@mcp-abap-adt/auth-broker 4.0.0 → 5.0.0

package/dist/destinations.d.ts

@@ -4,18 +4,40 @@
  * Two fields choose the provider — `authType` and, for `jwt` and `saml`,
  * `grantType` — and nothing else: no field's presence or absence is ever
  * read to pick a row. Both come from the key store's means.
+ *
+ * Every token row takes the consumer's `renewal` (called once per build, with
+ * the destination and its grant) and persists through auth-providers'
+ * `refreshStatePersistence` over the broker's write, governed by the
+ * consumer's `onWriteFailure`; a row built without either is refused naming
+ * it, beside every other missing field, in one error. A failure the broker
+ * reads — the SNC provider's, a validator's, a provider constructor's — is
+ * read through auth-errors (`readFailure`) and carried by the
+ * `DestinationConfigError`, never matched by class.
  */
-import { type IDeviceCodePresenter, type OidcCallbackResult } from '@mcp-abap-adt/auth-providers';
-import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, ITokenResult } from '@mcp-abap-adt/interfaces-auth';
+import { type IDeviceCodePresenter, type OidcCallbackResult, type PersistedTokens } from '@mcp-abap-adt/auth-providers';
+import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, IClientAuthentication, IRenewalStrategy } from '@mcp-abap-adt/interfaces-auth';
 import type { DestinationGrant, IConfig, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-broker';
 import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
 import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { type Binding } from './binding';
+import type { ClientIdentity } from './clientAuthentication';
+import { DestinationConfigError } from './DestinationConfigError';
 type StatedAuthType = NonNullable<IConnectionConfig['authType']>;
+/**
+ * `authType` and `grantType` are a `jwt` / `saml` pair of the closed list —
+ * so neither holds `;` or `/`. Never throws.
+ */
+export declare function isStatedRow(authType: unknown, grant: unknown): grant is DestinationGrant & string;
 /** The stated `authType`, or the error naming it. */
 export declare function statedAuthType(destination: string, means: IConnectionConfig | null): StatedAuthType;
 /** The stated grant of a `jwt` or `saml` destination, or the error naming it. */
 export declare function statedGrant(destination: string, authType: 'jwt' | 'saml', means: IConnectionConfig): DestinationGrant;
+/**
+ * A row's client: the key store's secret client, or — on the strategy path
+ * without one — the certificate client's identity, which carries no secret
+ * field at all, so it can never pass for a (public) secret client.
+ */
+export type RowClient = IAuthorizationConfig | ClientIdentity;
 /** `basic` → `BasicAuthProvider(username, password)`, from the means alone. */
 export declare function basicProvider(destination: string, means: IConnectionConfig): IAuthProvider;
 /**
@@ -24,96 +46,192 @@ export declare function basicProvider(destination: string, means: IConnectionCon
  * `sncLib` is absent and the user's name taken from the credential when
  * `sncMyName` is, and the provider documents its own `qop` default.
  */
-export declare function sncProvider(destination: string, means: IConnectionConfig, logger: ILogger): IAuthProvider;
+export declare function sncProvider(destination: string, means: IConnectionConfig, logger: ILogger): IAuthProvider & Attachable;
 /**
  * `none` → the credential handed over, from the session: the only way in, so
  * required. Read from the secret alone — the means are not a seed.
  *
  * The broker did not obtain it and cannot obtain it again, so a binding that
- * does not match is refused, never discarded: `issuedFor`
- * must always equal the destination's resource — it is what stops the
- * credential going to another one; `issuedBy` is compared only when the means
- * state an issuer.
+ * does not match is refused, never discarded: `issuedFor` must equal the
+ * destination's resource — it is what stops the credential going to another
+ * one — and `issuedBy` must be exactly the row's record: a credential
+ * handed over with a 4.x binding, or none, is refused until it is written
+ * again with 5.0.0's `bindingOf`.
  */
 export declare function handedOverProvider(destination: string, authType: 'jwt' | 'saml', secret: IConfig | null, binding: Binding): IAuthProvider;
+/** Every grant that obtains a secret: `DestinationGrant` without `'none'`. */
+export type TokenGrant = Exclude<DestinationGrant, 'none'>;
+/**
+ * A provider that has parties: every token provider
+ * (`BaseTokenProvider.attach`) and the SNC one (`SncLogonProvider.attach`).
+ */
+export interface Attachable {
+    attach(signal: AbortSignal): () => void;
+}
+/**
+ * A token row's provider, and the refresh token the builder handed it from
+ * the session — the very value in the provider's config, so what the broker
+ * takes as the refresh token the build owns at its start is what the
+ * provider was given, for every grant, and cannot drift from it:
+ * `client_credentials` is handed none (its row takes no seed), `saml2_pure`
+ * none (it holds cookies), and a build that started with nothing none.
+ */
+export interface RowBuild {
+    /** A token provider: it has parties. */
+    readonly provider: IAuthProvider & Attachable;
+    readonly seededRefreshToken: string | undefined;
+}
+/** How the consumer's `renewal` option is shaped. */
+export type RenewalOption = (destination: string, grant: TokenGrant) => IRenewalStrategy;
+/**
+ * What every token row takes from the broker beside its own data: the
+ * consumer's `renewal` and `onWriteFailure` (each refused by name when
+ * absent) and the broker's one write of the destination's session.
+ */
+export interface TokenRowOptions {
+    renewal: RenewalOption | undefined;
+    onWriteFailure: 'fail' | 'continue' | undefined;
+    /**
+     * One session write for the destination: resolves when it landed, rejects
+     * with the store's error when it did not.
+     */
+    write: (tokens: PersistedTokens) => Promise<void>;
+    logger: ILogger;
+    /**
+     * The consumer's `authDebug === true`, decided once by the broker: every
+     * token provider a row builds is given it.
+     */
+    authDebug: boolean;
+}
+/** `onWriteFailure` as given: `'fail'` or `'continue'`, nothing else. */
+export declare function isWriteFailurePolicy(value: unknown): value is 'fail' | 'continue';
+/**
+ * The consumer options a token row lacks, by name: `renewal` when it is no
+ * function, `onWriteFailure` when it is neither `'fail'` nor `'continue'`.
+ * There is no default for either.
+ */
+export declare function optionsLacking(options: Pick<TokenRowOptions, 'renewal' | 'onWriteFailure'>): string[];
 /** The UAA grants: one client, one token endpoint (`<uaaUrl>/oauth/token`). */
 export type UaaGrant = 'authorization_code' | 'client_credentials' | 'passcode';
 export declare function isUaaGrant(grant: DestinationGrant): grant is UaaGrant;
-/** What a UAA row is built from. */
-export interface UaaRow {
+/**
+ * What a token row's check reads of its client and options. `client`
+ * `undefined` means "not known yet": the consumer's `clientAuthentication`
+ * strategy will tell the client identity, so its fields are not judged.
+ */
+interface ClientCheck {
     destination: string;
+    client: RowClient | null | undefined;
+    /** Whether the client authenticates through the consumer's strategy. */
+    clientAuthenticated: boolean;
+    renewal: RenewalOption | undefined;
+    onWriteFailure: 'fail' | 'continue' | undefined;
+}
+/** What a UAA row's check reads. */
+export interface UaaCheck extends ClientCheck {
     grant: UaaGrant;
-    /** The client, from the key store's `getAuthorizationConfig`. */
-    client: IAuthorizationConfig | null;
-    /** The session secret — the seed; `null` when there is no session. */
-    secret: IConfig | null;
     /** The consumer's `authorization` option. */
     authorization: ((destination: string, grant: 'authorization_code' | 'passcode') => IAuthorizationStrategy<string>) | undefined;
-    logger: ILogger;
-    onTokens: (result: ITokenResult) => Promise<void>;
+}
+/** What a UAA row is built from. */
+export interface UaaRow extends Omit<UaaCheck, 'client' | 'clientAuthenticated'>, TokenRowOptions {
+    /**
+     * The client: the key store's `getAuthorizationConfig` — or, with a
+     * strategy and no secret client, the certificate client's identity.
+     */
+    client: RowClient | null;
+    /** The session secret — the seed; `null` when there is no session. */
+    secret: IConfig | null;
+    /**
+     * The consumer strategy's answer. Given, the provider authenticates its
+     * client with it and gets no `clientSecret`; absent, 4.0.0's secret.
+     */
+    clientAuthentication?: IClientAuthentication;
 }
+/**
+ * Every field and option a UAA row lacks, named in one error — or nothing.
+ * `serviceUrl` is not among them: the providers read the client and `uaaUrl`
+ * only. Without a strategy, `uaaClientSecret: ''` is a public client:
+ * `passcode` takes it as no secret; the other two rows' providers require a
+ * secret, so for them `''` is missing.
+ */
+export declare function uaaRefusal(check: UaaCheck): DestinationConfigError | undefined;
 /**
  * `jwt` / `authorization_code` → `AuthorizationCodeProvider`,
  * `client_credentials` → `ClientCredentialsProvider`, `passcode` →
  * `UaaPasscodeProvider`: the client from the key store, the seed from the
- * session (not for `client_credentials`, whose row takes the client alone).
+ * session (not for `client_credentials`, whose row takes the client alone),
+ * the consumer's renewal for this grant, and the broker's persistence.
  *
- * Every field and option the row lacks is named in one error, before the
- * consumer's `authorization` is called. `serviceUrl` is not among them: the
- * providers read the client and `uaaUrl` only. `uaaClientSecret: ''` is a public
- * client: `passcode` takes it as no secret; the other two rows' providers
- * require a secret, so for them `''` is missing.
+ * Every field and option the row lacks is named in one error
+ * (`uaaRefusal`), before the consumer's `authorization` or `renewal` is
+ * called. On the strategy path the client may be a certificate client's
+ * identity, which holds no secret field at all (`RowClient`). With the
+ * strategy's answer (`clientAuthentication`) no secret is required and none
+ * is passed: the provider authenticates its client with the answer.
  */
-export declare function uaaProvider(row: UaaRow): IAuthProvider;
+export declare function uaaProvider(row: UaaRow): RowBuild;
 /** The OIDC grants: a client, and an issuer or explicit endpoints. */
 export type OidcGrant = 'oidc_authorization_code' | 'device_code' | 'password' | 'token_exchange';
 export declare function isOidcGrant(grant: DestinationGrant): grant is OidcGrant;
-/** What an OIDC row is built from. */
-export interface OidcRow {
-    destination: string;
+/** What an OIDC row's check reads. */
+export interface OidcCheck extends ClientCheck {
     grant: OidcGrant;
     means: IConnectionConfig;
+    oidcAuthorization: ((destination: string) => IAuthorizationStrategy<OidcCallbackResult>) | undefined;
+    deviceCodePresenter: ((destination: string) => IDeviceCodePresenter) | undefined;
+}
+/** What an OIDC row is built from. */
+export interface OidcRow extends Omit<OidcCheck, 'client' | 'clientAuthenticated'>, TokenRowOptions {
     /** The client, from the key store's `getAuthorizationConfig`. */
-    client: IAuthorizationConfig | null;
+    client: RowClient | null;
     /** The session secret — the seed; `null` when there is none, or it is not bound here. */
     secret: IConfig | null;
-    oidcAuthorization: ((destination: string) => IAuthorizationStrategy<OidcCallbackResult>) | undefined;
-    deviceCodePresenter: ((destination: string) => IDeviceCodePresenter) | undefined;
-    logger: ILogger;
-    onTokens: (result: ITokenResult) => Promise<void>;
+    /** The consumer strategy's answer: given, it replaces the secret. */
+    clientAuthentication?: IClientAuthentication;
 }
+/**
+ * Every field and option an OIDC row lacks, named in one error — or nothing.
+ * The endpoints: `oidcIssuerUrl`, from which the provider discovers them, or
+ * every explicit endpoint the row uses — without either the error names the
+ * issuer and the endpoints missing.
+ */
+export declare function oidcRefusal(check: OidcCheck): DestinationConfigError | undefined;
 /**
  * `jwt` / `oidc_authorization_code` → `OidcBrowserProvider`, `device_code` →
  * `OidcDeviceFlowProvider`, `password` → `OidcPasswordProvider`,
  * `token_exchange` → `OidcTokenExchangeProvider`: the client id (and secret,
  * `''` being a public client) from the key store's client, the grant's data
- * from its `oidc*` fields, the seed from the session.
+ * from its `oidc*` fields, the seed from the session, the consumer's renewal
+ * for this grant, and the broker's persistence.
  *
- * The endpoints: `oidcIssuerUrl`, from which the provider discovers them, or
- * every explicit endpoint the row uses — without either the error names the
- * issuer and the endpoints missing. Every field and option the row lacks is
- * named in one error, before any collaborator is called. `token_exchange`
- * takes one scope string: the stored scopes joined by a space.
+ * Every field and option the row lacks is named in one error
+ * (`oidcRefusal`), before any collaborator is called. `token_exchange` takes
+ * one scope string: the stored scopes joined by a space.
  */
-export declare function oidcProvider(row: OidcRow): IAuthProvider;
+export declare function oidcProvider(row: OidcRow): RowBuild;
 /** The SAML grants: an identity provider's assertion, validated first. */
 export type SamlGrant = 'saml2_pure' | 'saml2_bearer';
 export declare function isSamlGrant(grant: DestinationGrant): grant is SamlGrant;
-/** What a SAML row is built from. */
-export interface SamlRow {
-    destination: string;
+/** What a SAML row's check reads. */
+export interface SamlCheck extends ClientCheck {
     grant: SamlGrant;
     means: IConnectionConfig;
-    /** `saml2_bearer`'s client, from the key store; `null` for `saml2_pure`. */
-    client: IAuthorizationConfig | null;
-    /** The session secret — the seed; `null` when there is none, or it is not bound here. */
-    secret: IConfig | null;
     authorization: ((destination: string, grant: SamlGrant) => IAuthorizationStrategy<string>) | undefined;
     samlCookies: ((destination: string) => (samlResponse: string) => Promise<string>) | undefined;
     assertionReplayStore: ((destination: string) => IAssertionReplayStore) | undefined;
-    logger: ILogger;
-    onTokens: (result: ITokenResult) => Promise<void>;
 }
+/** What a SAML row is built from. */
+export interface SamlRow extends Omit<SamlCheck, 'client' | 'clientAuthenticated'>, TokenRowOptions {
+    /** `saml2_bearer`'s client, from the key store; `null` for `saml2_pure`. */
+    client: RowClient | null;
+    /** The session secret — the seed; `null` when there is none, or it is not bound here. */
+    secret: IConfig | null;
+    /** `saml2_bearer`: the consumer strategy's answer; given, it replaces the secret. */
+    clientAuthentication?: IClientAuthentication;
+}
+/** Every field and option a SAML row lacks, named in one error — or nothing. */
+export declare function samlRefusal(check: SamlCheck): DestinationConfigError | undefined;
 /**
  * `saml` / `saml2_pure` → `Saml2PureProvider`, `saml2_bearer` →
  * `Saml2BearerProvider`, each validating the assertion before anything uses
@@ -126,14 +244,17 @@ export interface SamlRow {
  *
  * `saml2_pure` is seeded with the stored cookies and `expiresAt`;
  * `saml2_bearer` with the stored token, its refresh token and expiry, and
- * takes the client (`uaaUrl`, `uaaClientId`; `uaaClientSecret` `''` a public
- * client) and `samlTokenUrl` when stated.
+ * takes the client (`uaaUrl`, `uaaClientId`; without a strategy,
+ * `uaaClientSecret` `''` a public client; on the strategy path the identity
+ * alone, no secret) and `samlTokenUrl` when stated. Both take the consumer's
+ * renewal for their grant and the broker's persistence.
  *
- * Every field and option the row lacks is named in one error, before any
- * collaborator is called; so is a `samlClockSkewMs` that is not a whole number
- * of milliseconds, and a certificate the validator cannot read — by name, never
- * the value.
+ * Every field and option the row lacks is named in one error
+ * (`samlRefusal`), before any collaborator is called; so is a
+ * `samlClockSkewMs` that is not a whole number of milliseconds, and a
+ * certificate the validator cannot read — by name, never the value, the
+ * validator's error carried.
  */
-export declare function samlProvider(row: SamlRow): IAuthProvider;
+export declare function samlProvider(row: SamlRow): RowBuild;
 export {};
 //# sourceMappingURL=destinations.d.ts.map

package/dist/destinations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../src/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAML,KAAK,oBAAoB,EAEzB,KAAK,kBAAkB,EAWxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EAErB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,KAAK,OAAO,EAA4B,MAAM,WAAW,CAAC;AAGnE,KAAK,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAwBjE,qDAAqD;AACrD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAC9B,cAAc,CAmBhB;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,CAiBlB;AAUD,+EAA+E;AAC/E,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GACvB,aAAa,CAaf;AAUD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,OAAO,GACd,aAAa,CA0Bf;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,aAAa,CA2Bf;AAED,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAEhF,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,QAAQ,CAMrE;AAED,oCAAoC;AACpC,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,iEAAiE;IACjE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,sEAAsE;IACtE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,6CAA6C;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,GAAG,UAAU,KACrC,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CA4DtD;AAyBD,sEAAsE;AACtE,MAAM,MAAM,SAAS,GACjB,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,CAAC;AAErB,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAOvE;AAeD,sCAAsC;AACtC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,iEAAiE;IACjE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,iBAAiB,EACb,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,GACrE,SAAS,CAAC;IACd,mBAAmB,EACf,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC,GAC/C,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAqFxD;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAEvE;AAED,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,4EAA4E;IAC5E,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,KACb,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,WAAW,EACP,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACpE,SAAS,CAAC;IACd,oBAAoB,EAChB,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC,GAChD,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAgGxD"}
+{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../src/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAOL,KAAK,oBAAoB,EAGzB,KAAK,kBAAkB,EAOvB,KAAK,eAAe,EAYrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EAErB,sBAAsB,EACtB,aAAa,EAEb,qBAAqB,EACrB,gBAAgB,EAEjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,KAAK,OAAO,EAA4B,MAAM,WAAW,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,KAAK,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAmBjE;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,gBAAgB,GAAG,MAAM,CAGpC;AA+BD,qDAAqD;AACrD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAC9B,cAAc,CAmBhB;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,CAiBlB;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAwD9D,+EAA+E;AAC/E,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GACvB,aAAa,CAaf;AAUD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,OAAO,GACd,aAAa,GAAG,UAAU,CAiC5B;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,aAAa,CAyBf;AAED,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,IAAI,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;CACjD;AAED,qDAAqD;AACrD,MAAM,MAAM,aAAa,GAAG,CAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,KACd,gBAAgB,CAAC;AAEtB;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,cAAc,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAChD;;;OAGG;IACH,KAAK,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,MAAM,GAAG,UAAU,CAE9B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,gBAAgB,CAAC,GAC3D,MAAM,EAAE,CAOV;AA+GD,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAEhF,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,QAAQ,CAMrE;AAED;;;;GAIG;AACH,UAAU,WAAW;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC,wEAAwE;IACxE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,cAAc,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CACjD;AAED,oCAAoC;AACpC,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC3C,KAAK,EAAE,QAAQ,CAAC;IAChB,6CAA6C;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,GAAG,UAAU,KACrC,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,MACf,SAAQ,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,qBAAqB,CAAC,EACtD,eAAe;IACjB;;;OAGG;IACH,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,sEAAsE;IACtE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,QAAQ,GACd,sBAAsB,GAAG,SAAS,CAyBpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CA0FjD;AAyBD,sEAAsE;AACtE,MAAM,MAAM,SAAS,GACjB,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,CAAC;AAErB,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAOvE;AAeD,sCAAsC;AACtC,MAAM,WAAW,SAAU,SAAQ,WAAW;IAC5C,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,iBAAiB,EACb,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,GACrE,SAAS,CAAC;IACd,mBAAmB,EACf,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC,GAC/C,SAAS,CAAC;CACf;AAED,sCAAsC;AACtC,MAAM,WAAW,OACf,SAAQ,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,qBAAqB,CAAC,EACvD,eAAe;IACjB,iEAAiE;IACjE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,GACf,sBAAsB,GAAG,SAAS,CAsCpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAgHnD;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAEvE;AAED,qCAAqC;AACrC,MAAM,WAAW,SAAU,SAAQ,WAAW;IAC5C,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,KACb,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,WAAW,EACP,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACpE,SAAS,CAAC;IACd,oBAAoB,EAChB,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC,GAChD,SAAS,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,OACf,SAAQ,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,qBAAqB,CAAC,EACvD,eAAe;IACjB,4EAA4E;IAC5E,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,GACf,sBAAsB,GAAG,SAAS,CAkCpC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CA8GnD"}