@ontemper/sdk 0.5.0 → 0.6.0-pr-7774.1

package/README.md

@@ -41,7 +41,7 @@ Kinds accept optional defaults that deploy seeds into stored platform records wh
 .annotate(Trigger, { kind: 'schedule', cron: '*/10 * * * *', timezone: 'UTC', budgetSeconds: 900 })
 ```
 
-`budgetSeconds` sets the handler budget in whole seconds. An HTTP route with `response: 'wait'` accepts 3–115; an `ack` HTTP route or Schedule accepts 3–1,800. Split work longer than 30 min into several Runs. The 3 s floor leaves time after the SDK's 2 s deadline margin. Invalid values fail the build. These ranges limit the declaration. A `k8s-pod` `ack` Run gets the lower of its declaration (or the stack default when it declares none) and the gateway drain-safe cap: the drain grace minus 25 seconds and the attempt margin, 265 seconds at the default 300-second drain. Firecracker Runs get the declared value. Without it, `wait` uses 115 seconds and `ack` uses the stack default (900 seconds unless configured). A stored Trigger takes precedence on redeploy, which reports budget drift.
+`budgetSeconds` sets the handler budget in whole seconds. An HTTP route with `response: 'wait'` accepts 3–115; an `ack` HTTP route or Schedule accepts 3–1,800. Split work longer than 30 min into several Runs. The 3 s floor leaves time after the SDK's 2 s deadline margin. Invalid values fail the build. These ranges limit the declaration. `k8s-pod` and Firecracker Runs get the declared value. Without it, `wait` uses 115 seconds and `ack` uses the stack default (900 seconds unless configured). A stored Trigger takes precedence on redeploy, which reports budget drift.
 
 A manifest-created Schedule is disabled. Verify the deployed route and its bindings, then enable it
 through the Schedule surface. Deploying source MUST NOT start external work by itself.
@@ -170,6 +170,41 @@ const { key, value } = yield * partners.select({ tenantKey }); // ResourceNotFou
 - `makeManifest` lists the declarations of each endpoint in its `resources`. Deploy fails, with one
   message for each problem, when a declaration has no binding, a bound resource has a different type,
   a value breaks the declared schema, or the organization does not have a declared resource type.
+- Deploy checks a value against the JSON Schema of the declared schema. Declaring a `Resource` or
+  `ResourceType` throws, naming the key and the field, when a check exports a weaker rule than decoding
+  runs. Without the throw, a value would pass deploy and fail every run with a `500`. For a string, use
+  the form that deploy checks exactly:
+
+  | Throws                                     | Use instead                                    |
+  | ------------------------------------------ | ---------------------------------------------- |
+  | `Schema.isPattern(/^[a-z0-9.-]+$/)`        | `Schema.isPattern(/^[a-z0-9.-]+$/u)`           |
+  | `Schema.isPattern(/^[a-z]+$/i)`            | `Schema.isPattern(/^[A-Za-z]+$/u)`             |
+  | `Schema.isMinLength(n)`, `n` above 1       | `Schema.isMinCodePoints(n)`                    |
+  | `Schema.isMaxLength(n)`, `n` above 0       | `Schema.isMaxCodePoints(n)`                    |
+  | `Schema.isBetweenLength(minimum, maximum)` | `Schema.isBetweenCodePoints(minimum, maximum)` |
+
+  A pattern exports only with the `u` flag (`g`, `d`, and `y` may join it). JSON Schema counts code
+  points and JavaScript counts UTF-16 units, so the code-point checks are the ones both sides count alike.
+  On an array, the length checks export exact `minItems` and `maxItems` and build unchanged.
+  Deploy runs `pattern` with RE2, which reads some JavaScript syntax differently or does not compile it.
+  A pattern that uses one of these throws too, with the rewrite that both engines read alike:
+
+  | Syntax                       | Write instead                                                            |
+  | ---------------------------- | ------------------------------------------------------------------------ |
+  | `.`                          | `[^\n\r\p{Zl}\p{Zp}]`                                                    |
+  | `\s`, `\S`                   | `[\t\n\v\f\r\p{Z}]`, `[^\t\n\v\f\r\p{Z}]`, or `[\s\S]` for any character |
+  | `[^]`                        | `[\s\S]`                                                                 |
+  | `\u0041`, `\cA`              | the character itself, or `\x41`                                          |
+  | `(?i:…)`, `(?m:…)`, `(?s:…)` | the group without the modifier, for example `[Aa]` for `(?i:a)`          |
+  | lookarounds, backreferences  | a pattern without them, or the annotation below                          |
+
+  The `\s` rewrites differ from `\s` only on U+FEFF. `\p{…}` reads each engine's own Unicode tables:
+  they agree on Node 22.23 and Node 26.8 (Unicode 17), while a release on Unicode 16, such as Node 24.2,
+  reads letters added in Unicode 17 as not `\p{L}`.
+
+  A built-in check whose pattern uses them, such as `Schema.Trimmed`, takes the annotation below.
+  To keep a check that deploy does not run, annotate it: `Schema.isPattern(regExp, { toJsonSchema: () => ({}) })`.
+  A `Schema.makeFilter` predicate without `toJsonSchema` runs only when the workflow decodes the value.
 
 ## Invoke in a test
 
@@ -260,6 +295,29 @@ Run token. The Run token goes only to `<UNNBOUND_API_URL>/api/edi-gateway`, and
 document. A failure is an `EdiError` whose `reason` is `validation`, `unauthorized`, `service`,
 `control_number`, or `configuration`, and whose `retryable` says whether the same call may succeed later.
 
+## AS2
+
+`@temper/workflow/as2` exchanges AS2 (RFC 4130) messages through the platform AS2 service with the Run token. The
+platform runs every S/MIME operation; the client carries bytes and the `as2_partner` and `as2_identity` records.
+
+```ts
+import { As2 } from '@temper/workflow/as2';
+
+const as2 = yield * As2;
+// A raw `http` route: verify, handle, acknowledge, and answer with the sync MDN (or an empty 200 for async).
+return yield * as2.inbound({ request, partner: (as2Id) => selectPartner(as2Id) }, (message) => store(message.payload));
+// Outbound: pack, deliver, and settle the receipt; `outcome` is confirmed, failed, or pending.
+const sent = yield * as2.send(document, { partner, idempotencyKey: order.id });
+```
+
+Provide `As2.layer`, and mark each route a partner posts to with `.annotate(As2Route, true)`. `receive`, `confirm`,
+and `deliverMdn` are the steps `inbound` composes. A Run that the gateway admits as AS2 (`triggerKind: 'as2'`), or any
+request to a marked route, starts on a fresh trace, and its request lines log only allowlisted headers and no body. AS2 lines carry ids, outcomes, and byte counts, never the document, a receipt body, or a key. A
+failure is an `As2Error` with `operation`, `code`, `status`, and `retryable`. Partner TLS settings and proxies are
+not supported yet: `send` refuses them before it packs. In tests, provide `memoryAs2().layer` from
+`@temper/workflow/as2/testing` and pass its `fetch` to `testPlatform`; it keeps the platform ledger rules and runs
+no crypto.
+
 ## Versions
 
 CI publishes every version to npm as `@ontemper/sdk`; nobody publishes by hand. Workflow code keeps
@@ -273,9 +331,9 @@ npm install --save-exact @temper/workflow@npm:@ontemper/sdk@<version>
 A published version never changes. The workflow template and the examples pin one exact
 version; `pnpm sdk:pin` moves them all together.
 
-The package has six entry points: `@temper/workflow`, `@temper/workflow/testing`,
-`@temper/workflow/contract`, `@temper/workflow/sftp`, `@temper/workflow/sftp/testing`, and
-`@temper/workflow/edi`. Only `/sftp` loads `ssh2`. `@temper/workflow/contract` holds the runtime Resources HttpApi and the
+The package has eight entry points: `@temper/workflow`, `@temper/workflow/testing`,
+`@temper/workflow/contract`, `@temper/workflow/sftp`, `@temper/workflow/sftp/testing`,
+`@temper/workflow/edi`, `@temper/workflow/as2`, and `@temper/workflow/as2/testing`. Only `/sftp` loads `ssh2`. `@temper/workflow/contract` holds the runtime Resources HttpApi and the
 manifest, trigger, and invocation schemas that the platform imports. Workflow code rarely needs it.
 
 ## Develop and release

package/dist/As2.d.ts

@@ -0,0 +1,155 @@
+import { Context, Effect, Layer } from 'effect';
+import { HttpClient, type HttpServerRequest, HttpServerResponse } from 'effect/http';
+import { type LookupAddresses } from './As2Destination.js';
+import { As2Error } from './As2Error.js';
+import { As2IdentityResource, As2PartnerResource } from './As2Resource.js';
+import { Invocation } from './Invocation.js';
+export { As2Error } from './As2Error.js';
+export { As2Route } from './As2Route.js';
+export type { LookupAddresses } from './As2Destination.js';
+export { As2IdentityResource, As2PartnerResource } from './As2Resource.js';
+/** A Message Disposition Notification: the receipt one side signs for the other. */
+export interface As2Mdn {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: Uint8Array;
+}
+/** The receipt for one inbound message, and the HTTP answer that carries it. */
+export interface As2Acknowledgement {
+    readonly messageId: string;
+    readonly mic: string;
+    readonly mdn: As2Mdn | null;
+    readonly mdnMode: 'sync' | 'async';
+    /** Where an async receipt goes: the partner's own Receipt-Delivery-Option, checked by the platform. */
+    readonly mdnDeliveryUrl: string | null;
+    readonly alreadyAcknowledged: boolean;
+    /** The exchange's trace in the platform ledger. */
+    readonly customerTraceId: string | null;
+    /** A sync receipt as the response body; an async receipt answers an empty 200. */
+    readonly response: HttpServerResponse.HttpServerResponse;
+}
+/** A verified, decrypted message that the workflow has not acknowledged yet. */
+export interface As2Received {
+    readonly kind: 'received';
+    readonly messageId: string;
+    /** The business document. */
+    readonly payload: Uint8Array;
+    readonly contentType: string | null;
+    readonly mic: string;
+    readonly mdnMode: 'sync' | 'async';
+    /** The exchange's trace: the sending half's for a verified loopback, else minted by the platform. */
+    readonly customerTraceId: string | null;
+    /**
+     * Run only after the workflow handled the payload. Until it succeeds, the platform keeps the message
+     * processing and no success receipt reaches the partner.
+     */
+    readonly acknowledge: Effect.Effect<As2Acknowledgement, As2Error, Invocation>;
+}
+/** A message the platform already acknowledged: answer it with the stored receipt. */
+export interface As2Duplicate extends As2Acknowledgement {
+    readonly kind: 'duplicate';
+}
+/** Another Run holds the message (`inFlight`) or the platform parked it (`parked`): the partner retries later. */
+export interface As2Pending {
+    readonly kind: 'inFlight' | 'parked';
+    readonly messageId: string;
+    /** 503 with `retry-after: 60`. */
+    readonly response: HttpServerResponse.HttpServerResponse;
+}
+export type As2ReceiveResult = As2Received | As2Duplicate | As2Pending;
+export interface As2ReceiveOptions {
+    /** The partner's POST, exactly as received: headers and body bytes go to the platform for verification. */
+    readonly request: HttpServerRequest.HttpServerRequest;
+    readonly partner: As2PartnerResource;
+    /** Default: the identity the partner record references. */
+    readonly identity?: As2IdentityResource | undefined;
+}
+export interface As2InboundOptions<E, R> {
+    readonly request: HttpServerRequest.HttpServerRequest;
+    /** The partner record for the sender's AS2-From (unquoted), such as a `ResourceType` select on `as2Id`. */
+    readonly partner: (as2From: string) => Effect.Effect<As2PartnerResource, E, R>;
+    readonly identity?: As2IdentityResource | undefined;
+}
+export interface As2SendOptions {
+    readonly partner: As2PartnerResource;
+    /** Default: the identity the partner record references. */
+    readonly identity?: As2IdentityResource | undefined;
+    /** Default `application/edi-x12`. */
+    readonly contentType?: string | undefined;
+    readonly subject?: string | undefined;
+    /** A retry with the same key re-delivers the original envelope instead of minting a new Message-ID. At most 255 characters. */
+    readonly idempotencyKey?: string | undefined;
+    /** Delivery URL in place of the partner's; it may not carry the partner's credentials to another origin. */
+    readonly url?: string | undefined;
+    /** Where the partner posts an async receipt. Default: `UNNBOUND_WORKFLOW_URL` plus `/as2/mdn`. */
+    readonly receiptUrl?: string | undefined;
+}
+export interface As2SendResult {
+    readonly messageId: string;
+    readonly mic: string;
+    /** The platform served this key's earlier envelope again. */
+    readonly replayed: boolean;
+    /** `confirmed`: the receipt verified and its MIC matched; `pending`: an async receipt is still due. */
+    readonly outcome: 'confirmed' | 'failed' | 'pending';
+    readonly disposition: string | null;
+    readonly customerTraceId: string | null;
+}
+export type As2ConfirmOptions = {
+    readonly partner: As2PartnerResource;
+    readonly identity?: As2IdentityResource | undefined;
+    /** An assertion only: the platform settles the message the signed receipt names, and fails when it names another. */
+    readonly originalMessageId?: string | undefined;
+} & ({
+    readonly request: HttpServerRequest.HttpServerRequest;
+    readonly mdn?: never;
+} | {
+    readonly mdn: As2Mdn;
+    readonly request?: never;
+});
+export interface As2ConfirmResult {
+    readonly outcome: 'confirmed' | 'failed';
+    /** The outbound message this receipt settled: its signed Original-Message-ID. */
+    readonly messageId: string;
+    readonly disposition: string | null;
+    readonly receivedMic: string | null;
+    readonly packMic: string | null;
+    readonly micMatched: boolean;
+    /** The trace that sent the message; an async receipt stays on its own trace and links to it. */
+    readonly originatingTraceId: string | null;
+}
+export interface As2Client {
+    /** Verifies and decrypts one inbound message on the platform, then sorts it: received, duplicate, in flight, or parked. */
+    readonly receive: (options: As2ReceiveOptions) => Effect.Effect<As2ReceiveResult, As2Error, Invocation>;
+    /**
+     * The whole inbound exchange, as legacy `as2Endpoint`: select the partner, receive, run `handle` on a new
+     * message, acknowledge, deliver an async receipt, and answer. Lines after verification carry the exchange's trace.
+     * An `As2Error` becomes the status a partner reads: 502, 503, 504 retry; 400, 413, 422 do not; else 500.
+     */
+    readonly inbound: <E, R, E2, R2>(options: As2InboundOptions<E, R>, handle: (message: As2Received) => Effect.Effect<void, E2, R2>) => Effect.Effect<HttpServerResponse.HttpServerResponse, Exclude<E | E2, As2Error>, R | R2 | Invocation>;
+    /** Packs on the platform, posts the envelope to the partner, and settles the receipt. */
+    readonly send: (payload: Uint8Array | string, options: As2SendOptions) => Effect.Effect<As2SendResult, As2Error, Invocation>;
+    /** Verifies a receipt, such as an async MDN a partner posts to `/as2/mdn`, and settles its message. */
+    readonly confirm: (options: As2ConfirmOptions) => Effect.Effect<As2ConfirmResult, As2Error, Invocation>;
+    /** Posts a receipt to the partner's async-MDN URL. The URL must resolve to public addresses only. */
+    readonly deliverMdn: (mdn: As2Mdn, url: string) => Effect.Effect<void, As2Error>;
+}
+/** The route an async receipt is posted to, under the sending workflow's own URL. */
+export declare const AS2_ASYNC_RECEIPT_PATH = "/as2/mdn";
+/** RFC 2045 quoted-string unquote for AS2-From and AS2-To: a bare token passes through. */
+export declare const unquoteAs2Id: (value: string | undefined) => string;
+/** Runs `effect` on the exchange's verified trace; with none, on the current one. */
+export declare const withExchangeTrace: (customerTraceId: string | null) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+/** Legacy `as2Endpoint`: a partner decides whether to resend from the status, so it gets the status and a generic message. */
+export declare const as2FailureResponse: (error: As2Error) => HttpServerResponse.HttpServerResponse;
+declare const As2_base: Context.ServiceClass<As2, "@temper/workflow/As2", As2Client>;
+/**
+ * First-party AS2 on the workflow's `HttpClient`, logger, and Run token: `yield* As2` in a handler layer and
+ * provide `As2.layer`. All S/MIME crypto runs on the platform; the SDK carries bytes and records.
+ */
+export declare class As2 extends As2_base {
+    static readonly layer: Layer.Layer<As2, never, HttpClient.HttpClient>;
+    /** `layer` with a replaced name lookup for the async-MDN destination check. */
+    static readonly layerWith: (options: {
+        readonly lookupAddresses: LookupAddresses;
+    }) => Layer.Layer<As2, never, HttpClient.HttpClient>;
+}
+//# sourceMappingURL=As2.d.ts.map

package/dist/As2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"As2.d.ts","sourceRoot":"","sources":["../src/As2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,OAAO,EAAY,MAAM,EAAE,KAAK,EAA+C,MAAM,QAAQ,CAAC;AAC/G,OAAO,EAEL,UAAU,EAIV,KAAK,iBAAiB,EACtB,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAuB,KAAK,eAAe,EAAsB,MAAM,qBAAqB,CAAC;AACpG,OAAO,EAAE,QAAQ,EAAqB,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAI7C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,oFAAoF;AACpF,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,uGAAuG;IACvG,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,mDAAmD;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;CAC1D;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,qGAAqG;IACrG,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;CAC/E;AAED,sFAAsF;AACtF,MAAM,WAAW,YAAa,SAAQ,kBAAkB;IACtD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED,kHAAkH;AAClH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;CAC1D;AAED,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,2GAA2G;IAC3G,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IACtD,2GAA2G;IAC3G,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACpD,qCAAqC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,+HAA+H;IAC/H,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,kGAAkG;IAClG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACpD,qHAAqH;IACrH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjD,GAAG,CACA;IAAE,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAA;CAAE,CACrD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,gGAAgG;IAChG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,SAAS;IACxB,2HAA2H;IAC3H,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxG;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAC7B,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,EAChC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,KAC1D,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC;IAC1G,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,CACb,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,EAAE,cAAc,KACpB,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxD,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxG,qGAAqG;IACrG,QAAQ,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;CAClF;AAED,qFAAqF;AACrF,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,2FAA2F;AAC3F,eAAO,MAAM,YAAY,UAAW,MAAM,GAAG,SAAS,KAAG,MAIxD,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,oBACV,MAAM,GAAG,IAAI,MAC9B,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAQzD,CAAC;AAkRV,8HAA8H;AAC9H,eAAO,MAAM,kBAAkB,UAAW,QAAQ,KAAG,kBAAkB,CAAC,kBAOvE,CAAC;;AAgpBF;;;GAGG;AACH,qBAAa,GAAI,SAAQ,QAAyD;IAChF,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAGnE;IACF,+EAA+E;IAC/E,MAAM,CAAC,QAAQ,CAAC,SAAS,YAAa;QACpC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;KAC3C,KAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAAwD;CAC3G"}