@noodleseed/one 0.99.1 → 0.100.0

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-store-postgres.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-store-postgres.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAG3C,OAAO,EACL,KAAK,4BAA4B,EAEjC,KAAK,iBAAiB,EACtB,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EAEvB,KAAK,aAAa,EAGlB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAEjB,KAAK,6BAA6B,EAClC,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAK1B,MAAM,8BAA8B,CAAC;AAgDtC,6FAA6F;AAC7F,qBAAa,6BAA8B,YAAW,qBAAqB;;gBAI7D,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO;IAK7D,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,eAAe,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAkBpF,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC;IAUvE,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IA4B5E,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB3D,WAAW,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAyC1F,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBnD,gBAAgB,CACpB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,gCAAgC,CAAC;IA0DtC,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7D,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC;IA0C9C,qBAAqB,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B7E,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;CAqCtE"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres.js

@@ -0,0 +1,359 @@
+import { randomUUID } from 'node:crypto';
+import { validateSlug } from '../store/validate.js';
+import { validatePublicJwk } from './service-principal-credentials.js';
+import { currentServicePrincipalDate, normalizeServicePrincipalExpiry, normalizeServicePrincipalScopes, publicServicePrincipalCredential, validateServicePrincipalActor, validateServicePrincipalDisplayName, validateServicePrincipalEpoch, validateServicePrincipalSecretDigest, } from './service-principal-store.js';
+import { ensureServicePrincipalSchema } from './service-principal-store-postgres-schema.js';
+/** Durable, organization-isolated service-principal lifecycle and assertion replay store. */
+export class PostgresServicePrincipalStore {
+    #pool;
+    #now;
+    constructor(pool, options = {}) {
+        this.#pool = pool;
+        this.#now = options.now ?? (() => new Date());
+    }
+    async ensureSchema() {
+        await ensureServicePrincipalSchema(this.#pool);
+    }
+    async createPrincipal(input) {
+        const now = currentServicePrincipalDate(this.#now);
+        const values = {
+            principalId: `spn_${randomUUID()}`,
+            org: validateSlug('org', input.org),
+            name: validateServicePrincipalDisplayName('service-principal name', input.name),
+            actor: validateServicePrincipalActor(input.actorSubject),
+        };
+        const { rows } = await this.#pool.query(`INSERT INTO oauth_service_principals
+        (principal_id, org_slug, name, status, created_by_subject, created_at, updated_at)
+       VALUES ($1, $2, $3, 'active', $4, $5, $5)
+       RETURNING *`, [values.principalId, values.org, values.name, values.actor, now]);
+        return principalFromRow(requireRow(rows[0], 'service-principal create'));
+    }
+    async listPrincipals(org) {
+        const normalizedOrg = validateSlug('org', org);
+        const { rows } = await this.#pool.query(`SELECT * FROM oauth_service_principals
+       WHERE org_slug = $1 ORDER BY principal_id`, [normalizedOrg]);
+        return rows.map(principalFromRow);
+    }
+    async getPrincipal(input) {
+        const org = validateSlug('org', input.org);
+        const { rows } = await this.#pool.query(`SELECT * FROM oauth_service_principals
+       WHERE principal_id = $1 AND org_slug = $2`, [input.principalId, org]);
+        const principal = rows[0];
+        if (principal === undefined)
+            return undefined;
+        const [grants, credentials] = await Promise.all([
+            this.#pool.query(`SELECT * FROM oauth_service_principal_grants
+         WHERE principal_id = $1 ORDER BY grant_id`, [input.principalId]),
+            this.#pool.query(`SELECT * FROM oauth_service_principal_credentials
+         WHERE principal_id = $1 ORDER BY credential_id`, [input.principalId]),
+        ]);
+        return {
+            principal: principalFromRow(principal),
+            grants: grants.rows.map(grantFromRow),
+            credentials: credentials.rows.map(credentialFromRow).map(publicServicePrincipalCredential),
+        };
+    }
+    async revokePrincipal(input) {
+        const org = validateSlug('org', input.org);
+        const actor = validateServicePrincipalActor(input.actorSubject);
+        const now = currentServicePrincipalDate(this.#now);
+        const { rows } = await this.#pool.query(`UPDATE oauth_service_principals SET
+         status = 'revoked', updated_at = CASE WHEN status = 'active' THEN $3 ELSE updated_at END,
+         revoked_at = COALESCE(revoked_at, $3),
+         revoked_by_subject = COALESCE(revoked_by_subject, $4)
+       WHERE principal_id = $1 AND org_slug = $2
+       RETURNING *`, [input.principalId, org, now, actor]);
+        return rows[0] !== undefined;
+    }
+    async createGrant(input) {
+        const org = validateSlug('org', input.org);
+        const app = validateSlug('app', input.app);
+        const environment = validateSlug('env', input.environment);
+        const scopes = normalizeServicePrincipalScopes(input.scopes);
+        const actor = validateServicePrincipalActor(input.actorSubject);
+        const now = currentServicePrincipalDate(this.#now);
+        return this.#transaction(async (client) => {
+            await requireActivePrincipal(client, input.principalId, org);
+            const existing = await client.query(`SELECT 1 FROM oauth_service_principal_grants
+         WHERE principal_id = $1 AND app_slug = $2 AND environment = $3 AND status = 'active'`, [input.principalId, app, environment]);
+            if (existing.rowCount !== 0) {
+                throw new Error('service principal already has an active grant for this app and environment');
+            }
+            try {
+                const { rows } = await client.query(`INSERT INTO oauth_service_principal_grants
+            (grant_id, principal_id, org_slug, app_slug, environment, scopes, status,
+             created_by_subject, created_at, updated_at)
+           VALUES ($1, $2, $3, $4, $5, $6, 'active', $7, $8, $8)
+           RETURNING *`, [`spg_${randomUUID()}`, input.principalId, org, app, environment, scopes, actor, now]);
+                return grantFromRow(requireRow(rows[0], 'service-principal grant create'));
+            }
+            catch (error) {
+                if (isUniqueViolation(error)) {
+                    throw new Error('service principal already has an active grant for this app and environment', { cause: error });
+                }
+                throw error;
+            }
+        });
+    }
+    async revokeGrant(input) {
+        const org = validateSlug('org', input.org);
+        const actor = validateServicePrincipalActor(input.actorSubject);
+        const now = currentServicePrincipalDate(this.#now);
+        return this.#transaction(async (client) => {
+            const principal = await ownedPrincipal(client, input.principalId, org, true);
+            if (principal === undefined)
+                return false;
+            const { rows } = await client.query(`UPDATE oauth_service_principal_grants SET
+           status = 'revoked', updated_at = CASE WHEN status = 'active' THEN $3 ELSE updated_at END,
+           revoked_at = COALESCE(revoked_at, $3),
+           revoked_by_subject = COALESCE(revoked_by_subject, $4)
+         WHERE grant_id = $1 AND principal_id = $2
+         RETURNING *`, [input.grantId, input.principalId, now, actor]);
+            return rows[0] !== undefined;
+        });
+    }
+    async createCredential(input) {
+        const org = validateSlug('org', input.org);
+        const actor = validateServicePrincipalActor(input.actorSubject);
+        const label = validateServicePrincipalDisplayName('credential label', input.label);
+        const now = currentServicePrincipalDate(this.#now);
+        const expiresAt = normalizeServicePrincipalExpiry(input.expiresAt, now);
+        const material = input.kind === 'client_secret'
+            ? {
+                algorithm: null,
+                kid: null,
+                publicJwk: null,
+                secretDigest: validateServicePrincipalSecretDigest(input.secretDigest),
+            }
+            : await validatePublicJwk(input.publicJwk, input.algorithm).then((validated) => ({
+                algorithm: validated.algorithm,
+                kid: typeof validated.publicJwk.kid === 'string' ? validated.publicJwk.kid : null,
+                publicJwk: validated.publicJwk,
+                secretDigest: null,
+            }));
+        return this.#transaction(async (client) => {
+            await requireActivePrincipal(client, input.principalId, org);
+            const { rows: counts } = await client.query(`SELECT count(*)::text AS count FROM oauth_service_principal_credentials
+         WHERE principal_id = $1 AND kind = $2 AND status = 'active'
+           AND (expires_at IS NULL OR expires_at > $3)`, [input.principalId, input.kind, now]);
+            if (Number(requireRow(counts[0], 'service-principal credential count').count) >= 5) {
+                throw new Error(`service principal may have at most five active ${input.kind} credentials`);
+            }
+            const { rows } = await client.query(`INSERT INTO oauth_service_principal_credentials
+          (credential_id, principal_id, org_slug, kind, label, algorithm, kid, public_jwk,
+           secret_digest, status, created_by_subject, created_at, updated_at, expires_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, 'active', $10, $11, $11, $12)
+         RETURNING *`, [
+                `spc_${randomUUID()}`,
+                input.principalId,
+                org,
+                input.kind,
+                label,
+                material.algorithm,
+                material.kid,
+                material.publicJwk,
+                material.secretDigest,
+                actor,
+                now,
+                expiresAt ?? null,
+            ]);
+            return publicServicePrincipalCredential(credentialFromRow(requireRow(rows[0], 'service-principal credential create')));
+        });
+    }
+    async revokeCredential(input) {
+        const org = validateSlug('org', input.org);
+        const actor = validateServicePrincipalActor(input.actorSubject);
+        const now = currentServicePrincipalDate(this.#now);
+        return this.#transaction(async (client) => {
+            const principal = await ownedPrincipal(client, input.principalId, org, true);
+            if (principal === undefined)
+                return false;
+            const { rows } = await client.query(`UPDATE oauth_service_principal_credentials SET
+           status = 'revoked', updated_at = CASE WHEN status = 'active' THEN $3 ELSE updated_at END,
+           revoked_at = COALESCE(revoked_at, $3),
+           revoked_by_subject = COALESCE(revoked_by_subject, $4)
+         WHERE credential_id = $1 AND principal_id = $2
+         RETURNING *`, [input.credentialId, input.principalId, now, actor]);
+            return rows[0] !== undefined;
+        });
+    }
+    async loadActiveClient(clientId, now) {
+        validateServicePrincipalEpoch('authorization time', now);
+        const client = await this.#pool.connect();
+        try {
+            await client.query('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
+            const { rows } = await client.query(`SELECT * FROM oauth_service_principals
+         WHERE principal_id = $1 AND status = 'active'`, [clientId]);
+            const principal = rows[0];
+            if (principal === undefined) {
+                await client.query('COMMIT');
+                return undefined;
+            }
+            const [grants, credentials] = await Promise.all([
+                client.query(`SELECT * FROM oauth_service_principal_grants
+           WHERE principal_id = $1 AND status = 'active' ORDER BY grant_id`, [clientId]),
+                client.query(`SELECT * FROM oauth_service_principal_credentials
+           WHERE principal_id = $1 AND status = 'active'
+             AND (expires_at IS NULL OR expires_at > $2) ORDER BY credential_id`, [clientId, new Date(now)]),
+            ]);
+            await client.query('COMMIT');
+            return {
+                principal: principalFromRow(principal),
+                grants: grants.rows.map(grantFromRow),
+                credentials: credentials.rows.map(credentialFromRow),
+            };
+        }
+        catch (error) {
+            await rollbackQuietly(client);
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+    async validateAccessBinding(input) {
+        validateServicePrincipalEpoch('authorization time', input.now);
+        const { rowCount } = await this.#pool.query(`SELECT 1
+       FROM oauth_service_principals p
+       JOIN oauth_service_principal_grants g
+         ON g.principal_id = p.principal_id AND g.org_slug = p.org_slug
+       JOIN oauth_service_principal_credentials c
+         ON c.principal_id = p.principal_id AND c.org_slug = p.org_slug
+       WHERE p.principal_id = $1 AND p.org_slug = $2 AND p.status = 'active'
+         AND g.grant_id = $3 AND g.app_slug = $4 AND g.environment = $5 AND g.status = 'active'
+         AND c.credential_id = $6 AND c.status = 'active'
+         AND (c.expires_at IS NULL OR c.expires_at > $7)`, [
+            input.principalId,
+            input.org,
+            input.grantId,
+            input.app,
+            input.environment,
+            input.credentialId,
+            new Date(input.now),
+        ]);
+        return rowCount === 1;
+    }
+    async consumeAssertionJti(input) {
+        validateServicePrincipalEpoch('assertion time', input.now);
+        validateServicePrincipalEpoch('assertion expiry', input.expiresAt);
+        if (input.expiresAt <= input.now)
+            throw new Error('assertion expiry must be in the future');
+        if (input.jti.length < 1 || input.jti.length > 200) {
+            throw new Error('assertion jti must be between 1 and 200 characters');
+        }
+        return this.#transaction(async (client) => {
+            await client.query('DELETE FROM oauth_client_assertion_nonces WHERE expires_at <= $1', [
+                new Date(input.now),
+            ]);
+            const result = await client.query(`INSERT INTO oauth_client_assertion_nonces
+          (credential_id, jti, expires_at, created_at)
+         VALUES ($1, $2, $3, $4)
+         ON CONFLICT (credential_id, jti) DO NOTHING
+         RETURNING credential_id`, [input.credentialId, input.jti, new Date(input.expiresAt), new Date(input.now)]);
+            return result.rowCount === 1;
+        });
+    }
+    async #transaction(work) {
+        const client = await this.#pool.connect();
+        try {
+            await client.query('BEGIN');
+            const result = await work(client);
+            await client.query('COMMIT');
+            return result;
+        }
+        catch (error) {
+            await rollbackQuietly(client);
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+}
+async function ownedPrincipal(client, principalId, org, strict) {
+    const { rows } = await client.query('SELECT * FROM oauth_service_principals WHERE principal_id = $1 FOR UPDATE', [principalId]);
+    const principal = rows[0];
+    if (principal === undefined || principal.org_slug === org)
+        return principal;
+    if (strict)
+        throw new Error('service principal belongs to a different organization');
+    return undefined;
+}
+async function requireActivePrincipal(client, principalId, org) {
+    const principal = await ownedPrincipal(client, principalId, org, true);
+    if (principal === undefined)
+        throw new Error('service principal does not exist');
+    if (principal.status !== 'active')
+        throw new Error('service principal is revoked');
+    return principal;
+}
+function principalFromRow(row) {
+    return {
+        principalId: row.principal_id,
+        org: row.org_slug,
+        name: row.name,
+        status: row.status,
+        createdBySubject: row.created_by_subject,
+        createdAt: row.created_at.toISOString(),
+        updatedAt: row.updated_at.toISOString(),
+        ...(row.revoked_at === null ? {} : { revokedAt: row.revoked_at.toISOString() }),
+        ...(row.revoked_by_subject === null ? {} : { revokedBySubject: row.revoked_by_subject }),
+    };
+}
+function grantFromRow(row) {
+    return {
+        grantId: row.grant_id,
+        principalId: row.principal_id,
+        org: row.org_slug,
+        app: row.app_slug,
+        environment: row.environment,
+        scopes: Object.freeze([...row.scopes]),
+        status: row.status,
+        createdBySubject: row.created_by_subject,
+        createdAt: row.created_at.toISOString(),
+        updatedAt: row.updated_at.toISOString(),
+        ...(row.revoked_at === null ? {} : { revokedAt: row.revoked_at.toISOString() }),
+        ...(row.revoked_by_subject === null ? {} : { revokedBySubject: row.revoked_by_subject }),
+    };
+}
+function credentialFromRow(row) {
+    const lifecycle = {
+        credentialId: row.credential_id,
+        principalId: row.principal_id,
+        label: row.label,
+        status: row.status,
+        createdBySubject: row.created_by_subject,
+        createdAt: row.created_at.toISOString(),
+        updatedAt: row.updated_at.toISOString(),
+        ...(row.expires_at === null ? {} : { expiresAt: row.expires_at.toISOString() }),
+        ...(row.revoked_at === null ? {} : { revokedAt: row.revoked_at.toISOString() }),
+        ...(row.revoked_by_subject === null ? {} : { revokedBySubject: row.revoked_by_subject }),
+    };
+    if (row.kind === 'client_secret') {
+        if (row.secret_digest === null)
+            throw new Error('stored client secret is missing its digest');
+        return { ...lifecycle, kind: 'client_secret', secretDigest: row.secret_digest };
+    }
+    if (row.algorithm === null || row.public_jwk === null) {
+        throw new Error('stored public-key credential is missing its signing material');
+    }
+    return {
+        ...lifecycle,
+        kind: 'public_jwk',
+        algorithm: row.algorithm,
+        publicJwk: structuredClone(row.public_jwk),
+        ...(row.kid === null ? {} : { kid: row.kid }),
+    };
+}
+function requireRow(row, label) {
+    if (row === undefined)
+        throw new Error(`${label} returned no row`);
+    return row;
+}
+function isUniqueViolation(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === '23505';
+}
+async function rollbackQuietly(client) {
+    await client.query('ROLLBACK').catch(() => undefined);
+}
+//# sourceMappingURL=service-principal-store-postgres.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-store-postgres.js","sourceRoot":"","sources":["../../src/oauth/service-principal-store-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAQL,2BAA2B,EAE3B,+BAA+B,EAC/B,+BAA+B,EAG/B,gCAAgC,EAOhC,6BAA6B,EAC7B,mCAAmC,EACnC,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AA+C5F,6FAA6F;AAC7F,MAAM,OAAO,6BAA6B;IAC/B,KAAK,CAAO;IACZ,IAAI,CAAa;IAE1B,YAAY,IAAU,EAAE,UAAyC,EAAE;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAkC;QACtD,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG;YACb,WAAW,EAAE,OAAO,UAAU,EAAE,EAAE;YAClC,GAAG,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;YACnC,IAAI,EAAE,mCAAmC,CAAC,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC;YAC/E,KAAK,EAAE,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC;SACzD,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;mBAGa,EACb,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CACjE,CAAC;QACF,OAAO,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;iDAC2C,EAC3C,CAAC,aAAa,CAAC,CAChB,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAmB;QACpC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;iDAC2C,EAC3C,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CACzB,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,CACd;mDAC2C,EAC3C,CAAC,KAAK,CAAC,WAAW,CAAC,CACpB;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,CACd;wDACgD,EAChD,CAAC,KAAK,CAAC,WAAW,CAAC,CACpB;SACF,CAAC,CAAC;QACH,OAAO;YACL,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC;YACtC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACrC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC;SAC3F,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAwB;QAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;;mBAKa,EACb,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CACrC,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuC;QACvD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;8FACsF,EACtF,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,CAAC,CACtC,CAAC;YACF,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;uBAIa,EACb,CAAC,OAAO,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CACtF,CAAC;gBACF,OAAO,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,4EAA4E,EAC5E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAoB;QACpC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7E,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;;qBAKa,EACb,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAC/C,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,KAAkC;QAElC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,mCAAmC,CAAC,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,+BAA+B,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,QAAQ,GACZ,KAAK,CAAC,IAAI,KAAK,eAAe;YAC5B,CAAC,CAAC;gBACE,SAAS,EAAE,IAAI;gBACf,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,oCAAoC,CAAC,KAAK,CAAC,YAAY,CAAC;aACvE;YACH,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC7E,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,GAAG,EAAE,OAAO,SAAS,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;gBACjF,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC,CAAC;QACV,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACzC;;uDAE+C,EAC/C,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CACrC,CAAC;YACF,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;qBAIa,EACb;gBACE,OAAO,UAAU,EAAE,EAAE;gBACrB,KAAK,CAAC,WAAW;gBACjB,GAAG;gBACH,KAAK,CAAC,IAAI;gBACV,KAAK;gBACL,QAAQ,CAAC,SAAS;gBAClB,QAAQ,CAAC,GAAG;gBACZ,QAAQ,CAAC,SAAS;gBAClB,QAAQ,CAAC,YAAY;gBACrB,KAAK;gBACL,GAAG;gBACH,SAAS,IAAI,IAAI;aAClB,CACF,CAAC;YACF,OAAO,gCAAgC,CACrC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,qCAAqC,CAAC,CAAC,CAC9E,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAyB;QAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7E,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;;qBAKa,EACb,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CACpD,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,GAAW;QAEX,6BAA6B,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACtE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;uDAC+C,EAC/C,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9C,MAAM,CAAC,KAAK,CACV;2EACiE,EACjE,CAAC,QAAQ,CAAC,CACX;gBACD,MAAM,CAAC,KAAK,CACV;;gFAEsE,EACtE,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAC1B;aACF,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO;gBACL,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC;gBACtC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;gBACrC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;aACrD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAAoC;QAC9D,6BAA6B,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACzC;;;;;;;;;yDASmD,EACnD;YACE,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,GAAG;YACT,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,GAAG;YACT,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,YAAY;YAClB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;SACpB,CACF,CAAC;QACF,OAAO,QAAQ,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAwB;QAChD,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,6BAA6B,CAAC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,MAAM,CAAC,KAAK,CAAC,kEAAkE,EAAE;gBACrF,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;aACpB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;;;iCAIyB,EACzB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAChF,CAAC;YACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAI,IAAwC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,cAAc,CAC3B,MAAkB,EAClB,WAAmB,EACnB,GAAW,EACX,MAAe;IAEf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,2EAA2E,EAC3E,CAAC,WAAW,CAAC,CACd,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACrF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAkB,EAClB,WAAmB,EACnB,GAAW;IAEX,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjF,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAiB;IACzC,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;QACxC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAa;IACjC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;QACxC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,MAAM,SAAS,GAAG;QAChB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;QACxC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC;KACzF,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC9F,OAAO,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACL,GAAG,SAAS;QACZ,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAI,GAAkB,EAAE,KAAa;IACtD,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAkB;IAC/C,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store.d.ts

@@ -0,0 +1,165 @@
+import { type ServicePrincipalSigningAlgorithm } from './service-principal-credentials.js';
+export type ServicePrincipalStatus = 'active' | 'revoked';
+export type ServicePrincipalCredentialKind = 'public_jwk' | 'client_secret';
+export interface ServicePrincipalRecord {
+    readonly principalId: string;
+    readonly org: string;
+    readonly name: string;
+    readonly status: ServicePrincipalStatus;
+    readonly createdBySubject: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly revokedAt?: string;
+    readonly revokedBySubject?: string;
+}
+export interface ServicePrincipalGrantRecord {
+    readonly grantId: string;
+    readonly principalId: string;
+    readonly org: string;
+    readonly app: string;
+    readonly environment: string;
+    readonly scopes: readonly string[];
+    readonly status: ServicePrincipalStatus;
+    readonly createdBySubject: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly revokedAt?: string;
+    readonly revokedBySubject?: string;
+}
+interface ServicePrincipalCredentialBase {
+    readonly credentialId: string;
+    readonly principalId: string;
+    readonly kind: ServicePrincipalCredentialKind;
+    readonly label: string;
+    readonly status: ServicePrincipalStatus;
+    readonly createdBySubject: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly expiresAt?: string;
+    readonly revokedAt?: string;
+    readonly revokedBySubject?: string;
+}
+export type ServicePrincipalCredentialRecord = (ServicePrincipalCredentialBase & {
+    readonly kind: 'client_secret';
+}) | (ServicePrincipalCredentialBase & {
+    readonly kind: 'public_jwk';
+    readonly algorithm: ServicePrincipalSigningAlgorithm;
+    readonly kid?: string;
+});
+export interface ServicePrincipalView {
+    readonly principal: ServicePrincipalRecord;
+    readonly grants: readonly ServicePrincipalGrantRecord[];
+    readonly credentials: readonly ServicePrincipalCredentialRecord[];
+}
+export type ActiveServicePrincipalCredential = (ServicePrincipalCredentialRecord & {
+    readonly kind: 'client_secret';
+    readonly secretDigest: string;
+}) | (ServicePrincipalCredentialRecord & {
+    readonly kind: 'public_jwk';
+    readonly algorithm: ServicePrincipalSigningAlgorithm;
+    readonly publicJwk: Readonly<Record<string, unknown>>;
+});
+export interface ActiveServicePrincipalClient {
+    readonly principal: ServicePrincipalRecord;
+    readonly grants: readonly ServicePrincipalGrantRecord[];
+    readonly credentials: readonly ActiveServicePrincipalCredential[];
+}
+export interface CreateServicePrincipalInput {
+    readonly org: string;
+    readonly name: string;
+    readonly actorSubject: string;
+}
+export interface PrincipalRef {
+    readonly principalId: string;
+    readonly org: string;
+}
+export interface PrincipalMutation extends PrincipalRef {
+    readonly actorSubject: string;
+}
+export interface CreateServicePrincipalGrantInput extends PrincipalMutation {
+    readonly app: string;
+    readonly environment: string;
+    readonly scopes: readonly string[];
+}
+export interface GrantMutation extends PrincipalMutation {
+    readonly grantId: string;
+}
+interface CreateCredentialBase extends PrincipalMutation {
+    readonly label: string;
+    readonly expiresAt?: string;
+}
+export type CreateStoredCredentialInput = (CreateCredentialBase & {
+    readonly kind: 'client_secret';
+    readonly secretDigest: string;
+}) | (CreateCredentialBase & {
+    readonly kind: 'public_jwk';
+    readonly algorithm: ServicePrincipalSigningAlgorithm;
+    readonly publicJwk: unknown;
+});
+export interface CredentialMutation extends PrincipalMutation {
+    readonly credentialId: string;
+}
+export interface ServicePrincipalAccessBinding {
+    readonly principalId: string;
+    readonly grantId: string;
+    readonly credentialId: string;
+    readonly org: string;
+    readonly app: string;
+    readonly environment: string;
+    readonly now: number;
+}
+export interface AssertionJtiInput {
+    readonly credentialId: string;
+    readonly jti: string;
+    readonly expiresAt: number;
+    readonly now: number;
+}
+export interface ServicePrincipalStore {
+    createPrincipal(input: CreateServicePrincipalInput): Promise<ServicePrincipalRecord>;
+    listPrincipals(org: string): Promise<readonly ServicePrincipalRecord[]>;
+    getPrincipal(input: PrincipalRef): Promise<ServicePrincipalView | undefined>;
+    revokePrincipal(input: PrincipalMutation): Promise<boolean>;
+    createGrant(input: CreateServicePrincipalGrantInput): Promise<ServicePrincipalGrantRecord>;
+    revokeGrant(input: GrantMutation): Promise<boolean>;
+    createCredential(input: CreateStoredCredentialInput): Promise<ServicePrincipalCredentialRecord>;
+    revokeCredential(input: CredentialMutation): Promise<boolean>;
+    loadActiveClient(clientId: string, now: number): Promise<ActiveServicePrincipalClient | undefined>;
+    validateAccessBinding(input: ServicePrincipalAccessBinding): Promise<boolean>;
+    consumeAssertionJti(input: AssertionJtiInput): Promise<boolean>;
+}
+export type ServicePrincipalRuntime = {
+    readonly ready: true;
+    readonly store: ServicePrincipalStore;
+} | {
+    readonly ready: false;
+    readonly reason: 'schema_unavailable';
+};
+export declare class InMemoryServicePrincipalStore implements ServicePrincipalStore {
+    #private;
+    constructor(options?: {
+        readonly now?: () => Date;
+    });
+    createPrincipal(input: CreateServicePrincipalInput): Promise<ServicePrincipalRecord>;
+    listPrincipals(org: string): Promise<readonly ServicePrincipalRecord[]>;
+    getPrincipal(input: PrincipalRef): Promise<ServicePrincipalView | undefined>;
+    revokePrincipal(input: PrincipalMutation): Promise<boolean>;
+    createGrant(input: CreateServicePrincipalGrantInput): Promise<ServicePrincipalGrantRecord>;
+    revokeGrant(input: GrantMutation): Promise<boolean>;
+    createCredential(input: CreateStoredCredentialInput): Promise<ServicePrincipalCredentialRecord>;
+    revokeCredential(input: CredentialMutation): Promise<boolean>;
+    loadActiveClient(clientId: string, now: number): Promise<ActiveServicePrincipalClient | undefined>;
+    validateAccessBinding(input: ServicePrincipalAccessBinding): Promise<boolean>;
+    consumeAssertionJti(input: AssertionJtiInput): Promise<boolean>;
+}
+export declare function publicServicePrincipalCredential(credential: ActiveServicePrincipalCredential): ServicePrincipalCredentialRecord;
+export declare function normalizeServicePrincipalScopes(values: readonly string[]): readonly string[];
+export declare function validateServicePrincipalDisplayName(label: string, value: string): string;
+export declare function validateServicePrincipalActor(value: string): string;
+export declare function validateServicePrincipalSecretDigest(value: string): string;
+export declare function normalizeServicePrincipalExpiry(value: string | undefined, now: Date): string | undefined;
+export declare function servicePrincipalCredentialIsActive(credential: ActiveServicePrincipalCredential, now: number): boolean;
+export declare function currentServicePrincipalDate(now: () => Date): Date;
+export declare function currentServicePrincipalTimestamp(now: () => Date): string;
+export declare function validateServicePrincipalEpoch(label: string, value: number): void;
+export {};
+//# sourceMappingURL=service-principal-store.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-store.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-store.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,gCAAgC,EAEtC,MAAM,oCAAoC,CAAC;AAE5C,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC1D,MAAM,MAAM,8BAA8B,GAAG,YAAY,GAAG,eAAe,CAAC;AAE5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,MAAM,gCAAgC,GACxC,CAAC,8BAA8B,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,GACrE,CAAC,8BAA8B,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,gCAAgC,CAAC;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AAEP,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACxD,QAAQ,CAAC,WAAW,EAAE,SAAS,gCAAgC,EAAE,CAAC;CACnE;AAED,MAAM,MAAM,gCAAgC,GACxC,CAAC,gCAAgC,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC,GACF,CAAC,gCAAgC,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,gCAAgC,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD,CAAC,CAAC;AAEP,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACxD,QAAQ,CAAC,WAAW,EAAE,SAAS,gCAAgC,EAAE,CAAC;CACnE;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gCAAiC,SAAQ,iBAAiB;IACzE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,UAAU,oBAAqB,SAAQ,iBAAiB;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,2BAA2B,GACnC,CAAC,oBAAoB,GAAG;IACtB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC,GACF,CAAC,oBAAoB,GAAG;IACtB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,gCAAgC,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC,CAAC;AAEP,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrF,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAAC;IACxE,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC7E,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,WAAW,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3F,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAChG,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,gBAAgB,CACd,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CAAC;IACrD,qBAAqB,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAIrE,qBAAa,6BAA8B,YAAW,qBAAqB;;gBAO7D,OAAO,GAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO;IAIjD,eAAe,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAepF,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC;IAQvE,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAgB5E,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB3D,WAAW,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAgC1F,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBnD,gBAAgB,CACpB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,gCAAgC,CAAC;IA8CtC,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuB7D,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC;IAmB9C,qBAAqB,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB7E,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;CAiCtE;AAED,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,gCAAgC,GAC3C,gCAAgC,CA8BlC;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAI5F;AAcD,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMxF;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKnE;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK1E;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,MAAM,GAAG,SAAS,CAOpB;AAED,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,gCAAgC,EAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAKT;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,IAAI,CAKjE;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,MAAM,CAExE;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIhF"}