@nacre.work/api 0.0.0 → 0.1.0

package/dist/__tests__/service-keys.test.js

@@ -1,204 +0,0 @@
-import { createPool } from '@nacre.work/core';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { authenticate } from '../auth.js';
-import { Problem } from '../errors.js';
-import { generateKey, hashOf, KEY_PREFIX, looksLikeServiceKey, PostgresServiceAccounts, PostgresServiceKeys, prefixOf, } from '../service-keys.js';
-/**
- * Service account keys.
- *
- * The one credential meant to outlive a session, and therefore the one whose
- * failures are worth being paranoid about: a key that survives revocation, a
- * key that authenticates into the wrong organization, or a key recoverable from
- * the database are each worse than anything the token path can do, because a
- * token expires on its own and this does not.
- */
-const url = process.env.NACRE_PG_URL;
-if (!url && process.env.CI) {
-    throw new Error('NACRE_PG_URL is not set and CI is; the service key path would go untested.');
-}
-const when = url ? describe : describe.skip;
-const ORG = 'cccccccc-cccc-cccc-cccc-cccccccccccc';
-const OTHER = 'dddddddd-dddd-dddd-dddd-dddddddddddd';
-const admin = { orgId: ORG, principal: { type: 'user', id: 'u1' }, role: 'org_admin' };
-let pool;
-let accounts;
-let keys;
-describe('key shape', () => {
-    it('a key is opaque, prefixed, and not a UUID', () => {
-        const key = generateKey();
-        expect(key.startsWith(KEY_PREFIX)).toBe(true);
-        expect(looksLikeServiceKey(key)).toBe(true);
-        // 32 bytes from the CSPRNG. A UUID is 122 bits of which several are fixed,
-        // and it is routinely treated as an identifier rather than a secret.
-        expect(key.length).toBeGreaterThan(KEY_PREFIX.length + 40);
-    });
-    it('two keys never collide', () => {
-        const many = new Set(Array.from({ length: 500 }, () => generateKey()));
-        expect(many.size).toBe(500);
-    });
-    it('the stored prefix is not enough to reconstruct the key', () => {
-        const key = generateKey();
-        expect(prefixOf(key).length).toBe(KEY_PREFIX.length + 8);
-        expect(key.startsWith(prefixOf(key))).toBe(true);
-        expect(prefixOf(key).length).toBeLessThan(key.length / 2);
-    });
-    it('the hash is not the key', () => {
-        const key = generateKey();
-        expect(hashOf(key)).not.toContain(key.slice(KEY_PREFIX.length));
-        expect(hashOf(key)).toBe(hashOf(key));
-        expect(hashOf(key)).not.toBe(hashOf(generateKey()));
-    });
-});
-when('service accounts, against the database', () => {
-    beforeAll(async () => {
-        pool = createPool({ connectionString: url });
-        accounts = new PostgresServiceAccounts(pool, 'nacre_app');
-        keys = new PostgresServiceKeys(pool, 'nacre_app');
-        const c = await pool.connect();
-        try {
-            for (const [id, slug] of [
-                [ORG, 'keysone'],
-                [OTHER, 'keystwo'],
-            ]) {
-                await c.query(
-                // slug is citext and name is text; one parameter cannot feed both.
-                `INSERT INTO organizations (id, slug, name, vector_collection)
-           VALUES ($1,$2,$3,$4) ON CONFLICT DO NOTHING`, [id, slug, slug, `org_${slug}`]);
-            }
-            await c.query(`DELETE FROM service_accounts WHERE org_id IN ($1,$2)`, [ORG, OTHER]);
-        }
-        finally {
-            c.release();
-        }
-    });
-    afterAll(async () => {
-        await pool?.end();
-    });
-    it('a new key authenticates as its own organization, as a member', async () => {
-        const { key, account } = await accounts.create(admin, 'agent');
-        const resolved = await keys.resolve(key);
-        expect(resolved?.orgId).toBe(ORG);
-        expect(resolved?.principal).toEqual({ type: 'service_account', id: account.id });
-        // Never an admin by virtue of being a service account. Everything it can
-        // reach comes from a grant — which is what "permissions are exactly the
-        // service account's" has to mean if it means anything.
-        expect(resolved?.role).toBe('member');
-    });
-    it('the key is never readable again', async () => {
-        const { key, account } = await accounts.create(admin, 'agent-2');
-        const listed = (await accounts.list(admin)).find((a) => a.id === account.id);
-        expect(listed).toBeDefined();
-        expect(JSON.stringify(listed)).not.toContain(key.slice(KEY_PREFIX.length));
-        // The prefix is shown so two keys can be told apart when revoking one.
-        expect(listed?.keyPrefix).toBe(prefixOf(key));
-    });
-    it('a revoked key stops working immediately', async () => {
-        const { key, account } = await accounts.create(admin, 'agent-3');
-        expect(await keys.resolve(key)).toBeDefined();
-        expect(await accounts.revoke(admin, account.id)).toBe(true);
-        // No TTL, no propagation window, nothing to wait for. Unlike a token, this
-        // credential has no expiry of its own, so revocation is the only thing that
-        // ever ends it.
-        expect(await keys.resolve(key)).toBeUndefined();
-    });
-    it('revoking twice is not an error the second time, it is a no', async () => {
-        const { account } = await accounts.create(admin, 'agent-4');
-        expect(await accounts.revoke(admin, account.id)).toBe(true);
-        expect(await accounts.revoke(admin, account.id)).toBe(false);
-    });
-    it('a revoked key is still listed, and says when', async () => {
-        const { account } = await accounts.create(admin, 'agent-5');
-        await accounts.revoke(admin, account.id);
-        const listed = (await accounts.list(admin)).find((a) => a.id === account.id);
-        // A key that vanishes on revocation looks like one that never existed, and
-        // the audit log refers to this id — a row that disappears turns every past
-        // event into an unresolvable reference.
-        expect(listed?.revokedAt).not.toBeNull();
-    });
-    it('another organization cannot revoke this one’s key', async () => {
-        const { key, account } = await accounts.create(admin, 'agent-6');
-        const intruder = { ...admin, orgId: OTHER };
-        expect(await accounts.revoke(intruder, account.id)).toBe(false);
-        expect(await keys.resolve(key), 'the key must still work').toBeDefined();
-    });
-    it('another organization does not see this one’s keys', async () => {
-        await accounts.create(admin, 'agent-7');
-        const theirs = await accounts.list({ ...admin, orgId: OTHER });
-        expect(theirs.every((a) => a.name !== 'agent-7')).toBe(true);
-    });
-    it('a key that does not exist, and a mangled one, resolve to nothing', async () => {
-        const { key } = await accounts.create(admin, 'agent-8');
-        for (const bad of [
-            generateKey(),
-            `${key}x`,
-            key.slice(0, -1),
-            `${prefixOf(key)}${'A'.repeat(43)}`,
-            'nacre_sk_',
-            'not-a-key',
-        ]) {
-            expect(await keys.resolve(bad), bad.slice(0, 20)).toBeUndefined();
-        }
-    });
-    it('a key with the right prefix and the wrong secret is refused', async () => {
-        const { key } = await accounts.create(admin, 'agent-9');
-        // The prefix is the indexed lookup, not the credential. If the hash
-        // comparison were ever dropped, every one of these would authenticate as
-        // the real account — and the prefix is stored in clear and shown in
-        // listings, so it is not a secret to begin with.
-        const forged = `${prefixOf(key)}${'B'.repeat(key.length - prefixOf(key).length)}`;
-        expect(forged.startsWith(prefixOf(key))).toBe(true);
-        expect(await keys.resolve(forged)).toBeUndefined();
-    });
-    it('authenticate() answers a bad key exactly as it answers a bad token', async () => {
-        const verify = {
-            key: new TextEncoder().encode('a'.repeat(32)),
-            issuer: 'https://api.nacre.test',
-            audience: 'nacre',
-            serviceKeys: keys,
-        };
-        const badKey = await authenticate(`Bearer ${generateKey()}`, verify, '/v1/search', 'r1');
-        const badToken = await authenticate('Bearer not-a-token', verify, '/v1/search', 'r1');
-        expect(badKey).toBeInstanceOf(Problem);
-        expect(badToken).toBeInstanceOf(Problem);
-        // "Revoked key", "unknown key" and "expired token" are one answer. Telling
-        // them apart says which guess was closest, and a key is guessable in a way
-        // a signature is not.
-        expect(badKey.toJSON()).toEqual(badToken.toJSON());
-    });
-    it('authenticate() accepts a real key and carries its organization', async () => {
-        const { key, account } = await accounts.create(admin, 'agent-10');
-        const resolved = await authenticate(`Bearer ${key}`, {
-            key: new TextEncoder().encode('a'.repeat(32)),
-            issuer: 'https://api.nacre.test',
-            audience: 'nacre',
-            serviceKeys: keys,
-        }, '/v1/search', 'r1');
-        expect(resolved).not.toBeInstanceOf(Problem);
-        const context = resolved;
-        expect(context.orgId).toBe(ORG);
-        // The account it names, not just some account in the right organization.
-        // Every grant is keyed on this id, so resolving to the wrong one would
-        // hand the caller another service account's permissions.
-        expect(context.principal).toEqual({ type: 'service_account', id: account.id });
-    });
-    it('a surface with no resolver refuses keys rather than ignoring the prefix', async () => {
-        const { key } = await accounts.create(admin, 'agent-11');
-        const result = await authenticate(`Bearer ${key}`, {
-            key: new TextEncoder().encode('a'.repeat(32)),
-            issuer: 'https://api.nacre.test',
-            audience: 'nacre',
-        }, '/v1/search', 'r1');
-        // Falling through to the JWT path would try to verify an opaque string as a
-        // signed token. That fails today, but it fails for the wrong reason, and
-        // "this credential type is not served here" should not depend on that.
-        expect(result).toBeInstanceOf(Problem);
-    });
-    it('using a key records when, without touching the decision', async () => {
-        const { key, account } = await accounts.create(admin, 'agent-12');
-        expect((await accounts.list(admin)).find((a) => a.id === account.id)?.lastUsedAt).toBeNull();
-        expect(await keys.resolve(key)).toBeDefined();
-        await new Promise((r) => setTimeout(r, 50));
-        expect((await accounts.list(admin)).find((a) => a.id === account.id)?.lastUsedAt).not.toBeNull();
-    });
-});
-//# sourceMappingURL=service-keys.test.js.map

package/dist/__tests__/service-keys.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"service-keys.test.js","sourceRoot":"","sources":["../../src/__tests__/service-keys.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,oBAAoB,CAAA;AAE3B;;;;;;;;GAQG;AAEH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;AACpC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC3B,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;AAC/F,CAAC;AACD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;AAE3C,MAAM,GAAG,GAAG,sCAAsC,CAAA;AAClD,MAAM,KAAK,GAAG,sCAAsC,CAAA;AAEpD,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,CAAA;AAExG,IAAI,IAAU,CAAA;AACd,IAAI,QAAiC,CAAA;AACrC,IAAI,IAAyB,CAAA;AAE7B,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QACzB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACtE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;IAClD,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,GAAa,EAAE,CAAC,CAAA;QACtD,QAAQ,GAAG,IAAI,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACzD,IAAI,GAAG,IAAI,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAEjD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QAC9B,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI;gBACvB,CAAC,GAAG,EAAE,SAAS,CAAC;gBAChB,CAAC,KAAK,EAAE,SAAS,CAAC;aACV,EAAE,CAAC;gBACX,MAAM,CAAC,CAAC,KAAK;gBACX,mEAAmE;gBACnE;uDAC6C,EAC7C,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAChC,CAAA;YACH,CAAC;YACD,MAAM,CAAC,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QACrF,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,OAAO,EAAE,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,IAAI,EAAE,GAAG,EAAE,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAE9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACxC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;QAChF,yEAAyE;QACzE,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAEhE,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1E,uEAAuE;QACvE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAChE,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAE7C,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE3D,2EAA2E;QAC3E,4EAA4E;QAC5E,gBAAgB;QAChB,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAC3D,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;QAExC,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,wCAAwC;QACxC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAChE,MAAM,QAAQ,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;QAE3C,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/D,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAEvD,KAAK,MAAM,GAAG,IAAI;YAChB,WAAW,EAAE;YACb,GAAG,GAAG,GAAG;YACT,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChB,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;YACnC,WAAW;YACX,WAAW;SACZ,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QACnE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAEvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,iDAAiD;QACjD,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAA;QACjF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,MAAM,GAAG;YACb,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,IAAI;SAClB,CAAA;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAA;QACxF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAA;QAErF,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QACxC,2EAA2E;QAC3E,2EAA2E;QAC3E,sBAAsB;QACtB,MAAM,CAAE,MAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAE,QAAoB,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,UAAU,GAAG,EAAE,EACf;YACE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,IAAI;SAClB,EACD,YAAY,EACZ,IAAI,CACL,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,QAAsE,CAAA;QACtF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/B,yEAAyE;QACzE,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,UAAU,GAAG,EAAE,EACf;YACE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,OAAO;SAClB,EACD,YAAY,EACZ,IAAI,CACL,CAAA;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACjE,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;QAE5F,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC7C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QAE3C,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;IAClG,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}