@openzeppelin/guardian-operator-client 0.14.3 → 0.14.7

package/README.md

@@ -42,19 +42,196 @@ const verified = await client.verify({
 console.log(verified.operatorId);
 ```
 
-### List Accounts
+### List Accounts (Paginated)
 
 ```typescript
-const response = await client.listAccounts();
-console.log(response.totalCount);
-console.log(response.accounts[0]?.accountId);
+// Default page size is 50; max is 500.
+const page = await client.listAccounts({ limit: 50 });
+console.log(page.items[0]?.accountId);
+
+// Resume the next page with the cursor from the previous response.
+if (page.nextCursor !== null) {
+  const next = await client.listAccounts({
+    limit: 50,
+    cursor: page.nextCursor,
+  });
+  console.log(next.items.length);
+}
+
+// Filter by pause state. Omit `paused` for all accounts.
+const pausedOnly = await client.listAccounts({ paused: true });
+const activeOnly = await client.listAccounts({ paused: false });
 ```
 
 ### Fetch One Account
 
+`getAccount()` returns the bare `DashboardAccountDetail` — there is no
+`{ success, account }` wrapper. Read fields directly on the response.
+
+```typescript
+const detail = await client.getAccount('0x...');
+console.log(detail.authorizedSignerIds);
+console.log(detail.currentCommitment, detail.stateUpdatedAt);
+```
+
+### Decoded Account Snapshot
+
+Returns the decoded state (vault contents, pending-candidate flag) at
+the commitment Guardian last canonicalized for the account. Sourced
+from Guardian's stored state — no live Miden RPC calls.
+
+```typescript
+const snapshot = await client.getAccountSnapshot('0x...');
+console.log(snapshot.commitment, snapshot.updatedAt);
+if (snapshot.hasPendingCandidate) {
+  console.warn('vault may be stale — candidate delta in flight');
+}
+for (const asset of snapshot.vault.fungible) {
+  console.log(asset.faucetId, asset.amount);
+}
+```
+
+### Inventory And Health Snapshot
+
+```typescript
+const info = await client.getDashboardInfo();
+console.log(info.totalAccountCount, info.environment);
+console.log(info.deltaStatusCounts.candidate);
+console.log(info.inFlightProposalCount);
+if (info.serviceStatus === 'degraded') {
+  console.warn('degraded aggregates:', info.degradedAggregates);
+}
+```
+
+### Per-Account Delta Feed
+
+Each entry carries the dashboard-ready activity fields spread directly
+at L1 (feature 007). `category` is the server-curated coarse
+classification; `assets` (array) / `counterparty` / `noteCounts` are
+derived from the on-chain `TransactionSummary`; `proposalType` echoes
+the operator's intent label for multisig commits. All five fields are
+optional — absent fields mean "not derivable from this row" (EVM
+deltas, pre-feature-007 historical rows whose proposal was already
+deleted, or undecodable payloads).
+
+```typescript
+const page = await client.listAccountDeltas('0x...', { limit: 50 });
+for (const entry of page.items) {
+  console.log(entry.nonce, entry.status, entry.statusTimestamp);
+  if (entry.category) {
+    console.log('category:', entry.category);
+    console.log('notes:', entry.noteCounts);
+    if (entry.proposalType) {
+      console.log('proposal type:', entry.proposalType);
+    }
+    if (entry.assets && entry.assets.length > 0) {
+      for (const a of entry.assets) {
+        console.log('asset:', a.assetId, a.amount);
+      }
+    }
+  } else {
+    // No dashboard fields → render as "metadata unavailable", not as
+    // zero-valued defaults. Reasons listed above.
+    console.log('metadata unavailable');
+  }
+}
+```
+
+For the full structured projection of a single delta (decoded input /
+output notes, vault changes, storage changes, plus the full
+`proposal` intent block), call `getAccountDeltaDetail`:
+
+```typescript
+const detail = await client.getAccountDeltaDetail('0x...', entry.nonce);
+console.log('input notes:', detail.inputNotes.length);
+console.log('vault changes:', detail.vaultChanges);
+if (detail.proposal) {
+  console.log('proposal intent:', detail.proposal);
+}
+
+// Debug: include the raw base64 TransactionSummary blob in the
+// response so you can sanity-check the server's projection against
+// the on-disk bytes.
+const debug = await client.getAccountDeltaDetail('0x...', entry.nonce, {
+  includeRaw: true,
+});
+console.log('raw bytes (base64):', debug.rawTransactionSummary);
+```
+
+### Per-Account In-Flight Proposals
+
+Single-key Miden accounts and EVM accounts always return an empty
+proposal queue.
+
+```typescript
+const page = await client.listAccountProposals('0x...', { limit: 50 });
+for (const entry of page.items) {
+  console.log(
+    entry.commitment,
+    entry.signaturesCollected,
+    '/',
+    entry.signaturesRequired,
+  );
+}
+```
+
+### Pause / Unpause Account
+
+Both endpoints require the `accounts:pause` permission and are
+idempotent. Re-pausing an already-paused account returns success with
+the original `pausedAt` and `pausedReason` preserved (first-writer
+wins). `reason` is required on pause (non-empty, ≤ 512 chars) and
+optional on unpause.
+
+```typescript
+const paused = await client.pauseAccount('0x...', 'compliance review');
+console.log(paused.pausedAt, paused.pausedReason);
+
+await client.unpauseAccount('0x...', 'cleared by legal');
+```
+
+While an account is paused, mutating endpoints (delta submission,
+proposal creation, proposal signing) reject with HTTP 409 and code
+`account_paused` (normalized by the client from the server wire code
+`GUARDIAN_ACCOUNT_PAUSED`). Account setup paths (`configureAccount`,
+EVM register) are admin operations and remain available while paused.
+Read endpoints — including `listAccounts({ paused: true })` and
+`getAccount()` — continue to work and surface `pausedAt` /
+`pausedReason` on the response.
+
+### Cross-Account Delta Feed
+
+Paginated newest-first by `status_timestamp DESC`. The optional
+`status` filter accepts a single status or an array; the wrapper
+serializes the array to a comma-separated query parameter.
+
+```typescript
+const page = await client.listGlobalDeltas({
+  limit: 50,
+  status: ['candidate', 'canonical'],
+});
+for (const entry of page.items) {
+  console.log(entry.accountId, entry.nonce, entry.status);
+}
+```
+
+### Cross-Account In-Flight Proposal Feed
+
+Paginated newest-first by `originating_timestamp DESC`. There is no
+`status` filter — every entry is in-flight by definition. EVM accounts
+do not appear in v1.
+
 ```typescript
-const response = await client.getAccount('0x...');
-console.log(response.account.authorizedSignerIds);
+const page = await client.listGlobalProposals({ limit: 50 });
+for (const entry of page.items) {
+  console.log(
+    entry.accountId,
+    entry.commitment,
+    entry.signaturesCollected,
+    '/',
+    entry.signaturesRequired,
+  );
+}
 ```
 
 ### Logout
@@ -63,6 +240,33 @@ console.log(response.account.authorizedSignerIds);
 await client.logout();
 ```
 
+## Pagination Shape
+
+Every paginated dashboard endpoint returns a `PagedResult<T>` envelope:
+
+```jsonc
+{
+  "items": [ /* T entries */ ],
+  "next_cursor": "string | null"  // null at end of list
+}
+```
+
+- `limit` defaults to `50` and is capped at `500`. A bare `?limit=`
+  (present but empty) is treated as omitted; out-of-range values
+  return `400 invalid_limit`.
+- `cursor` is opaque, server-signed, and tied to a specific endpoint
+  kind (e.g. an account-list cursor cannot be replayed on the
+  deltas endpoint). Tampered or stale cursors return
+  `400 invalid_cursor`. There is no client-visible TTL.
+- A `cursor` may be supplied without a `limit`; the default of 50
+  applies.
+- The account list endpoint sorts by `(updated_at DESC, account_id
+  ASC)`. Concurrent updates to `updated_at` MAY cause an account to
+  be skipped or repeated across a traversal — documented expected
+  behavior of cursor pagination over a mutable sort key. All other
+  paginated endpoints sort by an immutable per-account `nonce` (or
+  `(nonce, commitment)` for proposals) and are fully stable.
+
 ## Cookie Transport
 
 The Guardian operator session is cookie-based. This package does not manage a
@@ -75,13 +279,36 @@ appropriate for your runtime.
 import {
   GuardianOperatorContractError,
   GuardianOperatorHttpError,
+  isDashboardErrorCode,
 } from '@openzeppelin/guardian-operator-client';
 
 try {
-  await client.listAccounts();
+  await client.listAccounts({ limit: 9999 });
 } catch (error) {
   if (error instanceof GuardianOperatorHttpError) {
-    console.error(error.status, error.data?.error);
+    // Stable machine-readable code lives on `error.data.code`.
+    // Branch on it rather than on `error.status` or
+    // `error.data.error` (the human message).
+    const code = error.data?.code;
+    if (code && isDashboardErrorCode(code)) {
+      switch (code) {
+        case 'invalid_limit':
+        case 'invalid_cursor':
+        case 'invalid_status_filter':
+          // Caller bug — fix the request.
+          break;
+        case 'account_not_found':
+          // Path-addressed account does not exist.
+          break;
+        case 'data_unavailable':
+          // Metadata exists but storage cannot be read; retry later.
+          break;
+        case 'authentication_failed':
+          // Operator session is missing, tampered, or expired —
+          // re-issue the challenge / verify flow.
+          break;
+      }
+    }
   }
 
   if (error instanceof GuardianOperatorContractError) {
@@ -89,3 +316,87 @@ try {
   }
 }
 ```
+
+The dashboard error taxonomy (feature `005-operator-dashboard-metrics`
+FR-028) is:
+
+| HTTP | Body `code` | When |
+|------|-------------|------|
+| 401 | `authentication_failed` | missing / tampered / expired operator session |
+| 403 | `GUARDIAN_INSUFFICIENT_OPERATOR_PERMISSION` | operator session is valid but lacks one or more route-required permissions (feature `006-operator-authz`) |
+| 404 | `account_not_found` | path-addressed account does not exist |
+| 400 | `invalid_cursor` | tampered, malformed, or stale cursor |
+| 400 | `invalid_limit` | `limit` outside `[1, 500]` |
+| 400 | `invalid_status_filter` | global delta feed `status` filter is unknown or malformed |
+| 409 | `account_paused` | mutating call against a paused account; error details carry `pausedAt` and `pausedReason`. Wire code `GUARDIAN_ACCOUNT_PAUSED` is normalized by the client. |
+| 503 | `data_unavailable` | metadata exists but underlying records cannot be read |
+
+### Operator Authorization (feature `006-operator-authz`)
+
+The dashboard now enforces per-operator permissions on every route. The
+allowlist JSON consumed by `GUARDIAN_OPERATOR_PUBLIC_KEYS_JSON` /
+`_FILE` / `_SECRET_ID` accepts a **heterogeneous** array of two element
+shapes:
+
+```jsonc
+[
+  // Legacy element: bare hex string → `{dashboard:read}` only.
+  "0x094f145ec43583db3ca443f43a67545c...",
+
+  // Structured element: explicit permission set.
+  {
+    "public_key": "0x0944089753530e9104cc9fc4...",
+    "permissions": ["dashboard:read", "accounts:pause"]
+  },
+
+  // Explicit-deny element: loads, but denies every authorization
+  // check (different from omitting the operator entirely).
+  {
+    "public_key": "0x0a11...",
+    "permissions": []
+  }
+]
+```
+
+Recognized permissions in v1: `dashboard:read`, `accounts:pause`,
+`policies:write`.
+
+When the server denies a request for insufficient permissions, the
+response body extends the existing flat envelope additively:
+
+```json
+{
+  "success": false,
+  "code": "GUARDIAN_INSUFFICIENT_OPERATOR_PERMISSION",
+  "error": "Operator lacks required permissions: accounts:pause",
+  "missing_permissions": ["accounts:pause"],
+  "retryable": false
+}
+```
+
+`parseErrorBody` and the `GuardianOperatorHttpErrorData` shape both
+expose `missingPermissions` and `retryable` for this code; the fields
+are `undefined` for every other code.
+
+For UI gating, call `getSession()` to read the authenticated
+operator's live permission set and compare entries against the
+exported wire-string constants:
+
+```typescript
+import {
+  ACCOUNTS_PAUSE,
+  DASHBOARD_READ,
+  GuardianOperatorHttpClient,
+} from '@openzeppelin/guardian-operator-client';
+
+const client = new GuardianOperatorHttpClient('https://guardian.example');
+const { permissions } = await client.getSession();
+
+const canPause = permissions.includes(ACCOUNTS_PAUSE);
+const canRead = permissions.includes(DASHBOARD_READ);
+```
+
+The session endpoint re-reads permissions from the allowlist on every
+call, so allowlist edits take effect without re-login. The server is
+still the source of truth on every mutating endpoint — the client
+MUST NOT short-circuit a request based on its own capability check.

package/dist/http.d.ts

@@ -1,4 +1,70 @@
-import type { DashboardAccountResponse, DashboardAccountsResponse, GuardianOperatorHttpClientOptions, GuardianOperatorHttpErrorData, LogoutOperatorResponse, OperatorChallengeResponse, VerifyOperatorRequest, VerifyOperatorResponse } from './types.js';
+import type { DashboardAccountResponse, DashboardAccountSnapshot, DashboardAccountSummary, DashboardDeltaDetail, DashboardDeltaEntry, DashboardErrorCode, DashboardGlobalDeltaEntry, DashboardGlobalProposalEntry, DashboardInfoResponse, DashboardProposalEntry, GlobalDeltasOptions, DeltaDetailOptions, GuardianOperatorHttpClientOptions, GuardianOperatorHttpErrorData, LogoutOperatorResponse, OperatorChallengeResponse, PagedResult, PauseAccountResponse, SessionInfoResponse, UnpauseAccountResponse, VerifyOperatorRequest, VerifyOperatorResponse } from './types.js';
+/**
+ * Common pagination query options for the new dashboard feeds
+ * endpoints. Spec reference: `005-operator-dashboard-metrics` FR-001.
+ */
+export interface PaginationOptions {
+    /** Page size; default 50 server-side, max 500. */
+    limit?: number;
+    /** Opaque cursor token from a prior page's `nextCursor`. */
+    cursor?: string;
+}
+/**
+ * Options for {@link GuardianOperatorHttpClient.listAccounts}. Extends
+ * {@link PaginationOptions} with a tri-state pause filter: `true` for
+ * paused accounts only, `false` for active only, omitted for all.
+ */
+export interface ListAccountsOptions extends PaginationOptions {
+    paused?: boolean;
+}
+/**
+ * Result of parsing an error response body. The {@link code} field is
+ * narrowed to {@link DashboardErrorCode} when the server emitted one of
+ * the dashboard error codes; otherwise it is forwarded as a raw string
+ * (or `null` if the body was missing/malformed).
+ */
+export interface ParsedErrorBody {
+    code: DashboardErrorCode | string | null;
+    message: string | null;
+    retryAfterSecs?: number;
+    /**
+     * Populated only when `code === 'insufficient_operator_permission'`.
+     * Lists the permission strings the route required that the
+     * authenticated operator does not hold, lexicographically sorted by
+     * the server (feature 006-operator-authz FR-017).
+     */
+    missingPermissions?: readonly string[];
+    /**
+     * `false` for permission denials and account-paused rejections;
+     * absent for every other code.
+     */
+    retryable?: boolean;
+    /**
+     * Populated only when `code === 'account_paused'`. RFC 3339 UTC
+     * timestamp of the original pause.
+     */
+    pausedAt?: string;
+    /**
+     * Populated only when `code === 'account_paused'`. May be `null`
+     * for forward compatibility (the v1 server always emits a
+     * non-null reason).
+     */
+    pausedReason?: string | null;
+}
+/**
+ * Parse an error response body into a typed `{ code, message }` shape.
+ * Clients SHOULD branch on `code` rather than on the HTTP status alone
+ * — see FR-028 of `005-operator-dashboard-metrics`.
+ *
+ * Accepts either a `Response` (fetch result) or a pre-read JSON body.
+ * Returns `{ code: null, message: null }` when the body is absent or
+ * malformed; never throws.
+ */
+export declare function parseErrorBody(response: Response | unknown): Promise<ParsedErrorBody>;
+/**
+ * Type guard narrowing an arbitrary string to {@link DashboardErrorCode}.
+ */
+export declare function isDashboardErrorCode(value: string): value is DashboardErrorCode;
 export declare class GuardianOperatorHttpError extends Error {
     readonly status: number;
     readonly statusText: string;
@@ -21,8 +87,98 @@ export declare class GuardianOperatorHttpClient {
     challenge(commitment: string): Promise<OperatorChallengeResponse>;
     verify(request: VerifyOperatorRequest): Promise<VerifyOperatorResponse>;
     logout(): Promise<LogoutOperatorResponse>;
-    listAccounts(): Promise<DashboardAccountsResponse>;
+    /**
+     * Paginated account list per feature
+     * `005-operator-dashboard-metrics` US1 / FR-001..FR-008.
+     *
+     * **Breaking change vs. `003-operator-account-apis`**: the response
+     * is now a {@link PagedResult} envelope. The previous
+     * unparameterized full-inventory mode and `total_count` field are
+     * removed; aggregate inventory totals are exposed via
+     * {@link GuardianOperatorHttpClient.getDashboardInfo}. Callers that
+     * relied on `listAccounts()` must migrate to this method.
+     */
+    listAccounts(options?: ListAccountsOptions): Promise<PagedResult<DashboardAccountSummary>>;
+    /**
+     * Return the authenticated operator's identity and effective
+     * permission set. Succeeds for any valid session, including
+     * operators with `permissions: []` (returns an empty array).
+     */
+    getSession(): Promise<SessionInfoResponse>;
+    /**
+     * Inventory and lifecycle health snapshot per feature
+     * `005-operator-dashboard-metrics` US2 / FR-008..FR-012.
+     */
+    getDashboardInfo(): Promise<DashboardInfoResponse>;
+    /**
+     * Pause mutating actions for the given account. Requires
+     * `accounts:pause`. Idempotent: re-pausing an already-paused account
+     * returns success with the original `pausedAt` preserved.
+     */
+    pauseAccount(accountId: string, reason: string): Promise<PauseAccountResponse>;
+    /**
+     * Clear pause state for the given account. Requires `accounts:pause`.
+     * Idempotent: unpausing an already-active account returns success
+     * with no state change.
+     */
+    unpauseAccount(accountId: string, reason?: string): Promise<UnpauseAccountResponse>;
     getAccount(accountId: string): Promise<DashboardAccountResponse>;
+    /**
+     * Return a decoded snapshot of `accountId`'s stored state at the
+     * commitment Guardian last canonicalized — v1 surface exposes the
+     * fungible/non-fungible vault. The endpoint distinguishes its
+     * failure modes via the FR-045 error taxonomy:
+     *
+     * - `400 unsupported_for_network` — the account's `network_config`
+     *   is EVM. The snapshot endpoint is Miden-only by construction;
+     *   this is a permanent condition for the account on this surface,
+     *   not a transient failure.
+     * - `404 account_not_found` — no metadata exists.
+     * - `503 account_data_unavailable` — metadata exists but the state
+     *   row cannot be loaded, or the stored blob fails to deserialize
+     *   as a Miden `Account`. Transient/recoverable.
+     *
+     * Spec reference: follow-up addition to `005-operator-dashboard-metrics`
+     * FR-043..FR-046.
+     */
+    getAccountSnapshot(accountId: string): Promise<DashboardAccountSnapshot>;
+    /**
+     * List the per-account delta feed for `accountId`, paginated
+     * newest-first by `nonce DESC`. Spec reference:
+     * `005-operator-dashboard-metrics` US3.
+     */
+    listAccountDeltas(accountId: string, options?: PaginationOptions): Promise<PagedResult<DashboardDeltaEntry>>;
+    /**
+     * Fetch the full detail projection of one canonical delta. The
+     * nonce is serialized as a canonical base-10 `u64` URL segment;
+     * unknown account and unknown nonce both surface as
+     * `404 delta_not_found`.
+     */
+    getAccountDeltaDetail(accountId: string, nonce: number, options?: DeltaDetailOptions): Promise<DashboardDeltaDetail>;
+    /**
+     * List the per-account in-flight multisig proposal queue for
+     * `accountId`, paginated newest-first by `(nonce DESC, commitment
+     * DESC)`. Single-key Miden and EVM accounts always return an empty
+     * page per FR-017. Spec reference:
+     * `005-operator-dashboard-metrics` US4.
+     */
+    listAccountProposals(accountId: string, options?: PaginationOptions): Promise<PagedResult<DashboardProposalEntry>>;
+    /**
+     * Cross-account delta feed. Paginated newest-first by
+     * `status_timestamp DESC`. The optional `status` filter accepts a
+     * single status or an array; the wrapper serializes the array to
+     * comma-separated. Spec reference:
+     * `005-operator-dashboard-metrics` US6.
+     */
+    listGlobalDeltas(options?: GlobalDeltasOptions): Promise<PagedResult<DashboardGlobalDeltaEntry>>;
+    /**
+     * Cross-account in-flight proposal feed. Paginated newest-first by
+     * `originating_timestamp DESC`. Takes no `status` filter — every
+     * entry is in-flight by definition. EVM accounts do not appear in
+     * v1 per FR-017. Spec reference:
+     * `005-operator-dashboard-metrics` US7.
+     */
+    listGlobalProposals(options?: PaginationOptions): Promise<PagedResult<DashboardGlobalProposalEntry>>;
     private request;
     private toHttpError;
 }

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,wBAAwB,EAExB,yBAAyB,EAEzB,iCAAiC,EACjC,6BAA6B,EAC7B,sBAAsB,EAEtB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,qBAAa,yBAA0B,SAAQ,KAAK;aAIhC,MAAM,EAAE,MAAM;aACd,UAAU,EAAE,MAAM;aAClB,IAAI,EAAE,MAAM;aACZ,IAAI,EAAE,6BAA6B,GAAG,IAAI;IAN5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;gBAGf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,6BAA6B,GAAG,IAAI;CAU7D;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,OAAO,EAAE,MAAM;gBAAf,OAAO,EAAE,MAAM,EAC/B,OAAO,EAAE,MAAM;CAKlB;AAED,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAM;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAE7B,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,iCAAiC;IAahD,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAMjE,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAcvE,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAQzC,YAAY,IAAI,OAAO,CAAC,yBAAyB,CAAC;IAQlD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;YASxD,OAAO;YA4BP,WAAW;CAU1B"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,wBAAwB,EACxB,wBAAwB,EAExB,uBAAuB,EAQvB,oBAAoB,EACpB,mBAAmB,EASnB,kBAAkB,EAClB,yBAAyB,EACzB,4BAA4B,EAC5B,qBAAqB,EACrB,sBAAsB,EAItB,mBAAmB,EACnB,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,EAC7B,sBAAsB,EAEtB,yBAAyB,EACzB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAGpB;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAiDD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,GAAG,OAAO,GAC3B,OAAO,CAAC,eAAe,CAAC,CA4F1B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,kBAAkB,CAE7B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;aAIhC,MAAM,EAAE,MAAM;aACd,UAAU,EAAE,MAAM;aAClB,IAAI,EAAE,MAAM;aACZ,IAAI,EAAE,6BAA6B,GAAG,IAAI;IAN5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;gBAGf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,6BAA6B,GAAG,IAAI;CAU7D;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,OAAO,EAAE,MAAM;gBAAf,OAAO,EAAE,MAAM,EAC/B,OAAO,EAAE,MAAM;CAKlB;AAED,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAM;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAE7B,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,iCAAiC;IAahD,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAMjE,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAcvE,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAQ/C;;;;;;;;;;OAUG;IACG,YAAY,CAChB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAShD;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAQhD;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAQxD;;;;OAIG;IACG,YAAY,CAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,CAAC;IAShC;;;;OAIG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,CAAC;IAa5B,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAStE;;;;;;;;;;;;;;;;;OAiBG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAS9E;;;;OAIG;IACG,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAU5C;;;;;OAKG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,oBAAoB,CAAC;IAkBhC;;;;;;OAMG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAU/C;;;;;;OAMG;IACG,gBAAgB,CACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAmBlD;;;;;;OAMG;IACG,mBAAmB,CACvB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;YAMvC,OAAO;YA4BP,WAAW;CAU1B"}