPathString(PATHS.CONFIDENTIALITY);\n      const dataDerivation = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      const pubKey = Buffer.from(secureChannel.pubKey, \"hex\");\n\n      const sigBuffer = Buffer.from(secureChannel.certificate.signature, \"base64\");\n      const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, \"base64\");\n      const certBuffer = Buffer.from(secureChannel.certificate.certificate, \"base64\");\n      const attestation = Buffer.concat([\n        Buffer.from([sigBuffer.length]),\n        sigBuffer,\n        attestationPubBuffer,\n        Buffer.from([certBuffer.length]),\n        certBuffer,\n      ]);\n\n      const lengthAttestation = Buffer.alloc(2);\n      lengthAttestation.writeUInt16BE(attestation.length, 0);\n\n      const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);\n\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x42, 0x00, SCRIPT_IDS.INIT_SESSION], data),\n      );\n    },\n\n    register: async (params: {\n      challenge: string;\n      u2fRegisterData: string;\n      name: string;\n      role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n    }): Promise<{\n      u2fRegister: Buffer;\n      keyHandle: Buffer;\n      rfu: number;\n      pubKey: string;\n    }> => {\n      const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n      const userNameBuff = Buffer.from(name);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([userNameBuff.length]),\n        userNameBuff,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n      const response = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n      );\n\n      let i = 0;\n      const rfu = response.slice(i, i + 1)[0]!;\n      i += 1;\n      const pubKey = response.slice(i, i + 65).toString(\"hex\");\n      i += 65;\n      const keyHandleLength = response.slice(i, i + 1)[0]!;\n      i++;\n      const keyHandle = response.slice(i, i + keyHandleLength);\n      i += keyHandleLength;\n      return {\n        u2fRegister: removeStatus(response),\n        keyHandle,\n        rfu,\n        pubKey,\n      };\n    },\n    registerData: async (params: { challenge: string }): Promise<string> => {\n      const { challenge: strChallenge } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n      return removeStatus(response).toString(\"hex\");\n    },\n\n    setPairing: async ({ pairing }) => {\n      logger.info(`[device] setPairing`);\n      const psdPayload = Buffer.from(pairing.blob, \"base64\");\n      const length = Buffer.alloc(2);\n      length.writeUInt16BE(psdPayload.length, 0);\n      const final = Buffer.concat([length, psdPayload]);\n      await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n    },\n    startKKPatternAsResponder: async (params: {\n      handshake: string;\n      handshakeAttestation: HsmCertificate;\n      partitionId: string;\n    }): Promise<{ handshake: string; signature: string }> => {\n      logger.info(`[device] startKKPatternAsResponder`);\n      const data = buildAttestation(params);\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x4c, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n      const buffer = removeStatus(bufWithStatus);\n      const dataLength = buffer.readInt8(0);\n      return {\n        handshake: buffer.slice(1, dataLength + 1).toString(\"base64\"),\n        signature: buffer.slice(dataLength + 1).toString(\"base64\"),\n      };\n    },\n    startKPatternAsResponder: async (params) => {\n      logger.info(`[device] startKPatternAsResponder`);\n      const data = buildAttestation(params);\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n    },\n    validateVaultOperation: async (params) => {\n      logger.info(`[device] validateVaultOperation`);\n      const path = getPathFromPathString(PATHS.VALIDATION);\n      const paths = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      let nextActionId = 1;\n      let finalResponse: Buffer | null = null;\n\n      while (!finalResponse) {\n        const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n        const length = Buffer.alloc(2);\n        length.writeUInt16BE(screen.length, 0);\n        const data = Buffer.concat([paths, length, screen]);\n        const response = await run((transport) =>\n          sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n        );\n        const responseType = response.readInt8(0);\n        let responseStatus = response.readUInt16BE(response.length - 2);\n        switch (responseType) {\n          case STREAMING_NEXT_ACTION:\n            nextActionId = response.readUIntBE(1, 2);\n            break;\n          case STREAMING_RESPONSE:\n            finalResponse = response.slice(3, response.length - 2);\n            while (responseStatus !== 0x9000) {\n              /* v8 ignore next -- @preserve */ {\n                const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n                responseStatus = resp.readUInt16BE(resp.length - 2);\n                finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n              }\n            }\n            break;\n          /* v8 ignore next -- @preserve */\n          default:\n            throw new Error(`Invalid response type: ${responseType}`);\n        }\n      }\n      return finalResponse.toString(\"base64\");\n    },\n\n    sendAPDU: async (apduCommand: string) => {\n      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n      return Buffer.from(res).toString(\"hex\");\n    },\n    getVersion: async () => {\n      const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n      const appNameLen = res.readInt8(1);\n      const appVersionLen = res.readInt8(2 + appNameLen);\n      const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n      const appVersion = Buffer.from(appVersionHex).toString();\n\n      return appVersion;\n    },\n    poll,\n    pollApp,\n  };\n  return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n  baseUrl: string;\n  debugAuthToken?: string;\n  rootAuthToken?: string;\n  apiAccessToken?: string;\n  psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport type TRPCContext = { context: Record<string, unknown> } | undefined;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n  const trpc = createTRPCClient<AppRouter>({\n    links: [\n      httpLink({\n        url: `${options.baseUrl}/trpc`,\n        transformer: superjson,\n        headers(opts) {\n          // Extract headers from the operation context\n          const contextHeaders = (opts.op.context?.headers as Record<string, string>) || {};\n\n          return {\n            ...(options.debugAuthToken\n              ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n              : {}),\n            ...(options.rootAuthToken\n              ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n              : {}),\n            ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n            ...(options.apiAccessToken\n              ? { Authorization: `Bearer ${options.apiAccessToken}` }\n              : {}),\n            // Merge in any headers passed via context\n            ...contextHeaders,\n          };\n        },\n      }),\n    ],\n  });\n  return trpc;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAYA,OAAOA,gBAAe;;;ACZtB,SAAS,oBAAoB,yBAAyB;AAGtD,OAAO,eAAe;AACtB,SAAS,MAAM,qBAAqB;AAkBpC,IAAM,mBAAmB;AAMzB,IAAM,wBAAwB,CAAC,eAAiC;AAC9D,QAAM,QAAQ,WAAW,MAAM,IAAI,EAAE,IAAI,CAAC,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC;AAC5E,SAAO,MAAM,IAAI,CAAC,UAAU,OAAO,gBAAgB,CAAC;AACtD;AAEA,IAAM,cAAc,CAAC,OAAe,WAA6B;AAC/D,QAAM,SAAS,CAAC;AAChB,WAAS,IAAI,GAAG,OAAO,OAAO,IAAI,OAAO,QAAQ,KAAK,MAAM,OAAO,OAAO;AACxE,WAAO,KAAK,OAAO,MAAM,GAAG,IAAI,IAAI,CAAC;AAAA,EACvC;AACA,SAAO;AACT;AAEA,IAAM,eAAe,CAAC,WAA2B,OAAO,MAAM,GAAG,OAAO,SAAS,aAAa;AAE9F,IAAM,cAAc,OAClB,WACA,SACA,MACA,YAAoB,qBACA;AACpB,QAAM,SAAS,YAAY,WAAW,IAAI;AAC1C,MAAI,WAAW,OAAO,KAAK,CAAC,CAAC;AAC7B,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,QAAQ,OAAO,CAAC;AACtB,UAAM,OAAO,CAAC,GAAG,OAAO;AAGxB,SAAK,CAAC,IAAI,KAAK;AACf,eAAY,MAAM,UAAU,KAAK,KAAK,CAAC,GAAI,KAAK,CAAC,GAAI,KAAK,CAAC,GAAG,KAAK,CAAC,GAAI,OAAO;AAAA,MAC7E;AAAA,MACA,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB,CAAC,WAIZ;AACZ,QAAM,YAAY,OAAO,KAAK,OAAO,qBAAqB,WAAW,QAAQ;AAC7E,QAAM,kBAAkB,OAAO,MAAM,CAAC;AACtC,kBAAgB,YAAY,UAAU,QAAQ,GAAG,CAAC;AAElD,QAAM,aAAa,OAAO,KAAK,OAAO,qBAAqB,aAAa,QAAQ;AAChF,QAAM,mBAAmB,OAAO,MAAM,CAAC;AACvC,mBAAiB,YAAY,WAAW,QAAQ,GAAG,CAAC;AAEpD,QAAM,YAAY,OAAO,KAAK,OAAO,qBAAqB,gBAAgB,QAAQ;AAElF,QAAM,gBAAgB,OAAO,OAAO;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,eAAe,OAAO,KAAK,OAAO,WAAW,KAAK;AACxD,QAAM,qBAAqB,OAAO,MAAM,CAAC;AACzC,qBAAmB,YAAY,aAAa,QAAQ,GAAG,CAAC;AAExD,QAAM,YAAY,OAAO,KAAK,OAAO,aAAa,KAAK;AACvD,QAAM,kBAAkB,OAAO,MAAM,CAAC;AACtC,kBAAgB,YAAY,UAAU,QAAQ,GAAG,CAAC;AAElD,QAAM,0BAA0B,OAAO,MAAM,CAAC;AAC9C,0BAAwB,cAAc,cAAc,QAAQ,CAAC;AAE7D,QAAM,OAAO,OAAO,OAAO;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,oBAAoB,OAAO,MAAM,CAAC;AACxC,oBAAkB,cAAc,KAAK,QAAQ,CAAC;AAE9C,QAAM,SAAS,OAAO,OAAO,CAAC,mBAAmB,IAAI,CAAC;AAEtD,SAAO;AACT;AAIA,IAAM,sBAAoC,CAAC,QAAQ;AAEjD,MAAI,eAAe,kBAAmB,QAAO;AAE7C,MAAI,uBAAuB,GAAG,KAAK,IAAI,eAAe,MAAQ,QAAO;AAErE,MAAI,eAAe,mBAAoB,QAAO;AAG9C,SAAO;AACT;AAEO,SAAS,iBAAiB,SAAkB,QAAwB;AACzE,QAAM,EAAE,YAAY,IAAI;AAExB,iBAAe,IACb,KACA,eAA6B,qBACjB;AACZ,WAAO;AAAA,MACL,kBAAkB,WAAW,EAAK,CAAC,cAAc,KAAK,IAAI,SAAS,CAAC,GAAG,YAAY;AAAA,IACrF;AAAA,EACF;AAGA,QAAM,UAAU,MAAe;AAE/B,QAAM,cAAc,MAAe;AACnC,QAAM,OAAO,OACX,OAAwC,CAAC,MACH;AAEtC,UAAM;AAAA;AAAA,MAEJ,OAAO,eAAe;AAAA,MAAC;AAAA,MACvB,KAAK,gBAAgB;AAAA,IACvB;AAEA,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,EAAE,WAAW,MAAM,cAAc,QAAQ,CAAC;AACxE,aAAO,EAAE,aAAa,KAAK;AAAA,IAC7B,SAAS,KAAK;AACZ,UAAI,uBAAuB,GAAG,KAAK,oBAAoB,GAAG,GAAG;AAC3D,eAAO,EAAE,aAAa,MAAM;AAAA,MAC9B;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,YAAqC;AAC1D,UAAM,MAAM,MAAM;AAAA,MAAI,CAAC,cACrB,UAAU,KAAK,KAAM,KAAM,GAAM,GAAM,OAAO,KAAK,SAAS,MAAM,CAAC;AAAA,IACrE;AAEA,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAC3C,WAAO,IAAI,SAAS,KAAK;AAAA,EAC3B;AAEA,QAAM,eAAe,OACnB,YACA,EAAE,WAAW,aAAa,MACyB;AACnD,WAAO,KAAK,0BAA0B,UAAU,GAAG;AACnD,UAAM,OAAO,sBAAsB,UAAU;AAC7C,UAAM,OAAO,OAAO,OAAO;AAAA,MACzB,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,MACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,cAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,YAAI,cAAc,YAAY,CAAC;AAC/B,eAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AACD,UAAM,QAAQ,YAAY,IAAO;AACjC,UAAM,WAAW,MAAM;AAAA,MACrB,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,OAAO,GAAM,IAAI;AAAA,MAC3D,gBAAgB;AAAA,IAClB;AACA,UAAM,eAAe,SAAS,SAAS,CAAC;AACxC,UAAM,SAAS,SACZ,MAAM,GAAG,eAAe,CAAC,EACzB,SAAS,KAAK,EACd,YAAY;AACf,UAAM,YAAY,SACf,MAAM,eAAe,GAAG,SAAS,SAAS,aAAa,EACvD,SAAS,QAAQ;AACpB,WAAO,EAAE,QAAQ,UAAU;AAAA,EAC7B;AAEA,QAAM,SAAiB;AAAA,IACrB,cAAc,OAAO,EAAE,WAAW,EAAE,WAAW,MAAM,MAAM,UAAU,GAAG,cAAc,MAAM;AAC1F,aAAO,KAAK,uBAAuB;AACnC,gBAAU,SAAS,qBAAqB,kDAAkD;AAC1F,YAAM,oBAAoB,OAAO,KAAK,2BAA2B,KAAK;AACtE,YAAM,aAAa,OAAO,KAAK,IAAI;AACnC,YAAM,kBAAkB,OAAO,KAAK,aAAa;AAEjD,YAAM,gBAAgB,OAAO,OAAO;AAAA,QAClC,OAAO,KAAK,UAAU,IAAI,GAAG,KAAK;AAAA,QAClC,OAAO,KAAK,CAAC,WAAW,MAAM,CAAC;AAAA,QAC/B;AAAA,QACA,OAAO,KAAK,CAAC,gBAAgB,MAAM,CAAC;AAAA,QACpC;AAAA,MACF,CAAC;AAED,YAAM,sBAAsB,OAAO,MAAM,CAAC;AAC1C,0BAAoB,cAAc,cAAc,QAAQ,CAAC;AAEzD,YAAM,OAAO,OAAO,OAAO;AAAA,QACzB,OAAO,KAAK,WAAW,QAAQ;AAAA,QAC/B;AAAA,QACA,OAAO,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,QAC9B,OAAO,KAAK,WAAW,KAAK;AAAA,QAC5B;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,iBAAiB,MAAM;AAAA,QAAI,CAAC,cAChC,YAAY,WAAW,CAAC,KAAM,GAAM,GAAM,CAAI,GAAG,IAAI;AAAA,MACvD;AAEA,aAAO,aAAa,cAAc,EAAE,SAAS,KAAK;AAAA,IACpD;AAAA,IAEA,0BAA0B,OAAO,WAIV;AACrB,YAAM,gBAAgB,MAAM;AAAA,QAAI,CAAC,cAC/B,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,CAAI,GAAG,iBAAiB,MAAM,CAAC;AAAA,MAC3E;AACA,aAAO,aAAa,aAAa,EAAE,SAAS,KAAK;AAAA,IACnD;AAAA,IAEA,sBAAsB,YAA6B;AACjD,aAAO,KAAK,+BAA+B;AAC3C,YAAM,OAAO,sBAAsB,MAAM,YAAY;AACrD,YAAM,OAAO,OAAO,OAAO;AAAA,QACzB,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,QACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,gBAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,cAAI,cAAc,YAAY,CAAC;AAC/B,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AACD,YAAM,WAAW,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,GAAM,IAAI,CAAC;AACtF,aAAO,aAAa,QAAQ,EAAE,SAAS,QAAQ;AAAA,IACjD;AAAA,IACA,6BAA6B,YAA6B;AACxD,aAAO,KAAK,sCAAsC;AAClD,YAAM,OAAO,sBAAsB,MAAM,YAAY;AACrD,YAAM,OAAO,OAAO,OAAO;AAAA,QACzB,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,QACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,gBAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,cAAI,cAAc,YAAY,CAAC;AAC/B,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AACD,YAAM,WAAW,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,GAAM,IAAI,CAAC;AACtF,aAAO,aAAa,QAAQ,EAAE,SAAS,QAAQ;AAAA,IACjD;AAAA,IACA,gBAAgB,YAOV;AACJ,YAAM,gBAAgB,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC;AACrF,YAAM,SAAS,aAAa,aAAa;AACzC,YAAM,UAAU,OAAO,SAAS,KAAK,KAAK,CAAC;AAC3C,aAAO;AAAA,QACL,aAAa;AAAA,UACX,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,SAAS,QAAQ;AAAA,UAC/C,gBAAgB,OAAO,MAAM,IAAI,KAAK,EAAE,EAAE,SAAS,QAAQ;AAAA,UAC3D,aAAa,OAAO,MAAM,KAAK,IAAI,KAAK,KAAK,IAAI,OAAO,EAAE,SAAS,QAAQ;AAAA,QAC7E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,uBAAuB,YAAY;AACjC,aAAO,KAAK,gCAAgC;AAC5C,YAAM,gBAAgB,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC;AACrF,YAAM,MAAM,aAAa,aAAa;AACtC,YAAM,YAAY,IAAI,CAAC;AACvB,YAAM,MAAM,IAAI,MAAM,GAAG,IAAI,SAAS;AACtC,YAAM,MAAM,IAAI,MAAM,IAAI,YAAY,CAAC;AACvC,aAAO;AAAA,QACL,8BAA8B,IAAI,SAAS,KAAK;AAAA,QAChD,6BAA6B,IAAI,SAAS,KAAK;AAAA,MACjD;AAAA,IACF;AAAA,IACA,0BAA0B,MAAM,aAAa,MAAM,iBAAiB,EAAE,WAAW,KAAK,CAAC;AAAA,IACvF,iBAAiB,YAA6B;AAC5C,aAAO,KAAK,0BAA0B;AACtC,YAAM,WAAW,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC;AAChF,aAAO,aAAa,QAAQ,EAAE,SAAS,KAAK,EAAE,YAAY;AAAA,IAC5D;AAAA,IACA,cAAc,MAAM,aAAa,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AAAA,IAChE,qBAAqB,MAAM,aAAa,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAAA,IAC7E,YAAY,YAAY;AACtB,aAAO,KAAK,qBAAqB;AACjC,YAAM,OAAO,CAAC,KAAM,IAAM,GAAM,GAAM,GAAI;AAC1C,YAAM,MAAM,MAAM,IAAI,CAAC,cAAc,UAAU,SAAS,OAAO,KAAK,IAAI,CAAC,CAAC;AAC1E,YAAM,MAAM,OAAO,KAAK,GAAG,EAAE,SAAS,KAAK;AAU3C,aAAO,QAAQ,UAAU,QAAQ;AAAA,IACnC;AAAA,IAEA,sBAAsB,YAA4D;AAChF,YAAM,MAAM,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC;AAC3E,YAAM,eAAe,IAAI,SAAS,CAAC;AACnC,YAAM,SAAS,IACZ,MAAM,GAAG,eAAe,CAAC,EACzB,SAAS,KAAK,EACd,YAAY;AACf,YAAM,YAAY,IAAI,MAAM,eAAe,GAAG,IAAI,SAAS,aAAa,EAAE,SAAS,QAAQ;AAC3F,aAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IAEA,aAAa,OAAO,WAEC;AACnB,aAAO,KAAK,sBAAsB;AAClC,YAAM,EAAE,cAAc,IAAI;AAE1B,YAAM,OAAO,sBAAsB,MAAM,eAAe;AACxD,YAAM,iBAAiB,OAAO,OAAO;AAAA,QACnC,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,QACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,gBAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,cAAI,cAAc,YAAY,CAAC;AAC/B,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAED,YAAM,SAAS,OAAO,KAAK,cAAc,QAAQ,KAAK;AAEtD,YAAM,YAAY,OAAO,KAAK,cAAc,YAAY,WAAW,QAAQ;AAC3E,YAAM,uBAAuB,OAAO,KAAK,cAAc,YAAY,gBAAgB,QAAQ;AAC3F,YAAM,aAAa,OAAO,KAAK,cAAc,YAAY,aAAa,QAAQ;AAC9E,YAAM,cAAc,OAAO,OAAO;AAAA,QAChC,OAAO,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,QAC9B;AAAA,QACA;AAAA,QACA,OAAO,KAAK,CAAC,WAAW,MAAM,CAAC;AAAA,QAC/B;AAAA,MACF,CAAC;AAED,YAAM,oBAAoB,OAAO,MAAM,CAAC;AACxC,wBAAkB,cAAc,YAAY,QAAQ,CAAC;AAErD,YAAM,OAAO,OAAO,OAAO,CAAC,gBAAgB,QAAQ,mBAAmB,WAAW,CAAC;AAEnF,YAAM;AAAA,QAAI,CAAC,cACT,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,WAAW,YAAY,GAAG,IAAI;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,UAAU,OAAO,WAUX;AACJ,YAAM,EAAE,WAAW,cAAc,iBAAiB,GAAG,MAAM,KAAK,IAAI;AACpE,YAAM,YAAY,OAAO,KAAK,cAAc,KAAK;AAEjD,gBAAU,UAAU,WAAW,IAAI,4CAA4C;AAC/E,YAAM,iBAAiB,OAAO,KAAK,2BAA2B,KAAK;AACnE,gBAAU,eAAe,WAAW,IAAI,8CAA8C;AAEtF,YAAM,eAAe,OAAO,KAAK,IAAI;AAErC,YAAM,gBAAgB,OAAO,OAAO;AAAA,QAClC,OAAO,KAAK,UAAU,IAAI,GAAG,KAAK;AAAA,QAClC,OAAO,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,QACjC;AAAA,MACF,CAAC;AAED,YAAM,sBAAsB,OAAO,MAAM,CAAC;AAC1C,0BAAoB,cAAc,cAAc,QAAQ,CAAC;AAEzD,YAAM,OAAO,OAAO,OAAO,CAAC,WAAW,gBAAgB,qBAAqB,aAAa,CAAC;AAE1F,YAAM,WAAW,MAAM;AAAA,QAAI,CAAC,cAC1B,YAAY,WAAW,CAAC,KAAM,GAAM,GAAM,CAAI,GAAG,IAAI;AAAA,MACvD;AAEA,UAAI,IAAI;AACR,YAAM,MAAM,SAAS,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;AACtC,WAAK;AACL,YAAM,SAAS,SAAS,MAAM,GAAG,IAAI,EAAE,EAAE,SAAS,KAAK;AACvD,WAAK;AACL,YAAM,kBAAkB,SAAS,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;AAClD;AACA,YAAM,YAAY,SAAS,MAAM,GAAG,IAAI,eAAe;AACvD,WAAK;AACL,aAAO;AAAA,QACL,aAAa,aAAa,QAAQ;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc,OAAO,WAAmD;AACtE,YAAM,EAAE,WAAW,aAAa,IAAI;AACpC,YAAM,YAAY,OAAO,KAAK,cAAc,KAAK;AACjD,gBAAU,UAAU,WAAW,IAAI,4CAA4C;AAC/E,YAAM,WAAW,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,GAAM,GAAM,GAAM,SAAS,CAAC;AAC3F,aAAO,aAAa,QAAQ,EAAE,SAAS,KAAK;AAAA,IAC9C;AAAA,IAEA,YAAY,OAAO,EAAE,QAAQ,MAAM;AACjC,aAAO,KAAK,qBAAqB;AACjC,YAAM,aAAa,OAAO,KAAK,QAAQ,MAAM,QAAQ;AACrD,YAAM,SAAS,OAAO,MAAM,CAAC;AAC7B,aAAO,cAAc,WAAW,QAAQ,CAAC;AACzC,YAAM,QAAQ,OAAO,OAAO,CAAC,QAAQ,UAAU,CAAC;AAChD,YAAM,IAAI,CAAC,cAAc,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,CAAI,GAAG,KAAK,CAAC;AAAA,IAClF;AAAA,IACA,2BAA2B,OAAO,WAIuB;AACvD,aAAO,KAAK,oCAAoC;AAChD,YAAM,OAAO,iBAAiB,MAAM;AACpC,YAAM,gBAAgB,MAAM;AAAA,QAAI,CAAC,cAC/B,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,WAAW,uBAAuB,GAAG,IAAI;AAAA,MACrF;AACA,YAAM,SAAS,aAAa,aAAa;AACzC,YAAM,aAAa,OAAO,SAAS,CAAC;AACpC,aAAO;AAAA,QACL,WAAW,OAAO,MAAM,GAAG,aAAa,CAAC,EAAE,SAAS,QAAQ;AAAA,QAC5D,WAAW,OAAO,MAAM,aAAa,CAAC,EAAE,SAAS,QAAQ;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,0BAA0B,OAAO,WAAW;AAC1C,aAAO,KAAK,mCAAmC;AAC/C,YAAM,OAAO,iBAAiB,MAAM;AACpC,YAAM;AAAA,QAAI,CAAC,cACT,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,WAAW,uBAAuB,GAAG,IAAI;AAAA,MACrF;AAAA,IACF;AAAA,IACA,wBAAwB,OAAO,WAAW;AACxC,aAAO,KAAK,iCAAiC;AAC7C,YAAM,OAAO,sBAAsB,MAAM,UAAU;AACnD,YAAM,QAAQ,OAAO,OAAO;AAAA,QAC1B,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,QACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,gBAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,cAAI,cAAc,YAAY,CAAC;AAC/B,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAED,UAAI,eAAe;AACnB,UAAI,gBAA+B;AAEnC,aAAO,CAAC,eAAe;AACrB,cAAM,SAAS,OAAO,KAAK,OAAO,QAAQ,eAAe,CAAC,GAAI,QAAQ;AACtE,cAAM,SAAS,OAAO,MAAM,CAAC;AAC7B,eAAO,cAAc,OAAO,QAAQ,CAAC;AACrC,cAAM,OAAO,OAAO,OAAO,CAAC,OAAO,QAAQ,MAAM,CAAC;AAClD,cAAM,WAAW,MAAM;AAAA,UAAI,CAAC,cAC1B,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,CAAI,GAAG,IAAI;AAAA,QACvD;AACA,cAAM,eAAe,SAAS,SAAS,CAAC;AACxC,YAAI,iBAAiB,SAAS,aAAa,SAAS,SAAS,CAAC;AAC9D,gBAAQ,cAAc;AAAA,UACpB,KAAK;AACH,2BAAe,SAAS,WAAW,GAAG,CAAC;AACvC;AAAA,UACF,KAAK;AACH,4BAAgB,SAAS,MAAM,GAAG,SAAS,SAAS,CAAC;AACrD,mBAAO,mBAAmB,OAAQ;AACE;AAChC,sBAAM,OAAO,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,GAAM,KAAM,GAAM,CAAI,CAAC;AAC5E,iCAAiB,KAAK,aAAa,KAAK,SAAS,CAAC;AAClD,gCAAgB,OAAO,OAAO,CAAC,eAAe,aAAa,IAAI,CAAC,CAAC;AAAA,cACnE;AAAA,YACF;AACA;AAAA;AAAA,UAEF;AACE,kBAAM,IAAI,MAAM,0BAA0B,YAAY,EAAE;AAAA,QAC5D;AAAA,MACF;AACA,aAAO,cAAc,SAAS,QAAQ;AAAA,IACxC;AAAA,IAEA,UAAU,OAAO,gBAAwB;AACvC,YAAM,MAAM,MAAM,IAAI,CAAC,cAAc,UAAU,SAAS,OAAO,KAAK,aAAa,KAAK,CAAC,CAAC;AACxF,aAAO,OAAO,KAAK,GAAG,EAAE,SAAS,KAAK;AAAA,IACxC;AAAA,IACA,YAAY,YAAY;AACtB,YAAM,MAAM,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,GAAM,GAAM,CAAI,CAAC;AAC3E,YAAM,aAAa,IAAI,SAAS,CAAC;AACjC,YAAM,gBAAgB,IAAI,SAAS,IAAI,UAAU;AACjD,YAAM,gBAAgB,IAAI,MAAM,IAAI,IAAI,YAAY,IAAI,aAAa,gBAAgB,CAAC;AAEtF,YAAM,aAAa,OAAO,KAAK,aAAa,EAAE,SAAS;AAEvD,aAAO;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO;AACT;;;AC9hBA,SAAS,kBAAkB,gBAAiC;AAE5D,OAAO,eAAe;AAiBf,IAAM,eAAe,CAAC,YAAqD;AAChF,QAAM,OAAO,iBAA4B;AAAA,IACvC,OAAO;AAAA,MACL,SAAS;AAAA,QACP,KAAK,GAAG,QAAQ,OAAO;AAAA,QACvB,aAAa;AAAA,QACb,QAAQ,MAAM;AAEZ,gBAAM,iBAAkB,KAAK,GAAG,SAAS,WAAsC,CAAC;AAEhF,iBAAO;AAAA,YACL,GAAI,QAAQ,iBACR,EAAE,8BAA8B,QAAQ,eAAe,IACvD,CAAC;AAAA,YACL,GAAI,QAAQ,gBACR,EAAE,6BAA6B,QAAQ,cAAc,IACrD,CAAC;AAAA,YACL,GAAI,QAAQ,UAAU,EAAE,eAAe,WAAW,QAAQ,OAAO,GAAG,IAAI,CAAC;AAAA,YACzE,GAAI,QAAQ,iBACR,EAAE,eAAe,UAAU,QAAQ,cAAc,GAAG,IACpD,CAAC;AAAA;AAAA,YAEL,GAAG;AAAA,UACL;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACD,SAAO;AACT;;;AFHA,eAAe,gBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAae;AACb,QAAM,CAAC,aAAa,WAAW,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACrE,OAAO,eAAe;AAAA,IACtB,OAAO,aAAa;AAAA,IACpB,OAAO,yBAAyB;AAAA,EAClC,CAAC;AACD,QAAM,kBAAkB,MAAM,OAAO,qBAAqB;AAC1D,QAAM,aAAyC;AAAA,IAC7C;AAAA,IACA,QAAQ,UAAU;AAAA,IAClB,UAAU;AAAA,IACV,oBAAoB,mBAAmB;AAAA,IACvC,iBAAiB,gBAAgB;AAAA,IACjC,4BAA4B;AAAA,MAC1B,GAAG,YAAY;AAAA,MACf,WAAW,gBAAgB;AAAA,IAC7B;AAAA,EACF;AACA,QAAM,YAAY,MAAM,aAAa,EAAE,QAAQ,UAAU,QAAQ,WAAW,CAAC;AAC7E,QAAM,iBAAiB,MAAM,OAAO,yBAAyB;AAAA,IAC3D,WAAW,UAAU;AAAA,IACrB,aAAa,UAAU;AAAA,IACvB,sBAAsB,UAAU;AAAA,EAClC,CAAC;AACD,QAAM,oBAAoB;AAC1B,QAAM,WAAW,MAAM,OAAO,SAAS;AAAA,IACrC,WAAW,UAAU;AAAA,IACrB,iBAAiB,UAAU;AAAA,IAC3B;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,mBAAmB,MAAM,OAAO,oBAAoB;AAC1D,QAAM,eAAe,MAAM,OAAO,aAAa,EAAE,WAAW,UAAU,UAAU,CAAC;AACjF,QAAM,oBAAoB,KAAK,SAAS,YAAY,SAAS,EAAE;AAC/D,QAAM,cAAc,OAAO,OAAO;AAAA,IAChC,SAAS,YAAY,MAAM,GAAG,iBAAiB;AAAA,IAC/C,OAAO,KAAK,CAAC,YAAY,OAAO,MAAM,CAAC;AAAA,IACvC,YAAY;AAAA,IACZ,SAAS,YAAY,MAAM,iBAAiB;AAAA,EAC9C,CAAC,EAAE,SAAS,KAAK;AACjB,QAAM,oBAAuD;AAAA,IAC3D;AAAA,IACA,aAAa;AAAA,MACX,GAAG,YAAY;AAAA,MACf,WAAW,iBAAiB;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,cAAc,SAAS,UAAU,SAAS,KAAK;AAAA,IAC/C,eAAe,iBAAiB;AAAA,IAChC;AAAA,EACF;AACA,SAAO,gBAAgB,EAAE,QAAQ,UAAU,QAAQ,kBAAkB,CAAC;AACxE;AAEO,SAAS,aAAa,SAAwB,QAAwB;AAC3E,QAAM,gBAAmC;AAAA,IACvC,SAAS,QAAQ;AAAA,EACnB;AACA,QAAM,SAAS,aAAa,aAAa;AACzC,QAAM,YAAY,gBAAgB,SAAS,MAAM;AAEjD,QAAM,OAAmB;AAAA,IACvB;AAAA,IACA,cAAc,CAAC,cAAc,aAAa,EAAE,GAAG,eAAe,GAAG,UAAU,CAAC;AAAA,IAC5E,WAAW;AAAA,EACb;AAEA,QAAM,kBAA6C,SAEjD,aACA;AACA,UAAM,SAAS,UAAU,KAAK,WAAW;AACzC,UAAM,UAAsB,EAAE,OAAO;AACrC,WAAO,eAAe,EAAE,GAAG,MAAM,GAAG,QAAQ,CAA2B;AAAA,EACzE;AAEA,QAAM,kBAA6C,SAEjD,aACA;AACA,UAAM,SAAS,iBAAiB,EAAE,YAAY,GAAG,MAAM;AACvD,UAAM,UAAsB,EAAE,OAAO;AACrC,WAAO,eAAe,EAAE,GAAG,MAAM,GAAG,QAAQ,CAA2B;AAAA,EACzE;AAEA,QAAM,cAAqC,WAA8B;AACvE,UAAMC,eAA2B,EAAE,aAAa,KAAK;AACrD,WAAO,eAAe,EAAE,GAAG,MAAM,GAAGA,aAAY,CAA4B;AAAA,EAC9E;AAEA,QAAM,gBAAyC,SAE7C,eACA;AACA,UAAMC,iBAA+B,EAAE,iBAAiB,cAAc;AACtE,WAAO,eAAe,EAAE,GAAG,MAAM,GAAGA,eAAc,CAA8B;AAAA,EAClF;AAEA,QAAM,iBAA2C,SAE/C,cACA;AACA,UAAMC,kBAAiC,EAAE,gBAAgB,aAAa;AACtE,WAAO,eAAe,EAAE,GAAG,MAAM,GAAGA,gBAAe,CAA+B;AAAA,EACpF;AAEA,WAAS,eACP,QAMW;AACX,aAAS,SACP,WACM;AACN,aAAO,OAAO,QAAQ,UAAU,MAAgC,CAAC;AAAA,IACnE;AAIA,QAAI,OAAO,QAAQ;AACjB;AAAA,QACE,CAACC,aACE;AAAA,UACC,eAAe,YAA+B;AAC5C,kBAAM,EAAE,QAAQ,QAAAC,QAAO,IAAID;AAC3B,kBAAM,EAAE,OAAO,IAAI,MAAM,OAAO,aAAa;AAC7C,kBAAM,EAAE,eAAe,IAAI,MAAMC,QAAO,KAAK,IAAI,mBAAmB,MAAM,EAAE,OAAO,CAAC;AACpF,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACJ;AAAA,IACF;AAIA,QAAI,OAAO,mBAAmB,CAAC,OAAO,cAAc,CAAC,OAAO,WAAW;AACrE,eAAiE,CAACD,YAAW;AAC3E,cAAM,EAAE,gBAAgB,IAAIA;AAC5B,eAAO;AAAA,UACL,cAAc,SAA8B,OAAwC;AAClF,kBAAM,cAA2B,EAAE,YAAY,MAAM;AACrD,kBAAM,UAAU,GAAG,eAAe,IAAI,KAAK;AAC3C,kBAAMC,UAASD,QAAO,aAAa,EAAE,QAAQ,CAAC;AAC9C,mBAAO,eAAe,EAAE,GAAG,MAAM,QAAAC,SAAQ,GAAG,YAAY,CAA4B;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAIA,QAAI,OAAO,UAAU,OAAO,gBAAgB;AAC1C,eAAuE,CAACD,YAAW;AACjF,cAAM,EAAE,QAAQ,QAAAC,SAAQ,eAAe,IAAID;AAC3C,uBAAe,iBAAgC;AAC7C,cAAI,MAAM,OAAO,WAAW,EAAG;AAC/B,gBAAM,CAAC,EAAE,OAAO,GAAG,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,YACzD,OAAO,aAAa;AAAA,YACpB,OAAO,sBAAsB;AAAA,UAC/B,CAAC;AACD,gBAAM,UAAU,MAAMC,QAAO,WAAW,oBAAoB,OAAO;AAAA,YACjE;AAAA,YACA,cAAc;AAAA,YACd,MAAM;AAAA,cACJ,8BAA8B,mBAAmB;AAAA,cACjD,6BAA6B,mBAAmB;AAAA,YAClD;AAAA,UACF,CAAC;AACD,gBAAM,OAAO,WAAW,EAAE,QAAQ,CAAC;AAAA,QACrC;AACA,eAAO;AAAA,UACL,aAAa,OAAO,WAAqE;AACvF,kBAAM,EAAE,MAAM,WAAW,IAAI;AAC7B,kBAAM,CAAC,EAAE,OAAO,GAAG,EAAE,QAAQ,mBAAmB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,cACrE,OAAO,aAAa;AAAA,cACpB,OAAO,yBAAyB;AAAA,YAClC,CAAC;AACD,kBAAMA,QAAO,WAAW,YAAY,OAAO;AAAA,cACzC,cAAc;AAAA,cACd,OAAO,EAAE,MAAM,QAAQ,YAAY,mBAAmB;AAAA,YACxD,CAAC;AAAA,UACH;AAAA,UAEA,4BAA4B,OAC1B,aACA,WACkB;AAClB,kBAAM,CAAC,EAAE,OAAO,GAAG,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,cACzD,OAAO,aAAa;AAAA,cACpB,OAAO,yBAAyB;AAAA,YAClC,CAAC;AACD,kBAAM,OAAO,YAAY;AAAA,cACvB,eAAe;AAAA,gBACb,QAAQ,YAAY;AAAA,gBACpB,aAAa,YAAY;AAAA,cAC3B;AAAA,YACF,CAAC;AACD,kBAAM,EAAE,YAAY,IAAI,MAAM,OAAO,eAAe;AACpD,kBAAM,QAAQ,oBAAoB;AAClC,kBAAM,OAAO,MAAM,OAAO,4BAA4B;AACtD,kBAAMA,QAAO,WAAW,0BAA0B,OAAO;AAAA,cACvD;AAAA,cACA,cAAc;AAAA,cACd,UAAU;AAAA,gBACR;AAAA,gBACA,iBAAiB,mBAAmB;AAAA,gBACpC,sBAAsB;AAAA,kBACpB,GAAG;AAAA,kBACH,WAAW,mBAAmB;AAAA,gBAChC;AAAA,cACF;AAAA,YACF,CAAC;AAAA,UACH;AAAA,UAEA,gBAAgB,OACd,gBACA,WACkB;AAClB,kBAAM,EAAE,MAAM,KAAK,IAAI;AACvB,kBAAM,uBACJ,SAAS,UACLA,QAAO,WAAW,2CAClBA,QAAO,WAAW;AACxB,kBAAM,0BACJ,SAAS,UACLA,QAAO,WAAW,gCAClBA,QAAO,WAAW;AACxB,kBAAM,gBAAgB;AAAA,cACpB;AAAA,cACA;AAAA,cACA;AAAA,cACA,cAAc,CAAC,EAAE,QAAQ,WAAW,MAClC,qBAAqB,OAAO;AAAA,gBAC1B,cAAc;AAAA,gBACd;AAAA,gBACA;AAAA,cACF,CAAC;AAAA,cACH,iBAAiB,CAAC,EAAE,QAAQ,kBAAkB,MAC5C,wBAAwB,OAAO;AAAA,gBAC7B,cAAcD,QAAO;AAAA,gBACrB;AAAA;AAAA,gBAEA,UAAU;AAAA,cACZ,CAAC;AAAA,cACH,mBAAmB,QAAQ;AAAA,YAC7B,CAAC;AAAA,UACH;AAAA,UAEA,mBAAmB,OACjB,WACA,WACkB;AAClB,kBAAM,eAAe;AACrB,kBAAM,EAAE,OAAO,IAAI,MAAM,OAAO,aAAa;AAC7C,kBAAM,OAAO,yBAAyB;AAAA,cACpC,WAAW,UAAU;AAAA,cACrB,sBAAsB,UAAU;AAAA,cAChC,aAAa,UAAU;AAAA,YACzB,CAAC;AACD,kBAAM,QAAQ,oBAAoB;AAClC,kBAAM,YAAY,MAAM,OAAO,uBAAuB;AAAA,cACpD,SAAS,UAAU;AAAA,YACrB,CAAC;AACD,kBAAMC,QAAO,WAAW,mCAAmC,OAAO;AAAA,cAChE,cAAc;AAAA,cACd;AAAA,cACA;AAAA,YACF,CAAC;AAAA,UACH;AAAA,UAEA,qBAAqB,OACnB,WACA,WACkB;AAClB,kBAAM,eAAe;AACrB,kBAAM,CAAC,EAAE,OAAO,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,cACtD,OAAO,aAAa;AAAA,cACpB,OAAO,eAAe;AAAA,YACxB,CAAC;AACD,kBAAM,OAAO,yBAAyB;AAAA,cACpC,WAAW,UAAU;AAAA,cACrB,sBAAsB,UAAU;AAAA,cAChC,aAAa,UAAU;AAAA,YACzB,CAAC;AACD,kBAAM,QAAQ,oBAAoB;AAClC,kBAAM,oBAAoB,MAAM,OAAO,uBAAuB;AAAA,cAC5D,SAAS,UAAU;AAAA,YACrB,CAAC;AACD,kBAAM,YAAY,MAAM,OAAO,0BAA0B;AAAA,cACvD,aAAa,UAAU;AAAA,cACvB,WAAW,UAAU;AAAA,cACrB,sBAAsB,UAAU;AAAA,YAClC,CAAC;AACD,kBAAM,eAAe,MAAM,OAAO,qBAAqB;AACvD,kBAAMA,QAAO,WAAW,mBAAmB,OAAO;AAAA,cAChD,cAAc;AAAA,cACd;AAAA,cACA,cAAc;AAAA,gBACZ;AAAA,gBACA;AAAA,gBACA,WAAW,UAAU;AAAA,gBACrB,sBAAsB;AAAA,kBACpB,GAAG;AAAA,kBACH,WAAW,UAAU;AAAA,gBACvB;AAAA,cACF;AAAA,YACF,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAIA,QAAI,OAAO,UAAU,OAAO,mBAAmB,CAAC,OAAO,YAAY;AACjE;AAAA,QACE,CAACD,YAAW;AACV,gBAAM,EAAE,QAAQ,QAAAC,SAAQ,gBAAgB,IAAID;AAC5C,iBAAO;AAAA,YACL,OAAO,eAEL,MAKkC;AAClC,oBAAM,EAAE,OAAO,IAAI,MAAM,OAAO,aAAa;AAC7C,oBAAM,YAAY,MAAMC,QAAO,KAAK,IAAI,kBAAkB;AAAA,gBACxD;AAAA,kBACE;AAAA,kBACA,eAAe;AAAA,gBACjB;AAAA,gBACA,iBAAiB,EAAE,eAAe,MAAM,cAAc,CAAC;AAAA,cACzD;AACA,oBAAM,MAAM,oBAAoB;AAChC,oBAAM,iBAAiB,MAAM,OAAO,aAAa;AAAA,gBAC/C;AAAA,gBACA,eAAe;AAAA,cACjB,CAAC;AACD,oBAAM,cAAc;AAAA,gBAClB,eAAe;AAAA,gBACf;AAAA,gBACA;AAAA,gBACA,sBAAsB,MAAM;AAAA,cAC9B;AACA,oBAAM,EAAE,MAAM,IAAI,MAAMA,QAAO,KAAK,IAAI,aAAa;AAAA,gBACnD,EAAE,GAAG,YAAY;AAAA,gBACjB,iBAAiB,EAAE,eAAe,MAAM,cAAc,CAAC;AAAA,cACzD;AACA,oBAAM,cAA2B;AAAA,gBAC/B,YAAY;AAAA,cACd;AACA,oBAAM,UAAU,GAAGD,QAAO,eAAe,IAAI,KAAK;AAClD,oBAAM,eAAeA,QAAO,aAAa,EAAE,QAAQ,CAAC;AACpD,qBAAO,eAAe,EAAE,GAAG,MAAM,QAAQ,cAAc,GAAG,YAAY,CAErE;AAAA,YACH;AAAA,YAEA,UAAU,CACR,iBACsC;AACtC,qBAAO,gBAAgB;AAAA,gBACrB;AAAA,gBACA,MAAM,aAAa;AAAA,gBACnB,MAAM,aAAa;AAAA,gBACnB,cAAc,OAAO,EAAE,WAAW,MAAM;AACtC,wBAAM,YAAY,MAAMC,QAAO,kBAAkB,kBAAkB,OAAO;AAAA,oBACxE,IAAI,aAAa;AAAA,oBACjB,eAAe;AAAA,oBACf;AAAA,kBACF,CAAC;AACD,yBAAO;AAAA,gBACT;AAAA,gBACA,iBAAiB,CAAC,EAAE,kBAAkB,MACpCA,QAAO,kBAAkB,gBAAgB,OAAO;AAAA,kBAC9C,eAAe;AAAA,kBACf,IAAI,aAAa;AAAA,kBACjB;AAAA,gBACF,CAAC;AAAA,cACL,CAAC;AAAA,YACH;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,QAAI,OAAO,mBAAmB,OAAO,eAAe,CAAC,OAAO,WAAW;AACrE;AAAA,QACE,CAACD,YAAW;AACV,gBAAM,EAAE,QAAAC,SAAQ,gBAAgB,IAAID;AACpC,iBAAO;AAAA,YACL,OAAO,eAEL,aAIA,MACkC;AAClC,oBAAM,MAAM,MAAMC,QAAO,KAAK,aAAa;AAAA,gBACzC;AAAA,kBACE,UAAU,YAAY;AAAA,kBACtB,cAAc,YAAY;AAAA,kBAC1B,WAAW;AAAA,gBACb;AAAA,gBACA,iBAAiB,EAAE,eAAe,MAAM,cAAc,CAAC;AAAA,cACzD;AACA,oBAAM,cAA2B;AAAA,gBAC/B,WAAW;AAAA,cACb;AACA,oBAAM,eAAeD,QAAO,aAAa,EAAE,gBAAgB,IAAI,YAAY,CAAC;AAC5E,qBAAO,eAAe,EAAE,GAAG,MAAM,QAAQ,cAAc,GAAG,YAAY,CAErE;AAAA,YACH;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,QAAI,OAAO,UAAU,OAAO,mBAAmB,OAAO,YAAY;AAChE,eAA4E,CAACA,YAAW;AACtF,cAAM,EAAE,QAAAC,SAAQ,OAAO,IAAID;AAE3B,uBAAe,iBAAgC;AAC7C,cAAI,MAAM,OAAO,WAAW,EAAG;AAC/B,gBAAM,qBAAqB,MAAM,OAAO,sBAAsB;AAC9D,gBAAM,UAAU,MAAMC,QAAO,MAAM,oBAAoB,OAAO;AAAA,YAC5D,8BAA8B,mBAAmB;AAAA,YACjD,6BAA6B,mBAAmB;AAAA,UAClD,CAAC;AACD,gBAAM,OAAO,WAAW,EAAE,QAAQ,CAAC;AAAA,QACrC;AAEA,cAAM,mBAAmB,OACvB,WACA,WACoB;AACpB,gBAAM,eAAe;AACrB,gBAAM,OAAO,yBAAyB;AAAA,YACpC,WAAW,UAAU;AAAA,YACrB,sBAAsB,UAAU;AAAA,YAChC,aAAa,UAAU;AAAA,UACzB,CAAC;AACD,gBAAM,QAAQ,oBAAoB;AAClC,gBAAM,YAAY,MAAM,OAAO,uBAAuB;AAAA,YACpD,SAAS,UAAU;AAAA,UACrB,CAAC;AACD,iBAAO;AAAA,QACT;AAEA,eAAO;AAAA,UACL,SAAS,OACP,SACA,WACkC;AAClC,kBAAM,EAAE,UAAU,IAAI,MAAMA,QAAO,SAAS,aAAa,MAAM,EAAE,IAAI,QAAQ,GAAG,CAAC;AACjF,gBAAI,UAAU,kBAAkB,OAAO;AACrC,oBAAM,YAAY,MAAM,iBAAiB,WAAW,MAAM;AAC1D,oBAAM,QAAQ,uBAAuB;AACrC,qBAAOA,QAAO,SAAS,QAAQ;AAAA,gBAC7B;AAAA,kBACE,IAAI,QAAQ;AAAA,kBACZ,MAAM,EAAE,eAAe,OAAO,UAAU;AAAA,gBAC1C;AAAA,gBACA,iBAAiB,MAAM;AAAA,cACzB;AAAA,YACF;AACA,gBAAI,UAAU,kBAAkB,QAAQ;AACtC,qBAAOA,QAAO,SAAS,QAAQ;AAAA,gBAC7B;AAAA,kBACE,IAAI,QAAQ;AAAA,kBACZ,MAAM,EAAE,eAAe,OAAO;AAAA,gBAChC;AAAA,gBACA,iBAAiB,MAAM;AAAA,cACzB;AAAA,YACF;AACA,kBAAM,IAAI,MAAM,2CAA2C;AAAA,UAC7D;AAAA,UAEA;AAAA,UAEA,QAAQ,CACN,SACA,SACkC;AAClC,mBAAOA,QAAO,SAAS,OAAO;AAAA,cAC5B,EAAE,IAAI,QAAQ,IAAI,MAAM,KAAK;AAAA,cAC7B,iBAAiB,IAAI;AAAA,YACvB;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAIA,QAAI,OAAO,mBAAmB,OAAO,WAAW;AAC9C,eAA6E,CAACD,YAAW;AACvF,cAAM,EAAE,QAAAC,QAAO,IAAID;AACnB,eAAO;AAAA,UACL,cAAc,OAAO,YAAoE;AACvF,kBAAM,EAAE,UAAU,IAAI,MAAMC,QAAO,SAAS,aAAa,MAAM,EAAE,IAAI,QAAQ,GAAG,CAAC;AACjF,YAAAC,WAAU,UAAU,kBAAkB,OAAO,4BAA4B;AACzE,mBAAO,UAAU;AAAA,UACnB;AAAA,UAEA,SAAS,CACP,SACA,cACkC;AAClC,mBAAOD,QAAO,SAAS,QAAQ,OAAO;AAAA,cACpC,IAAI,QAAQ;AAAA,cACZ,MAAM,EAAE,eAAe,OAAO,UAAU;AAAA,YAC1C,CAAC;AAAA,UACH;AAAA,UAEA,QAAQ,CACN,SACA,cACkC;AAClC,mBAAOA,QAAO,SAAS,OAAO,OAAO;AAAA,cACnC,IAAI,QAAQ;AAAA,cACZ,MAAM,EAAE,eAAe,OAAO,UAAU;AAAA,YAC1C,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":["invariant","withApiUser","withWorkspace","withOnboarding","engine","client","invariant"]}
+{"version":3,"sources":["../src/engine/index.ts","../src/device/real-device.ts","../src/trpc.ts"],"sourcesContent":["import type {\n  ApiChallenge,\n  ClaimedRole,\n  OnboardingSeedChallenge,\n  PsdChallenge,\n  UserRegistrationChallenge,\n  UserRegistrationChallengeResponse,\n  UserRegistrationDeviceData,\n  UserRegistrationResponse,\n  VaultRequestResponse,\n  WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type RouterOutputs, type TRPCClientOptions } from \"@/trpc\";\n\nimport { buildTrpcContext } from \"../utils\";\nimport type {\n  ApproveRequestParams,\n  CorrelationIdOpts,\n  DecorateWithApiUserAndWorkspaceUnauthenticated,\n  DecorateWithDevice,\n  DecorateWithDeviceAndOnboarding,\n  DecorateWithDeviceAndWorkspaceUnauthenticated,\n  DecorateWithWorkspaceApiAuthenticated,\n  DecorateWithWorkspacePsdAuthenticated,\n  DecorateWithWorkspaceUnauthenticated,\n  Engine,\n  EngineBase,\n  EngineOptions,\n  OnboardingOperationParams,\n  RegisterOnboardingDeviceParams,\n  WithApiAuth,\n  WithApiUser,\n  WithDevice,\n  WithOnboarding,\n  WithPsdAuth,\n  WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n  device,\n  name,\n  role,\n  getChallenge,\n  submitChallenge,\n  onScreenDisplayed,\n}: {\n  device: Device;\n  name: string;\n  role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n  getChallenge: (p: {\n    pubKey: string;\n    deviceData: UserRegistrationDeviceData;\n  }) => Promise<UserRegistrationChallenge>;\n  submitChallenge: (p: {\n    pubKey: string;\n    challengeResponse: UserRegistrationChallengeResponse;\n  }) => Promise<T>;\n  onScreenDisplayed?: () => void | Promise<void>;\n}): Promise<T> {\n  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n    device.getAttestation(),\n    device.getU2FPubKey(),\n    device.getConfidentialityPubKey(),\n  ]);\n  const ephemeralPubKey = await device.initPairingHandshake();\n  const deviceData: UserRegistrationDeviceData = {\n    name,\n    pubKey: u2fPubKey.pubKey,\n    psdModel: \"STAX\",\n    confidentialityKey: confidentialityKey.pubKey,\n    psdEphemeralKey: ephemeralPubKey.pubKey,\n    psdEphemeralKeyAttestation: {\n      ...attestation.attestation,\n      signature: ephemeralPubKey.signature,\n    },\n  };\n  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n  const pairingPayload = await device.finalizePairingHandshake({\n    handshake: challenge.handshake,\n    partitionId: challenge.ciphertext,\n    handshakeAttestation: challenge.handshakeAttestation,\n  });\n  await onScreenDisplayed?.();\n  const register = await device.register({\n    challenge: challenge.challenge,\n    u2fRegisterData: challenge.u2fRegisterData,\n    name,\n    role,\n  });\n  const validationPubKey = await device.getValidationPubKey();\n  const registerData = await device.registerData({ challenge: challenge.challenge });\n  const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n  const u2fRegister = Buffer.concat([\n    register.u2fRegister.slice(0, attestationOffset),\n    Buffer.from([attestation.buffer.length]),\n    attestation.buffer,\n    register.u2fRegister.slice(attestationOffset),\n  ]).toString(\"hex\");\n  const challengeResponse: UserRegistrationChallengeResponse = {\n    registerData,\n    certificate: {\n      ...attestation.attestation,\n      signature: validationPubKey.signature,\n    },\n    u2fRegister,\n    u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n    validationKey: validationPubKey.pubKey,\n    pairingPayload,\n  };\n  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n  const clientOptions: TRPCClientOptions = {\n    baseUrl: options.baseUrl,\n  };\n  const client = createClient(clientOptions);\n  const apiDevice = createApiDevice(options, logger);\n\n  const base: EngineBase = {\n    client,\n    createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n    __options: options,\n  };\n\n  const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n    this: Engine<T>,\n    deviceIndex: number,\n  ) {\n    const device = apiDevice.with(deviceIndex);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withTransportId: Engine[\"withTransportId\"] = function <T>(\n    this: Engine<T>,\n    transportId: string,\n  ) {\n    const device = createRealDevice({ transportId }, logger);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n    const withApiUser: WithApiUser = { __isApiUser: true };\n    return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n  };\n\n  const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n    this: Engine<T>,\n    workspaceName: string,\n  ) {\n    const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n    return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n  };\n\n  const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n    this: Engine<T>,\n    onboardingId: string,\n  ) {\n    const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n    return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n  };\n\n  function decorateEngine<T>(\n    engine: Engine<\n      T &\n        Partial<\n          WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n        >\n    >,\n  ): Engine<T> {\n    function decorate<TEnhanced, TDecoration>(\n      decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n    ): void {\n      Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n    }\n\n    // DecorateWithDevice\n    // -------------------------------------------------------------------------\n    if (engine.device) {\n      decorate<WithDevice, DecorateWithDevice<T>>(\n        (engine) =>\n          ({\n            getWorkspaces: async (): Promise<string[]> => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n              return workspaceNames;\n            },\n\n            getWorkspacesForSso: async (): Promise<\n              RouterOutputs[\"auth\"][\"sso\"][\"findWorkspaces\"][\"workspaces\"]\n            > => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaces } = await client.auth.sso.findWorkspaces.query({ pubKey });\n              return workspaces;\n            },\n          }) satisfies DecorateWithDevice<T>,\n      );\n    }\n\n    // DecorateWithWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n      decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n        const { __workspaceName } = engine;\n        return {\n          withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n            const withPsdAuth: WithPsdAuth = { __psdToken: token };\n            const psdAuth = `${__workspaceName}:${token}`;\n            const client = engine.createClient({ psdAuth });\n            return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n          },\n        } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n      });\n    }\n\n    // DecorateWithDeviceAndOnboarding\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__onboardingId) {\n      decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n        const { device, client, __onboardingId } = engine;\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const [{ pubKey }, confidentialityKey] = await Promise.all([\n            device.getU2FPubKey(),\n            device.getConfidentialityKey(),\n          ]);\n          const pairing = await client.onboarding.pairDevicePartition.mutate({\n            pubKey,\n            onboardingId: __onboardingId,\n            data: {\n              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n            },\n          });\n          await device.setPairing({ pairing });\n        }\n        return {\n          claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n            const { role, deviceName } = params;\n            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await client.onboarding.claimDevice.mutate({\n              onboardingId: __onboardingId,\n              claim: { role, pubKey, deviceName, confidentialityKey },\n            });\n          },\n\n          collectWrappingKeyFragment: async (\n            wrappingKey: WrappingKeyResponse,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const [{ pubKey }, confidentialityKey] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await device.openSession({\n              secureChannel: {\n                pubKey: wrappingKey.ephemeralPubKey,\n                certificate: wrappingKey.ephemeralCertificate,\n              },\n            });\n            const { attestation } = await device.getAttestation();\n            await params?.onScreenDisplayed?.();\n            const blob = await device.generateWrappingKeyFragment();\n            await client.onboarding.submitWrappingKeyFragment.mutate({\n              pubKey,\n              onboardingId: __onboardingId,\n              fragment: {\n                blob,\n                ephemeralPubKey: confidentialityKey.pubKey,\n                ephemeralCertificate: {\n                  ...attestation,\n                  signature: confidentialityKey.signature,\n                },\n              },\n            });\n          },\n\n          registerDevice: async (\n            registerParams: RegisterOnboardingDeviceParams,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const { role, name } = registerParams;\n            const getChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.generateMasterAdminRegistrationChallenge\n                : client.onboarding.generateSharedOwnerRegistrationChallenge;\n            const submitChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.submitMasterAdminRegistration\n                : client.onboarding.submitSharedOwnerRegistration;\n            await genericRegister({\n              device: device,\n              name,\n              role,\n              getChallenge: ({ pubKey, deviceData }) =>\n                getChallengeMutation.mutate({\n                  onboardingId: __onboardingId,\n                  pubKey,\n                  deviceData,\n                }),\n              submitChallenge: ({ pubKey, challengeResponse }) =>\n                submitChallengeMutation.mutate({\n                  onboardingId: engine.__onboardingId,\n                  pubKey,\n                  // FIXME this should be renamed to `challengeResponse` on backend side\n                  response: challengeResponse,\n                }),\n              onScreenDisplayed: params?.onScreenDisplayed,\n            });\n          },\n\n          reviewSharedOwner: async (\n            challenge: PsdChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          collectSeedFragment: async (\n            challenge: OnboardingSeedChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const [{ pubKey }, { attestation }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getAttestation(),\n            ]);\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const challengeResponse = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            const kkPattern = await device.startKKPatternAsResponder({\n              partitionId: challenge.partitionId,\n              handshake: challenge.kkHandshake,\n              handshakeAttestation: challenge.kkHandshakeAttestation,\n            });\n            const approverBlob = await device.generateSeedFragment();\n            await client.onboarding.submitSeedFragment.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              seedFragment: {\n                challengeResponse,\n                approverBlob,\n                handshake: kkPattern.handshake,\n                handshakeAttestation: {\n                  ...attestation,\n                  signature: kkPattern.signature,\n                },\n              },\n            });\n          },\n        } satisfies DecorateWithDeviceAndOnboarding;\n      });\n    }\n\n    // DecorateWithDeviceAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { device, client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              opts?: {\n                validityDurationSecs?: number;\n                onScreenDisplayed?: () => void | Promise<void>;\n                correlationId?: string;\n              },\n            ): Promise<Engine<T & WithPsdAuth>> {\n              const { pubKey } = await device.getU2FPubKey();\n              const challenge = await client.auth.psd.generateChallenge.mutate(\n                {\n                  pubKey,\n                  workspaceName: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              await opts?.onScreenDisplayed?.();\n              const authentication = await device.authenticate({\n                challenge,\n                workspaceName: __workspaceName,\n              });\n              const authPayload = {\n                workspaceName: __workspaceName,\n                pubKey,\n                authentication,\n                challengeId: challenge.challengeId,\n                validityDurationSecs: opts?.validityDurationSecs,\n              };\n              const { token } = await client.auth.psd.authenticate.mutate(\n                { ...authPayload },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withPsdAuth: WithPsdAuth = {\n                __psdToken: token,\n              };\n              const psdAuth = `${engine.__workspaceName}:${token}`;\n              const __authClient = engine.createClient({ psdAuth });\n              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n                T & WithPsdAuth\n              >);\n            },\n\n            register: (\n              registration: UserRegistrationResponse,\n            ): Promise<UserRegistrationResponse> => {\n              return genericRegister({\n                device,\n                name: registration.name,\n                role: registration.role,\n                getChallenge: async ({ deviceData }) => {\n                  const challenge = await client.userRegistrations.generateChallenge.mutate({\n                    id: registration.id,\n                    workspaceName: __workspaceName,\n                    deviceData,\n                  });\n                  return challenge;\n                },\n                submitChallenge: ({ challengeResponse }) =>\n                  client.userRegistrations.submitChallenge.mutate({\n                    workspaceName: __workspaceName,\n                    id: registration.id,\n                    challengeResponse,\n                  }),\n              });\n            },\n          } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithApiUserAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              credentials: {\n                apiKeyId: string;\n                apiKeySecret: string;\n              },\n              opts?: { correlationId?: string },\n            ): Promise<Engine<T & WithApiAuth>> {\n              const res = await client.auth.authenticate.mutate(\n                {\n                  apiKeyId: credentials.apiKeyId,\n                  apiKeySecret: credentials.apiKeySecret,\n                  workspace: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withApiAuth: WithApiAuth = {\n                __apiAuth: res,\n              };\n              const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n              return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n                T & WithApiAuth\n              >);\n            },\n          } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithWorkspacePsdAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n        const { client, device } = engine;\n\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const confidentialityKey = await device.getConfidentialityKey();\n          const pairing = await client.debug.pairDevicePartition.mutate({\n            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n          });\n          await device.setPairing({ pairing });\n        }\n\n        const approveChallenge = async (\n          challenge: PsdChallenge,\n          params?: ApproveRequestParams,\n        ): Promise<string> => {\n          await enforcePairing();\n          await device.startKPatternAsResponder({\n            handshake: challenge.handshake,\n            handshakeAttestation: challenge.handshakeAttestation,\n            partitionId: challenge.partitionId,\n          });\n          await params?.onScreenDisplayed?.();\n          const signature = await device.validateVaultOperation({\n            actions: challenge.wActions,\n          });\n          return signature;\n        };\n\n        return {\n          approve: async (\n            request: VaultRequestResponse,\n            params?: ApproveRequestParams,\n          ): Promise<VaultRequestResponse> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            if (challenge.challengeType === \"PSD\") {\n              const signature = await approveChallenge(challenge, params);\n              await params?.onPsdChallengeSigned?.();\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"PSD\", signature },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            if (challenge.challengeType === \"SOFT\") {\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"SOFT\" },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            throw new Error(\"Challenge type must be either PSD or SOFT\");\n          },\n\n          approveChallenge,\n\n          reject: (\n            request: VaultRequestResponse,\n            opts?: CorrelationIdOpts,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate(\n              { id: request.id, data: null },\n              buildTrpcContext(opts),\n            );\n          },\n        } satisfies DecorateWithWorkspacePsdAuthenticated;\n      });\n    }\n\n    // DecorateWithWorkspaceApiAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n        const { client } = engine;\n        return {\n          getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n            return challenge.payload;\n          },\n\n          approve: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.approve.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n\n          reject: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n        } satisfies DecorateWithWorkspaceApiAuthenticated;\n      });\n    }\n\n    return engine;\n  }\n\n  return {\n    ...base,\n    withDeviceIndex,\n    withTransportId,\n    withApiUser,\n    withWorkspace,\n    withOnboarding,\n  };\n}\n","import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate, PubKey } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n  APPID_VAULT_ADMINISTRATOR,\n  PAGINATED_STATUS,\n  PATHS,\n  SCRIPT_IDS,\n  STATUS_LENGTH,\n  STR_ROLES,\n  STREAMING_NEXT_ACTION,\n  STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n  transportId: string;\n};\n\nconst getPathFromPathString = (pathString: string): number[] => {\n  const parts = pathString.split(\"'/\").map((part) => Number.parseInt(part, 10));\n  return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n  const chunks = [];\n  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n    chunks.push(buffer.slice(i, i + size));\n  }\n  return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n  transport: Transport,\n  command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n  data: Buffer,\n  chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n  const chunks = splitChunks(chunkSize, data);\n  let response = Buffer.from([]);\n  for (let i = 0; i < chunks.length; i++) {\n    const chunk = chunks[i];\n    const apdu = [...command];\n    // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n    /* v8 ignore next -- @preserve */\n    apdu[2] = i && 0x80;\n    response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n      0x9000,\n      ...PAGINATED_STATUS,\n    ])) as Buffer<ArrayBuffer>;\n  }\n  return response;\n};\n\nconst buildAttestation = (params: {\n  handshake: string;\n  handshakeAttestation: HsmCertificate;\n  partitionId: string;\n}): Buffer => {\n  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n  const sigLengthBuffer = Buffer.alloc(1);\n  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n  const certLengthBuffer = Buffer.alloc(1);\n  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n  const certChainData = Buffer.concat([\n    sigLengthBuffer,\n    sigBuffer,\n    pubBuffer,\n    certLengthBuffer,\n    certBuffer,\n  ]);\n\n  const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n  const cliMsgLengthBuffer = Buffer.alloc(1);\n  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n  const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n  const pidLengthBuffer = Buffer.alloc(1);\n  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n  const certChainDataLengthBuff = Buffer.alloc(2);\n  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n  const data = Buffer.concat([\n    cliMsgLengthBuffer,\n    cliMsgBuffer,\n    certChainDataLengthBuff,\n    certChainData,\n    pidLengthBuffer,\n    pidBuffer,\n  ]);\n\n  const totalLengthBuffer = Buffer.alloc(2);\n  totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n  const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n  return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n  // device is locked\n  if (err instanceof LockedDeviceError) return true;\n  // user is on dashboard when receiving a Vault app apdu\n  if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n  // VG-24797 error that can happen in BLE in some situations (still unclear)\n  if (err instanceof DisconnectedDevice) return true;\n\n  // for everything else, we don't want to retry\n  return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n  const { transportId } = options;\n\n  async function run<T>(\n    job: (transport: Transport) => Promise<T>,\n    retryOnError: RetryOnError = genericRetryOnError,\n  ): Promise<T> {\n    return lastValueFrom(\n      withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n    );\n  }\n\n  /* v8 ignore next -- @preserve */\n  const noRetry = (): boolean => false;\n  /* v8 ignore next -- @preserve */\n  const alwaysRetry = (): boolean => true;\n  const poll = async (\n    opts: { retryOnError?: RetryOnError } = {},\n  ): Promise<{ isAppOpened: boolean }> => {\n    // waiting for device to be turned on\n    await run(\n      // eslint-disable-next-line  @typescript-eslint/no-empty-function\n      async (_transport) => {},\n      opts.retryOnError ?? alwaysRetry,\n    );\n    // checking if app is opened: should return directly on getPubKey\n    try {\n      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n      return { isAppOpened: true };\n    } catch (err) {\n      if (isTransportStatusError(err) && genericRetryOnError(err)) {\n        return { isAppOpened: false };\n      }\n      throw err;\n    }\n  };\n\n  const pollApp = async (appName: string): Promise<string> => {\n    const res = await run((transport) =>\n      transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n    );\n    // little delay to give time to the app to be fully opened\n    await new Promise((r) => setTimeout(r, 1e3));\n    return res.toString(\"hex\");\n  };\n\n  const getPublicKey = async (\n    pathString: string,\n    { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n  ): Promise<{ pubKey: string; signature: string }> => {\n    logger.info(`[device] getPublicKey (${pathString})`);\n    const path = getPathFromPathString(pathString);\n    const data = Buffer.concat([\n      Buffer.from([path.length]),\n      ...path.map((derivation) => {\n        const buf = Buffer.alloc(4);\n        buf.writeUInt32BE(derivation, 0);\n        return buf;\n      }),\n    ]);\n    const curve = secp256k1 ? 0x01 : 0x02;\n    const response = await run(\n      (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n      retryOnError ?? genericRetryOnError,\n    );\n    const pubKeyLength = response.readInt8(0);\n    const pubKey = response\n      .slice(1, pubKeyLength + 1)\n      .toString(\"hex\")\n      .toUpperCase();\n    const signature = response\n      .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n      .toString(\"base64\");\n    return { pubKey, signature };\n  };\n\n  const device: Device = {\n    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n      logger.info(`[device] Authenticate`);\n      invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      const nameBuffer = Buffer.from(name);\n      const workspaceBuffer = Buffer.from(workspaceName);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([nameBuffer.length]),\n        nameBuffer,\n        Buffer.from([workspaceBuffer.length]),\n        workspaceBuffer,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([\n        Buffer.from(challenge, \"base64\"),\n        applicationBuffer,\n        Buffer.from([keyHandle.length]),\n        Buffer.from(keyHandle, \"hex\"),\n        keyHandleDataLength,\n        keyHandleData,\n      ]);\n\n      const authentication = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n      );\n\n      return removeStatus(authentication).toString(\"hex\");\n    },\n\n    finalizePairingHandshake: async (params: {\n      handshake: string;\n      partitionId: string;\n      handshakeAttestation: HsmCertificate;\n    }): Promise<string> => {\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n      );\n      return removeStatus(bufWithStatus).toString(\"hex\");\n    },\n\n    generateSeedFragment: async (): Promise<string> => {\n      logger.info(`[device] generateSeedFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x00, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    generateWrappingKeyFragment: async (): Promise<string> => {\n      logger.info(`[device] generateWrappingKeyFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x01, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    getAttestation: async (): Promise<{\n      attestation: {\n        codeHash: string;\n        attestationPub: string;\n        certificate: string;\n      };\n      buffer: Buffer;\n    }> => {\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n      const buffer = removeStatus(bufWithStatus);\n      const certLen = buffer.readInt8(32 + 65 + 1);\n      return {\n        attestation: {\n          codeHash: buffer.slice(0, 32).toString(\"base64\"),\n          attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n          certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n        },\n        buffer,\n      };\n    },\n    getConfidentialityKey: async () => {\n      logger.info(`[device] getConfidentialityKey`);\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n      const buf = removeStatus(bufWithStatus);\n      const keyLength = buf[0]!;\n      const key = buf.slice(1, 1 + keyLength);\n      const sig = buf.slice(1 + keyLength + 1);\n      return {\n        confidentialityKeyCurve25519: key.toString(\"hex\"),\n        confidentialityKeySignature: sig.toString(\"hex\"),\n      };\n    },\n    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n    getDeviceUserId: async (): Promise<string> => {\n      logger.info(`[device] getDeviceUserId`);\n      const response = await run((transport) => transport.send(0xe0, 0x52, 0x00, 0x00));\n      return removeStatus(response).toString(\"hex\").toUpperCase();\n    },\n    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n    hasPairing: async () => {\n      logger.info(`[device] hasPairing`);\n      const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n      const hex = Buffer.from(res).toString(\"hex\");\n\n      // 6f45 => this error means that there is no partition ID on the device\n      // if no error, it means there is (at least) one\n      //\n      // 6a87 => TEMPORARY hack because Stax apparently does not implement\n      //         the \"get partition id\" APDU, so it returns \"incorrect length\"\n      //         easier to just assume that in this case there is no partition,\n      //         and try to insert one anyway (done on revault onboarding)\n      //\n      return hex !== \"6f45\" && hex !== \"6a87\";\n    },\n\n    initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n      const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n      const pubKeyLength = res.readInt8(0);\n      const pubKey = res\n        .slice(1, pubKeyLength + 1)\n        .toString(\"hex\")\n        .toUpperCase();\n      const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n      return { pubKey, signature };\n    },\n\n    openSession: async (params: {\n      secureChannel: { pubKey: PubKey; certificate: HsmCertificate };\n    }): Promise<void> => {\n      logger.info(`[device] openSession`);\n      const { secureChannel } = params;\n\n      const path = getPathFromPathString(PATHS.CONFIDENTIALITY);\n      const dataDerivation = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      const pubKey = Buffer.from(secureChannel.pubKey, \"hex\");\n\n      const sigBuffer = Buffer.from(secureChannel.certificate.signature, \"base64\");\n      const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, \"base64\");\n      const certBuffer = Buffer.from(secureChannel.certificate.certificate, \"base64\");\n      const attestation = Buffer.concat([\n        Buffer.from([sigBuffer.length]),\n        sigBuffer,\n        attestationPubBuffer,\n        Buffer.from([certBuffer.length]),\n        certBuffer,\n      ]);\n\n      const lengthAttestation = Buffer.alloc(2);\n      lengthAttestation.writeUInt16BE(attestation.length, 0);\n\n      const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);\n\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x42, 0x00, SCRIPT_IDS.INIT_SESSION], data),\n      );\n    },\n\n    register: async (params: {\n      challenge: string;\n      u2fRegisterData: string;\n      name: string;\n      role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n    }): Promise<{\n      u2fRegister: Buffer;\n      keyHandle: Buffer;\n      rfu: number;\n      pubKey: string;\n    }> => {\n      const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n      const userNameBuff = Buffer.from(name);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([userNameBuff.length]),\n        userNameBuff,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n      const response = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n      );\n\n      let i = 0;\n      const rfu = response.slice(i, i + 1)[0]!;\n      i += 1;\n      const pubKey = response.slice(i, i + 65).toString(\"hex\");\n      i += 65;\n      const keyHandleLength = response.slice(i, i + 1)[0]!;\n      i++;\n      const keyHandle = response.slice(i, i + keyHandleLength);\n      i += keyHandleLength;\n      return {\n        u2fRegister: removeStatus(response),\n        keyHandle,\n        rfu,\n        pubKey,\n      };\n    },\n    registerData: async (params: { challenge: string }): Promise<string> => {\n      const { challenge: strChallenge } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n      return removeStatus(response).toString(\"hex\");\n    },\n\n    setPairing: async ({ pairing }) => {\n      logger.info(`[device] setPairing`);\n      const psdPayload = Buffer.from(pairing.blob, \"base64\");\n      const length = Buffer.alloc(2);\n      length.writeUInt16BE(psdPayload.length, 0);\n      const final = Buffer.concat([length, psdPayload]);\n      await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n    },\n    startKKPatternAsResponder: async (params: {\n      handshake: string;\n      handshakeAttestation: HsmCertificate;\n      partitionId: string;\n    }): Promise<{ handshake: string; signature: string }> => {\n      logger.info(`[device] startKKPatternAsResponder`);\n      const data = buildAttestation(params);\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x4c, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n      const buffer = removeStatus(bufWithStatus);\n      const dataLength = buffer.readInt8(0);\n      return {\n        handshake: buffer.slice(1, dataLength + 1).toString(\"base64\"),\n        signature: buffer.slice(dataLength + 1).toString(\"base64\"),\n      };\n    },\n    startKPatternAsResponder: async (params) => {\n      logger.info(`[device] startKPatternAsResponder`);\n      const data = buildAttestation(params);\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n    },\n    validateVaultOperation: async (params) => {\n      logger.info(`[device] validateVaultOperation`);\n      const path = getPathFromPathString(PATHS.VALIDATION);\n      const paths = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      let nextActionId = 1;\n      let finalResponse: Buffer | null = null;\n\n      while (!finalResponse) {\n        const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n        const length = Buffer.alloc(2);\n        length.writeUInt16BE(screen.length, 0);\n        const data = Buffer.concat([paths, length, screen]);\n        const response = await run((transport) =>\n          sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n        );\n        const responseType = response.readInt8(0);\n        let responseStatus = response.readUInt16BE(response.length - 2);\n        switch (responseType) {\n          case STREAMING_NEXT_ACTION:\n            nextActionId = response.readUIntBE(1, 2);\n            break;\n          case STREAMING_RESPONSE:\n            finalResponse = response.slice(3, response.length - 2);\n            while (responseStatus !== 0x9000) {\n              /* v8 ignore next -- @preserve */ {\n                const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n                responseStatus = resp.readUInt16BE(resp.length - 2);\n                finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n              }\n            }\n            break;\n          /* v8 ignore next -- @preserve */\n          default:\n            throw new Error(`Invalid response type: ${responseType}`);\n        }\n      }\n      return finalResponse.toString(\"base64\");\n    },\n\n    sendAPDU: async (apduCommand: string) => {\n      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n      return Buffer.from(res).toString(\"hex\");\n    },\n    getVersion: async () => {\n      const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n      const appNameLen = res.readInt8(1);\n      const appVersionLen = res.readInt8(2 + appNameLen);\n      const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n      const appVersion = Buffer.from(appVersionHex).toString();\n\n      return appVersion;\n    },\n    poll,\n    pollApp,\n  };\n  return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n  baseUrl: string;\n  debugAuthToken?: string;\n  rootAuthToken?: string;\n  apiAccessToken?: string;\n  psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport type TRPCContext = { context: Record<string, unknown> } | undefined;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n  const trpc = createTRPCClient<AppRouter>({\n    links: [\n      httpLink({\n        url: `${options.baseUrl}/trpc`,\n        transformer: superjson,\n        headers(opts) {\n          // Extract headers from the operation context\n          const contextHeaders = (opts.op.context?.headers as Record<string, string>) || {};\n\n          return {\n            ...(options.debugAuthToken\n              ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n              : {}),\n            ...(options.rootAuthToken\n              ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n              : {}),\n            ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n            ...(options.apiAccessToken\n              ? { Authorization: `Bearer ${options.apiAccessToken}` }\n              : {}),\n            // Merge in any headers passed via context\n            ...contextHeaders,\n          };\n        },\n      }),\n    ],\n  });\n  return trpc;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAYA,OAAOA,gBAAe;;;ACTtB,OAAO,eAAe;AACtB,SAAS,MAAM,qBAAqB;AAkBpC,IAAM,mBAAmB;AAMzB,IAAM,wBAAwB,CAAC,eAAiC;AAC9D,QAAM,QAAQ,WAAW,MAAM,IAAI,EAAE,IAAI,CAAC,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC;AAC5E,SAAO,MAAM,IAAI,CAAC,UAAU,OAAO,gBAAgB,CAAC;AACtD;AAEA,IAAM,cAAc,CAAC,OAAe,WAA6B;AAC/D,QAAM,SAAS,CAAC;AAChB,WAAS,IAAI,GAAG,OAAO,OAAO,IAAI,OAAO,QAAQ,KAAK,MAAM,OAAO,OAAO;AACxE,WAAO,KAAK,OAAO,MAAM,GAAG,IAAI,IAAI,CAAC;AAAA,EACvC;AACA,SAAO;AACT;AAEA,IAAM,eAAe,CAAC,WAA2B,OAAO,MAAM,GAAG,OAAO,SAAS,aAAa;AAE9F,IAAM,cAAc,OAClB,WACA,SACA,MACA,YAAoB,qBACA;AACpB,QAAM,SAAS,YAAY,WAAW,IAAI;AAC1C,MAAI,WAAW,OAAO,KAAK,CAAC,CAAC;AAC7B,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,QAAQ,OAAO,CAAC;AACtB,UAAM,OAAO,CAAC,GAAG,OAAO;AAGxB,SAAK,CAAC,IAAI,KAAK;AACf,eAAY,MAAM,UAAU,KAAK,KAAK,CAAC,GAAI,KAAK,CAAC,GAAI,KAAK,CAAC,GAAG,KAAK,CAAC,GAAI,OAAO;AAAA,MAC7E;AAAA,MACA,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB,CAAC,WAIZ;AACZ,QAAM,YAAY,OAAO,KAAK,OAAO,qBAAqB,WAAW,QAAQ;AAC7E,QAAM,kBAAkB,OAAO,MAAM,CAAC;AACtC,kBAAgB,YAAY,UAAU,QAAQ,GAAG,CAAC;AAElD,QAAM,aAAa,OAAO,KAAK,OAAO,qBAAqB,aAAa,QAAQ;AAChF,QAAM,mBAAmB,OAAO,MAAM,CAAC;AACvC,mBAAiB,YAAY,WAAW,QAAQ,GAAG,CAAC;AAEpD,QAAM,YAAY,OAAO,KAAK,OAAO,qBAAqB,gBAAgB,QAAQ;AAElF,QAAM,gBAAgB,OAAO,OAAO;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,eAAe,OAAO,KAAK,OAAO,WAAW,KAAK;AACxD,QAAM,qBAAqB,OAAO,MAAM,CAAC;AACzC,qBAAmB,YAAY,aAAa,QAAQ,GAAG,CAAC;AAExD,QAAM,YAAY,OAAO,KAAK,OAAO,aAAa,KAAK;AACvD,QAAM,kBAAkB,OAAO,MAAM,CAAC;AACtC,kBAAgB,YAAY,UAAU,QAAQ,GAAG,CAAC;AAElD,QAAM,0BAA0B,OAAO,MAAM,CAAC;AAC9C,0BAAwB,cAAc,cAAc,QAAQ,CAAC;AAE7D,QAAM,OAAO,OAAO,OAAO;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,oBAAoB,OAAO,MAAM,CAAC;AACxC,oBAAkB,cAAc,KAAK,QAAQ,CAAC;AAE9C,QAAM,SAAS,OAAO,OAAO,CAAC,mBAAmB,IAAI,CAAC;AAEtD,SAAO;AACT;AAIA,IAAM,sBAAoC,CAAC,QAAQ;AAEjD,MAAI,eAAe,kBAAmB,QAAO;AAE7C,MAAI,uBAAuB,GAAG,KAAK,IAAI,eAAe,MAAQ,QAAO;AAErE,MAAI,eAAe,mBAAoB,QAAO;AAG9C,SAAO;AACT;AAEO,SAAS,iBAAiB,SAAkB,QAAwB;AACzE,QAAM,EAAE,YAAY,IAAI;AAExB,iBAAe,IACb,KACA,eAA6B,qBACjB;AACZ,WAAO;AAAA,MACL,kBAAkB,WAAW,EAAK,CAAC,cAAc,KAAK,IAAI,SAAS,CAAC,GAAG,YAAY;AAAA,IACrF;AAAA,EACF;AAGA,QAAM,UAAU,MAAe;AAE/B,QAAM,cAAc,MAAe;AACnC,QAAM,OAAO,OACX,OAAwC,CAAC,MACH;AAEtC,UAAM;AAAA;AAAA,MAEJ,OAAO,eAAe;AAAA,MAAC;AAAA,MACvB,KAAK,gBAAgB;AAAA,IACvB;AAEA,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,EAAE,WAAW,MAAM,cAAc,QAAQ,CAAC;AACxE,aAAO,EAAE,aAAa,KAAK;AAAA,IAC7B,SAAS,KAAK;AACZ,UAAI,uBAAuB,GAAG,KAAK,oBAAoB,GAAG,GAAG;AAC3D,eAAO,EAAE,aAAa,MAAM;AAAA,MAC9B;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,YAAqC;AAC1D,UAAM,MAAM,MAAM;AAAA,MAAI,CAAC,cACrB,UAAU,KAAK,KAAM,KAAM,GAAM,GAAM,OAAO,KAAK,SAAS,MAAM,CAAC;AAAA,IACrE;AAEA,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAC3C,WAAO,IAAI,SAAS,KAAK;AAAA,EAC3B;AAEA,QAAM,eAAe,OACnB,YACA,EAAE,WAAW,aAAa,MACyB;AACnD,WAAO,KAAK,0BAA0B,UAAU,GAAG;AACnD,UAAM,OAAO,sBAAsB,UAAU;AAC7C,UAAM,OAAO,OAAO,OAAO;AAAA,MACzB,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,MACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,cAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,YAAI,cAAc,YAAY,CAAC;AAC/B,eAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AACD,UAAM,QAAQ,YAAY,IAAO;AACjC,UAAM,WAAW,MAAM;AAAA,MACrB,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,OAAO,GAAM,IAAI;AAAA,MAC3D,gBAAgB;AAAA,IAClB;AACA,UAAM,eAAe,SAAS,SAAS,CAAC;AACxC,UAAM,SAAS,SACZ,MAAM,GAAG,eAAe,CAAC,EACzB,SAAS,KAAK,EACd,YAAY;AACf,UAAM,YAAY,SACf,MAAM,eAAe,GAAG,SAAS,SAAS,aAAa,EACvD,SAAS,QAAQ;AACpB,WAAO,EAAE,QAAQ,UAAU;AAAA,EAC7B;AAEA,QAAM,SAAiB;AAAA,IACrB,cAAc,OAAO,EAAE,WAAW,EAAE,WAAW,MAAM,MAAM,UAAU,GAAG,cAAc,MAAM;AAC1F,aAAO,KAAK,uBAAuB;AACnC,gBAAU,SAAS,qBAAqB,kDAAkD;AAC1F,YAAM,oBAAoB,OAAO,KAAK,2BAA2B,KAAK;AACtE,YAAM,aAAa,OAAO,KAAK,IAAI;AACnC,YAAM,kBAAkB,OAAO,KAAK,aAAa;AAEjD,YAAM,gBAAgB,OAAO,OAAO;AAAA,QAClC,OAAO,KAAK,UAAU,IAAI,GAAG,KAAK;AAAA,QAClC,OAAO,KAAK,CAAC,WAAW,MAAM,CAAC;AAAA,QAC/B;AAAA,QACA,OAAO,KAAK,CAAC,gBAAgB,MAAM,CAAC;AAAA,QACpC;AAAA,MACF,CAAC;AAED,YAAM,sBAAsB,OAAO,MAAM,CAAC;AAC1C,0BAAoB,cAAc,cAAc,QAAQ,CAAC;AAEzD,YAAM,OAAO,OAAO,OAAO;AAAA,QACzB,OAAO,KAAK,WAAW,QAAQ;AAAA,QAC/B;AAAA,QACA,OAAO,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,QAC9B,OAAO,KAAK,WAAW,KAAK;AAAA,QAC5B;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,iBAAiB,MAAM;AAAA,QAAI,CAAC,cAChC,YAAY,WAAW,CAAC,KAAM,GAAM,GAAM,CAAI,GAAG,IAAI;AAAA,MACvD;AAEA,aAAO,aAAa,cAAc,EAAE,SAAS,KAAK;AAAA,IACpD;AAAA,IAEA,0BAA0B,OAAO,WAIV;AACrB,YAAM,gBAAgB,MAAM;AAAA,QAAI,CAAC,cAC/B,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,CAAI,GAAG,iBAAiB,MAAM,CAAC;AAAA,MAC3E;AACA,aAAO,aAAa,aAAa,EAAE,SAAS,KAAK;AAAA,IACnD;AAAA,IAEA,sBAAsB,YAA6B;AACjD,aAAO,KAAK,+BAA+B;AAC3C,YAAM,OAAO,sBAAsB,MAAM,YAAY;AACrD,YAAM,OAAO,OAAO,OAAO;AAAA,QACzB,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,QACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,gBAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,cAAI,cAAc,YAAY,CAAC;AAC/B,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AACD,YAAM,WAAW,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,GAAM,IAAI,CAAC;AACtF,aAAO,aAAa,QAAQ,EAAE,SAAS,QAAQ;AAAA,IACjD;AAAA,IACA,6BAA6B,YAA6B;AACxD,aAAO,KAAK,sCAAsC;AAClD,YAAM,OAAO,sBAAsB,MAAM,YAAY;AACrD,YAAM,OAAO,OAAO,OAAO;AAAA,QACzB,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,QACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,gBAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,cAAI,cAAc,YAAY,CAAC;AAC/B,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AACD,YAAM,WAAW,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,GAAM,IAAI,CAAC;AACtF,aAAO,aAAa,QAAQ,EAAE,SAAS,QAAQ;AAAA,IACjD;AAAA,IACA,gBAAgB,YAOV;AACJ,YAAM,gBAAgB,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC;AACrF,YAAM,SAAS,aAAa,aAAa;AACzC,YAAM,UAAU,OAAO,SAAS,KAAK,KAAK,CAAC;AAC3C,aAAO;AAAA,QACL,aAAa;AAAA,UACX,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,SAAS,QAAQ;AAAA,UAC/C,gBAAgB,OAAO,MAAM,IAAI,KAAK,EAAE,EAAE,SAAS,QAAQ;AAAA,UAC3D,aAAa,OAAO,MAAM,KAAK,IAAI,KAAK,KAAK,IAAI,OAAO,EAAE,SAAS,QAAQ;AAAA,QAC7E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,uBAAuB,YAAY;AACjC,aAAO,KAAK,gCAAgC;AAC5C,YAAM,gBAAgB,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC;AACrF,YAAM,MAAM,aAAa,aAAa;AACtC,YAAM,YAAY,IAAI,CAAC;AACvB,YAAM,MAAM,IAAI,MAAM,GAAG,IAAI,SAAS;AACtC,YAAM,MAAM,IAAI,MAAM,IAAI,YAAY,CAAC;AACvC,aAAO;AAAA,QACL,8BAA8B,IAAI,SAAS,KAAK;AAAA,QAChD,6BAA6B,IAAI,SAAS,KAAK;AAAA,MACjD;AAAA,IACF;AAAA,IACA,0BAA0B,MAAM,aAAa,MAAM,iBAAiB,EAAE,WAAW,KAAK,CAAC;AAAA,IACvF,iBAAiB,YAA6B;AAC5C,aAAO,KAAK,0BAA0B;AACtC,YAAM,WAAW,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC;AAChF,aAAO,aAAa,QAAQ,EAAE,SAAS,KAAK,EAAE,YAAY;AAAA,IAC5D;AAAA,IACA,cAAc,MAAM,aAAa,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AAAA,IAChE,qBAAqB,MAAM,aAAa,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAAA,IAC7E,YAAY,YAAY;AACtB,aAAO,KAAK,qBAAqB;AACjC,YAAM,OAAO,CAAC,KAAM,IAAM,GAAM,GAAM,GAAI;AAC1C,YAAM,MAAM,MAAM,IAAI,CAAC,cAAc,UAAU,SAAS,OAAO,KAAK,IAAI,CAAC,CAAC;AAC1E,YAAM,MAAM,OAAO,KAAK,GAAG,EAAE,SAAS,KAAK;AAU3C,aAAO,QAAQ,UAAU,QAAQ;AAAA,IACnC;AAAA,IAEA,sBAAsB,YAA4D;AAChF,YAAM,MAAM,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC;AAC3E,YAAM,eAAe,IAAI,SAAS,CAAC;AACnC,YAAM,SAAS,IACZ,MAAM,GAAG,eAAe,CAAC,EACzB,SAAS,KAAK,EACd,YAAY;AACf,YAAM,YAAY,IAAI,MAAM,eAAe,GAAG,IAAI,SAAS,aAAa,EAAE,SAAS,QAAQ;AAC3F,aAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IAEA,aAAa,OAAO,WAEC;AACnB,aAAO,KAAK,sBAAsB;AAClC,YAAM,EAAE,cAAc,IAAI;AAE1B,YAAM,OAAO,sBAAsB,MAAM,eAAe;AACxD,YAAM,iBAAiB,OAAO,OAAO;AAAA,QACnC,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,QACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,gBAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,cAAI,cAAc,YAAY,CAAC;AAC/B,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAED,YAAM,SAAS,OAAO,KAAK,cAAc,QAAQ,KAAK;AAEtD,YAAM,YAAY,OAAO,KAAK,cAAc,YAAY,WAAW,QAAQ;AAC3E,YAAM,uBAAuB,OAAO,KAAK,cAAc,YAAY,gBAAgB,QAAQ;AAC3F,YAAM,aAAa,OAAO,KAAK,cAAc,YAAY,aAAa,QAAQ;AAC9E,YAAM,cAAc,OAAO,OAAO;AAAA,QAChC,OAAO,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,QAC9B;AAAA,QACA;AAAA,QACA,OAAO,KAAK,CAAC,WAAW,MAAM,CAAC;AAAA,QAC/B;AAAA,MACF,CAAC;AAED,YAAM,oBAAoB,OAAO,MAAM,CAAC;AACxC,wBAAkB,cAAc,YAAY,QAAQ,CAAC;AAErD,YAAM,OAAO,OAAO,OAAO,CAAC,gBAAgB,QAAQ,mBAAmB,WAAW,CAAC;AAEnF,YAAM;AAAA,QAAI,CAAC,cACT,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,WAAW,YAAY,GAAG,IAAI;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,UAAU,OAAO,WAUX;AACJ,YAAM,EAAE,WAAW,cAAc,iBAAiB,GAAG,MAAM,KAAK,IAAI;AACpE,YAAM,YAAY,OAAO,KAAK,cAAc,KAAK;AAEjD,gBAAU,UAAU,WAAW,IAAI,4CAA4C;AAC/E,YAAM,iBAAiB,OAAO,KAAK,2BAA2B,KAAK;AACnE,gBAAU,eAAe,WAAW,IAAI,8CAA8C;AAEtF,YAAM,eAAe,OAAO,KAAK,IAAI;AAErC,YAAM,gBAAgB,OAAO,OAAO;AAAA,QAClC,OAAO,KAAK,UAAU,IAAI,GAAG,KAAK;AAAA,QAClC,OAAO,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,QACjC;AAAA,MACF,CAAC;AAED,YAAM,sBAAsB,OAAO,MAAM,CAAC;AAC1C,0BAAoB,cAAc,cAAc,QAAQ,CAAC;AAEzD,YAAM,OAAO,OAAO,OAAO,CAAC,WAAW,gBAAgB,qBAAqB,aAAa,CAAC;AAE1F,YAAM,WAAW,MAAM;AAAA,QAAI,CAAC,cAC1B,YAAY,WAAW,CAAC,KAAM,GAAM,GAAM,CAAI,GAAG,IAAI;AAAA,MACvD;AAEA,UAAI,IAAI;AACR,YAAM,MAAM,SAAS,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;AACtC,WAAK;AACL,YAAM,SAAS,SAAS,MAAM,GAAG,IAAI,EAAE,EAAE,SAAS,KAAK;AACvD,WAAK;AACL,YAAM,kBAAkB,SAAS,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;AAClD;AACA,YAAM,YAAY,SAAS,MAAM,GAAG,IAAI,eAAe;AACvD,WAAK;AACL,aAAO;AAAA,QACL,aAAa,aAAa,QAAQ;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc,OAAO,WAAmD;AACtE,YAAM,EAAE,WAAW,aAAa,IAAI;AACpC,YAAM,YAAY,OAAO,KAAK,cAAc,KAAK;AACjD,gBAAU,UAAU,WAAW,IAAI,4CAA4C;AAC/E,YAAM,WAAW,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,GAAM,GAAM,GAAM,SAAS,CAAC;AAC3F,aAAO,aAAa,QAAQ,EAAE,SAAS,KAAK;AAAA,IAC9C;AAAA,IAEA,YAAY,OAAO,EAAE,QAAQ,MAAM;AACjC,aAAO,KAAK,qBAAqB;AACjC,YAAM,aAAa,OAAO,KAAK,QAAQ,MAAM,QAAQ;AACrD,YAAM,SAAS,OAAO,MAAM,CAAC;AAC7B,aAAO,cAAc,WAAW,QAAQ,CAAC;AACzC,YAAM,QAAQ,OAAO,OAAO,CAAC,QAAQ,UAAU,CAAC;AAChD,YAAM,IAAI,CAAC,cAAc,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,CAAI,GAAG,KAAK,CAAC;AAAA,IAClF;AAAA,IACA,2BAA2B,OAAO,WAIuB;AACvD,aAAO,KAAK,oCAAoC;AAChD,YAAM,OAAO,iBAAiB,MAAM;AACpC,YAAM,gBAAgB,MAAM;AAAA,QAAI,CAAC,cAC/B,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,WAAW,uBAAuB,GAAG,IAAI;AAAA,MACrF;AACA,YAAM,SAAS,aAAa,aAAa;AACzC,YAAM,aAAa,OAAO,SAAS,CAAC;AACpC,aAAO;AAAA,QACL,WAAW,OAAO,MAAM,GAAG,aAAa,CAAC,EAAE,SAAS,QAAQ;AAAA,QAC5D,WAAW,OAAO,MAAM,aAAa,CAAC,EAAE,SAAS,QAAQ;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,0BAA0B,OAAO,WAAW;AAC1C,aAAO,KAAK,mCAAmC;AAC/C,YAAM,OAAO,iBAAiB,MAAM;AACpC,YAAM;AAAA,QAAI,CAAC,cACT,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,WAAW,uBAAuB,GAAG,IAAI;AAAA,MACrF;AAAA,IACF;AAAA,IACA,wBAAwB,OAAO,WAAW;AACxC,aAAO,KAAK,iCAAiC;AAC7C,YAAM,OAAO,sBAAsB,MAAM,UAAU;AACnD,YAAM,QAAQ,OAAO,OAAO;AAAA,QAC1B,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC;AAAA,QACzB,GAAG,KAAK,IAAI,CAAC,eAAe;AAC1B,gBAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,cAAI,cAAc,YAAY,CAAC;AAC/B,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAED,UAAI,eAAe;AACnB,UAAI,gBAA+B;AAEnC,aAAO,CAAC,eAAe;AACrB,cAAM,SAAS,OAAO,KAAK,OAAO,QAAQ,eAAe,CAAC,GAAI,QAAQ;AACtE,cAAM,SAAS,OAAO,MAAM,CAAC;AAC7B,eAAO,cAAc,OAAO,QAAQ,CAAC;AACrC,cAAM,OAAO,OAAO,OAAO,CAAC,OAAO,QAAQ,MAAM,CAAC;AAClD,cAAM,WAAW,MAAM;AAAA,UAAI,CAAC,cAC1B,YAAY,WAAW,CAAC,KAAM,IAAM,GAAM,CAAI,GAAG,IAAI;AAAA,QACvD;AACA,cAAM,eAAe,SAAS,SAAS,CAAC;AACxC,YAAI,iBAAiB,SAAS,aAAa,SAAS,SAAS,CAAC;AAC9D,gBAAQ,cAAc;AAAA,UACpB,KAAK;AACH,2BAAe,SAAS,WAAW,GAAG,CAAC;AACvC;AAAA,UACF,KAAK;AACH,4BAAgB,SAAS,MAAM,GAAG,SAAS,SAAS,CAAC;AACrD,mBAAO,mBAAmB,OAAQ;AACE;AAChC,sBAAM,OAAO,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,GAAM,KAAM,GAAM,CAAI,CAAC;AAC5E,iCAAiB,KAAK,aAAa,KAAK,SAAS,CAAC;AAClD,gCAAgB,OAAO,OAAO,CAAC,eAAe,aAAa,IAAI,CAAC,CAAC;AAAA,cACnE;AAAA,YACF;AACA;AAAA;AAAA,UAEF;AACE,kBAAM,IAAI,MAAM,0BAA0B,YAAY,EAAE;AAAA,QAC5D;AAAA,MACF;AACA,aAAO,cAAc,SAAS,QAAQ;AAAA,IACxC;AAAA,IAEA,UAAU,OAAO,gBAAwB;AACvC,YAAM,MAAM,MAAM,IAAI,CAAC,cAAc,UAAU,SAAS,OAAO,KAAK,aAAa,KAAK,CAAC,CAAC;AACxF,aAAO,OAAO,KAAK,GAAG,EAAE,SAAS,KAAK;AAAA,IACxC;AAAA,IACA,YAAY,YAAY;AACtB,YAAM,MAAM,MAAM,IAAI,CAAC,cAAc,UAAU,KAAK,KAAM,GAAM,GAAM,CAAI,CAAC;AAC3E,YAAM,aAAa,IAAI,SAAS,CAAC;AACjC,YAAM,gBAAgB,IAAI,SAAS,IAAI,UAAU;AACjD,YAAM,gBAAgB,IAAI,MAAM,IAAI,IAAI,YAAY,IAAI,aAAa,gBAAgB,CAAC;AAEtF,YAAM,aAAa,OAAO,KAAK,aAAa,EAAE,SAAS;AAEvD,aAAO;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO;AACT;;;AC9hBA,SAAS,kBAAkB,gBAAiC;AAE5D,OAAO,eAAe;AAiBf,IAAM,eAAe,CAAC,YAAqD;AAChF,QAAM,OAAO,iBAA4B;AAAA,IACvC,OAAO;AAAA,MACL,SAAS;AAAA,QACP,KAAK,GAAG,QAAQ,OAAO;AAAA,QACvB,aAAa;AAAA,QACb,QAAQ,MAAM;AAEZ,gBAAM,iBAAkB,KAAK,GAAG,SAAS,WAAsC,CAAC;AAEhF,iBAAO;AAAA,YACL,GAAI,QAAQ,iBACR,EAAE,8BAA8B,QAAQ,eAAe,IACvD,CAAC;AAAA,YACL,GAAI,QAAQ,gBACR,EAAE,6BAA6B,QAAQ,cAAc,IACrD,CAAC;AAAA,YACL,GAAI,QAAQ,UAAU,EAAE,eAAe,WAAW,QAAQ,OAAO,GAAG,IAAI,CAAC;AAAA,YACzE,GAAI,QAAQ,iBACR,EAAE,eAAe,UAAU,QAAQ,cAAc,GAAG,IACpD,CAAC;AAAA;AAAA,YAEL,GAAG;AAAA,UACL;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACD,SAAO;AACT;;;AFHA,eAAe,gBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAae;AACb,QAAM,CAAC,aAAa,WAAW,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACrE,OAAO,eAAe;AAAA,IACtB,OAAO,aAAa;AAAA,IACpB,OAAO,yBAAyB;AAAA,EAClC,CAAC;AACD,QAAM,kBAAkB,MAAM,OAAO,qBAAqB;AAC1D,QAAM,aAAyC;AAAA,IAC7C;AAAA,IACA,QAAQ,UAAU;AAAA,IAClB,UAAU;AAAA,IACV,oBAAoB,mBAAmB;AAAA,IACvC,iBAAiB,gBAAgB;AAAA,IACjC,4BAA4B;AAAA,MAC1B,GAAG,YAAY;AAAA,MACf,WAAW,gBAAgB;AAAA,IAC7B;AAAA,EACF;AACA,QAAM,YAAY,MAAM,aAAa,EAAE,QAAQ,UAAU,QAAQ,WAAW,CAAC;AAC7E,QAAM,iBAAiB,MAAM,OAAO,yBAAyB;AAAA,IAC3D,WAAW,UAAU;AAAA,IACrB,aAAa,UAAU;AAAA,IACvB,sBAAsB,UAAU;AAAA,EAClC,CAAC;AACD,QAAM,oBAAoB;AAC1B,QAAM,WAAW,MAAM,OAAO,SAAS;AAAA,IACrC,WAAW,UAAU;AAAA,IACrB,iBAAiB,UAAU;AAAA,IAC3B;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,mBAAmB,MAAM,OAAO,oBAAoB;AAC1D,QAAM,eAAe,MAAM,OAAO,aAAa,EAAE,WAAW,UAAU,UAAU,CAAC;AACjF,QAAM,oBAAoB,KAAK,SAAS,YAAY,SAAS,EAAE;AAC/D,QAAM,cAAc,OAAO,OAAO;AAAA,IAChC,SAAS,YAAY,MAAM,GAAG,iBAAiB;AAAA,IAC/C,OAAO,KAAK,CAAC,YAAY,OAAO,MAAM,CAAC;AAAA,IACvC,YAAY;AAAA,IACZ,SAAS,YAAY,MAAM,iBAAiB;AAAA,EAC9C,CAAC,EAAE,SAAS,KAAK;AACjB,QAAM,oBAAuD;AAAA,IAC3D;AAAA,IACA,aAAa;AAAA,MACX,GAAG,YAAY;AAAA,MACf,WAAW,iBAAiB;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,cAAc,SAAS,UAAU,SAAS,KAAK;AAAA,IAC/C,eAAe,iBAAiB;AAAA,IAChC;AAAA,EACF;AACA,SAAO,gBAAgB,EAAE,QAAQ,UAAU,QAAQ,kBAAkB,CAAC;AACxE;AAEO,SAAS,aAAa,SAAwB,QAAwB;AAC3E,QAAM,gBAAmC;AAAA,IACvC,SAAS,QAAQ;AAAA,EACnB;AACA,QAAM,SAAS,aAAa,aAAa;AACzC,QAAM,YAAY,gBAAgB,SAAS,MAAM;AAEjD,QAAM,OAAmB;AAAA,IACvB;AAAA,IACA,cAAc,CAAC,cAAc,aAAa,EAAE,GAAG,eAAe,GAAG,UAAU,CAAC;AAAA,IAC5E,WAAW;AAAA,EACb;AAEA,QAAM,kBAA6C,SAEjD,aACA;AACA,UAAM,SAAS,UAAU,KAAK,WAAW;AACzC,UAAM,UAAsB,EAAE,OAAO;AACrC,WAAO,eAAe,EAAE,GAAG,MAAM,GAAG,QAAQ,CAA2B;AAAA,EACzE;AAEA,QAAM,kBAA6C,SAEjD,aACA;AACA,UAAM,SAAS,iBAAiB,EAAE,YAAY,GAAG,MAAM;AACvD,UAAM,UAAsB,EAAE,OAAO;AACrC,WAAO,eAAe,EAAE,GAAG,MAAM,GAAG,QAAQ,CAA2B;AAAA,EACzE;AAEA,QAAM,cAAqC,WAA8B;AACvE,UAAMC,eAA2B,EAAE,aAAa,KAAK;AACrD,WAAO,eAAe,EAAE,GAAG,MAAM,GAAGA,aAAY,CAA4B;AAAA,EAC9E;AAEA,QAAM,gBAAyC,SAE7C,eACA;AACA,UAAMC,iBAA+B,EAAE,iBAAiB,cAAc;AACtE,WAAO,eAAe,EAAE,GAAG,MAAM,GAAGA,eAAc,CAA8B;AAAA,EAClF;AAEA,QAAM,iBAA2C,SAE/C,cACA;AACA,UAAMC,kBAAiC,EAAE,gBAAgB,aAAa;AACtE,WAAO,eAAe,EAAE,GAAG,MAAM,GAAGA,gBAAe,CAA+B;AAAA,EACpF;AAEA,WAAS,eACP,QAMW;AACX,aAAS,SACP,WACM;AACN,aAAO,OAAO,QAAQ,UAAU,MAAgC,CAAC;AAAA,IACnE;AAIA,QAAI,OAAO,QAAQ;AACjB;AAAA,QACE,CAACC,aACE;AAAA,UACC,eAAe,YAA+B;AAC5C,kBAAM,EAAE,QAAQ,QAAAC,QAAO,IAAID;AAC3B,kBAAM,EAAE,OAAO,IAAI,MAAM,OAAO,aAAa;AAC7C,kBAAM,EAAE,eAAe,IAAI,MAAMC,QAAO,KAAK,IAAI,mBAAmB,MAAM,EAAE,OAAO,CAAC;AACpF,mBAAO;AAAA,UACT;AAAA,UAEA,qBAAqB,YAEhB;AACH,kBAAM,EAAE,QAAQ,QAAAA,QAAO,IAAID;AAC3B,kBAAM,EAAE,OAAO,IAAI,MAAM,OAAO,aAAa;AAC7C,kBAAM,EAAE,WAAW,IAAI,MAAMC,QAAO,KAAK,IAAI,eAAe,MAAM,EAAE,OAAO,CAAC;AAC5E,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACJ;AAAA,IACF;AAIA,QAAI,OAAO,mBAAmB,CAAC,OAAO,cAAc,CAAC,OAAO,WAAW;AACrE,eAAiE,CAACD,YAAW;AAC3E,cAAM,EAAE,gBAAgB,IAAIA;AAC5B,eAAO;AAAA,UACL,cAAc,SAA8B,OAAwC;AAClF,kBAAM,cAA2B,EAAE,YAAY,MAAM;AACrD,kBAAM,UAAU,GAAG,eAAe,IAAI,KAAK;AAC3C,kBAAMC,UAASD,QAAO,aAAa,EAAE,QAAQ,CAAC;AAC9C,mBAAO,eAAe,EAAE,GAAG,MAAM,QAAAC,SAAQ,GAAG,YAAY,CAA4B;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAIA,QAAI,OAAO,UAAU,OAAO,gBAAgB;AAC1C,eAAuE,CAACD,YAAW;AACjF,cAAM,EAAE,QAAQ,QAAAC,SAAQ,eAAe,IAAID;AAC3C,uBAAe,iBAAgC;AAC7C,cAAI,MAAM,OAAO,WAAW,EAAG;AAC/B,gBAAM,CAAC,EAAE,OAAO,GAAG,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,YACzD,OAAO,aAAa;AAAA,YACpB,OAAO,sBAAsB;AAAA,UAC/B,CAAC;AACD,gBAAM,UAAU,MAAMC,QAAO,WAAW,oBAAoB,OAAO;AAAA,YACjE;AAAA,YACA,cAAc;AAAA,YACd,MAAM;AAAA,cACJ,8BAA8B,mBAAmB;AAAA,cACjD,6BAA6B,mBAAmB;AAAA,YAClD;AAAA,UACF,CAAC;AACD,gBAAM,OAAO,WAAW,EAAE,QAAQ,CAAC;AAAA,QACrC;AACA,eAAO;AAAA,UACL,aAAa,OAAO,WAAqE;AACvF,kBAAM,EAAE,MAAM,WAAW,IAAI;AAC7B,kBAAM,CAAC,EAAE,OAAO,GAAG,EAAE,QAAQ,mBAAmB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,cACrE,OAAO,aAAa;AAAA,cACpB,OAAO,yBAAyB;AAAA,YAClC,CAAC;AACD,kBAAMA,QAAO,WAAW,YAAY,OAAO;AAAA,cACzC,cAAc;AAAA,cACd,OAAO,EAAE,MAAM,QAAQ,YAAY,mBAAmB;AAAA,YACxD,CAAC;AAAA,UACH;AAAA,UAEA,4BAA4B,OAC1B,aACA,WACkB;AAClB,kBAAM,CAAC,EAAE,OAAO,GAAG,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,cACzD,OAAO,aAAa;AAAA,cACpB,OAAO,yBAAyB;AAAA,YAClC,CAAC;AACD,kBAAM,OAAO,YAAY;AAAA,cACvB,eAAe;AAAA,gBACb,QAAQ,YAAY;AAAA,gBACpB,aAAa,YAAY;AAAA,cAC3B;AAAA,YACF,CAAC;AACD,kBAAM,EAAE,YAAY,IAAI,MAAM,OAAO,eAAe;AACpD,kBAAM,QAAQ,oBAAoB;AAClC,kBAAM,OAAO,MAAM,OAAO,4BAA4B;AACtD,kBAAMA,QAAO,WAAW,0BAA0B,OAAO;AAAA,cACvD;AAAA,cACA,cAAc;AAAA,cACd,UAAU;AAAA,gBACR;AAAA,gBACA,iBAAiB,mBAAmB;AAAA,gBACpC,sBAAsB;AAAA,kBACpB,GAAG;AAAA,kBACH,WAAW,mBAAmB;AAAA,gBAChC;AAAA,cACF;AAAA,YACF,CAAC;AAAA,UACH;AAAA,UAEA,gBAAgB,OACd,gBACA,WACkB;AAClB,kBAAM,EAAE,MAAM,KAAK,IAAI;AACvB,kBAAM,uBACJ,SAAS,UACLA,QAAO,WAAW,2CAClBA,QAAO,WAAW;AACxB,kBAAM,0BACJ,SAAS,UACLA,QAAO,WAAW,gCAClBA,QAAO,WAAW;AACxB,kBAAM,gBAAgB;AAAA,cACpB;AAAA,cACA;AAAA,cACA;AAAA,cACA,cAAc,CAAC,EAAE,QAAQ,WAAW,MAClC,qBAAqB,OAAO;AAAA,gBAC1B,cAAc;AAAA,gBACd;AAAA,gBACA;AAAA,cACF,CAAC;AAAA,cACH,iBAAiB,CAAC,EAAE,QAAQ,kBAAkB,MAC5C,wBAAwB,OAAO;AAAA,gBAC7B,cAAcD,QAAO;AAAA,gBACrB;AAAA;AAAA,gBAEA,UAAU;AAAA,cACZ,CAAC;AAAA,cACH,mBAAmB,QAAQ;AAAA,YAC7B,CAAC;AAAA,UACH;AAAA,UAEA,mBAAmB,OACjB,WACA,WACkB;AAClB,kBAAM,eAAe;AACrB,kBAAM,EAAE,OAAO,IAAI,MAAM,OAAO,aAAa;AAC7C,kBAAM,OAAO,yBAAyB;AAAA,cACpC,WAAW,UAAU;AAAA,cACrB,sBAAsB,UAAU;AAAA,cAChC,aAAa,UAAU;AAAA,YACzB,CAAC;AACD,kBAAM,QAAQ,oBAAoB;AAClC,kBAAM,YAAY,MAAM,OAAO,uBAAuB;AAAA,cACpD,SAAS,UAAU;AAAA,YACrB,CAAC;AACD,kBAAMC,QAAO,WAAW,mCAAmC,OAAO;AAAA,cAChE,cAAc;AAAA,cACd;AAAA,cACA;AAAA,YACF,CAAC;AAAA,UACH;AAAA,UAEA,qBAAqB,OACnB,WACA,WACkB;AAClB,kBAAM,eAAe;AACrB,kBAAM,CAAC,EAAE,OAAO,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,cACtD,OAAO,aAAa;AAAA,cACpB,OAAO,eAAe;AAAA,YACxB,CAAC;AACD,kBAAM,OAAO,yBAAyB;AAAA,cACpC,WAAW,UAAU;AAAA,cACrB,sBAAsB,UAAU;AAAA,cAChC,aAAa,UAAU;AAAA,YACzB,CAAC;AACD,kBAAM,QAAQ,oBAAoB;AAClC,kBAAM,oBAAoB,MAAM,OAAO,uBAAuB;AAAA,cAC5D,SAAS,UAAU;AAAA,YACrB,CAAC;AACD,kBAAM,YAAY,MAAM,OAAO,0BAA0B;AAAA,cACvD,aAAa,UAAU;AAAA,cACvB,WAAW,UAAU;AAAA,cACrB,sBAAsB,UAAU;AAAA,YAClC,CAAC;AACD,kBAAM,eAAe,MAAM,OAAO,qBAAqB;AACvD,kBAAMA,QAAO,WAAW,mBAAmB,OAAO;AAAA,cAChD,cAAc;AAAA,cACd;AAAA,cACA,cAAc;AAAA,gBACZ;AAAA,gBACA;AAAA,gBACA,WAAW,UAAU;AAAA,gBACrB,sBAAsB;AAAA,kBACpB,GAAG;AAAA,kBACH,WAAW,UAAU;AAAA,gBACvB;AAAA,cACF;AAAA,YACF,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAIA,QAAI,OAAO,UAAU,OAAO,mBAAmB,CAAC,OAAO,YAAY;AACjE;AAAA,QACE,CAACD,YAAW;AACV,gBAAM,EAAE,QAAQ,QAAAC,SAAQ,gBAAgB,IAAID;AAC5C,iBAAO;AAAA,YACL,OAAO,eAEL,MAKkC;AAClC,oBAAM,EAAE,OAAO,IAAI,MAAM,OAAO,aAAa;AAC7C,oBAAM,YAAY,MAAMC,QAAO,KAAK,IAAI,kBAAkB;AAAA,gBACxD;AAAA,kBACE;AAAA,kBACA,eAAe;AAAA,gBACjB;AAAA,gBACA,iBAAiB,EAAE,eAAe,MAAM,cAAc,CAAC;AAAA,cACzD;AACA,oBAAM,MAAM,oBAAoB;AAChC,oBAAM,iBAAiB,MAAM,OAAO,aAAa;AAAA,gBAC/C;AAAA,gBACA,eAAe;AAAA,cACjB,CAAC;AACD,oBAAM,cAAc;AAAA,gBAClB,eAAe;AAAA,gBACf;AAAA,gBACA;AAAA,gBACA,aAAa,UAAU;AAAA,gBACvB,sBAAsB,MAAM;AAAA,cAC9B;AACA,oBAAM,EAAE,MAAM,IAAI,MAAMA,QAAO,KAAK,IAAI,aAAa;AAAA,gBACnD,EAAE,GAAG,YAAY;AAAA,gBACjB,iBAAiB,EAAE,eAAe,MAAM,cAAc,CAAC;AAAA,cACzD;AACA,oBAAM,cAA2B;AAAA,gBAC/B,YAAY;AAAA,cACd;AACA,oBAAM,UAAU,GAAGD,QAAO,eAAe,IAAI,KAAK;AAClD,oBAAM,eAAeA,QAAO,aAAa,EAAE,QAAQ,CAAC;AACpD,qBAAO,eAAe,EAAE,GAAG,MAAM,QAAQ,cAAc,GAAG,YAAY,CAErE;AAAA,YACH;AAAA,YAEA,UAAU,CACR,iBACsC;AACtC,qBAAO,gBAAgB;AAAA,gBACrB;AAAA,gBACA,MAAM,aAAa;AAAA,gBACnB,MAAM,aAAa;AAAA,gBACnB,cAAc,OAAO,EAAE,WAAW,MAAM;AACtC,wBAAM,YAAY,MAAMC,QAAO,kBAAkB,kBAAkB,OAAO;AAAA,oBACxE,IAAI,aAAa;AAAA,oBACjB,eAAe;AAAA,oBACf;AAAA,kBACF,CAAC;AACD,yBAAO;AAAA,gBACT;AAAA,gBACA,iBAAiB,CAAC,EAAE,kBAAkB,MACpCA,QAAO,kBAAkB,gBAAgB,OAAO;AAAA,kBAC9C,eAAe;AAAA,kBACf,IAAI,aAAa;AAAA,kBACjB;AAAA,gBACF,CAAC;AAAA,cACL,CAAC;AAAA,YACH;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,QAAI,OAAO,mBAAmB,OAAO,eAAe,CAAC,OAAO,WAAW;AACrE;AAAA,QACE,CAACD,YAAW;AACV,gBAAM,EAAE,QAAAC,SAAQ,gBAAgB,IAAID;AACpC,iBAAO;AAAA,YACL,OAAO,eAEL,aAIA,MACkC;AAClC,oBAAM,MAAM,MAAMC,QAAO,KAAK,aAAa;AAAA,gBACzC;AAAA,kBACE,UAAU,YAAY;AAAA,kBACtB,cAAc,YAAY;AAAA,kBAC1B,WAAW;AAAA,gBACb;AAAA,gBACA,iBAAiB,EAAE,eAAe,MAAM,cAAc,CAAC;AAAA,cACzD;AACA,oBAAM,cAA2B;AAAA,gBAC/B,WAAW;AAAA,cACb;AACA,oBAAM,eAAeD,QAAO,aAAa,EAAE,gBAAgB,IAAI,YAAY,CAAC;AAC5E,qBAAO,eAAe,EAAE,GAAG,MAAM,QAAQ,cAAc,GAAG,YAAY,CAErE;AAAA,YACH;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,QAAI,OAAO,UAAU,OAAO,mBAAmB,OAAO,YAAY;AAChE,eAA4E,CAACA,YAAW;AACtF,cAAM,EAAE,QAAAC,SAAQ,OAAO,IAAID;AAE3B,uBAAe,iBAAgC;AAC7C,cAAI,MAAM,OAAO,WAAW,EAAG;AAC/B,gBAAM,qBAAqB,MAAM,OAAO,sBAAsB;AAC9D,gBAAM,UAAU,MAAMC,QAAO,MAAM,oBAAoB,OAAO;AAAA,YAC5D,8BAA8B,mBAAmB;AAAA,YACjD,6BAA6B,mBAAmB;AAAA,UAClD,CAAC;AACD,gBAAM,OAAO,WAAW,EAAE,QAAQ,CAAC;AAAA,QACrC;AAEA,cAAM,mBAAmB,OACvB,WACA,WACoB;AACpB,gBAAM,eAAe;AACrB,gBAAM,OAAO,yBAAyB;AAAA,YACpC,WAAW,UAAU;AAAA,YACrB,sBAAsB,UAAU;AAAA,YAChC,aAAa,UAAU;AAAA,UACzB,CAAC;AACD,gBAAM,QAAQ,oBAAoB;AAClC,gBAAM,YAAY,MAAM,OAAO,uBAAuB;AAAA,YACpD,SAAS,UAAU;AAAA,UACrB,CAAC;AACD,iBAAO;AAAA,QACT;AAEA,eAAO;AAAA,UACL,SAAS,OACP,SACA,WACkC;AAClC,kBAAM,EAAE,UAAU,IAAI,MAAMA,QAAO,SAAS,aAAa,MAAM,EAAE,IAAI,QAAQ,GAAG,CAAC;AACjF,gBAAI,UAAU,kBAAkB,OAAO;AACrC,oBAAM,YAAY,MAAM,iBAAiB,WAAW,MAAM;AAC1D,oBAAM,QAAQ,uBAAuB;AACrC,qBAAOA,QAAO,SAAS,QAAQ;AAAA,gBAC7B;AAAA,kBACE,IAAI,QAAQ;AAAA,kBACZ,MAAM,EAAE,eAAe,OAAO,UAAU;AAAA,gBAC1C;AAAA,gBACA,iBAAiB,MAAM;AAAA,cACzB;AAAA,YACF;AACA,gBAAI,UAAU,kBAAkB,QAAQ;AACtC,qBAAOA,QAAO,SAAS,QAAQ;AAAA,gBAC7B;AAAA,kBACE,IAAI,QAAQ;AAAA,kBACZ,MAAM,EAAE,eAAe,OAAO;AAAA,gBAChC;AAAA,gBACA,iBAAiB,MAAM;AAAA,cACzB;AAAA,YACF;AACA,kBAAM,IAAI,MAAM,2CAA2C;AAAA,UAC7D;AAAA,UAEA;AAAA,UAEA,QAAQ,CACN,SACA,SACkC;AAClC,mBAAOA,QAAO,SAAS,OAAO;AAAA,cAC5B,EAAE,IAAI,QAAQ,IAAI,MAAM,KAAK;AAAA,cAC7B,iBAAiB,IAAI;AAAA,YACvB;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAIA,QAAI,OAAO,mBAAmB,OAAO,WAAW;AAC9C,eAA6E,CAACD,YAAW;AACvF,cAAM,EAAE,QAAAC,QAAO,IAAID;AACnB,eAAO;AAAA,UACL,cAAc,OAAO,YAAoE;AACvF,kBAAM,EAAE,UAAU,IAAI,MAAMC,QAAO,SAAS,aAAa,MAAM,EAAE,IAAI,QAAQ,GAAG,CAAC;AACjF,YAAAC,WAAU,UAAU,kBAAkB,OAAO,4BAA4B;AACzE,mBAAO,UAAU;AAAA,UACnB;AAAA,UAEA,SAAS,CACP,SACA,cACkC;AAClC,mBAAOD,QAAO,SAAS,QAAQ,OAAO;AAAA,cACpC,IAAI,QAAQ;AAAA,cACZ,MAAM,EAAE,eAAe,OAAO,UAAU;AAAA,YAC1C,CAAC;AAAA,UACH;AAAA,UAEA,QAAQ,CACN,SACA,cACkC;AAClC,mBAAOA,QAAO,SAAS,OAAO,OAAO;AAAA,cACnC,IAAI,QAAQ;AAAA,cACZ,MAAM,EAAE,eAAe,OAAO,UAAU;AAAA,YAC1C,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":["invariant","withApiUser","withWorkspace","withOnboarding","engine","client","invariant"]}

package/lib/onboarding.d.cts

@@ -1,6 +1,6 @@
 import { OnboardingFullStateResponse, OnboardingStep } from '@ledgerhq/revault-api';
 import { L as Logger } from './logger-C-TPbnjv.cjs';
-import { E as Engine, W as WithOnboarding } from './types-6nV5J9yp.cjs';
+import { E as Engine, W as WithOnboarding } from './types-CryvY9pW.cjs';
 import './types-DJfbanPz.cjs';
 import './types-CpGEbAxh.cjs';
 import '@trpc/client';
@@ -21,7 +21,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -193,7 +193,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -365,7 +365,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -537,7 +537,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -709,7 +709,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -881,7 +881,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -1053,7 +1053,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -1225,7 +1225,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -1397,7 +1397,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;

package/lib/onboarding.d.ts

@@ -1,6 +1,6 @@
 import { OnboardingFullStateResponse, OnboardingStep } from '@ledgerhq/revault-api';
 import { L as Logger } from './logger-C-TPbnjv.js';
-import { E as Engine, W as WithOnboarding } from './types-BdCVJxZy.js';
+import { E as Engine, W as WithOnboarding } from './types-C-ngtI5m.js';
 import './types-DJfbanPz.js';
 import './types-CpGEbAxh.js';
 import '@trpc/client';
@@ -21,7 +21,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -193,7 +193,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -365,7 +365,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -537,7 +537,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -709,7 +709,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -881,7 +881,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -1053,7 +1053,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -1225,7 +1225,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;
@@ -1397,7 +1397,7 @@ declare const STEPS: {
             pubKey: string;
             deviceUserId: string;
             deviceName: string;
-            role: "SHARED_OWNER" | "WRAPPING_KEY_OWNER" | "MASTER_ADMIN";
+            role: "WRAPPING_KEY_OWNER" | "SHARED_OWNER" | "MASTER_ADMIN";
         }[];
         wrappingKey: {
             ephemeralPubKey: string;

package/lib/{types-BdCVJxZy.d.ts → types-C-ngtI5m.d.ts}

@@ -81,6 +81,7 @@ type WithDevice = {
 };
 type DecorateWithDevice<T> = T extends WithWorkspace ? unknown : {
     getWorkspaces: () => Promise<string[]>;
+    getWorkspacesForSso: () => Promise<RouterOutputs["auth"]["sso"]["findWorkspaces"]["workspaces"]>;
 };
 type WithApiUser = {
     __isApiUser: true;

package/lib/{types-6nV5J9yp.d.cts → types-CryvY9pW.d.cts}

@@ -81,6 +81,7 @@ type WithDevice = {
 };
 type DecorateWithDevice<T> = T extends WithWorkspace ? unknown : {
     getWorkspaces: () => Promise<string[]>;
+    getWorkspacesForSso: () => Promise<RouterOutputs["auth"]["sso"]["findWorkspaces"]["workspaces"]>;
 };
 type WithApiUser = {
     __isApiUser: true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ledgerhq/revault-sdk",
-  "version": "0.23.1",
+  "version": "0.24.1",
   "license": "Apache-2.0",
   "type": "module",
   "files": [
@@ -63,7 +63,7 @@
     "ts-pattern": "^5.9.0",
     "uuid": "^13.0.0",
     "zod": "^4.3.6",
-    "@ledgerhq/revault-api": "1.53.0"
+    "@ledgerhq/revault-api": "1.55.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.2",
@@ -72,8 +72,8 @@
     "@types/invariant": "^2.2.37",
     "@types/lodash": "^4.17.23",
     "@types/node": "^22.19.7",
-    "@vitest/coverage-v8": "^4.0.17",
-    "@vitest/ui": "^4.0.17",
+    "@vitest/coverage-v8": "^4.1.0",
+    "@vitest/ui": "^4.1.0",
     "eslint": "^9.39.2",
     "eslint-plugin-unicorn": "^62.0.0",
     "tsup": "^8.5.1",
@@ -81,7 +81,7 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.53.0",
     "vite-plugin-node-polyfills": "^0.24.0",
-    "vitest": "^4.0.17",
+    "vitest": "^4.1.0",
     "vitest-mock-extended": "^3.1.0"
   },
   "scripts": {