@nacre.work/api 0.5.8 → 0.7.0

package/dist/auth.js

@@ -1,6 +1,69 @@
-import { authProviders } from '@nacre.work/core';
+import { authProviders, } from '@nacre.work/core';
 import { jwtVerify } from 'jose';
 import { forbidden, unauthorized } from './errors.js';
+/**
+ * Whether this request may exercise a permission at all.
+ *
+ * The delegation's ceiling, and `true` for everything that is not one. It is
+ * consulted by `contextFor` on the way into `resolve`, which is where it does
+ * the work for documents; this is for the handful of places that ask about a
+ * verb without building a plan.
+ */
+export function delegationPermits(auth, permission) {
+    const ceiling = auth.delegation?.permissions;
+    return ceiling === undefined || ceiling.includes(permission);
+}
+/**
+ * Whether this request administers the organization.
+ *
+ * Two facts, deliberately kept as two. `role` is what the *principal* is and
+ * decides what they reach — an `org_admin` holds admin on every scope with no
+ * grants at all, by rule 3. The ceiling is what this *token* may exercise, and
+ * a delegation restricted to `{read}` must not mint a service account key even
+ * though its person could.
+ *
+ * Rewriting the role to `member` instead would be the same check in one place
+ * and would be wrong: `member` reaches only what grants give, so an `org_admin`
+ * with a read-only delegation would stop reading the organization they came to
+ * delegate. So the role stays, and every handler that gated on
+ * `auth.role === 'org_admin'` asks this.
+ *
+ * `scripts/check-admin-gate.mjs` is what keeps that true — a rule that has to
+ * hold in nine handlers, with nothing that knows nine, is the defect this
+ * repository keeps re-deriving.
+ */
+export function administers(auth) {
+    return auth.role === 'org_admin' && delegationPermits(auth, 'admin');
+}
+/**
+ * Whether this request administers *tenants* — the multi-tenancy module's role.
+ *
+ * No ceiling question: `platform_admin` is never delegable, refused at consent
+ * and again at validation, so a request carrying this role is never a
+ * delegation. Stated as its own function anyway, because the alternative is a
+ * raw comparison and the check refuses those.
+ */
+export function administersTenants(auth) {
+    return auth.role === 'platform_admin';
+}
+/**
+ * Whether a layer is inside this request's delegation, if it has one.
+ *
+ * `true` for everything that is not a delegation, because there is no narrowing
+ * to be outside of — a plain token, a service account key and an SSO assertion
+ * all reach whatever `resolve` says they reach.
+ *
+ * The **search** path does not go through this: there the narrowing is a `must`
+ * on `layer_id` inside the index traversal, which is what invariant 2 requires
+ * and what a per-result check would break. This is for the paths that already
+ * hold one row and one layer id — a document fetched by id, an ingest naming
+ * its target — where the same restriction has to hold and there is no traversal
+ * to put it inside of.
+ */
+export function withinDelegation(auth, layerId) {
+    const narrowing = auth.delegation?.layers;
+    return narrowing === undefined || narrowing.includes(layerId);
+}
 /**
  * Fields a request body, path, or query string may never carry.
  *
@@ -133,10 +196,51 @@ export async function authenticate(authorization, options, instance, requestId)
         // rule I3 makes that a denial rather than a default.
         return unauthorized(instance, requestId, 'The token is not valid.');
     }
-    return {
+    const base = {
         orgId: org,
         principal: { type: type, id: sub },
         role: role,
     };
+    if (claims.del === undefined)
+        return base;
+    // ── a delegated token ──
+    //
+    // Everything above verified the signature; none of it says whether this
+    // authority may still be exercised. That question has no answer in a JWT —
+    // it changes when an administrator acts — so it is asked here, before
+    // `resolve`, on every request.
+    //
+    // Uncached, deliberately. The effective-principals cache keys on
+    // `organizations.groups_version`, which triggers bump on `groups`,
+    // `group_members` and `grants` — and not on `users`. Behind that cache a
+    // disabled user's delegations would keep working for the TTL, which is the
+    // lag the ACL tag cache was removed for.
+    if (typeof claims.del !== 'string' || options.delegations === undefined) {
+        return unauthorized(instance, requestId, 'The token is not valid.');
+    }
+    const delegation = await options.delegations.resolve(org, claims.del);
+    if (delegation === undefined) {
+        return unauthorized(instance, requestId, 'The token is not valid.');
+    }
+    // The token says who it acts for and the row says who it was issued for. They
+    // are two copies of one fact, so they are compared rather than one being
+    // trusted: a token whose subject no longer matches its connection is refused,
+    // not resolved as whichever of the two the code happened to read.
+    if (delegation.userId !== sub || type !== 'user') {
+        return unauthorized(instance, requestId, 'The token is not valid.');
+    }
+    return {
+        orgId: org,
+        principal: { type: 'user', id: delegation.userId },
+        // From the row and never from the claim. A role in a token is a snapshot,
+        // and an administrator demoted since consent must not keep administering
+        // through an application they connected while they still could.
+        role: delegation.role,
+        delegation: {
+            id: claims.del,
+            ...(delegation.layers === undefined ? {} : { layers: delegation.layers }),
+            ...(delegation.permissions === undefined ? {} : { permissions: delegation.permissions }),
+        },
+    };
 }
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAwD,MAAM,kBAAkB,CAAA;AACtG,OAAO,EAAE,SAAS,EAAmC,MAAM,MAAM,CAAA;AAEjE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAA;AAyDnE;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;AAEpG,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,OAAiB,EAAE;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAEjE,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjE,0EAA0E;QAC1E,qBAAqB;QACrB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;IACzC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa,EACb,KAAsB,EACtB,OAAsD,EACtD,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,MAAM,IAAI,CAAC,CAAA;IACrG,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,GAAG,IAAI,CAAC,CAAA;QAClG,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,wCAAwC,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAQD,MAAM,KAAK,GAAuB,CAAC,gBAAgB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;AAC3E,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAU,CAAA;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAiC,EACjC,OAAsB,EACtB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,6BAA6B,CAAC,CAAA;IACzE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1D,OAAO,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACjF,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,mCAAmC;IACnC,IAAI,MAA+B,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAc,MAAM,EAAE,GAAG,EAAE;gBACzD,UAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAA;YACF,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAA;YACzB,MAAK;QACP,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,6CAA6C;QAC7C,EAAE;QACF,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,8CAA8C;QAC9C,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,EAAE,CAAC;YACvC,IAAI,QAAuC,CAAA;YAC3C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,0CAA0C;gBAC1C,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;QAC7C,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAA;IAEpC,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtD,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC5C,CAAC;QACD,4EAA4E;QAC5E,qDAAqD;QACrD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,IAAyB,EAAE,EAAE,EAAE,GAAG,EAAE;QACvD,IAAI,EAAE,IAAe;KACtB,CAAA;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAKd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,SAAS,EAAmC,MAAM,MAAM,CAAA;AAEjE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAA;AAiHnE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAiB,EAAE,UAAsB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAA;IAC5C,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAiB;IAClD,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,OAAe;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAA;IACzC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;AAEpG,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,OAAiB,EAAE;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAEjE,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjE,0EAA0E;QAC1E,qBAAqB;QACrB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;IACzC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa,EACb,KAAsB,EACtB,OAAsD,EACtD,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,MAAM,IAAI,CAAC,CAAA;IACrG,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,GAAG,IAAI,CAAC,CAAA;QAClG,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,wCAAwC,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAkBD,MAAM,KAAK,GAAuB,CAAC,gBAAgB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;AAC3E,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAU,CAAA;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAiC,EACjC,OAAsB,EACtB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,6BAA6B,CAAC,CAAA;IACzE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1D,OAAO,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACjF,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,mCAAmC;IACnC,IAAI,MAA+B,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAc,MAAM,EAAE,GAAG,EAAE;gBACzD,UAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAA;YACF,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAA;YACzB,MAAK;QACP,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,6CAA6C;QAC7C,EAAE;QACF,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,8CAA8C;QAC9C,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,EAAE,CAAC;YACvC,IAAI,QAAuC,CAAA;YAC3C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,0CAA0C;gBAC1C,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;QAC7C,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAA;IAEpC,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtD,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC5C,CAAC;QACD,4EAA4E;QAC5E,qDAAqD;QACrD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,IAAI,GAAgB;QACxB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,IAAyB,EAAE,EAAE,EAAE,GAAG,EAAE;QACvD,IAAI,EAAE,IAAe;KACtB,CAAA;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEzC,0BAA0B;IAC1B,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,+BAA+B;IAC/B,EAAE;IACF,iEAAiE;IACjE,mEAAmE;IACnE,yEAAyE;IACzE,2EAA2E;IAC3E,yCAAyC;IACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IACrE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,kEAAkE;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE;QAClD,0EAA0E;QAC1E,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,UAAU,EAAE;YACV,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;YACzE,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;SACzF;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,10 @@
 export { createApi } from './server.js';
 export type { ApiOptions, AuditEvent, AuditQuery, AuditReader, AuditRecord, Reindex, ReindexOutcome, ReindexStatus, ReferenceQueries, ReferenceQuery, RecallCheck, AuditWriter, DocumentView, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, Layers, SearchHit, SearchOptions, SearchService, ServiceAccountPort, ServiceAccountView, } from './server.js';
-export { authenticate, findTenantOverride, rejectTenantOverride } from './auth.js';
-export type { AuthContext, VerifyOptions } from './auth.js';
+export { administers, administersTenants, authenticate, delegationPermits, findTenantOverride, rejectTenantOverride, withinDelegation, } from './auth.js';
+export type { AuthContext, Delegations, VerifyOptions } from './auth.js';
+export { postgresVerification } from './verification.js';
+export { PostgresDelegations, PostgresOAuthAuthorizations, PostgresOAuthClients, PostgresOAuthConsents, PostgresOAuthRefreshTokens, } from './oauth-store.js';
+export type { Consent, ConsentSubject, MintRequest, OAuthAuthorizations, OAuthClients, OAuthConsents, OAuthRefreshTokens, PendingAuthorization, RegisteredClient, } from './oauth-store.js';
 export { Problem, badRequest, forbidden, internal, notFound, unauthorized } from './errors.js';
 export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, PostgresWorkspaces, PostgresReferenceQueries, PostgresReindex, } from './adapters.js';
 export type { DocumentTombstone, Embedder, IngestDeps, ObjectStore, PrincipalsCache, SearchDeps, } from './adapters.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,OAAO,EACP,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAClF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,WAAW,EACX,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAK5F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC3F,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,OAAO,EACP,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,OAAO,EACP,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,WAAW,EACX,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAK5F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC3F,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,5 +1,7 @@
 export { createApi } from './server.js';
-export { authenticate, findTenantOverride, rejectTenantOverride } from './auth.js';
+export { administers, administersTenants, authenticate, delegationPermits, findTenantOverride, rejectTenantOverride, withinDelegation, } from './auth.js';
+export { postgresVerification } from './verification.js';
+export { PostgresDelegations, PostgresOAuthAuthorizations, PostgresOAuthClients, PostgresOAuthConsents, PostgresOAuthRefreshTokens, } from './oauth-store.js';
 export { Problem, badRequest, forbidden, internal, notFound, unauthorized } from './errors.js';
 export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, PostgresWorkspaces, PostgresReferenceQueries, PostgresReindex, } from './adapters.js';
 export { PostgresGroups, PostgresUsers, generatePassword, looksLikeEmail } from './principals.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAiCvC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAElF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,eAAe,CAAA;AAStB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEjG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAE1B,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,+CAA+C;AAC/C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE3F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAiCvC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAElB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AAYzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,eAAe,CAAA;AAStB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEjG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAE1B,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,+CAA+C;AAC/C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE3F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA"}

package/dist/main.js

@@ -7,7 +7,8 @@ import { PostgresOAuthAuthorizations, PostgresOAuthClients, PostgresOAuthConsent
 import { rerankerFor } from './rerank.js';
 import { RateLimiter } from './limits.js';
 import { PostgresGroups, PostgresUsers } from './principals.js';
-import { PostgresServiceAccounts, PostgresServiceKeys } from './service-keys.js';
+import { PostgresServiceAccounts } from './service-keys.js';
+import { postgresVerification } from './verification.js';
 import { createApi } from './server.js';
 /**
  * The REST API process.
@@ -185,7 +186,10 @@ async function main() {
             algorithms: [jwt.algorithm],
             issuer: config.jwtIssuer,
             audience: config.jwtAudience,
-            serviceKeys: new PostgresServiceKeys(pool, APP_ROLE),
+            // Both database-backed ports, from the one function that knows what a
+            // Postgres verifier is. See verification.ts — this used to be assembled
+            // by hand in three processes.
+            ...postgresVerification(pool, APP_ROLE),
         },
         metrics: registry,
         resourceMetadata: protectedResourceMetadata({
@@ -286,27 +290,40 @@ async function main() {
             refreshTtlSeconds: config.refreshTokenTtl,
             accessTtlSeconds: config.accessTokenTtl,
             /**
-             * A token for the **agent**, never for the person who approved it.
+             * A token for whatever the connection acts as.
              *
-             * `principal_type: 'service_account'` and `sub` is the account — the same
-             * claims a service account key resolves to, so everything downstream
-             * treats this exactly as it treats one and there is no second notion of
-             * what an agent is. `role` is `member` because a service account has no
-             * organization-wide role: everything it reaches, it reaches by grant.
+             * For an **agent**: `principal_type: 'service_account'` and `sub` is the
+             * account — the same claims a service account key resolves to, so
+             * everything downstream treats this exactly as it treats one and there is
+             * no second notion of what an agent is. `role` is `member` because a
+             * service account has no organization-wide role: everything it reaches,
+             * it reaches by grant.
+             *
+             * For a **delegation**: `principal_type: 'user'` and `sub` is the person,
+             * plus `del` naming the connection. The permitted set is deliberately not
+             * in here — a token carrying one would keep answering with the access its
+             * holder had at consent, and every revocation would wait for it to
+             * expire. `role` is carried for shape and is **not** what the request
+             * runs as: `authenticate` takes the role from the connection's row, so a
+             * demotion applies without waiting for the token to expire.
              */
             mint: async (approved) => {
                 const ttl = config.accessTokenTtl;
                 const now = Math.floor(Date.now() / 1000);
+                const delegated = approved.subject.actsAs === 'user';
                 const accessToken = await new SignJWT({
                     org: approved.orgId,
-                    principal_type: 'service_account',
+                    principal_type: delegated ? 'user' : 'service_account',
                     role: 'member',
+                    ...(delegated ? { del: approved.consentId } : {}),
                 })
                     .setProtectedHeader({
                     alg: jwt.algorithm,
                     ...(jwt.keyId === undefined ? {} : { kid: jwt.keyId }),
                 })
-                    .setSubject(approved.serviceAccountId)
+                    .setSubject(approved.subject.actsAs === 'user'
+                    ? approved.subject.userId
+                    : approved.subject.serviceAccountId)
                     .setIssuer(config.jwtIssuer)
                     .setAudience(config.jwtAudience)
                     .setIssuedAt(now)

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,KAAK,EACL,UAAU,EACV,QAAQ,EACR,EAAE,EACF,WAAW,EACX,iBAAiB,EACjB,OAAO,EACP,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC;;;;;;GAMG;AAEH,MAAM,QAAQ,GAAG,WAAW,CAAA;AAE5B,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAE3B,+EAA+E;IAC/E,+EAA+E;IAC/E,qCAAqC;IACrC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAEtE,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAEjC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,WAAW,CAC7B,MAAM,CAAC,YAAY,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE;QAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAC3D,CAAA;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAEvE,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACvC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAEhE,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEjD,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,iBAAiB;IACjB,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,eAAe,GAAG,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;IAGxF,MAAM,aAAa,GAAkC;QACnD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;QAC7D,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE;QAChE,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,aAAa,EAAE,GAAG,EAAE;QAC9D,uEAAuE;QACvE,wEAAwE;QACxE,4DAA4D;QAC5D,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,uBAAuB,EAAE,aAAa,EAAE,GAAG,EAAE;KAC5E,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;QAC7B,KAAK;QACL,QAAQ,EAAE,aAAa;QACvB,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9B,wEAAwE;YACxE,qEAAqE;YACrE,qEAAqE;YACrE,6CAA6C;YAC7C,EAAE;YACF,yEAAyE;YACzE,kEAAkE;YAClE,mEAAmE;YACnE,wCAAwC;YACxC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC9C,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,QAAQ;gBACnE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3C,CAAC;KACF,CAAC,CAAA;IAEF,oEAAoE;IACpE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAEpC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;QAClC,KAAK;QACL,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAClH,CAAC;KACF,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,IAAI;QACJ,0EAA0E;QAC1E,0EAA0E;QAC1E,OAAO;QACP,GAAG,EAAE,GAAG,CAAC,OAAO;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;QAC5B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,IAAI,EAAE,QAAQ;KACf,CAAC,CAAA;IAEF,oDAAoD;IACpD,EAAE;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,aAAa;IACb,MAAM,KAAK,GAAG,KAAK,IAAsC,EAAE;QACzD,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClE,OAAO,CAAC,IAAI,EAAE,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAChE,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBACzB,OAAO,IAAI,CAAA;YACb,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACzC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YAClC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YAC/B,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACvF,6DAA6D;YAC7D,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,mEAAmE;YACnE,sDAAsD;YACtD,EAAE;YACF,kEAAkE;YAClE,8DAA8D;YAC9D,EAAE;YACF,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;YACF,kEAAkE;YAClE,uEAAuE;YACvE,iCAAiC;YACjC,iBAAiB,CAAC,IAAI,CAAC;iBACpB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;gBACrC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBACzC,OAAO,EAAE,OAAO,CAAC,MAAM;oBACvB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;iBACjB,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,mEAAmE;gBACnE,qEAAqE;gBACrE,uCAAuC;gBACvC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC5E,OAAO,KAAK,CAAA;YACd,CAAC,CAAC;SACL,CAAC,CAAA;QACF,OAAO;YACL,QAAQ;YACR,MAAM;YACN,KAAK,EAAE,OAAO;YACd,MAAM;YACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SAC5C,CAAA;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,SAAS,CAAC;QACvB,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,YAAY;YACrB,yEAAyE;YACzE,kEAAkE;YAClE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YACtE,UAAU,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;YAC3B,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,WAAW,EAAE,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC;SACrD;QACD,OAAO,EAAE,QAAQ;QACjB,gBAAgB,EAAE,yBAAyB,CAAC;YAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,6DAA6D;YAC7D,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,iDAAiD;YACjD,mBAAmB,EACjB,MAAM,CAAC,wBAAwB,KAAK,EAAE;gBACpC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzC,CAAC,CAAC,MAAM,CAAC,wBAAwB;SACtC,CAAC;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,UAAU;QACV,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,0EAA0E;QAC1E,uEAAuE;QACvE,iCAAiC;QACjC,OAAO,EAAE,OAAO;QAChB,KAAK;QACL,YAAY,EAAE,MAAM,CAAC,gBAAgB;QACrC,qEAAqE;QACrE,mEAAmE;QACnE,aAAa,EAAE,OAAO,KAAK,SAAS;QACpC,MAAM;QACN,aAAa;QACb,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QACnF,WAAW;QACX,KAAK;QACL,WAAW,EAAE,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACrE,OAAO,EAAE,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC;QACtE,gBAAgB,EAAE,IAAI,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC/E,SAAS,EAAE,IAAI,iBAAiB,CAC9B,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,eAAe,EACf,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CACtE;QACD,MAAM,EAAE,IAAI,kBAAkB,CAAC;YAC7B,eAAe;YACf,IAAI;YACJ,OAAO;YACP,WAAW,EAAE,YAAY,CAAC,IAAI,EAAE;YAChC,IAAI,EAAE,QAAQ;YACd,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;gBACxB,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,mEAAmE;gBACnE,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YACtG,CAAC;SACF,CAAC;QACF,MAAM,EAAE,IAAI,WAAW,CAAC;YACtB,IAAI;YACJ,eAAe;YACf,SAAS,EAAE,OAAO;YAClB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACvD,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC;QACpE,UAAU,EAAE,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACnE,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC3D,eAAe,EAAE,IAAI,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC5D,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxC,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;QAE1C;;;;;;;;;WASG;QACH,KAAK,EAAE;YACL,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,iEAAiE;YACjE,wEAAwE;YACxE,yEAAyE;YACzE,+BAA+B;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,IAAI,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACjD,cAAc,EAAE,IAAI,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC/D,QAAQ,EAAE,IAAI,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACnD,aAAa,EAAE,IAAI,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC7D,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,yEAAyE;YACzE,iBAAiB,EAAE,MAAM,CAAC,eAAe;YACzC,gBAAgB,EAAE,MAAM,CAAC,cAAc;YACvC;;;;;;;;eAQG;YACH,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACvB,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAA;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;gBACzC,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;oBACpC,GAAG,EAAE,QAAQ,CAAC,KAAK;oBACnB,cAAc,EAAE,iBAAiB;oBACjC,IAAI,EAAE,QAAQ;iBACf,CAAC;qBACC,kBAAkB,CAAC;oBAClB,GAAG,EAAE,GAAG,CAAC,SAAS;oBAClB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;iBACvD,CAAC;qBACD,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC;qBACrC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;qBAC3B,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC;qBAC/B,WAAW,CAAC,GAAG,CAAC;qBAChB,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;qBAC5B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACpB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;YACxC,CAAC;SACF;KACF,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;IAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI;YAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;YACzC,uEAAuE;YACvE,kEAAkE;YAClE,mCAAmC;YACnC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7D,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,0CAA0C;YAC1C,UAAU,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IAElC,aAAa,CAAC;QACZ,OAAO,EAAE,KAAK;QACd,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,uEAAuE;QACvE,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YACnE,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,KAAK,EACL,UAAU,EACV,QAAQ,EACR,EAAE,EACF,WAAW,EACX,iBAAiB,EACjB,OAAO,EACP,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC;;;;;;GAMG;AAEH,MAAM,QAAQ,GAAG,WAAW,CAAA;AAE5B,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAE3B,+EAA+E;IAC/E,+EAA+E;IAC/E,qCAAqC;IACrC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAEtE,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAEjC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,WAAW,CAC7B,MAAM,CAAC,YAAY,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE;QAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAC3D,CAAA;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAEvE,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACvC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAEhE,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEjD,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,iBAAiB;IACjB,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,eAAe,GAAG,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;IAGxF,MAAM,aAAa,GAAkC;QACnD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;QAC7D,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE;QAChE,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,aAAa,EAAE,GAAG,EAAE;QAC9D,uEAAuE;QACvE,wEAAwE;QACxE,4DAA4D;QAC5D,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,uBAAuB,EAAE,aAAa,EAAE,GAAG,EAAE;KAC5E,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;QAC7B,KAAK;QACL,QAAQ,EAAE,aAAa;QACvB,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9B,wEAAwE;YACxE,qEAAqE;YACrE,qEAAqE;YACrE,6CAA6C;YAC7C,EAAE;YACF,yEAAyE;YACzE,kEAAkE;YAClE,mEAAmE;YACnE,wCAAwC;YACxC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC9C,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,QAAQ;gBACnE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3C,CAAC;KACF,CAAC,CAAA;IAEF,oEAAoE;IACpE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAEpC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;QAClC,KAAK;QACL,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAClH,CAAC;KACF,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,IAAI;QACJ,0EAA0E;QAC1E,0EAA0E;QAC1E,OAAO;QACP,GAAG,EAAE,GAAG,CAAC,OAAO;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;QAC5B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,IAAI,EAAE,QAAQ;KACf,CAAC,CAAA;IAEF,oDAAoD;IACpD,EAAE;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,aAAa;IACb,MAAM,KAAK,GAAG,KAAK,IAAsC,EAAE;QACzD,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClE,OAAO,CAAC,IAAI,EAAE,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAChE,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBACzB,OAAO,IAAI,CAAA;YACb,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACzC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YAClC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YAC/B,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACvF,6DAA6D;YAC7D,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,mEAAmE;YACnE,sDAAsD;YACtD,EAAE;YACF,kEAAkE;YAClE,8DAA8D;YAC9D,EAAE;YACF,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;YACF,kEAAkE;YAClE,uEAAuE;YACvE,iCAAiC;YACjC,iBAAiB,CAAC,IAAI,CAAC;iBACpB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;gBACrC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBACzC,OAAO,EAAE,OAAO,CAAC,MAAM;oBACvB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;iBACjB,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,mEAAmE;gBACnE,qEAAqE;gBACrE,uCAAuC;gBACvC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC5E,OAAO,KAAK,CAAA;YACd,CAAC,CAAC;SACL,CAAC,CAAA;QACF,OAAO;YACL,QAAQ;YACR,MAAM;YACN,KAAK,EAAE,OAAO;YACd,MAAM;YACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SAC5C,CAAA;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,SAAS,CAAC;QACvB,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,YAAY;YACrB,yEAAyE;YACzE,kEAAkE;YAClE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YACtE,UAAU,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;YAC3B,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,sEAAsE;YACtE,wEAAwE;YACxE,8BAA8B;YAC9B,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC;SACxC;QACD,OAAO,EAAE,QAAQ;QACjB,gBAAgB,EAAE,yBAAyB,CAAC;YAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,6DAA6D;YAC7D,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,iDAAiD;YACjD,mBAAmB,EACjB,MAAM,CAAC,wBAAwB,KAAK,EAAE;gBACpC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzC,CAAC,CAAC,MAAM,CAAC,wBAAwB;SACtC,CAAC;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,UAAU;QACV,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,0EAA0E;QAC1E,uEAAuE;QACvE,iCAAiC;QACjC,OAAO,EAAE,OAAO;QAChB,KAAK;QACL,YAAY,EAAE,MAAM,CAAC,gBAAgB;QACrC,qEAAqE;QACrE,mEAAmE;QACnE,aAAa,EAAE,OAAO,KAAK,SAAS;QACpC,MAAM;QACN,aAAa;QACb,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QACnF,WAAW;QACX,KAAK;QACL,WAAW,EAAE,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACrE,OAAO,EAAE,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC;QACtE,gBAAgB,EAAE,IAAI,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC/E,SAAS,EAAE,IAAI,iBAAiB,CAC9B,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,eAAe,EACf,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CACtE;QACD,MAAM,EAAE,IAAI,kBAAkB,CAAC;YAC7B,eAAe;YACf,IAAI;YACJ,OAAO;YACP,WAAW,EAAE,YAAY,CAAC,IAAI,EAAE;YAChC,IAAI,EAAE,QAAQ;YACd,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;gBACxB,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,mEAAmE;gBACnE,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YACtG,CAAC;SACF,CAAC;QACF,MAAM,EAAE,IAAI,WAAW,CAAC;YACtB,IAAI;YACJ,eAAe;YACf,SAAS,EAAE,OAAO;YAClB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACvD,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC;QACpE,UAAU,EAAE,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACnE,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC3D,eAAe,EAAE,IAAI,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC5D,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxC,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;QAE1C;;;;;;;;;WASG;QACH,KAAK,EAAE;YACL,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,iEAAiE;YACjE,wEAAwE;YACxE,yEAAyE;YACzE,+BAA+B;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,IAAI,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACjD,cAAc,EAAE,IAAI,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC/D,QAAQ,EAAE,IAAI,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACnD,aAAa,EAAE,IAAI,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC7D,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,yEAAyE;YACzE,iBAAiB,EAAE,MAAM,CAAC,eAAe;YACzC,gBAAgB,EAAE,MAAM,CAAC,cAAc;YACvC;;;;;;;;;;;;;;;;;eAiBG;YACH,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACvB,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAA;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;gBACzC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAA;gBACpD,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;oBACpC,GAAG,EAAE,QAAQ,CAAC,KAAK;oBACnB,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB;oBACtD,IAAI,EAAE,QAAQ;oBACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD,CAAC;qBACC,kBAAkB,CAAC;oBAClB,GAAG,EAAE,GAAG,CAAC,SAAS;oBAClB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;iBACvD,CAAC;qBACD,UAAU,CACT,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;oBAChC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM;oBACzB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CACtC;qBACA,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;qBAC3B,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC;qBAC/B,WAAW,CAAC,GAAG,CAAC;qBAChB,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;qBAC5B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACpB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;YACxC,CAAC;SACF;KACF,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;IAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI;YAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;YACzC,uEAAuE;YACvE,kEAAkE;YAClE,mCAAmC;YACnC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7D,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,0CAA0C;YAC1C,UAAU,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IAElC,aAAa,CAAC;QACZ,OAAO,EAAE,KAAK;QACd,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,uEAAuE;QACvE,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YACnE,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/oauth-store.d.ts

@@ -8,36 +8,90 @@
  * the moment it exists, because it names a service account, and every statement
  * against it goes through `withOrg`.
  */
+import { type OrgRole, type Permission } from '@nacre.work/core';
 import type { Pool } from 'pg';
-import type { AuthContext } from './auth.js';
+import type { AuthContext, Delegations } from './auth.js';
 export interface RegisteredClient {
     readonly clientId: string;
     readonly clientName: string;
     readonly redirectUris: readonly string[];
 }
-/** A standing connection: this application, acting as this agent. */
+/**
+ * What a connection acts as.
+ *
+ * A discriminated union rather than a nullable id, which is migration 0025's
+ * argument carried into the code: inferring "this is a delegation" from a null
+ * puts a guess on the issuance path, and the two modes mint different tokens.
+ */
+export type ConsentSubject = {
+    readonly actsAs: 'service_account';
+    readonly serviceAccountId: string;
+}
+/** A delegation. `userId` is the person who approved it — see docs/authz.md. */
+ | {
+    readonly actsAs: 'user';
+    readonly userId: string;
+};
+/** A standing connection: this application, acting as this agent or as a person. */
 export interface Consent {
     readonly id: string;
     readonly clientId: string;
     readonly clientName: string;
-    readonly serviceAccountId: string;
-    readonly serviceAccountName: string;
+    readonly subject: ConsentSubject;
+    /** The agent's name, for a connection that has one. */
+    readonly serviceAccountName: string | null;
     readonly approvedBy: string;
+    /**
+     * The layers a delegation was narrowed to at consent, if any.
+     *
+     * Empty means **no narrowing**, never "narrowed to nothing" — the two are
+     * opposite, and the table deliberately cannot express the second.
+     */
+    readonly layers: readonly string[];
+    /**
+     * The permissions a delegation may exercise. Empty means no ceiling — it
+     * reaches every verb its person holds.
+     */
+    readonly permissions: readonly Permission[];
     readonly createdAt: string;
     readonly lastRefreshedAt: string | null;
     readonly revokedAt: string | null;
 }
-/** A consent that has been given and not yet exchanged. */
-export interface PendingAuthorization {
+/**
+ * What a token is minted for.
+ *
+ * A union rather than a record with two optional halves, so the delegated case
+ * **cannot** be constructed without the connection it names. The `del` claim is
+ * that connection's id and the authentication path refuses a token whose
+ * delegation does not resolve, so a delegated token minted with nothing to
+ * point at would be one nobody can ever use — and a type is a cheaper place to
+ * learn that than a running deployment.
+ *
+ * `consentId` is optional on the service-account side only, because 0023 wrote
+ * authorization codes before 0024 gave connections a table.
+ */
+export type MintRequest = {
     readonly orgId: string;
-    /** The standing connection this code belongs to. */
+    readonly subject: {
+        readonly actsAs: 'service_account';
+        readonly serviceAccountId: string;
+    };
     readonly consentId?: string;
-    readonly serviceAccountId: string;
+} | {
+    readonly orgId: string;
+    readonly subject: {
+        readonly actsAs: 'user';
+        readonly userId: string;
+    };
+    readonly consentId: string;
+};
+/** A consent that has been given and not yet exchanged. */
+export type PendingAuthorization = MintRequest & {
     readonly clientId: string;
     readonly redirectUri: string;
     readonly codeChallenge: string;
     readonly resource?: string;
-}
+};
 export interface OAuthClients {
     register(name: string, redirectUris: readonly string[], clientId: string): Promise<RegisteredClient>;
     find(clientId: string): Promise<RegisteredClient | undefined>;
@@ -50,7 +104,21 @@ export interface OAuthConsents {
      * full of duplicates is one where ending a connection leaves the others
      * working.
      */
-    record(auth: AuthContext, clientId: string, serviceAccountId: string): Promise<string>;
+    record(auth: AuthContext, clientId: string, subject: ConsentSubject, 
+    /**
+     * The layers a delegation is restricted to. Replaced wholesale on
+     * re-approval, because a person reconnecting an application is answering
+     * the narrowing question again rather than adding to a previous answer.
+     */
+    layers?: readonly string[], 
+    /**
+     * The permissions a delegation may exercise. Absent is no ceiling.
+     *
+     * Replaced wholesale for the same reason as `layers`, and empty is
+     * deliberately not storable: a delegation that can do nothing is not a
+     * restriction anybody meant to write, and the database refuses one.
+     */
+    permissions?: readonly Permission[]): Promise<string>;
     /**
      * Every connection this caller may see.
      *
@@ -76,12 +144,10 @@ export interface OAuthRefreshTokens {
      * a token already spent means two holders have it and there is no way to tell
      * which is genuine, so the whole family is ended rather than the one token.
      */
-    rotate(token: string): Promise<{
-        orgId: string;
-        consentId: string;
-        serviceAccountId: string;
-        family: string;
-    } | undefined>;
+    rotate(token: string): Promise<(MintRequest & {
+        readonly consentId: string;
+        readonly family: string;
+    }) | undefined>;
 }
 export interface OAuthAuthorizations {
     /** Records a consent and returns nothing: the code is the caller's to hand back. */
@@ -119,7 +185,7 @@ export declare class PostgresOAuthConsents implements OAuthConsents {
     private readonly pool;
     private readonly role?;
     constructor(pool: Pool, role?: string | undefined);
-    record(auth: AuthContext, clientId: string, serviceAccountId: string): Promise<string>;
+    record(auth: AuthContext, clientId: string, subject: ConsentSubject, layers?: readonly string[], permissions?: readonly Permission[]): Promise<string>;
     list(auth: AuthContext): Promise<readonly Consent[]>;
     revoke(auth: AuthContext, id: string): Promise<boolean>;
 }
@@ -128,11 +194,30 @@ export declare class PostgresOAuthRefreshTokens implements OAuthRefreshTokens {
     private readonly role?;
     constructor(pool: Pool, role?: string | undefined);
     issue(orgId: string, consentId: string, token: string, family: string | undefined, expiresAt: Date): Promise<string>;
-    rotate(token: string): Promise<{
-        orgId: string;
-        consentId: string;
-        serviceAccountId: string;
-        family: string;
+    rotate(token: string): Promise<(MintRequest & {
+        readonly consentId: string;
+        readonly family: string;
+    }) | undefined>;
+}
+/**
+ * The one read docs/authz.md puts before `resolve` on a delegated request.
+ *
+ * Its whole job is to be *current*. Everything a JWT can say was true when it
+ * was signed; whether this authority may still be exercised changes when an
+ * administrator acts, and that question has no answer in a token.
+ *
+ * One statement, joined by primary key, inside `withOrg` — the organization
+ * comes from the token, so unlike a refresh token there is no cross-tenant
+ * lookup here and no `app.authenticating` shape to it.
+ */
+export declare class PostgresDelegations implements Delegations {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    resolve(orgId: string, id: string): Promise<{
+        userId: string;
+        role: OrgRole;
+        layers?: readonly string[];
     } | undefined>;
 }
 //# sourceMappingURL=oauth-store.d.ts.map

package/dist/oauth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../src/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAE9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED,qEAAqE;AACrE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,oDAAoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACpG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACtF;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IACpD;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpH;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;CAC3H;AAED,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1G;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAChE;AAED,qBAAa,oBAAqB,YAAW,YAAY;IAErD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC;IActB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;CAWpE;AAED,qBAAa,2BAA4B,YAAW,mBAAmB;IAEnE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,OAAO,CACX,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,oBAAoB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IA4BV,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAiEtE;AAED,qBAAa,qBAAsB,YAAW,aAAa;IAEvD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBtF,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;IA8CpD,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA8B9D;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IAEjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,KAAK,CACT,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,IAAI,GACd,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CA4EvG"}
+{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../src/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAA0C,KAAK,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAG9B,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE;AAC3E,gFAAgF;GAC9E;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAExD,oFAAoF;AACpF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B,GACD;IACE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAEL,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACpG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE;IAC1B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,GAClC,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IACpD;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpH;;;;;;OAMG;IACH,MAAM,CACJ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,WAAW,GAAG;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC,CAAA;CAChG;AAED,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1G;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAChE;AAED,qBAAa,oBAAqB,YAAW,YAAY;IAErD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC;IActB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;CAWpE;AAED,qBAAa,2BAA4B,YAAW,mBAAmB;IAEnE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,OAAO,CACX,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,oBAAoB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IA6BV,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAgFtE;AAED,qBAAa,qBAAsB,YAAW,aAAa;IAEvD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,EAC1B,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,GAClC,OAAO,CAAC,MAAM,CAAC;IAgEZ,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;IA4DpD,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA8B9D;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IAEjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,KAAK,CACT,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,IAAI,GACd,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,WAAW,GAAG;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;CAkGhG;AAED;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IAEnD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,OAAO,CACX,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,SAAS,CAAC;CA0DtF"}