@opendatalabs/personal-server-ts-core 0.0.1-canary.bd807be → 0.0.1-canary.bf36bcb

package/dist/api/index.d.ts

@@ -0,0 +1,375 @@
+import type { AccessLogWriter } from "../logging/access-log.js";
+import type { AccessLogReader } from "../logging/access-reader.js";
+import { type DataStoragePort, type RuntimeAvailabilityPort } from "../ports/index.js";
+import type { DataReadPolicyPorts } from "../policy/index.js";
+import type { SyncManager } from "../sync/index.js";
+import { type ScopeDeletionTracker } from "../sync/scope-deletions.js";
+import type { IndexEntry } from "../storage/index/types.js";
+import { type DeleteScopeResult } from "../sync/workers/delete.js";
+import { type OAuthDeviceSessionLookup, type OAuthTokenStorePort } from "../contracts/index.js";
+import type { DataFileEnvelope, DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/browser";
+import type { ServerSigner } from "../signing/index.js";
+import { type WriterAttribution } from "../write/attribution.js";
+import type { LineageGatewayPort } from "../lineage/gateway.js";
+import { type X402Challenge } from "../payment/index.js";
+export interface PersonalServerReadAuthInput {
+    request: Request;
+    scope: string;
+    grantId?: string;
+    fileId?: string;
+    /**
+     * The `collectedAt` version the read is pinned to (cursor-pinned or
+     * `?at=`-pinned reads). Payment-enforcing auth ports use it to bind the
+     * x402 challenge/settlement to the exact version served, not the latest.
+     */
+    at?: string;
+}
+export interface PersonalServerReadAuthResult {
+    builder?: `0x${string}` | string;
+    grantId?: string;
+}
+export interface PersonalServerWriteAuthInput {
+    request: Request;
+    /** Raw scope path param (validated by parseDataScopeContract after auth,
+     * same precedence as the owner write path). */
+    scope: string;
+}
+/**
+ * Result of authorizing a DELEGATED (write-session) write. A void return
+ * means the request was authorized as the owner instead — the ingest then
+ * proceeds exactly as today, with no attribution stamped.
+ */
+export interface PersonalServerWriteAuthResult {
+    builder: `0x${string}`;
+    grantId: string;
+    /**
+     * The live grant's scope entries (read entries bare, write entries
+     * `write:`-prefixed). Consumers that need more than the write permission
+     * (the derivative compute layer checks read coverage of source scopes)
+     * fail closed when this is absent.
+     */
+    grantScopes?: string[];
+    attribution: WriterAttribution;
+    /**
+     * Rolls back the per-write proof reservation (replay guard). The handler
+     * calls it when the write fails BEFORE the record is committed, so the
+     * builder can retry with the same still-valid proof.
+     */
+    releaseProof?: () => Promise<void>;
+}
+/**
+ * Result of recognizing a delegated caller WITHOUT a scope to authorize
+ * against (see `authorizeWriteSession`). Identity only: no grant policy has
+ * been evaluated, so this must never gate access to data — it exists so a
+ * route can tell "a builder is calling" from "nobody is authenticated" and
+ * answer 404 / 400 instead of a misleading 401.
+ */
+export interface PersonalServerWriteSessionResult {
+    builder: `0x${string}`;
+    grantId: string;
+    /** Rolls back the per-call proof reservation; see the write result. */
+    releaseProof?: () => Promise<void>;
+}
+export interface PersonalServerReadFulfillment {
+    builder: string;
+    fileId?: string;
+    grantId: string;
+    ipAddress: string;
+    logId: string;
+    scope: string;
+    servedAt: string;
+    userAgent: string;
+}
+export interface PersonalServerReadFulfillmentReporter {
+    report(event: PersonalServerReadFulfillment): Promise<void>;
+}
+export interface PersonalServerApiAuthPort {
+    authorizeOwner(request: Request): Promise<void>;
+    authorizeBuilderList(request: Request): Promise<void>;
+    authorizeBuilderRead(input: PersonalServerReadAuthInput): Promise<PersonalServerReadAuthResult | void>;
+    /**
+     * Authorize a data ingest (POST /v1/data/:scope). Optional — auth ports
+     * that don't support delegated writes omit it and the handler falls back
+     * to authorizeOwner, preserving today's owner-only behavior. Ports that DO
+     * support write sessions handle BOTH paths here: a recognized session
+     * token authorizes as the builder (write policy + attribution proof) and
+     * returns the attribution to store; anything else falls through to the
+     * owner path and returns void.
+     */
+    authorizeWrite?(input: PersonalServerWriteAuthInput): Promise<PersonalServerWriteAuthResult | void>;
+    /**
+     * Recognize a live write session (bearer + `X-Vana-Write-Signature` proof)
+     * WITHOUT authorizing a scope. Optional, and identity only: routes use it
+     * where there is no scope to authorize against yet — an unknown question
+     * id, or a builder list call missing its `?derivedScope=` — so the answer
+     * is 404 / 400 rather than the owner gate's 401, which would send every
+     * client with a re-handshake-on-401 policy through a pointless handshake.
+     * Returns void when the request carries no write-session credential.
+     */
+    authorizeWriteSession?(request: Request): Promise<PersonalServerWriteSessionResult | void>;
+}
+export interface PersonalServerApiLogger {
+    debug?(payload: Record<string, unknown>, message: string): void;
+    info?(payload: Record<string, unknown>, message: string): void;
+    warn?(payload: Record<string, unknown>, message: string): void;
+    error?(payload: Record<string, unknown>, message: string): void;
+}
+export interface PersonalServerIngestSyncManager {
+    trigger(): Promise<void>;
+    notifyNewData?(): void;
+    /**
+     * Durable scope deletion (gateway tombstone -> storage blobs -> local).
+     * When absent the DELETE route deletes the local copy only and reports
+     * `durable: false`.
+     */
+    deleteScope?(scope: string): Promise<DeleteScopeResult>;
+}
+export interface PersonalServerDataApiDeps {
+    storage: DataStoragePort;
+    auth: PersonalServerApiAuthPort;
+    accessLogWriter: AccessLogWriter;
+    syncManager?: PersonalServerIngestSyncManager | null;
+    runtimeAvailability?: RuntimeAvailabilityPort;
+    readFulfillmentReporter?: PersonalServerReadFulfillmentReporter;
+    /**
+     * Read-side memory of gateway tombstones (see sync/scope-deletions.ts for
+     * the consistency window). Every read consults it before serving or
+     * charging: a scope the gateway reports deleted answers 410 DATA_DELETED
+     * whether or not a stale local copy still exists, and a local miss on a
+     * deleted scope answers 410 instead of 404 so SDK readers can tell
+     * "deleted" from "never had it". Without it reads are local-only.
+     */
+    scopeDeletions?: ScopeDeletionTracker;
+    /**
+     * Required when payment is on. Powers two things on GET /v1/data/:scope:
+     *   - the X402 challenge generation (fee lookup, accessRecord binding)
+     *   - the forward of validated X-PAYMENTs to gateway.payForOperation
+     *
+     * Two channels because the SDK client's payForOperation throws plain
+     * Errors on non-2xx and loses the gateway's structured error body — we
+     * need that body to map gateway 402/409/400 into fresh challenges.
+     */
+    gateway?: Pick<GatewayClient, "getGrant">;
+    /**
+     * Gateway base URL. Used for the direct-fetch forwarding of validated
+     * X-PAYMENTs to POST /v1/escrow/pay so we can inspect the gateway's
+     * structured error body (which the SDK's gateway.payForOperation
+     * discards). Required when X402 is enabled.
+     */
+    gatewayUrl?: string;
+    /**
+     * Required to construct escrowPaymentDomain + dataRegistryDomain for
+     * EIP-712 signature recovery during X-PAYMENT validation.
+     */
+    gatewayConfig?: DataPortabilityGatewayConfig;
+    /**
+     * Required for the X402 flow. Signs RECORD_DATA_ACCESS attestations
+     * embedded in 402 challenges. Without it, challenges still issue but
+     * never include an accessRecord — gateway accepts the resulting payment
+     * but the on-chain recordDataAccess won't be scheduled.
+     */
+    serverSigner?: Pick<ServerSigner, "signRecordDataAccess">;
+    serverOwner?: `0x${string}`;
+    /**
+     * The server's own account address — accessRecord signatures must
+     * recover to this for the X-PAYMENT validation to accept them as
+     * server-issued.
+     */
+    serverAddress?: `0x${string}`;
+    /**
+     * Identifier echoed in the X402 challenge as `accepts[].network`. Pure
+     * convention (e.g. "vana-moksha"); the gateway doesn't read it.
+     */
+    network?: string;
+    /**
+     * When true, GET /v1/data/:scope enforces the X402 dance: missing /
+     * invalid X-PAYMENT → 402 challenge; valid → forward to gateway then
+     * serve. When false (default), reads bypass payment entirely.
+     */
+    paymentEnabled?: boolean;
+    /**
+     * Test seam for the gateway forwarding fetch. Defaults to the global
+     * `fetch`; tests inject a mock that returns specific gateway statuses.
+     */
+    paymentFetch?: typeof fetch;
+    /**
+     * Test seam for the per-event recordId / paymentNonce / clock. Production
+     * leaves these unset and the X402 module generates fresh values via
+     * crypto.getRandomValues / Date.now.
+     */
+    generateRecordId?: () => `0x${string}`;
+    generatePaymentNonce?: () => bigint;
+    now?: () => Date;
+    createLogId?: () => string;
+    logger?: PersonalServerApiLogger;
+    /**
+     * Gateway access for derivative data (docs/derivative-data-api.md): source
+     * lookups for lineage validation on write and the signed lineage read
+     * behind GET /v1/data/:scope/lineage. Absent = writes with lineage can
+     * only cite local scopes and the lineage read answers 503.
+     */
+    lineageGateway?: LineageGatewayPort;
+    /**
+     * Called after a write is committed (owner or builder, JSON or binary).
+     * The derivative compute layer uses it to mark questions that read the
+     * scope stale; the recompute itself waits for a reader (see onDataRead).
+     * Best-effort: a throwing hook is swallowed, the write already succeeded.
+     */
+    onDataWritten?: (event: {
+        scope: string;
+        collectedAt: string;
+        /** The stamped `$lineage.sources` of the written record, if any. */
+        lineageSources?: string[];
+    }) => void;
+    /**
+     * Called on GET /v1/data/:scope once the read is authorized (a live grant
+     * covering the scope, or the owner) and the scope is not tombstoned, and
+     * before anything is served. The derivative compute layer uses it to run
+     * a question whose answer is stale just in time: a source refresh only
+     * marks the answer stale, and this is the demand that pays for the
+     * recompute. Called for every scope — the compute layer decides whether a
+     * question is behind it. Best-effort and non-blocking: a throwing hook is
+     * swallowed and the read is never delayed by inference.
+     */
+    onDataRead?: (event: {
+        scope: string;
+    }) => void;
+}
+export interface PersonalServerAccessLogsApiDeps {
+    auth: Pick<PersonalServerApiAuthPort, "authorizeOwner">;
+    accessLogReader: AccessLogReader;
+}
+export interface PersonalServerSyncApiDeps {
+    auth: Pick<PersonalServerApiAuthPort, "authorizeOwner">;
+    syncManager: Pick<SyncManager, "trigger" | "getStatus"> | null;
+    logger?: PersonalServerApiLogger;
+}
+export interface PersonalServerGrantsApiDeps {
+    auth: Pick<PersonalServerApiAuthPort, "authorizeOwner">;
+    gateway?: Pick<GatewayClient, "getBuilder" | "createGrant" | "listGrantsByUser" | "revokeGrant" | "getGrant">;
+    gatewayConfig?: DataPortabilityGatewayConfig;
+    serverOwner?: `0x${string}`;
+    serverSigner?: Pick<ServerSigner, "signGrantRegistration"> & Partial<Pick<ServerSigner, "signGrantRevocation">>;
+    now?: () => Date;
+}
+export interface PersonalServerConfigApiDeps {
+    auth: Pick<PersonalServerApiAuthPort, "authorizeOwner">;
+    readConfig(): Promise<unknown>;
+    writeConfig(config: unknown): Promise<void>;
+}
+export interface PersonalServerOauthTokenApiDeps {
+    tokenStore: OAuthTokenStorePort;
+    controlPlaneSecret?: string;
+    deviceSessions?: OAuthDeviceSessionLookup;
+    randomToken(): string;
+    now?: () => Date;
+    safeCompare?: (left: string, right: string) => boolean;
+}
+export interface PersonalServerApiDispatchOptions {
+    basePath?: string;
+}
+/**
+ * The grant the caller nominates for a read: `?grantId=` or the
+ * `x-ps-grant-id` header, the SDK's shape on every read route. Exported so
+ * the derivatives status route authorizes with exactly the same inputs as
+ * a data read — a credential that reads /v1/data/<scope> must not be
+ * refused by /v1/derivatives/status.
+ */
+export declare function selectedGrantId(request: Request, url: URL): string | undefined;
+export interface X402CycleInput {
+    deps: PersonalServerDataApiDeps;
+    request: Request;
+    scope: string;
+    fileIdParam?: string;
+    atParam?: string;
+    grantId: string;
+    builder: `0x${string}`;
+    gateway: Pick<GatewayClient, "getGrant">;
+    gatewayConfig: DataPortabilityGatewayConfig;
+    gatewayUrl: string;
+}
+export type X402CycleResult = {
+    kind: "ok";
+    payResponse: unknown;
+} | {
+    kind: "challenge";
+    body: X402Challenge;
+} | {
+    kind: "gateway-error";
+    status: number;
+    body: unknown;
+};
+/**
+ * Run the X402 dispatch for one read:
+ *
+ *   X-PAYMENT absent / malformed / fails local validation
+ *     → challenge: fresh 402 with current fee + accessRecord
+ *   X-PAYMENT valid, forward to gateway succeeds
+ *     → ok: caller proceeds to read the data
+ *   X-PAYMENT valid, gateway returns 4xx/5xx
+ *     → gateway-error: relay the gateway's body verbatim so the builder
+ *       can dispatch (insufficient balance vs. replay vs. race etc.)
+ *
+ * The gateway POST goes through `fetch` directly (not `gateway.payForOperation`)
+ * because the SDK client throws plain Errors and loses the body — which is
+ * exactly what we need to distinguish gateway 402 (insufficient balance) from
+ * 409 (replay) from 400 (amount mismatch).
+ */
+export declare function handleX402Cycle(input: X402CycleInput): Promise<X402CycleResult>;
+/**
+ * The deletion that applies to a read of `scope`, or null when the read may
+ * be served. `entry` is the local version the read would serve (undefined
+ * on a local miss).
+ *
+ * - A local copy is refused when the gateway holds a tombstone that covers
+ *   it (see `isEntryCoveredByTombstone`: registry versions and the ingest
+ *   marker, never clocks). A local re-add on top of the tombstone is served.
+ * - A local miss asks the tracker to consult the gateway (bounded by its
+ *   per-scope verdict cache and failure back-off): the local index cannot
+ *   tell "deleted long ago" from "never had it".
+ * Gateway unreachability never fails the read: the tracker answers from its
+ * last known state, which is the documented offline behaviour.
+ */
+export declare function resolveReadDeletion(deps: Pick<PersonalServerDataApiDeps, "scopeDeletions" | "serverOwner">, scope: string, entry: ReadDeletionEntry | null | undefined): Promise<{
+    scope: string;
+    dataPointId: string | null;
+    deletedAt: string;
+} | null>;
+/**
+ * Throw 410 DATA_DELETED when `resolveReadDeletion` says the read must not be
+ * served. Call it before any payment step: a builder must never be charged
+ * for a scope the owner deleted.
+ */
+export declare function assertScopeNotDeleted(deps: Pick<PersonalServerDataApiDeps, "scopeDeletions" | "serverOwner">, scope: string, entry: ReadDeletionEntry | null | undefined): Promise<void>;
+/** The index fields the deletion gate needs from the entry a read would serve. */
+export type ReadDeletionEntry = Pick<IndexEntry, "version" | "dataPointId" | "afterTombstoneVersion">;
+export declare function reportPersonalServerReadFulfillment(deps: PersonalServerDataApiDeps, event: PersonalServerReadFulfillment): void;
+/**
+ * True when a read auth result entitles the caller to the owner's view of a
+ * record — the same convention as resolveLineageGrantView: no result, or the
+ * "owner" / "policy-bypass" sentinels. Everything else is a grantee.
+ */
+export declare function isOwnerView(authResult: PersonalServerReadAuthResult | void): boolean;
+/**
+ * The envelope view a grantee read is entitled to. The server-stamped
+ * `$writtenBy` (writing builder's address, grantId, signature) and
+ * `$lineage` (the owner's source data-point ids, dictionary-attackable back
+ * to scopes since dataPointId = keccak(owner, scope)) never leave the server
+ * on a grantee read: the owner reads them from storage, and grantees get the
+ * graph only through the grant-redacted lineage endpoint. When `$lineage` is
+ * present, the caller-supplied lineage field it mirrors (top-level `lineage`
+ * on a JSON record, `metadata.lineage` on a binary one) carries the same ids
+ * and is dropped with it; without the stamp such a field is ordinary user
+ * data and stays. Redaction is at serve time only — the stored envelope, its
+ * dataHash commitment, and the owner's view are unchanged.
+ */
+export declare function redactEnvelopeForGrantee(envelope: DataFileEnvelope): DataFileEnvelope;
+export { redactJsonEnvelopeBytesForGrantee } from "./raw-envelope.js";
+export declare function handlePersonalServerDataRequest(request: Request, deps: PersonalServerDataApiDeps, options?: PersonalServerApiDispatchOptions): Promise<Response>;
+export declare function handlePersonalServerAccessLogsRequest(request: Request, deps: PersonalServerAccessLogsApiDeps, options?: PersonalServerApiDispatchOptions): Promise<Response>;
+export declare function handlePersonalServerSyncRequest(request: Request, deps: PersonalServerSyncApiDeps, options?: PersonalServerApiDispatchOptions): Promise<Response>;
+export declare function handlePersonalServerGrantsRequest(request: Request, deps: PersonalServerGrantsApiDeps, options?: PersonalServerApiDispatchOptions): Promise<Response>;
+export declare function handlePersonalServerConfigRequest(request: Request, deps: PersonalServerConfigApiDeps): Promise<Response>;
+export declare function handlePersonalServerOauthTokenRequest(request: Request, deps: PersonalServerOauthTokenApiDeps): Promise<Response>;
+export type { DataReadPolicyPorts };
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAoBL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EASzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,gBAAgB,EAChB,4BAA4B,EAC5B,aAAa,EACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAMhE,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,MAAM,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB;mDAC+C;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,iBAAiB,CAAC;IAC/B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qCAAqC;IACpD,MAAM,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,oBAAoB,CAClB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;IAChD;;;;;;;;OAQG;IACH,cAAc,CAAC,CACb,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAAC;IACjD;;;;;;;;OAQG;IACH,qBAAqB,CAAC,CACpB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,CAAC,IAAI,IAAI,CAAC;IACvB;;;;OAIG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;IACrD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACvC,oBAAoB,CAAC,EAAE,MAAM,MAAM,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,oEAAoE;QACpE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,KAAK,IAAI,CAAC;IACX;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACxD,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACxD,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC;IAC/D,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,IAAI,CACZ,aAAa,EACX,YAAY,GACZ,aAAa,GACb,kBAAkB,GAClB,aAAa,GAIb,UAAU,CACb,CAAC;IACF,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,GACxD,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACxD,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,mBAAmB,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,WAAW,IAAI,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CACxD;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA+FD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,MAAM,GAAG,SAAS,CAMpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzC,aAAa,EAAE,4BAA4B,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,eAAe,CAAC,CAuK1B;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,GAAG,aAAa,CAAC,EACvE,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,IAAI,CAAC,CAgBR;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,GAAG,aAAa,CAAC,EACvE,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAAC,IAAI,CAAC,CAGf;AAeD,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,UAAU,EACV,SAAS,GAAG,aAAa,GAAG,uBAAuB,CACpD,CAAC;AAgHF,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE,6BAA6B,GACnC,IAAI,CAcN;AAoDD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,4BAA4B,GAAG,IAAI,GAC9C,OAAO,CAMT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GACzB,gBAAgB,CAqClB;AAED,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AAEtE,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,yBAAyB,EAC/B,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CA4oBnB;AAED,wBAAsB,qCAAqC,CACzD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,+BAA+B,EACrC,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAenB;AAED,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,yBAAyB,EAC/B,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAmCnB;AAED,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,2BAA2B,EACjC,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAyEnB;AAED,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AAED,wBAAsB,qCAAqC,CACzD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CA6BnB;AAED,YAAY,EAAE,mBAAmB,EAAE,CAAC"}