@smthrs/gateway 0.35.0 → 1.0.0-rc.4

package/dist/esm/GatewayServer.d.ts

@@ -0,0 +1,427 @@
+/**
+ * The assembled workspace gateway: one HTTP surface carrying the control
+ * plane, the sync read path, the served projections, and a health probe.
+ *
+ * Mounts:
+ *
+ * | Path | Protocol | Serves |
+ * | --- | --- | --- |
+ * | `POST /rpc` | RPC over HTTP | `@smthrs/control` `ControlRpcs` |
+ * | `/rpc/ws` | RPC over WebSocket | `ControlRpcs`, including a kept-alive `Watch` |
+ * | `POST /projections` | RPC over HTTP | `GatewayRpcs` |
+ * | `/projections/ws` | RPC over WebSocket | `GatewayRpcs`, including `Projection.Subscribe` |
+ * | `POST /sync` | RPC over HTTP | `@smthrs/sync` `SyncRpcs` |
+ * | `/sync/ws` | RPC over WebSocket | `SyncRpcs` |
+ * | `GET /health` | JSON | `GatewaySchema.GatewayHealth` plus the package version |
+ * | `POST /auth/ticket` | JSON | A single-use {@link Ticket} that opens one protected socket |
+ *
+ * `/health` is deliberately unauthenticated: a supervisor decides whether to
+ * keep or replace a gateway process by asking which workspace it belongs to,
+ * and a probe that needed a credential could not answer that question about a
+ * gateway it did not start. The response carries identity only: the
+ * workspace hash, the gateway id, the protocol version, and the package
+ * version. It never carries a token, a run, or a path.
+ *
+ * @since 1.0.0
+ */
+import { Control } from "@smthrs/control/Control";
+import * as SyncServer from "@smthrs/sync/SyncServer";
+import { Effect, Layer, Schema } from "effect";
+import { HttpRouter } from "effect/unstable/http";
+import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+import { GatewayError } from "./GatewayError.ts";
+import { Projections } from "./Projections.ts";
+import * as RuntimeBridge from "./RuntimeBridge.ts";
+/**
+ * What `GET /health` answers: the `GatewaySchema.GatewayHealth` identity plus
+ * the version of the package serving it.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export declare const Health: Schema.Struct<{
+    readonly version: Schema.String;
+    readonly runtimeBridge: Schema.optional<Schema.Struct<{
+        readonly protocol: Schema.Literal<"smithers.flow-runtime/v1">;
+        readonly runtimeArtifactDigest: Schema.String;
+        readonly sourceRevision: Schema.String;
+        readonly ownerGeneration: Schema.Int;
+    }>>;
+    readonly workspaceHash: Schema.String;
+    readonly gatewayId: Schema.String;
+    readonly protocolVersion: Schema.String;
+    readonly capabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
+}>;
+/**
+ * What `GET /health` answers.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export type Health = typeof Health.Type;
+/**
+ * Mounts the unauthenticated health probe.
+ *
+ * @param health the identity this process serves under
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layerHealth: (health: Health) => Layer.Layer<never, never, HttpRouter.HttpRouter>;
+/**
+ * The gateway's own RPC handlers over the read path and the control plane.
+ *
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layerHandlers: Layer.Layer<import("effect/unstable/rpc/Rpc").Handler<"Projection.Snapshot"> | import("effect/unstable/rpc/Rpc").Handler<"Projection.Subscribe"> | import("effect/unstable/rpc/Rpc").Handler<"Approval.Submit"> | import("effect/unstable/rpc/Rpc").Handler<"Run.Fork"> | import("effect/unstable/rpc/Rpc").Handler<"Run.Verify">, never, Control | Projections>;
+/**
+ * The kind a `Watch` keepalive carries.
+ *
+ * `ControlRpcs.Watch` answers `ControlSchema.ControlEvent` and has no frame of
+ * its own for a keepalive, so the gateway publishes one as an event whose kind
+ * no emitter uses. A fold that does not know the kind ignores it, which is
+ * what every fold in this package and in `@smthrs/cli` `Forensics` already
+ * does with an unknown kind.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export declare const watchHeartbeatKind = "control.gateway.heartbeat";
+/**
+ * The control service the `/rpc` mounts read through: the ambient one, with
+ * the keepalive merged into `watch`.
+ *
+ * Wrapping the service rather than re-declaring the handlers keeps
+ * `@smthrs/control` `ControlServer` the single definition of what every
+ * procedure does, including the principal it stamps on every mutation that
+ * records who asked. Only `watch` behaves differently, and only in what it
+ * adds.
+ *
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layerKeepAlive: (millis?: number) => Layer.Layer<Control, never, Control>;
+/**
+ * The read path the `/projections` mounts serve through: the ambient one, with
+ * a followed subscription's keepalive re-timed to the bind's cadence.
+ *
+ * `Projections.make` already merges a `heartbeat` frame at the cadence it was
+ * built with. A host that supplies `Projections.layer` and sets the cadence at
+ * the bind expects one option to govern both keepalives, so this replaces the
+ * service's beats with beats at the bind's cadence rather than adding a second
+ * channel. Snapshot reads are left alone: they have to end.
+ *
+ * @param millis how often an idle followed subscription emits a keepalive
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layerProjectionsKeepAlive: (millis: number) => Layer.Layer<Projections, never, Projections>;
+/**
+ * Mounts the control plane on `POST /rpc` and `/rpc/ws`, with the keepalive.
+ *
+ * @param millis how often an idle followed watch emits one, defaulting to
+ * `Projections.heartbeatIntervalMillis`
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layerControlHttp: (millis?: number | undefined) => Layer.Layer<RpcServer.Protocol, never, Control | import("@smthrs/control/ControlRpcs").ControlAuth | HttpRouter.HttpRouter | RpcSerialization.RpcSerialization>;
+/**
+ * Mounts the gateway's projections on `POST /projections` and
+ * `/projections/ws`.
+ *
+ * Both protocols are mounted together because a client reads a snapshot over
+ * the request/response path and follows deltas over the socket, and pointing
+ * those at two different servers would let them disagree.
+ *
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layerProjectionsHttp: Layer.Layer<RpcServer.Protocol, never, Control | import("@smthrs/control/ControlRpcs").ControlAuth | HttpRouter.HttpRouter | RpcSerialization.RpcSerialization | Projections>;
+/**
+ * Mounts the sync read path on `POST /sync` and `/sync/ws`.
+ *
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layerSyncHttp: Layer.Layer<RpcServer.Protocol, never, HttpRouter.HttpRouter | RpcSerialization.RpcSerialization | import("@smthrs/sync/SyncRpcs").SyncAuth | SyncServer.SyncServer>;
+/**
+ * The POST mounts that carry RPC request messages and nothing else.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const rpcPaths: ReadonlyArray<string>;
+/**
+ * POST mounts whose request bodies are bounded before their handlers read.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const boundedPostPaths: ReadonlyArray<string>;
+/**
+ * RPC paths whose upgrade or request must pass edge authentication.
+ *
+ * `POST /rpc` is deliberately not one of them. The control mount authenticates
+ * in band through `@smthrs/control` `ControlRpcs.ControlAuth`, whose declared
+ * error is `ControlError.Unauthorized`, and that typed control error is the
+ * refusal the control plane publishes: "Missing, malformed, empty, and
+ * incorrect credentials all return the same typed `Unauthorized` control
+ * error" (`packages/smithers/gateway/docs/guides/serve-beyond-loopback.md`). An edge 401 answered
+ * ahead of the mount, and `ControlClient` filters a non-2xx status, so every
+ * refusal reached a caller as a `TransportError`, the one error class
+ * `@smthrs/control` reserves for a request that failed *before* a declared
+ * control response reached it. It also made the gateway refuse a call
+ * differently from `NodeControl.layerServer` hosting the very same
+ * `ControlRpcs`. The body limit below still applies to `/rpc`, so an
+ * unauthenticated caller buys one bounded body read and nothing else.
+ *
+ * The `/rpc/ws` upgrade stays here. A socket is a resource the server holds
+ * open, the RPC middleware can only refuse frames on a socket that already
+ * exists, and a refused handshake has no RPC channel to answer a typed error
+ * on, so its refusal is a transport fact either way.
+ *
+ * @category constants
+ * @since 1.0.0
+ */
+export declare const protectedPaths: ReadonlyArray<string>;
+/**
+ * The mount a request target reaches, spelled the way {@link rpcPaths} and
+ * {@link protectedPaths} spell it.
+ *
+ * The guard runs before the router and has to reach the router's verdict, or
+ * an alias walks past the credential check and the body limit and is answered
+ * by the mount anyway. Measured against `HttpRouter` on this tree, all of
+ * `/%72pc`, `/rpc;transport-parameter`, `/rpc/`, `//rpc`, `///rpc`, `/rpc//`,
+ * `/RPC`, `/./rpc`, and `/foo/../rpc` reach the `/rpc` handler, while
+ * `/rpc%2f`, `/rpc%3Bp`, `/%2frpc`, and `/rpc%20` do not. This is not only
+ * about crafted aliases: `@smthrs/control` `ControlClient`'s HTTP protocol
+ * posts every call to `/rpc/`, so a literal comparison skipped the body limit
+ * on the path the product's own client uses.
+ *
+ * Each segment is therefore taken without its `;` parameter, empty segments are
+ * dropped, and what is left is decoded with `decodeURI` and compared without
+ * regard to case. `decodeURI` is the decoder rather than `decodeURIComponent`
+ * because it leaves a reserved character encoded, which is what keeps
+ * `/rpc%2f` a different path here exactly as it is to the router. An invalid
+ * escape is left as written, since it names no mount either way.
+ *
+ * Dot segments are resolved by `URL` before the split. The normalization errs
+ * toward matching: a spelling this resolves to a mount that the router then
+ * refuses is answered 401 rather than 404, which costs an unauthenticated
+ * caller nothing it was entitled to.
+ *
+ * @param url the request target, origin-relative or absolute
+ * @since 1.0.0
+ * @category constructors
+ */
+export declare const routedPath: (url: string) => string;
+/**
+ * The mount that exchanges a bearer credential for a WebSocket {@link Ticket}.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const ticketPath = "/auth/ticket";
+/**
+ * The protected socket mounts a {@link Ticket} opens.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const ticketPaths: ReadonlyArray<string>;
+/**
+ * How long an unredeemed {@link Ticket} stays valid (thirty seconds).
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const defaultTicketMillis = 30000;
+/**
+ * What `POST /auth/ticket` answers.
+ *
+ * A browser `WebSocket` cannot set an `Authorization` header, so a browser
+ * client first posts its bearer to `/auth/ticket`, then opens a protected
+ * socket as `<mount>?ticket=<ticket>` within `expiresInMs`. The first upgrade
+ * that presents the ticket consumes it, whether or not the upgrade completes;
+ * a replay or a late one is refused 401. The socket then runs under the
+ * bearer the ticket was issued for, so every frame authenticates as it would
+ * with the header.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export declare const Ticket: Schema.Struct<{
+    readonly ticket: Schema.String;
+    readonly expiresInMs: Schema.Number;
+}>;
+/**
+ * What `POST /auth/ticket` answers.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export type Ticket = typeof Ticket.Type;
+/**
+ * Default maximum request body accepted by an RPC mount (one MiB).
+ *
+ * @category constants
+ * @since 1.0.0
+ */
+export declare const defaultMaxRequestBodyBytes: number;
+/**
+ * Ingress policy enforced before an RPC transport parses a request.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface IngressOptions {
+    /** Accepted Host header names, without ports. Defaults to loopback names. */
+    readonly allowedHosts?: ReadonlyArray<string> | undefined;
+    readonly maxRequestBodyBytes?: number | undefined;
+    /** Confine requests to loopback Host values and browser origins. */
+    readonly loopbackOnly?: boolean | undefined;
+    /**
+     * Edge authentication for {@link protectedPaths}, told which mount the
+     * request reaches. When set, `POST /auth/ticket` exchanges a credential it
+     * accepts for a {@link Ticket}, and a redeemed ticket's credential is judged
+     * again for the mount its upgrade reaches.
+     */
+    readonly authorize?: (headers: Readonly<Record<string, string>>, path: string) => Effect.Effect<boolean>;
+    /** How long an unredeemed ticket stays valid. Default {@link defaultTicketMillis}. */
+    readonly ticketMillis?: number | undefined;
+}
+/**
+ * The names that mean this machine only, as a bind address is spelled.
+ *
+ * This is a list of spellings a person types, not a subnet test: `127.0.0.2`
+ * is loopback to the kernel and is not on it. The Node host's
+ * `isLoopbackHost`, the Host-header names below, and the ingress regex all
+ * derive from this one list so widening it is one edit.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const loopbackHostNames: ReadonlyArray<string>;
+/**
+ * {@link loopbackHostNames} as a Host header spells them: an IPv6 address is
+ * bracketed as a URL authority. This is the default `allowedHosts`.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const loopbackHostHeaderNames: ReadonlyArray<string>;
+/**
+ * Whether a failed request-body read hit the configured size limit rather than
+ * failing for another reason.
+ *
+ * `@effect/platform-node` raises the limit as an `HttpServerError` whose
+ * `reason` is a `RequestParseError` carrying the `Error("maxBytes exceeded")`
+ * that `@effect/platform-node-shared` `NodeStream.toString` throws
+ * (`NodeHttpIncomingMessage.text` passes `MaxBodySize` in as `maxBytes`, and
+ * `NodeHttpServer`'s `ServerRequestImpl` wraps whatever it throws). Nothing on
+ * the wire distinguishes it otherwise, so the check is that exact shape and a
+ * version bump of those packages is the thing to re-read it against.
+ *
+ * Every other read failure, a transport reset among them, is not a size
+ * overflow. Answering 413 for all of them told a client to shrink a request
+ * that was never too big.
+ *
+ * @param error the failure a body read produced
+ * @since 1.0.0
+ * @category predicates
+ */
+export declare const exceededBodyLimit: (error: unknown) => boolean;
+/**
+ * The refusal a failed request-body read earns, and the status it answers
+ * under.
+ *
+ * A body over the limit is 413 `request_too_large`. Every other read failure,
+ * a truncated body or a reset transport among them, is 400
+ * `malformed_request`: the request cannot be retried smaller, because its size
+ * was never the problem.
+ *
+ * @param path the mount the request was made to
+ * @param maxBytes the configured limit
+ * @param error the failure the body read produced
+ * @since 1.0.0
+ * @category constructors
+ */
+export declare const bodyRefusal: (path: string, maxBytes: number, error: unknown) => {
+    readonly error: GatewayError;
+    readonly status: number;
+};
+/**
+ * Whether a request body carries at least one RPC message the server can act
+ * on.
+ *
+ * The transport's own parser answers, not a second reading of the wire
+ * format: whatever `RpcSerialization` the host composed decodes the body, and
+ * the answer is no only when that decode throws or yields no tagged message.
+ * A body naming a procedure that does not exist is a yes — that is an
+ * RPC-level defect the protocol itself reports.
+ *
+ * A binary framing is always a yes. Its body is not text, so there is nothing
+ * to read here, and the mount owns it.
+ *
+ * @since 1.0.0
+ * @category predicates
+ */
+export declare const carriesRpcRequest: (serialization: RpcSerialization.RpcSerialization["Service"], body: string) => boolean;
+/**
+ * Enforces local Host/Origin policy and edge authentication before reading a
+ * body or upgrading a socket, then validates RPC body size and framing.
+ *
+ * `effect/unstable/rpc` hands every decoded message to the server loop, and a
+ * body that decodes to something else — `{}`, `[]`, prose, nothing at all —
+ * reached it as a message with no tag and died there, so the gateway answered
+ * `500 Internal Server Error` with an empty body (release validation). That is the
+ * wrong half of the contract twice over: it tells an operator the gateway
+ * broke, and it tells a client to retry a request that can never succeed.
+ *
+ * The body reader is cached per request, so reading the body here does not
+ * consume the body the mount reads. It is read through the reader the mount
+ * uses, `text` under a JSON serialization and `arrayBuffer` under a binary
+ * one, so the bytes the mount decodes are the bytes the client sent.
+ *
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layerIngress: (options?: IngressOptions) => Layer.Layer<never, GatewayError, never> | Layer.Layer<never, never, HttpRouter.HttpRouter | RpcSerialization.RpcSerialization>;
+/**
+ * How an assembled gateway is configured.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface LayerOptions {
+    /**
+     * How often an idle followed `Watch` on `/rpc/ws` and an idle followed
+     * `Projection.Subscribe` on `/projections/ws` emit a keepalive. Unset, the
+     * `Watch` keepalive runs at `Projections.heartbeatIntervalMillis` and the
+     * supplied `Projections` service keeps the cadence it was built with.
+     */
+    readonly heartbeatMillis?: number | undefined;
+    /** The ingress policy the RPC mounts run behind. */
+    readonly ingress?: IngressOptions | undefined;
+    /** Enables the authenticated Go-to-Control runtime bridge. */
+    readonly runtimeBridge?: RuntimeBridge.Config | undefined;
+}
+/**
+ * The whole gateway surface, as one application layer a host serves.
+ *
+ * The caller supplies the transport serialization, the authentication
+ * middleware for both RPC groups, and the services the mounts read through
+ * (`Control`, `Projections`, `SyncServer`). `@smthrs/gateway/node/NodeGateway`
+ * is the Node host that binds this to a socket.
+ *
+ * A keepalive cadence or a body limit that is not a positive safe integer is
+ * refused here, before anything binds, through the layer's typed
+ * `GatewayError` channel.
+ *
+ * @param health the identity `GET /health` answers with
+ * @param options the keepalive cadence and the ingress policy
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layer: (health: Health, options?: LayerOptions) => Layer.Layer<never, GatewayError, never> | Layer.Layer<RpcServer.Protocol, GatewayError | import("@smthrs/sync/SyncError").SyncError, Control | import("@smthrs/control/ControlRpcs").ControlAuth | HttpRouter.HttpRouter | RpcSerialization.RpcSerialization | import("@smthrs/sync/SyncRpcs").SyncAuth | SyncServer.SyncServer | Projections | HttpRouter.Request<"Requires", Control>>;
+//# sourceMappingURL=GatewayServer.d.ts.map

package/dist/esm/GatewayServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayServer.d.ts","sourceRoot":"","sources":["../../src/GatewayServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AAOjD,OAAO,KAAK,UAAU,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,EAAsB,MAAM,QAAQ,CAAA;AAE1E,OAAO,EAAW,UAAU,EAAyC,MAAM,sBAAsB,CAAA;AACjG,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,EAAE,YAAY,EAAkB,MAAM,mBAAmB,CAAA;AAIhE,OAAO,EAA2B,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEvE,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;EAIjB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAA;AAIvC;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CACL,CAAA;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,kWAkGzB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAgD7D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GACzB,SAAQ,MAAgC,KACvC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAInC,CAAA;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,QAAQ,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAOnG,CAAA;AAyBH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,MAAM,GAAG,SAAS,oKACS,CAAA;AAMrE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,+KAWhC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,sKAWzB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAgD,CAAA;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAIlD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,MAAM,CAShD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,MAqBxC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,iBAAiB,CAAA;AAExC;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,MAAM,CAA8C,CAAA;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAKzC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,MAAM;;;EAGjB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAA;AAevC;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAc,CAAA;AAErD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACzD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjD,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3C;AAyDD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAqC,CAAA;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,MAAM,CAEzD,CAAA;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,OAQlD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,GACtB,MAAM,MAAM,EACZ,UAAU,MAAM,EAChB,OAAO,OAAO,KACb;IAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CASrD,CAAA;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,GAC5B,eAAe,gBAAgB,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAC3D,MAAM,MAAM,KACX,OAWF,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,GAAI,UAAS,cAAmB,mIAsGxD,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,oDAAoD;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAA;CAC1D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,KAAK,GAAI,QAAQ,MAAM,EAAE,UAAS,YAAiB,6XAe/D,CAAA"}