@pithy-sh/core 0.13.0 → 0.15.0

package/README.md

@@ -0,0 +1,54 @@
+# @pithy-sh/core
+
+The contract every Pithy capability composes through, and the seams they share: `defineCapability` and `createBackend`, the `PithyError` family, the D1 and KV codecs, the `AuthContext`, translator, audit and entitlement seams, the control-plane seam, and presence rooms.
+
+**Documentation: [pithy.sh/docs](https://pithy.sh/docs).** The control-plane seam is [`docs/CONTROL-PLANE.md`](../../docs/CONTROL-PLANE.md); sockets are [`docs/SOCKETS.md`](../../docs/SOCKETS.md).
+
+## Presence rooms
+
+Who else has a record open, live, from your own Worker. A capability declares its room kinds on `presence`:
+
+```ts
+defineCapability({
+  name: "support",
+  presence: {
+    basePath: "/support",
+    ticketKey: (env) => readTicketKey(env), // presence-ticket-key, through @pithy-sh/secrets
+    rooms: [
+      {
+        kind: "support.thread",
+        scope: "support:threads:read",
+        activities: ["viewing", "replying"],
+        session: (c, recordId) => (canRead(c, recordId) ? { name: displayName(c) } : null),
+      },
+    ],
+  },
+  // …
+});
+```
+
+At runtime that is the whole of the wiring: `defineCapability` adds the `PRESENCE_ROOMS` Durable Object binding and the room socket, `createBackend` mounts the routes under `basePath`, and the control-plane manifest lists the kind. The CLI does not read your code, though. A kit capability's `pithy.manifest.json` must list the binding in `requiredBindings` exactly as `PRESENCE_ROOMS_BINDING_SPEC` gives it, beside the `presence-ticket-key` entry in `devSecrets`, because that manifest is what `pithy add` and `pithy upgrade` wire. Leave it out and `pithy add` writes no binding, no class migration and no entry export, and the Worker has no room to open. Only your own `app` capability, which has no manifest, is wired from its composition by `pithy upgrade`.
+
+```json
+"requiredBindings": [
+  {
+    "type": "durable_object",
+    "name": "PRESENCE_ROOMS",
+    "className": "PresenceRoom",
+    "classModule": "@pithy-sh/core/src/presence/durableObject"
+  }
+]
+```
+
+- **Tickets.** A management client mints one at `POST /control-plane/presence/tickets` with the kind's own scope. A signed-in user mints one at `POST {basePath}/presence/tickets`, when `session` admits them. Single use, 60 seconds, one room, one participant.
+- **The socket.** `GET {basePath}/presence/rooms/:kind/:recordId`, offering `pithy.presence.v1` and `pithy.ticket.<ticket>` in `Sec-WebSocket-Protocol`. `init` first, then `joined`, `left` and `activity`. Send `set_activity` with a declared activity, and `ping` for `pong`.
+- **The ticket key.** `presence-ticket-key`, declared in the capability's `@pithy-sh/secrets` registry with `PRESENCE_TICKET_KEY_ENTRY` and listed in its manifest's `devSecrets`. Nobody chooses its value: `pithy add` mints the local one and `pithy secrets provision` the deployed ones.
+- **The room** is one hibernating `PresenceRoom` per record. It holds nothing but who is here, in its sockets' attachments, and writes nothing to D1, KV or storage.
+
+Ticket, participant and frame schemas are exported from `@pithy-sh/core/src/presence/http/responses`, `@pithy-sh/core/src/presence/http/schemas` and `@pithy-sh/core/src/presence/frames`.
+
+`pithy add` and `pithy upgrade` write the binding, the class migration tag and this line into your Worker's entry:
+
+```ts
+export { PresenceRoom } from "@pithy-sh/core/src/presence/durableObject";
+```

package/dist/audit/auditEvent.js

@@ -58,7 +58,7 @@ const AuditEvent = z.object({
 	severity: AuditSeverity.default("info").describe("How serious the event is; defaults to `info`."),
 	actorType: AuditActorType.describe("The kind of principal that acted."),
 	actorId: z.string().nullish().describe("The acting principal's stable id (user id, service/token name); null for `system`/`anonymous`."),
-	actorKind: ControlPlaneActorKind.nullish().describe("For a `control-plane` actor, what kind of management client acted — `agent`, `dashboard` or `script` — from the connection it called through (#721). `actorType` names all three alike; this is what tells them apart. Stamped by `requireControlPlane`, so an emit site does not set it; null for every other actor type, and for a connection registered before the kind was recorded."),
+	actorKind: ControlPlaneActorKind.nullish().describe("What kind of client acted — `agent`, `dashboard` or `script`. On a `control-plane` row it is the connection's kind, which `actorType` cannot tell apart, stamped by `requireControlPlane` so an emit site does not set it; null for a connection registered before the kind was recorded. On a `user` row it is `agent` when an MCP client acted as that user, so one filter finds every agent row on both paths. Null otherwise."),
 	sessionId: z.string().nullish().describe("The session this action belongs to, tying a chain of actions together; null when none."),
 	resourceType: z.string().nullish().describe("The type of resource the action targeted (e.g. `user`, `secret`); null when not resource-scoped."),
 	resourceId: z.string().nullish().describe("The id of the resource the action targeted; null when not resource-scoped."),

package/dist/audit/chain.d.ts

@@ -0,0 +1,289 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { z } from "zod";
+/**
+ * **The audit trail's hash chain (#822): its canonical form, its commitments, and its verifier.**
+ *
+ * Every event `@pithy-sh/audit` records after the upgrade carries the hash of the event before it in its tenant's
+ * chain, computed over a canonical serialization. Editing, deleting or inserting a row then breaks a link, and a
+ * chain rewritten end to end is caught against a checkpoint written outside the database.
+ *
+ * **It lives in core, not in the audit package**, because three readers need the same bytes: the recorder that
+ * writes a link, the Worker's verify read, and `pithy audit verify`, which an auditor runs on an export with no
+ * project and no `@pithy-sh/audit` installed. A second copy of the canonical form is a second definition of the
+ * evidence, and the first time they differ every export reads as tampered.
+ *
+ * **Personal fields are committed, not included.** An event's hash covers a salted hash of its IP, user-agent and
+ * metadata rather than the values, so an export that leaves them out still verifies. The salt is per event and
+ * travels only with the values, so a commitment cannot be reversed by hashing every IPv4 address.
+ *
+ * **Nothing is signed.** The chain proves the trail is whole against its checkpoints; it adds no key and no way
+ * to change the trail.
+ */
+/** The canonical form's version, the first element of every serialization. A new form is a new string. */
+export declare const AUDIT_CHAIN_FORMAT = "pithy-audit-chain/1";
+/** A lowercase hex SHA-256 digest. */
+export declare const Sha256Hex: z.ZodString;
+/**
+ * Every field of an event its hash covers, as the row stores it. Loose strings, never the taxonomy's enums: a
+ * verifier reads an export somebody may have altered, and an altered value must reach the hash check and be
+ * named as a break rather than fail to parse.
+ */
+export declare const ChainedEventFields: z.ZodObject<{
+    eventId: z.ZodString;
+    occurredAt: z.ZodNumber;
+    action: z.ZodString;
+    outcome: z.ZodString;
+    severity: z.ZodString;
+    actorType: z.ZodString;
+    actorId: z.ZodNullable<z.ZodString>;
+    actorKind: z.ZodNullable<z.ZodString>;
+    sessionId: z.ZodNullable<z.ZodString>;
+    resourceType: z.ZodNullable<z.ZodString>;
+    resourceId: z.ZodNullable<z.ZodString>;
+    requestId: z.ZodNullable<z.ZodString>;
+    tenant: z.ZodNullable<z.ZodString>;
+    project: z.ZodNullable<z.ZodString>;
+    environment: z.ZodNullable<z.ZodString>;
+    worker: z.ZodNullable<z.ZodString>;
+    version: z.ZodNullable<z.ZodString>;
+    ipCommitment: z.ZodNullable<z.ZodString>;
+    userAgentCommitment: z.ZodNullable<z.ZodString>;
+    metadataCommitment: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ChainedEventFields = z.infer<typeof ChainedEventFields>;
+/** One event's place in its chain: its position and the hash of the event before it. */
+export interface ChainPosition {
+    /** The 1-based position in the tenant's chain. */
+    seq: number;
+    /** The previous event's hash, or null for the first event. */
+    prev: string | null;
+}
+/** A link a range starts from or ends at: a position and the hash of the event there. */
+export declare const ChainLink: z.ZodObject<{
+    seq: z.ZodNumber;
+    hash: z.ZodString;
+}, z.core.$strip>;
+export type ChainLink = z.infer<typeof ChainLink>;
+/**
+ * One chained event as an export carries it: the hashed fields, its link, and — only with the detail scope — the
+ * personal values and the salt their commitments were made under.
+ */
+export declare const ChainedEvent: z.ZodObject<{
+    eventId: z.ZodString;
+    occurredAt: z.ZodNumber;
+    action: z.ZodString;
+    outcome: z.ZodString;
+    severity: z.ZodString;
+    actorType: z.ZodString;
+    actorId: z.ZodNullable<z.ZodString>;
+    actorKind: z.ZodNullable<z.ZodString>;
+    sessionId: z.ZodNullable<z.ZodString>;
+    resourceType: z.ZodNullable<z.ZodString>;
+    resourceId: z.ZodNullable<z.ZodString>;
+    requestId: z.ZodNullable<z.ZodString>;
+    tenant: z.ZodNullable<z.ZodString>;
+    project: z.ZodNullable<z.ZodString>;
+    environment: z.ZodNullable<z.ZodString>;
+    worker: z.ZodNullable<z.ZodString>;
+    version: z.ZodNullable<z.ZodString>;
+    ipCommitment: z.ZodNullable<z.ZodString>;
+    userAgentCommitment: z.ZodNullable<z.ZodString>;
+    metadataCommitment: z.ZodNullable<z.ZodString>;
+    seq: z.ZodNumber;
+    prev: z.ZodNullable<z.ZodString>;
+    hash: z.ZodString;
+    salt: z.ZodOptional<z.ZodString>;
+    ip: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    userAgent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    metadata: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type ChainedEvent = z.infer<typeof ChainedEvent>;
+/** The format string of a checkpoint object. */
+export declare const AUDIT_CHECKPOINT_FORMAT = "pithy-audit-checkpoint/1";
+/** One checkpoint: a tenant chain's length and head, written outside the database on a schedule. */
+export declare const AuditCheckpoint: z.ZodObject<{
+    format: z.ZodLiteral<"pithy-audit-checkpoint/1">;
+    tenant: z.ZodNullable<z.ZodString>;
+    count: z.ZodNumber;
+    head: z.ZodString;
+    takenAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export type AuditCheckpoint = z.infer<typeof AuditCheckpoint>;
+/** The format string of a tombstone object. */
+export declare const AUDIT_TOMBSTONE_FORMAT = "pithy-audit-tombstone/1";
+/**
+ * A pruned run of one chain: which positions the retention prune removed, the link before them, and the hashes at
+ * either end. Written to the checkpoint bucket before the rows are deleted, never overwritten, so a verify bridges
+ * the gap from the event before it to the event after it and reads the chain as whole across it.
+ */
+export declare const AuditTombstone: z.ZodObject<{
+    format: z.ZodLiteral<"pithy-audit-tombstone/1">;
+    tenant: z.ZodNullable<z.ZodString>;
+    fromSeq: z.ZodNumber;
+    throughSeq: z.ZodNumber;
+    count: z.ZodNumber;
+    prior: z.ZodNullable<z.ZodString>;
+    first: z.ZodString;
+    last: z.ZodString;
+    prunedAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export type AuditTombstone = z.infer<typeof AuditTombstone>;
+/** The format string of an export document. */
+export declare const AUDIT_EXPORT_FORMAT = "pithy-audit-export/1";
+/** An export: one tenant's events in a range, the link before it, and the checkpoints covering it. */
+export declare const AuditChainExport: z.ZodObject<{
+    format: z.ZodLiteral<"pithy-audit-export/1">;
+    chain: z.ZodLiteral<"pithy-audit-chain/1">;
+    tenant: z.ZodNullable<z.ZodString>;
+    since: z.ZodNullable<z.ZodISODateTime>;
+    until: z.ZodNullable<z.ZodISODateTime>;
+    exportedAt: z.ZodISODateTime;
+    detail: z.ZodBoolean;
+    prior: z.ZodNullable<z.ZodObject<{
+        seq: z.ZodNumber;
+        hash: z.ZodString;
+    }, z.core.$strip>>;
+    events: z.ZodArray<z.ZodObject<{
+        eventId: z.ZodString;
+        occurredAt: z.ZodNumber;
+        action: z.ZodString;
+        outcome: z.ZodString;
+        severity: z.ZodString;
+        actorType: z.ZodString;
+        actorId: z.ZodNullable<z.ZodString>;
+        actorKind: z.ZodNullable<z.ZodString>;
+        sessionId: z.ZodNullable<z.ZodString>;
+        resourceType: z.ZodNullable<z.ZodString>;
+        resourceId: z.ZodNullable<z.ZodString>;
+        requestId: z.ZodNullable<z.ZodString>;
+        tenant: z.ZodNullable<z.ZodString>;
+        project: z.ZodNullable<z.ZodString>;
+        environment: z.ZodNullable<z.ZodString>;
+        worker: z.ZodNullable<z.ZodString>;
+        version: z.ZodNullable<z.ZodString>;
+        ipCommitment: z.ZodNullable<z.ZodString>;
+        userAgentCommitment: z.ZodNullable<z.ZodString>;
+        metadataCommitment: z.ZodNullable<z.ZodString>;
+        seq: z.ZodNumber;
+        prev: z.ZodNullable<z.ZodString>;
+        hash: z.ZodString;
+        salt: z.ZodOptional<z.ZodString>;
+        ip: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        userAgent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    checkpoints: z.ZodArray<z.ZodObject<{
+        format: z.ZodLiteral<"pithy-audit-checkpoint/1">;
+        tenant: z.ZodNullable<z.ZodString>;
+        count: z.ZodNumber;
+        head: z.ZodString;
+        takenAt: z.ZodISODateTime;
+    }, z.core.$strip>>;
+    tombstones: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        format: z.ZodLiteral<"pithy-audit-tombstone/1">;
+        tenant: z.ZodNullable<z.ZodString>;
+        fromSeq: z.ZodNumber;
+        throughSeq: z.ZodNumber;
+        count: z.ZodNumber;
+        prior: z.ZodNullable<z.ZodString>;
+        first: z.ZodString;
+        last: z.ZodString;
+        prunedAt: z.ZodISODateTime;
+    }, z.core.$strip>>>;
+    complete: z.ZodBoolean;
+    beforeChain: z.ZodNumber;
+    outsideChain: z.ZodNumber;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type AuditChainExport = z.infer<typeof AuditChainExport>;
+/** Why a chain is not whole. */
+export declare const ChainBreakReason: z.ZodEnum<{
+    checkpoint: "checkpoint";
+    commitment: "commitment";
+    edited: "edited";
+    inserted: "inserted";
+    missing: "missing";
+    truncated: "truncated";
+    unlinked: "unlinked";
+}>;
+export type ChainBreakReason = z.infer<typeof ChainBreakReason>;
+/** The first place a chain is not whole. */
+export declare const ChainBreak: z.ZodObject<{
+    eventId: z.ZodNullable<z.ZodString>;
+    position: z.ZodNumber;
+    reason: z.ZodEnum<{
+        checkpoint: "checkpoint";
+        commitment: "commitment";
+        edited: "edited";
+        inserted: "inserted";
+        missing: "missing";
+        truncated: "truncated";
+        unlinked: "unlinked";
+    }>;
+    detail: z.ZodString;
+}, z.core.$strip>;
+export type ChainBreak = z.infer<typeof ChainBreak>;
+/** The canonical serialization: a JSON array in one fixed order, so no key order or whitespace can vary it. */
+export declare function canonicalEvent(position: ChainPosition, fields: ChainedEventFields): string;
+/** Lowercase hex SHA-256 of a UTF-8 string. */
+export declare function sha256Hex(text: string): Promise<string>;
+/** A fresh per-event salt: 16 random bytes, hex. */
+export declare function newChainSalt(): string;
+/** The salted commitment to one personal value, or null when there is no value. */
+export declare function commitment(salt: string, value: string | null): Promise<string | null>;
+/** An event's chain hash: SHA-256 over its canonical serialization. */
+export declare function chainHash(position: ChainPosition, fields: ChainedEventFields): Promise<string>;
+/** What {@link chainVerifier} needs: whose chain, where the range starts, and the checkpoints to hold it to. */
+export interface ChainVerifierOptions {
+    /** The tenant whose chain is walked. An event from any other chain is a break. */
+    tenant: string | null;
+    /** The link before the first event, or null when the walk starts the chain. */
+    prior: ChainLink | null;
+    /** Checkpoints to hold the walk to. Another tenant's are ignored. */
+    checkpoints: readonly AuditCheckpoint[];
+    /** The chain's pruned runs, each bridged where the walk reaches it. Another tenant's are ignored. */
+    tombstones?: readonly AuditTombstone[];
+    /**
+     * Whether every event must carry its personal values and their salt, so every commitment is checked: an export
+     * taken with the detail says it does. Omitted, an event without them is one whose commitments stand unopened.
+     */
+    values?: boolean;
+}
+/** A walk over one chain, fed in order, page by page. */
+export interface ChainVerifier {
+    /** Check the next event. Returns the break it is, or null. Stop at the first break. */
+    push(event: ChainedEvent): Promise<ChainBreak | null>;
+    /** End the walk. With `complete`, a checkpoint past the last event is a truncation. */
+    finish(complete: boolean): ChainBreak | null;
+    /** The last link walked, or the prior when none was. */
+    readonly head: ChainLink | null;
+    /** How many events were checked. */
+    readonly checked: number;
+    /** How many of the tenant's checkpoints applied. */
+    readonly checkpoints: number;
+    /** How many events the walk crossed as pruned, bridged by a tombstone rather than checked. */
+    readonly pruned: number;
+}
+/**
+ * Walk one tenant's chain in order. Each event is checked for its tenant, its position, its link, its commitments
+ * (when it carries its values), its hash, and the checkpoint at its position — in that order, so the reason names
+ * the first thing wrong.
+ */
+export declare function chainVerifier(options: ChainVerifierOptions): ChainVerifier;
+/** What verifying one export found. */
+export interface ChainVerification {
+    /** Whether the export's chain is whole. */
+    intact: boolean;
+    /** How many events were checked before the first break, or all of them. */
+    checked: number;
+    /** How many of the tenant's checkpoints the export carried. */
+    checkpoints: number;
+    /** How many events the walk crossed as pruned, each run bridged by its tombstone. */
+    pruned: number;
+    /** The first break, or null. */
+    break: ChainBreak | null;
+}
+/** Verify an export offline: every link, every commitment it can check, every checkpoint it carries. */
+export declare function verifyChainExport(document: AuditChainExport): Promise<ChainVerification>;
+//# sourceMappingURL=chain.d.ts.map

package/dist/audit/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/audit/chain.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,0GAA0G;AAC1G,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,sCAAsC;AACtC,eAAO,MAAM,SAAS,aAGuC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;iBA8BuE,CAAC;AACvG,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,yFAAyF;AACzF,eAAO,MAAM,SAAS;;;iBAK0D,CAAC;AACjF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAesC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAElE,oGAAoG;AACpG,eAAO,MAAM,eAAe;;;;;;iBAQyE,CAAC;AACtG,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;iBAc+E,CAAC;AAC3G,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,sGAAsG;AACtG,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqC6E,CAAC;AAC3G,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,gCAAgC;AAChC,eAAO,MAAM,gBAAgB;;;;;;;;EAI1B,CAAC;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,4CAA4C;AAC5C,eAAO,MAAM,UAAU;;;;;;;;;;;;;iBAU4D,CAAC;AACpF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,+GAA+G;AAC/G,wBAAgB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA0B1F;AAED,+CAA+C;AAC/C,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7D;AAED,oDAAoD;AACpD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,mFAAmF;AACnF,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3F;AAED,uEAAuE;AACvE,wBAAsB,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpG;AAmCD,gHAAgH;AAChH,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+EAA+E;IAC/E,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,qEAAqE;IACrE,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;IACxC,qGAAqG;IACrG,UAAU,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACtD,uFAAuF;IACvF,MAAM,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAAC;IAC7C,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IAChC,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAuK1E;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,2CAA2C;IAC3C,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B;AAED,wGAAwG;AACxG,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4B9F"}