@substrat-run/connector-scrive 0.0.2

package/README.md

@@ -0,0 +1,98 @@
+# @substrat-run/connector-scrive
+
+Scrive eSign (BankID) — the **outbound half** of external signing.
+
+`engine-protocol` emits `protocol.signatures-requested` when a vertical freezes a document and
+sends it for signature. This turns that into a Scrive document: create → set file → set parties
+with `se_bankid` → start.
+
+## ⚠️ This connector cannot complete a signature
+
+It is `private` and unpublished on purpose. Four things are missing, none of them here:
+
+1. ~~**Dispatch is not idempotent.**~~ **Done.** A redelivery once created a *second* Scrive
+   document — duplicate legal paperwork to real signatories. The connector now records each
+   dispatch in a directory-side ledger (`ctx.admin.putConnectorState`, keyed by the connection)
+   and skips if a prior dispatch is found. Directory-side because a connector runs *inside* the
+   scope's dispatch and re-entering the scope actor deadlocks (verified). A narrow residual
+   remains — if the ledger write itself fails after the provider `start` succeeds, the retry
+   still duplicates — closable with provider-side dedup via the `substrat_instance` tag the
+   connector already sets, once a list-by-tag query lands.
+
+2. ~~**Connector state has no home.**~~ **Done** — the ledger above is that home.
+
+3. ~~**Recording the signature back**~~ **Done** ([#97](https://github.com/substrat-run/substrat/issues/97)).
+   When a party signs, the signature belongs on the protocol instance in the *scope*.
+   `reconcileScriveDispatch(host, connectionId, instanceId, { fetch })` reads
+   `documents/{id}/get`, maps each signed party back to its request, and records it by invoking
+   `protocol/record-signature` through `getConnectorScope` — the connection acting as itself,
+   as a top-level operation (not the dispatch handler, where re-entering the scope deadlocks).
+   The connection must hold `protocol:record-signature` (`grantToConnection`), which shows up in
+   the permission diff. Idempotent across polls; verified against `ScriveMock` advanced to
+   `closed`. The one thing a mock can't prove — Scrive's real `get` shape and party order —
+   waits on a testbed BankID round-trip (BankID-to-sign is disabled on the account).
+
+4. **The poll driver exists; nothing calls it on a timer.**
+   `sweepScriveReconciliations(host, connectionId, { fetch })` is the scheduler's unit of work:
+   it enumerates the dispatch ledger (`HostAdmin.listConnectorState(id, 'scrive:dispatch:')`) and
+   reconciles every outstanding instance, skipping ones the ledger already shows complete and
+   stepping past a provider error on any one instance. It is idempotent and scoped to one
+   connection (a connection never crosses a tenant). What is *still* missing is the **timer** —
+   there is no cron, queue or Durable Object alarm in any wrangler config, the same trigger
+   `drainDue` still lacks. A platform sweeper would, on a schedule, iterate the connections it
+   owns and call this for each:
+
+   ```ts
+   // in a Cloudflare Worker's scheduled() handler, or a DO alarm:
+   for (const connectionId of scriveConnections) {
+     await sweepScriveReconciliations(host, connectionId, { fetch });
+   }
+   ```
+
+   That trigger is a deployment concern, not connector code — which is why it, not the seam or
+   the driver, is the remaining reason the connector stays unpublished.
+
+5. **No document store.** `attachmentTargets` is declared in the manifest contract and
+   implemented nowhere, so there is no place for rendered bytes.
+
+## What it therefore sends
+
+An **attestation sheet**, not the avtal: the template, the parties, and the content hash the
+signature refers to. That is honest for a hash-attestation model and enough to exercise the
+seam, but it is not a contract anybody should sign.
+
+Rendering the real document belongs to the **vertical**, which owns the content — a connector
+cannot read another module's tables and should not learn a vertical's vocabulary to try. It
+needs (4) to hand the bytes over.
+
+## Verified against the testbed
+
+The API layer was **checked against `api-testbed.scrive.com`**, not just the docs — and the
+first version, written from the docs, was wrong in three ways one live call exposed at once:
+
+- **auth is OAuth1 PLAINTEXT**, not OAuth2 bearer (the UI's "Client" + "Token" credentials are
+  two halves of one four-part signature; the `oauth2.scrive.com` endpoint rejects them)
+- **`documents/new` returns no `status`** — only `get` does, so mutation responses are parsed
+  for their id and status is re-read
+- **`setfile` is `multipart/form-data`**, not a base64 body
+
+`test/live.test.ts` runs the real lifecycle (`new → setfile → update → get`) when
+`connectors/scrive/.dev.vars` holds a complete OAuth1 credential, and **skips** otherwise — so
+CI without secrets stays offline and a local run with the testbed verifies the actual API. It
+uses `standard` auth because **`se_bankid`-to-sign is disabled on the testbed account** (`start`
+returns 409); the BankID round-trip waits on that setting.
+
+## Testing
+
+`ScriveMock` implements the documented endpoints in memory, so the whole lifecycle runs without
+a provider account.
+
+**What a mock proves:** that our shape works — credential resolution, egress, health, retry,
+the document lifecycle.
+
+**What it cannot prove:** that our reading of Scrive's API is correct. The mock *is* that
+reading — same author, same misunderstandings, on both sides of the call. Green here means
+*ready to check against `api-testbed.scrive.com`*, never *verified*.
+
+It stays useful afterwards: a real provider will not return 503 on demand, or let you
+fast-forward two days to a signature.

package/dist/api.d.ts

@@ -0,0 +1,134 @@
+import { z } from 'zod';
+import type { ConnectorConnection } from '@substrat-run/kernel';
+/**
+ * A thin, typed client over the Scrive eSign v2 endpoints.
+ *
+ * Every call goes through the connection's `fetch`, never a global one: that is
+ * what gets it a timeout, an egress policy, and health recorded against the
+ * right connection. Module code cannot reach any of this — boundary-lint bans
+ * `fetch` outright — and a connector is host code.
+ *
+ * **The shapes here were verified against `api-testbed.scrive.com`, not just the
+ * docs.** The first version of this file was written from the documentation and
+ * was wrong in three ways a live call exposed at once (auth scheme, the upload
+ * encoding, the create-response shape). Each is called out below where it bit.
+ */
+export declare const SCRIVE_TESTBED = "https://api-testbed.scrive.com";
+export declare const SCRIVE_PRODUCTION = "https://scrive.com";
+/**
+ * A Scrive connection's credential — OAuth1 "personal access credentials".
+ *
+ * NOT OAuth2 bearer, which the first version assumed. Scrive's UI labels these
+ * "Client credentials" and "Token credentials", which reads like two schemes but
+ * is one: the four parts combine into a PLAINTEXT OAuth signature. The
+ * `oauth2.scrive.com` token endpoint rejects them with `invalid_client` — it is
+ * a different mechanism entirely.
+ */
+export declare const scriveSecret: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    tokenId: z.ZodString;
+    tokenSecret: z.ZodString;
+}, z.core.$strip>;
+export type ScriveSecret = z.infer<typeof scriveSecret>;
+/**
+ * An id-bearing response — what `new` / `setfile` / `update` / `start` return.
+ *
+ * `POST /documents/new` returns NO top-level `status` (verified) — only
+ * `/documents/{id}/get` returns the full object. The first version parsed every
+ * response as a full document and would have thrown on call one. So mutation
+ * responses are parsed for their id only, and status is read from `get` — which
+ * is the right design anyway: don't trust a mutation's echo, re-read the truth.
+ */
+export declare const scriveDocRef: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export type ScriveDocRef = z.infer<typeof scriveDocRef>;
+/** The full document, as `get` returns it — extra fields ignored. */
+export declare const scriveDocument: z.ZodObject<{
+    id: z.ZodString;
+    status: z.ZodEnum<{
+        preparation: "preparation";
+        pending: "pending";
+        closed: "closed";
+        canceled: "canceled";
+        timedout: "timedout";
+        rejected: "rejected";
+    }>;
+    parties: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        is_author: z.ZodOptional<z.ZodBoolean>;
+        is_signatory: z.ZodOptional<z.ZodBoolean>;
+        signatory_role: z.ZodOptional<z.ZodString>;
+        sign_time: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        authentication_method_to_sign: z.ZodOptional<z.ZodString>;
+        fields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            type: z.ZodString;
+            value: z.ZodUnknown;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ScriveDocument = z.infer<typeof scriveDocument>;
+export interface ScriveParty {
+    /** Display name for the signing page. */
+    name: string;
+    email?: string;
+    /**
+     * Swedish personnummer, when the flow authenticates to sign with BankID.
+     *
+     * Passed THROUGH to the provider and never persisted by us: it is `direct`
+     * PII, and `engine-protocol` stores an opaque `DataSubjectId` as the signatory
+     * instead. The provider needs it; our tables must not have it.
+     */
+    personalNumber?: string;
+    /** `se_bankid` for Swedish BankID; `standard` otherwise. */
+    authenticationMethodToSign: 'standard' | 'se_bankid';
+    /**
+     * The sender/author. Scrive auto-adds the API user as an author party on
+     * `new`; exactly one party across the set must be the author, so the connector
+     * marks the issuing (primary) party as it. Verified: sending an explicit
+     * author party in `update` replaces the auto one.
+     */
+    isAuthor?: boolean;
+    /** A viewer rather than a signer — an author who does not sign. */
+    isSignatory?: boolean;
+}
+export declare class ScriveApi {
+    private readonly conn;
+    private readonly baseUrl;
+    private readonly secret;
+    constructor(conn: ConnectorConnection, baseUrl?: string);
+    /**
+     * The OAuth1 PLAINTEXT authorization header. The signature is
+     * `<clientSecret>&<tokenSecret>` — literally the two secrets joined by `&`,
+     * which is what "PLAINTEXT" means: no HMAC, TLS is the confidentiality.
+     */
+    private headers;
+    createDocument(): Promise<ScriveDocRef>;
+    /**
+     * Attach the PDF. **`multipart/form-data`**, verified — not the raw base64 body
+     * the first version sent. The multipart envelope is built as bytes because the
+     * file is binary and a string body would corrupt it (which is why
+     * `ConnectorRequestInit.body` accepts `Uint8Array`).
+     */
+    setFile(documentId: string, filename: string, pdf: Uint8Array): Promise<void>;
+    /** Parties, callback URL and title, in one `document=` form field. */
+    update(documentId: string, patch: {
+        title?: string;
+        parties?: ScriveParty[];
+        callbackUrl?: string;
+        tags?: {
+            name: string;
+            value: string;
+        }[];
+    }): Promise<ScriveDocRef>;
+    /** Send it. After this the document is `pending` and the parties are invited. */
+    start(documentId: string): Promise<ScriveDocRef>;
+    /**
+     * Current state — the polling path, and the only call that returns `status`.
+     * Webhook ingress (#96) is not on the critical path precisely because this
+     * exists and Scrive's callbacks are unauthenticated anyway.
+     */
+    get(documentId: string): Promise<ScriveDocument>;
+}
+//# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAMhE;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,cAAc,mCAAmC,CAAC;AAC/D,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY;;;;;iBAKvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY;;iBAAsC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,qEAAqE;AACrE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;iBAyBzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,0BAA0B,EAAE,UAAU,GAAG,WAAW,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA2BD,qBAAa,SAAS;IAIlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAGnB,IAAI,EAAE,mBAAmB,EACzB,OAAO,GAAE,MAAuB;IAKnD;;;;OAIG;IACH,OAAO,CAAC,OAAO;IAUT,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAQ7C;;;;;OAKG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnF,sEAAsE;IAChE,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,GACA,OAAO,CAAC,YAAY,CAAC;IAiCxB,iFAAiF;IAC3E,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQtD;;;;OAIG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAOvD"}

package/dist/api.js

@@ -0,0 +1,203 @@
+import { z } from 'zod';
+/**
+ * A thin, typed client over the Scrive eSign v2 endpoints.
+ *
+ * Every call goes through the connection's `fetch`, never a global one: that is
+ * what gets it a timeout, an egress policy, and health recorded against the
+ * right connection. Module code cannot reach any of this — boundary-lint bans
+ * `fetch` outright — and a connector is host code.
+ *
+ * **The shapes here were verified against `api-testbed.scrive.com`, not just the
+ * docs.** The first version of this file was written from the documentation and
+ * was wrong in three ways a live call exposed at once (auth scheme, the upload
+ * encoding, the create-response shape). Each is called out below where it bit.
+ */
+export const SCRIVE_TESTBED = 'https://api-testbed.scrive.com';
+export const SCRIVE_PRODUCTION = 'https://scrive.com';
+/**
+ * A Scrive connection's credential — OAuth1 "personal access credentials".
+ *
+ * NOT OAuth2 bearer, which the first version assumed. Scrive's UI labels these
+ * "Client credentials" and "Token credentials", which reads like two schemes but
+ * is one: the four parts combine into a PLAINTEXT OAuth signature. The
+ * `oauth2.scrive.com` token endpoint rejects them with `invalid_client` — it is
+ * a different mechanism entirely.
+ */
+export const scriveSecret = z.object({
+    clientId: z.string().min(1),
+    clientSecret: z.string().min(1),
+    tokenId: z.string().min(1),
+    tokenSecret: z.string().min(1),
+});
+/**
+ * An id-bearing response — what `new` / `setfile` / `update` / `start` return.
+ *
+ * `POST /documents/new` returns NO top-level `status` (verified) — only
+ * `/documents/{id}/get` returns the full object. The first version parsed every
+ * response as a full document and would have thrown on call one. So mutation
+ * responses are parsed for their id only, and status is read from `get` — which
+ * is the right design anyway: don't trust a mutation's echo, re-read the truth.
+ */
+export const scriveDocRef = z.object({ id: z.string().min(1) });
+/** The full document, as `get` returns it — extra fields ignored. */
+export const scriveDocument = z.object({
+    id: z.string().min(1),
+    status: z.enum(['preparation', 'pending', 'closed', 'canceled', 'timedout', 'rejected']),
+    parties: z
+        .array(z.object({
+        id: z.string().min(1),
+        is_author: z.boolean().optional(),
+        is_signatory: z.boolean().optional(),
+        signatory_role: z.string().optional(),
+        /** Set once that party has signed. */
+        sign_time: z.string().nullable().optional(),
+        authentication_method_to_sign: z.string().optional(),
+        /**
+         * The party's fields — read by the poll driver to cross-check that the
+         * provider's Nth party is still the dispatch's Nth party (name), before
+         * attributing a signature to a request. Kept so the reconcile can fail
+         * closed on a reorder rather than mis-record.
+         */
+        fields: z
+            .array(z.object({ type: z.string(), value: z.unknown() }))
+            .optional(),
+    }))
+        .default([]),
+});
+const asJson = async (res, what) => {
+    const body = await res.text();
+    if (!res.ok) {
+        // Scrive's error body is JSON with `error_message`; surface it rather than a
+        // bare status, because "This feature is disabled" is the difference between a
+        // bug and an account setting.
+        let detail = body.slice(0, 400);
+        try {
+            const parsed = JSON.parse(body);
+            if (parsed.error_message)
+                detail = parsed.error_message;
+        }
+        catch {
+            /* not JSON; keep the raw slice */
+        }
+        throw new Error(`scrive ${what} failed: HTTP ${res.status} ${detail}`);
+    }
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new Error(`scrive ${what}: response was not JSON (${body.slice(0, 200)})`);
+    }
+};
+export class ScriveApi {
+    conn;
+    baseUrl;
+    secret;
+    constructor(conn, baseUrl = SCRIVE_TESTBED) {
+        this.conn = conn;
+        this.baseUrl = baseUrl;
+        this.secret = scriveSecret.parse(conn.secret);
+    }
+    /**
+     * The OAuth1 PLAINTEXT authorization header. The signature is
+     * `<clientSecret>&<tokenSecret>` — literally the two secrets joined by `&`,
+     * which is what "PLAINTEXT" means: no HMAC, TLS is the confidentiality.
+     */
+    headers(extra = {}) {
+        const s = this.secret;
+        const auth = `oauth_signature_method="PLAINTEXT", ` +
+            `oauth_consumer_key="${s.clientId}", ` +
+            `oauth_token="${s.tokenId}", ` +
+            `oauth_signature="${s.clientSecret}&${s.tokenSecret}"`;
+        return { authorization: auth, ...extra };
+    }
+    async createDocument() {
+        const res = await this.conn.fetch(`${this.baseUrl}/api/v2/documents/new`, {
+            method: 'POST',
+            headers: this.headers(),
+        });
+        return scriveDocRef.parse(await asJson(res, 'documents/new'));
+    }
+    /**
+     * Attach the PDF. **`multipart/form-data`**, verified — not the raw base64 body
+     * the first version sent. The multipart envelope is built as bytes because the
+     * file is binary and a string body would corrupt it (which is why
+     * `ConnectorRequestInit.body` accepts `Uint8Array`).
+     */
+    async setFile(documentId, filename, pdf) {
+        const boundary = `----substrat${filename.length}${pdf.length}`;
+        const body = multipartFile(boundary, 'file', filename, pdf);
+        const res = await this.conn.fetch(`${this.baseUrl}/api/v2/documents/${documentId}/setfile`, {
+            method: 'POST',
+            headers: this.headers({ 'content-type': `multipart/form-data; boundary=${boundary}` }),
+            body,
+        });
+        await asJson(res, 'setfile');
+    }
+    /** Parties, callback URL and title, in one `document=` form field. */
+    async update(documentId, patch) {
+        const document = {
+            ...(patch.title ? { title: patch.title } : {}),
+            ...(patch.callbackUrl ? { api_callback_url: patch.callbackUrl } : {}),
+            ...(patch.tags ? { tags: patch.tags } : {}),
+            ...(patch.parties
+                ? {
+                    parties: patch.parties.map((p) => ({
+                        is_author: p.isAuthor ?? false,
+                        is_signatory: p.isSignatory ?? true,
+                        authentication_method_to_sign: p.authenticationMethodToSign,
+                        fields: [
+                            { type: 'name', order: 1, value: p.name },
+                            ...(p.email ? [{ type: 'email', value: p.email }] : []),
+                            ...(p.personalNumber
+                                ? [{ type: 'personal_number', value: p.personalNumber }]
+                                : []),
+                        ],
+                    })),
+                }
+                : {}),
+        };
+        // Scrive takes the document JSON as a url-encoded `document=` form field, not
+        // a JSON request body — another shape the docs left ambiguous and the testbed
+        // settled.
+        const res = await this.conn.fetch(`${this.baseUrl}/api/v2/documents/${documentId}/update`, {
+            method: 'POST',
+            headers: this.headers({ 'content-type': 'application/x-www-form-urlencoded' }),
+            body: `document=${encodeURIComponent(JSON.stringify(document))}`,
+        });
+        return scriveDocRef.parse(await asJson(res, 'update'));
+    }
+    /** Send it. After this the document is `pending` and the parties are invited. */
+    async start(documentId) {
+        const res = await this.conn.fetch(`${this.baseUrl}/api/v2/documents/${documentId}/start`, {
+            method: 'POST',
+            headers: this.headers(),
+        });
+        return scriveDocRef.parse(await asJson(res, 'start'));
+    }
+    /**
+     * Current state — the polling path, and the only call that returns `status`.
+     * Webhook ingress (#96) is not on the critical path precisely because this
+     * exists and Scrive's callbacks are unauthenticated anyway.
+     */
+    async get(documentId) {
+        const res = await this.conn.fetch(`${this.baseUrl}/api/v2/documents/${documentId}/get`, {
+            method: 'GET',
+            headers: this.headers(),
+        });
+        return scriveDocument.parse(await asJson(res, 'get'));
+    }
+}
+/** A one-file `multipart/form-data` body, as bytes. Web-standard, no node:buffer. */
+function multipartFile(boundary, field, filename, file) {
+    const enc = new TextEncoder();
+    const head = enc.encode(`--${boundary}\r\n` +
+        `content-disposition: form-data; name="${field}"; filename="${filename}"\r\n` +
+        `content-type: application/pdf\r\n\r\n`);
+    const tail = enc.encode(`\r\n--${boundary}--\r\n`);
+    const out = new Uint8Array(head.length + file.length + tail.length);
+    out.set(head, 0);
+    out.set(file, head.length);
+    out.set(tail, head.length + file.length);
+    return out;
+}
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAGhE,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,sCAAsC;QACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC3C,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpD;;;;;WAKG;QACH,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;aACzD,QAAQ,EAAE;KACd,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AA4BH,MAAM,MAAM,GAAG,KAAK,EAClB,GAA6D,EAC7D,IAAY,EACZ,EAAE;IACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,6EAA6E;QAC7E,8EAA8E;QAC9E,8BAA8B;QAC9B,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+B,CAAC;YAC9D,IAAI,MAAM,CAAC,aAAa;gBAAE,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,iBAAiB,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,4BAA4B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,OAAO,SAAS;IAID;IACA;IAJF,MAAM,CAAe;IAEtC,YACmB,IAAyB,EACzB,UAAkB,cAAc;QADhC,SAAI,GAAJ,IAAI,CAAqB;QACzB,YAAO,GAAP,OAAO,CAAyB;QAEjD,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,QAAgC,EAAE;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,MAAM,IAAI,GACR,sCAAsC;YACtC,uBAAuB,CAAC,CAAC,QAAQ,KAAK;YACtC,gBAAgB,CAAC,CAAC,OAAO,KAAK;YAC9B,oBAAoB,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC;QACzD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,QAAgB,EAAE,GAAe;QACjE,MAAM,QAAQ,GAAG,eAAe,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,qBAAqB,UAAU,UAAU,EAAE;YAC1F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,iCAAiC,QAAQ,EAAE,EAAE,CAAC;YACtF,IAAI;SACL,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,KAKC;QAED,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC;oBACE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACjC,SAAS,EAAE,CAAC,CAAC,QAAQ,IAAI,KAAK;wBAC9B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;wBACnC,6BAA6B,EAAE,CAAC,CAAC,0BAA0B;wBAC3D,MAAM,EAAE;4BACN,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;4BACzC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;4BACvD,GAAG,CAAC,CAAC,CAAC,cAAc;gCAClB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;gCACxD,CAAC,CAAC,EAAE,CAAC;yBACR;qBACF,CAAC,CAAC;iBACJ;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,8EAA8E;QAC9E,8EAA8E;QAC9E,WAAW;QACX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,qBAAqB,UAAU,SAAS,EAAE;YACzF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC;YAC9E,IAAI,EAAE,YAAY,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE;SACjE,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,KAAK,CAAC,UAAkB;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,qBAAqB,UAAU,QAAQ,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,qBAAqB,UAAU,MAAM,EAAE;YACtF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC;CACF;AAED,qFAAqF;AACrF,SAAS,aAAa,CACpB,QAAgB,EAChB,KAAa,EACb,QAAgB,EAChB,IAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CACrB,KAAK,QAAQ,MAAM;QACjB,yCAAyC,KAAK,gBAAgB,QAAQ,OAAO;QAC7E,uCAAuC,CAC1C,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,QAAQ,QAAQ,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC;AACb,CAAC"}