@opendatalabs/personal-server-ts-server 1.33.7 → 1.34.0

package/dist/pdpp/deployment.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Deployment wiring for the PDPP Authorization Server.
+ *
+ * Two jobs the route module deliberately does not do, because both are
+ * deployment policy rather than protocol:
+ *
+ *   1. Decide which source declarations this server will accept as authority
+ *      over a source. Core §5 requires an explicit trust policy; "we could
+ *      reach it over HTTPS" is not one. The policy here is derived from what
+ *      this PS actually serves, so a server that holds no Spotify data does
+ *      not accept a Spotify declaration and cannot be talked into issuing a
+ *      grant over data it has never collected.
+ *
+ *   2. Map a verified owner wallet to the PDPP subject. This PS is
+ *      single-owner, so the subject is the server owner and nothing else.
+ *
+ * There is no trust-all default. A deployment that has configured no
+ * declarations accepts none, which makes `/pdpp/v1` inert rather than
+ * dangerous — the failure mode of a misconfigured authorization server should
+ * be "issues nothing", never "issues anything".
+ */
+import type { DeclarationSnapshot } from "@opendatalabs/personal-server-ts-core/pdpp";
+import type { Logger } from "pino";
+/**
+ * The connector inventory this PS serves, derived from the scopes it actually
+ * holds. A scope is `{source}.{category}[.{subcategory}]`, so the leading
+ * segment is the connector.
+ */
+export declare function deriveSupportedConnectors(scopes: string[]): string[];
+/**
+ * A declaration this deployment retains, as configured.
+ *
+ * `document` is the exact retained bytes. Keeping the raw document (rather
+ * than a parsed object) is what lets the digest be computed over what was
+ * actually retrieved, which is the evidence §9 item 16 requires to survive
+ * into consent and issuance.
+ */
+export interface ConfiguredDeclaration {
+    sourceId: string;
+    document: string;
+    path?: string;
+}
+export interface PdppDeclarationRegistryOptions {
+    /** Declarations this deployment has explicitly retained. */
+    declarations: ConfiguredDeclaration[];
+    /** Connector inventory; a declaration for an unserved source is rejected. */
+    supportedConnectors: string[];
+    logger: Logger;
+}
+/**
+ * Build the `resolveDeclaration` lookup the AS routes consume.
+ *
+ * Every configured declaration is validated and digested once at startup, then
+ * pinned. A declaration that fails validation is dropped with a warning rather
+ * than accepted-and-hoped-for: an AS resolving grants against a malformed
+ * declaration would freeze nonsense into an immutable consent artifact.
+ *
+ * The connector gate is the part that makes this a real trust policy rather
+ * than a config list. A declaration naming a source this PS does not serve is
+ * refused even if an operator pasted it in, because a grant over data that
+ * cannot exist here is at best useless and at worst a consent screen showing
+ * an owner something they cannot actually be sharing.
+ */
+export declare function buildDeclarationRegistry(options: PdppDeclarationRegistryOptions): {
+    resolve: (sourceId: string) => DeclarationSnapshot | null;
+    retained: DeclarationSnapshot[];
+    /** The exact retained bytes per source id, for digest verification. */
+    retainedDocuments: Map<string, string>;
+};
+//# sourceMappingURL=deployment.d.ts.map

package/dist/pdpp/deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/pdpp/deployment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAEtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAOpE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,8BAA8B;IAC7C,4DAA4D;IAC5D,YAAY,EAAE,qBAAqB,EAAE,CAAC;IACtC,6EAA6E;IAC7E,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,8BAA8B,GACtC;IACD,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,mBAAmB,GAAG,IAAI,CAAC;IAC1D,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,uEAAuE;IACvE,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC,CA8CA"}

package/dist/pdpp/deployment.js

@@ -0,0 +1,104 @@
+/**
+ * Deployment wiring for the PDPP Authorization Server.
+ *
+ * Two jobs the route module deliberately does not do, because both are
+ * deployment policy rather than protocol:
+ *
+ *   1. Decide which source declarations this server will accept as authority
+ *      over a source. Core §5 requires an explicit trust policy; "we could
+ *      reach it over HTTPS" is not one. The policy here is derived from what
+ *      this PS actually serves, so a server that holds no Spotify data does
+ *      not accept a Spotify declaration and cannot be talked into issuing a
+ *      grant over data it has never collected.
+ *
+ *   2. Map a verified owner wallet to the PDPP subject. This PS is
+ *      single-owner, so the subject is the server owner and nothing else.
+ *
+ * There is no trust-all default. A deployment that has configured no
+ * declarations accepts none, which makes `/pdpp/v1` inert rather than
+ * dangerous — the failure mode of a misconfigured authorization server should
+ * be "issues nothing", never "issues anything".
+ */
+import { parseDeclaration } from "@opendatalabs/personal-server-ts-core/pdpp";
+/**
+ * The connector inventory this PS serves, derived from the scopes it actually
+ * holds. A scope is `{source}.{category}[.{subcategory}]`, so the leading
+ * segment is the connector.
+ */
+export function deriveSupportedConnectors(scopes) {
+    const sources = new Set();
+    for (const scope of scopes) {
+        const source = scope.split(".")[0];
+        if (source && source.length > 0)
+            sources.add(source);
+    }
+    return Array.from(sources).sort();
+}
+/**
+ * Build the `resolveDeclaration` lookup the AS routes consume.
+ *
+ * Every configured declaration is validated and digested once at startup, then
+ * pinned. A declaration that fails validation is dropped with a warning rather
+ * than accepted-and-hoped-for: an AS resolving grants against a malformed
+ * declaration would freeze nonsense into an immutable consent artifact.
+ *
+ * The connector gate is the part that makes this a real trust policy rather
+ * than a config list. A declaration naming a source this PS does not serve is
+ * refused even if an operator pasted it in, because a grant over data that
+ * cannot exist here is at best useless and at worst a consent screen showing
+ * an owner something they cannot actually be sharing.
+ */
+export function buildDeclarationRegistry(options) {
+    const { logger } = options;
+    const supported = new Set(options.supportedConnectors);
+    const bySourceId = new Map();
+    // Only the documents that survived validation AND the connector gate. A
+    // rejected declaration must not leave its bytes behind for something else
+    // to verify against, or the trust policy would apply to the snapshot and
+    // not to the document.
+    const documentsBySourceId = new Map();
+    for (const configured of options.declarations) {
+        const parsed = parseDeclaration(configured.document, configured.sourceId);
+        if (!parsed.ok) {
+            logger.warn({ sourceId: configured.sourceId, reason: parsed.failure.message }, "PDPP declaration rejected: not retained");
+            continue;
+        }
+        const connector = connectorNameFor(parsed.snapshot);
+        if (!supported.has(connector)) {
+            logger.warn({ sourceId: configured.sourceId, connector }, "PDPP declaration rejected: this server does not serve that connector");
+            continue;
+        }
+        bySourceId.set(parsed.snapshot.source_id, parsed.snapshot);
+        documentsBySourceId.set(parsed.snapshot.source_id, configured.document);
+        logger.info({
+            sourceId: parsed.snapshot.source_id,
+            version: parsed.snapshot.version,
+            digest: parsed.snapshot.digest.slice(0, 12),
+        }, "PDPP declaration retained");
+    }
+    return {
+        resolve: (sourceId) => bySourceId.get(sourceId) ?? null,
+        retained: Array.from(bySourceId.values()),
+        retainedDocuments: documentsBySourceId,
+    };
+}
+/**
+ * The connector a declaration belongs to.
+ *
+ * Source IDs are absolute URIs whose last path segment names the connector
+ * (`https://registry.pdpp.dev/connectors/spotify` → `spotify`). Falling back
+ * to the whole ID for an unparseable value means an odd source fails the
+ * `supported` check rather than silently matching a connector it is not.
+ */
+function connectorNameFor(snapshot) {
+    try {
+        const segments = new URL(snapshot.source_id).pathname
+            .split("/")
+            .filter((s) => s.length > 0);
+        return segments[segments.length - 1] ?? snapshot.source_id;
+    }
+    catch {
+        return snapshot.source_id;
+    }
+}
+//# sourceMappingURL=deployment.js.map

package/dist/pdpp/deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../../src/pdpp/deployment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAG9E;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAgB;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAwBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAuC;IAOvC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC1D,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,uBAAuB;IACvB,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEtD,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EACjE,yCAAyC,CAC1C,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,EAC5C,sEAAsE,CACvE,CAAC;YACF,SAAS;QACX,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CACT;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;YACnC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;YAChC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAC5C,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI;QAC/D,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACzC,iBAAiB,EAAE,mBAAmB;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,QAA6B;IACrD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ;aAClD,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/pdpp/record-schema.d.ts

@@ -0,0 +1,2 @@
+export { createRecordDataValidator } from "@opendatalabs/personal-server-ts-core/storage/pdpp-records/schema";
+//# sourceMappingURL=record-schema.d.ts.map

package/dist/pdpp/record-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-schema.d.ts","sourceRoot":"","sources":["../../src/pdpp/record-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mEAAmE,CAAC"}

package/dist/pdpp/record-schema.js

@@ -0,0 +1,2 @@
+export { createRecordDataValidator } from "@opendatalabs/personal-server-ts-core/storage/pdpp-records/schema";
+//# sourceMappingURL=record-schema.js.map

package/dist/pdpp/record-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-schema.js","sourceRoot":"","sources":["../../src/pdpp/record-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mEAAmE,CAAC"}

package/dist/pdpp/records-bootstrap.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Boot the PDPP Resource Server for a real Personal Server.
+ *
+ * `createPdppAuthDeps` makes a running server a PDPP *authorization* server.
+ * This is its counterpart: without it a real deployment can issue a perfectly
+ * valid grant-bound token that has nothing to read, and cannot even publish
+ * the RFC 9728 metadata a client needs to discover where to authorize.
+ *
+ * Two deliberate choices about where things come from:
+ *
+ *   1. Stream declarations are derived from the SAME retained declaration
+ *      snapshots the AS resolved grants against — not a second config list.
+ *      A grant freezes a declaration version at consent time; if the RS read
+ *      its stream shapes from somewhere else, the two could disagree about
+ *      what a stream's primary key or required fields are, and enforcement
+ *      would be measured against a different document than the one the owner
+ *      consented to. One retained snapshot, one authority.
+ *
+ *   2. Token resolution is the co-located path: the RS resolves through the
+ *      AS's own `PdppTokenService` in-process. Core §8 permits this for a
+ *      co-located AS+RS, and it is the only correct option here because there
+ *      is exactly one authority — introspecting over HTTP against ourselves
+ *      would add a network hop and a second code path without adding a second
+ *      opinion. A separated deployment is a different wiring, not this one.
+ *
+ * Returns undefined when the AS did not mount, which leaves the resource
+ * surface unmounted too. An RS with no authorization server cannot enforce a
+ * grant, and a resource server that cannot enforce is worse than absent.
+ */
+import type { Database } from "better-sqlite3";
+import type { Logger } from "pino";
+import type { DeclarationSnapshot } from "@opendatalabs/personal-server-ts-core/pdpp";
+import { type PdppRecordStore, type StreamDeclarationRegistry } from "@opendatalabs/personal-server-ts-core/storage/pdpp-records";
+import type { PdppAuthorizationService } from "@opendatalabs/personal-server-ts-core/ports/pdpp-auth";
+import { type PdppImporter } from "@opendatalabs/personal-server-ts-core/sync";
+import type { PdppAuthRouteDeps } from "../routes/pdpp-auth.js";
+import { createSqliteRecordStore } from "../storage/pdpp-records-sqlite-store.js";
+export interface PdppRecordsDeps {
+    store: PdppRecordStore;
+    bindingStore: ReturnType<typeof createSqliteRecordStore>;
+    configuredMethods: Map<string, string[]>;
+    auth: PdppAuthorizationService;
+    declarations: StreamDeclarationRegistry;
+    instancesForSubject?: (subjectId: string) => string[];
+    instancesForSource?: (subjectId: string, sourceId: string) => string[];
+    readBlobBytes?: (blobId: string) => Promise<Uint8Array<ArrayBuffer> | undefined>;
+    resource: string;
+    authorizationServers?: string[];
+}
+export interface CreatePdppRecordsDepsOptions {
+    /** The mounted AS, or undefined when it did not mount. */
+    pdppAuth: PdppAuthRouteDeps | undefined;
+    /** The retained snapshots the AS resolves grants against. */
+    declarations: DeclarationSnapshot[];
+    /** The server's own database; records live alongside the rest of its state. */
+    db: Database;
+    serverOwner: `0x${string}` | undefined;
+    resource: string;
+    logger: Logger;
+    configuredMethods?: {
+        sourceId: string;
+        methodId: string;
+    }[];
+}
+/** Restore account-one registry rows for legacy scopes before Desktop reads the registry. */
+export declare function registerLegacyDataConnections(options: {
+    db: Database;
+    serverOwner: string | undefined;
+    connectionMethods: Map<string, string[]>;
+    legacyScopes: string[];
+    logger: Logger;
+}): void;
+export declare function createPdppRecordsDeps(options: CreatePdppRecordsDepsOptions): PdppRecordsDeps | undefined;
+/**
+ * Resolve tokens through the AS in-process.
+ *
+ * The AS's `resolveToken` is synchronous and marks `tokenKind`/`subjectId`
+ * optional, because an inactive token carries neither (RFC 7662 §2.2). The
+ * RS port is async and requires them, so this narrows explicitly rather than
+ * casting: an inactive result must never yield an undefined subject that
+ * flows onward into an authorization decision.
+ */
+export declare function coLocatedAuthorizationService(pdppAuth: PdppAuthRouteDeps): PdppAuthorizationService;
+/**
+ * Build the sync importer that maps qualifying DataPipe envelopes into the
+ * record store the RS reads from.
+ *
+ * Built from the SAME retained snapshots and the SAME instance derivation as
+ * the RS above, for the same reason given at the top of this file: a record
+ * imported under a different stream shape or a different instance handle than
+ * the RS enforces against is a record no grant can correctly reach. One
+ * retained declaration, one authority — on the write path too.
+ *
+ * The SQLite store refuses every write from this importer with
+ * `method_required`: `$pdpp` metadata names no acquisition method or binding
+ * generation, so P8a and P8c cannot be applied to it. The importer reports
+ * that as a terminal `method_authority` rejection and does not retry it.
+ *
+ * Returns undefined when the RS did not mount. Importing into a store nothing
+ * can read would be write-only work, and it would do it against declarations
+ * this deployment has not accepted.
+ */
+export declare function createPdppSyncImporter(options: {
+    records: PdppRecordsDeps | undefined;
+    declarations: DeclarationSnapshot[];
+    /** Exact retained bytes per source id, from the AS boot. */
+    documents: Map<string, string>;
+    serverOwner: `0x${string}` | undefined;
+    logger: Logger;
+}): PdppImporter | undefined;
+//# sourceMappingURL=records-bootstrap.d.ts.map

package/dist/pdpp/records-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records-bootstrap.d.ts","sourceRoot":"","sources":["../../src/pdpp/records-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAEL,KAAK,eAAe,EAGpB,KAAK,yBAAyB,EAC/B,MAAM,4DAA4D,CAAC;AACpE,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,uBAAuB,EAExB,MAAM,yCAAyC,CAAC;AAEjD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACzD,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,YAAY,EAAE,yBAAyB,CAAC;IACxC,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACtD,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACvE,aAAa,CAAC,EAAE,CACd,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,4BAA4B;IAC3C,0DAA0D;IAC1D,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACxC,6DAA6D;IAC7D,YAAY,EAAE,mBAAmB,EAAE,CAAC;IACpC,+EAA+E;IAC/E,EAAE,EAAE,QAAQ,CAAC;IACb,WAAW,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9D;AAED,6FAA6F;AAC7F,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,EAAE,EAAE,QAAQ,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,IAAI,CAoDP;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,GACpC,eAAe,GAAG,SAAS,CA+K7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,iBAAiB,GAC1B,wBAAwB,CAwB1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,eAAe,GAAG,SAAS,CAAC;IACrC,YAAY,EAAE,mBAAmB,EAAE,CAAC;IACpC,4DAA4D;IAC5D,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,YAAY,GAAG,SAAS,CAsD3B"}