@substrat-run/contracts 0.159.0 → 0.161.0

package/dist/wire-signing.d.ts

@@ -0,0 +1,443 @@
+import { type ScopeStoreKeyProblem } from './scope-store-envelope.js';
+export declare const WIRE_ENVELOPE_VERSION = 1;
+/** The first line of every wire envelope: the protocol and its version. */
+export declare const WIRE_ENVELOPE_TAG: "substrat-wire/1";
+/** The request header carrying base64url of the canonical bytes. */
+export declare const WIRE_ENVELOPE_HEADER = "x-substrat-wire-envelope";
+/** The request header carrying the base64url signature. */
+export declare const WIRE_SIGNATURE_HEADER = "x-substrat-wire-signature";
+/** What a signer gives an envelope when it is not told: `exp = iat + 60`. */
+export declare const WIRE_ENVELOPE_LIFETIME_SECONDS = 60;
+/** The longest `exp - iat` a verifier accepts, and a signer mints. */
+export declare const WIRE_ENVELOPE_MAX_LIFETIME_SECONDS = 120;
+/** How far a verifier's clock may be from the signer's, on either side of `[iat, exp]`. */
+export declare const WIRE_CLOCK_SKEW_SECONDS = 30;
+export type WireIssuer = 'router' | 'platform';
+export type WireKind = 'route' | 'call';
+/** Whether a field is carried: always, possibly (empty when not), or never (always empty). */
+export type WireFieldPresence = 'required' | 'optional' | 'absent';
+export interface WireEnvelopeShape {
+    /** The tenant and scope, as a pair: both ULIDs or both empty. */
+    readonly scope: WireFieldPresence;
+    readonly surface: WireFieldPresence;
+    readonly vertical: WireFieldPresence;
+    readonly body: WireFieldPresence;
+}
+/** What an (iss, kind) pair carries, or undefined when version 1 does not admit the pair. */
+export declare function wireEnvelopeShape(iss: string, kind: string): WireEnvelopeShape | undefined;
+/** One envelope's fields. An absent field is `null`, never an empty string. */
+export interface WireClaims {
+    readonly v: 1;
+    readonly iss: WireIssuer;
+    readonly kind: WireKind;
+    readonly kid: string;
+    readonly aud: string;
+    readonly tenantId: string | null;
+    readonly scopeId: string | null;
+    readonly surface: string | null;
+    readonly vertical: string | null;
+    readonly method: string;
+    readonly targetDigest: string;
+    readonly bodyDigest: string | null;
+    readonly iat: number;
+    readonly exp: number;
+    readonly nonce: string;
+}
+/** The claims those bytes name, or undefined when they are not exactly what the encoder emits. */
+export declare function parseWireEnvelope(canonical: string): WireClaims | undefined;
+/**
+ * The canonical text a header carries and the claims it names, or undefined when the header is not
+ * base64url of exactly what the encoder emits. Nothing is verified here: the verifier decodes with
+ * this, and an entry may read the claims beforehand only to choose what to verify them against.
+ */
+export declare function decodeWireEnvelope(header: string): {
+    readonly canonical: string;
+    readonly claims: WireClaims;
+} | undefined;
+/**
+ * The encoder's refusal of claims no verifier would accept: a field the parser would refuse, a body
+ * where the pair binds none or none where it binds one, a lifetime past the maximum. Its own class, so
+ * a signer counts it as `claims` and every other throw as `error` (RFC §8).
+ */
+export declare class WireClaimsError extends Error {
+    readonly name = "WireClaimsError";
+}
+/** Fifteen lines, no trailing newline. Throws {@link WireClaimsError} on a field the parser would refuse. */
+export declare function canonicalWireEnvelope(claims: WireClaims): string;
+/** A body or a target, as the bytes a digest is taken over. A string is its UTF-8. */
+export type WireBytes = string | ArrayBuffer | ArrayBufferView;
+/** SHA-256 of the exact bytes, lowercase hex: for a string, the store's body digest. */
+export declare function wireDigest(data: WireBytes): Promise<string>;
+/**
+ * What an envelope binds of a request, read the same way by the signer (from the request it is
+ * about to send) and the verifier (from the request it received): the method, upper-cased, and
+ * the target, the URL's pathname plus its search as the URL API serializes them. The fragment
+ * never travels, and an empty `?` reads as no query on both ends.
+ */
+export declare function wireRequestBinding(request: {
+    readonly method: string;
+    readonly url: string;
+}): {
+    readonly method: string;
+    readonly target: string;
+};
+/** A signing key that is present but cannot be used. Its message never carries the key. */
+export declare class WireKeyError extends Error {
+    readonly reason: ScopeStoreKeyProblem;
+    readonly name = "WireKeyError";
+    constructor(message: string, reason: ScopeStoreKeyProblem);
+}
+/** An imported private key and the key id its envelopes name. Import once per isolate. */
+export interface WireSigningKey {
+    readonly kid: string;
+    readonly publicKey: string;
+    readonly key: CryptoKey;
+}
+/**
+ * Import a PKCS8 Ed25519 private key (base64url) for signing. The key is judged by the store
+ * module's own check (only the 48-byte PKCS8 v1 form, never a small-order point), so the store
+ * key tooling's `generate` and `doctor` accept and refuse the same values. Throws
+ * {@link WireKeyError} when it is unusable.
+ */
+export declare function importWireSigningKey(pkcs8: string): Promise<WireSigningKey>;
+/** What a signer is told. Absent optional fields are omitted or `null`. */
+export interface WireEnvelopeInput {
+    readonly iss: WireIssuer;
+    readonly kind: WireKind;
+    readonly aud: string;
+    readonly tenantId?: string | null;
+    readonly scopeId?: string | null;
+    readonly surface?: string | null;
+    readonly vertical?: string | null;
+    /** From {@link wireRequestBinding} over the request being sent. */
+    readonly method: string;
+    readonly target: string;
+    /** A call's exact body (an empty one is `''`). A route takes none. */
+    readonly body?: WireBytes;
+    /** Defaults to now. */
+    readonly iat?: number;
+    /** Defaults to `iat` + {@link WIRE_ENVELOPE_LIFETIME_SECONDS}. */
+    readonly exp?: number;
+    /** Defaults to 16 random bytes. */
+    readonly nonce?: string;
+}
+export interface IssuedWireEnvelope {
+    readonly claims: WireClaims;
+    readonly canonical: string;
+    /** {@link WIRE_ENVELOPE_HEADER} carries it: base64url of the canonical UTF-8 bytes. */
+    readonly header: string;
+    /** {@link WIRE_SIGNATURE_HEADER} carries it. */
+    readonly signature: string;
+}
+/** Build, digest and sign one envelope. Throws {@link WireClaimsError} on an input no verifier would accept. */
+export declare function signWireEnvelope(key: WireSigningKey, input: WireEnvelopeInput): Promise<IssuedWireEnvelope>;
+/**
+ * The public keys a deployment verifies with, per issuer, by key id. Only {@link wireVerificationKeys}
+ * makes one, and only the same copy of this module accepts it: the mark is held by the module
+ * instance, so a key set built by a second copy of the package (two bundled versions, say) throws
+ * on every call. Build the key set and verify in the same bundle.
+ */
+export interface WireVerificationKeys {
+    readonly router: ReadonlyMap<string, string>;
+    readonly platform: ReadonlyMap<string, string>;
+}
+/**
+ * Each issuer's public keys, from the configured lists: raw Ed25519 keys, base64url, separated
+ * by commas, as the store's lists are and refused for the same faults. An unset or blank list is
+ * no keys, which verifies nothing. Throws on a key listed for both issuers: whoever holds the
+ * router's private key could then sign as the platform.
+ */
+export declare function wireVerificationKeys(config: {
+    readonly router?: string;
+    readonly platform?: string;
+}): Promise<WireVerificationKeys>;
+/**
+ * Where a deployment records the nonces of envelopes it accepted, so a replay inside the window
+ * is refused. An interface only: the RFC puts the store in the scope's own object, for the calls
+ * that change state.
+ */
+export interface WireNonceCache {
+    /**
+     * Record `nonce` as spent until `until` (Unix seconds) and answer whether it was unspent. It
+     * answers `true` at most once per nonce while recorded, concurrent claims included, and may
+     * forget a nonce after `until`, and a claim made after `until` by its own clock answers `false`:
+     * that is what makes forgetting safe. The verifier also refuses, without asking, a claim it would
+     * make after `until` by its own clock (a slow body). Only `true` itself is acceptance: any other
+     * answer refuses. A cache that cannot answer throws, and the verifier never reads a throw as
+     * acceptance. The entry bounds each claim in time and treats a timeout as that throw.
+     */
+    claim(nonce: string, until: number): boolean | Promise<boolean>;
+}
+/**
+ * How a call is held against replay, stated by the endpoint, never defaulted: `'none'` keeps no
+ * nonce memory, so a replay inside the window is accepted (a read, an idempotent call); a cache
+ * spends each nonce once (a call that changes state). A call expectation without one throws.
+ */
+export type WireReplayPolicy = 'none' | WireNonceCache;
+/** What a deployment expects of an envelope: who signs, for whom, and the request it rides on. */
+interface WireExpectationOf<K extends WireKind> {
+    readonly iss: WireIssuer;
+    readonly kind: K;
+    /** This deployment's own name. An empty one matches nothing. */
+    readonly aud: string;
+    /** From {@link wireRequestBinding} over the request received. */
+    readonly method: string;
+    readonly target: string;
+    /** When given, the envelope must name exactly this tenant. */
+    readonly tenantId?: string;
+    /** When given, the envelope must name exactly this scope. */
+    readonly scopeId?: string;
+}
+/**
+ * A call's body, read on demand: the verifier calls it only when the body is the next check, after
+ * the signature, the audience, the lifetime, the clock, the method and the target have passed, so an
+ * envelope refused for any of those never costs a read. The tenant and scope pins, and a nonce claim,
+ * come after it, in the order §3.4 of the RFC fixes. It answers `null` when the body could not be read, which is refused as `body`.
+ */
+export type WireBodyReader = () => WireBytes | null | Promise<WireBytes | null>;
+export type WireExpectation = WireExpectationOf<'route'> | (WireExpectationOf<'call'> & {
+    /** The exact body received, read before any of it is acted on; or a reader that reads it then. */
+    readonly body: WireBytes | WireBodyReader;
+    /** Required: an endpoint that forgets to say fails closed, rather than accepting replays. */
+    readonly replay: WireReplayPolicy;
+});
+/** Why an envelope was refused, in the order the verifier checks. For metrics only. */
+export declare const WIRE_REFUSAL_REASONS: readonly ['missing', 'malformed', 'issuer', 'kind', 'kid', 'signature', 'audience', 'lifetime', 'not-yet-valid', 'expired', 'method', 'target', 'body', 'scope', 'claim-after-until', 'replay'];
+export type WireRefusalReason = (typeof WIRE_REFUSAL_REASONS)[number];
+export interface WireAccepted {
+    readonly ok: true;
+    readonly claims: WireClaims;
+}
+/** The one refusal. Every failure returns this same object, so none can be told from another. */
+export interface WireRefused {
+    readonly ok: false;
+}
+export declare const WIRE_REFUSED: WireRefused;
+export type WireVerdict = WireAccepted | WireRefused;
+/**
+ * Every check a deployment makes on an envelope, in one fixed order: present, well-formed, the
+ * expected issuer and kind, a listed key id, the signature, then (all over signed bytes) the
+ * audience, the lifetime, the clock, the method, the target, a call's body, any pinned tenant
+ * and scope, and last a call's nonce when its policy keeps them, so an envelope that fails anything
+ * else never spends a cache entry. A route keeps no nonces. `nowSeconds` is the time the request
+ * arrived, not when its body finished reading.
+ *
+ * Returns {@link WIRE_REFUSED} for every failure of the caller's. `onRefusal` hears the reason; a
+ * throw or a rejection from it is ignored. The deployment's own faults throw instead, so no counter
+ * files them under a caller, and they are checked before anything else: a key set
+ * {@link wireVerificationKeys} did not build, a call expectation whose replay policy is neither
+ * `'none'` nor a cache, a cache with no pinned `scopeId` (a cache lives in one scope's object, so
+ * the endpoint pins the scope it claims through), and a cache with no `clockSeconds` function. Two
+ * more are found only when a nonce is about to be claimed, and throw then: a claim clock that reads
+ * something other than a finite, non-negative number of seconds (a promise from an async clock
+ * included), before the cache is asked; and a throw from the cache.
+ */
+export declare function verifyWireEnvelope(input: {
+    readonly headers: {
+        get(name: string): string | null;
+    };
+    readonly keys: WireVerificationKeys;
+    readonly expected: WireExpectation;
+    /** When the request arrived: what the envelope's window is judged against. */
+    readonly nowSeconds: number;
+    /**
+     * The time now, read again just before a nonce is claimed, after the body has been read: the same
+     * clock `nowSeconds` was read from. Required when the replay policy is a cache (it throws otherwise,
+     * before anything is read). A claim that would come after the cache may have forgotten the nonce is
+     * refused as `claim-after-until`.
+     */
+    readonly clockSeconds?: () => number;
+    /** Whatever it returns is ignored; a promise it returns is awaited by nobody and its rejection caught. */
+    readonly onRefusal?: (reason: WireRefusalReason) => unknown;
+}): Promise<WireVerdict>;
+/** The router's public keys, a comma-separated list. Plain configuration: public keys are not secret. */
+export declare const WIRE_ROUTER_KEYS_VAR = "SUBSTRAT_WIRE_ROUTER_KEYS";
+/** The control plane's public keys, a comma-separated list. */
+export declare const WIRE_PLATFORM_KEYS_VAR = "SUBSTRAT_WIRE_PLATFORM_KEYS";
+/** The deployment's own dispatch name, which an envelope's `aud` must equal. */
+export declare const WIRE_AUDIENCE_VAR = "SUBSTRAT_WIRE_AUDIENCE";
+/** The environment's down-channel state, one of {@link WIRE_STATES}. */
+export declare const WIRE_STATE_VAR = "SUBSTRAT_WIRE_STATE";
+/** What a deployment accepts on a call down (RFC §5). */
+export declare const WIRE_STATES: readonly ['legacy-only', 'dual', 'signed-only'];
+export type WireState = (typeof WIRE_STATES)[number];
+/**
+ * A deployment's state from what its upload carries (RFC §5, Q3). No key list at all is
+ * `legacy-only` whatever the setting says, so a deployment no upload gave keys behaves as it
+ * did before the verifier existed. With keys, an explicit `legacy-only` or `signed-only` is
+ * taken as said, and anything else (missing, unknown) reads as `dual`: a wrong value fails
+ * toward accepting what is accepted today.
+ */
+export declare function wireStateOf(config: {
+    readonly routerKeys?: unknown;
+    readonly platformKeys?: unknown;
+    readonly state?: unknown;
+}): WireState;
+/**
+ * The only state an upload gives a deployment in step 2 (RFC §9): `dual`. Moving a deployment to
+ * `signed-only` is a later, separate step (the flip, follow-on 7), a person's act behind its own
+ * gate, so no code that injects settings here can name it.
+ */
+export declare const WIRE_UPLOAD_STATE = "dual";
+/**
+ * What one upload gives the deployment it uploads as `audience` (RFC §5, §6, step 2), as the settings
+ * the entry reads: both key lists, its own name for the audience check, and the state
+ * {@link WIRE_UPLOAD_STATE}. The uploader writes them as plain configuration. The lists are judged first
+ * by {@link wireVerificationKeys}, the very function the entry loads them with, so an upload never gives
+ * a deployment lists its verifier would refuse: it throws instead, and the caller gives nothing. Each
+ * list must hold at least one key, and the audience must be one the encoder admits. Answers the kids
+ * each list names, for the capability record (RFC §7, Q8).
+ */
+export declare function wireUploadSettings(input: {
+    readonly routerKeys: string;
+    readonly platformKeys: string;
+    readonly audience: string;
+}): Promise<{
+    readonly settings: readonly {
+        readonly name: string;
+        readonly text: string;
+    }[];
+    readonly routerKids: string[];
+    readonly platformKids: string[];
+}>;
+/** What an endpoint of a deployment accepts: the kind of envelope, and the issuers that may sign it. */
+export interface WireEndpoint {
+    readonly kind: WireKind;
+    readonly issuers: readonly WireIssuer[];
+}
+/**
+ * Which envelope a deployment's endpoint accepts (RFC §3.4, check 3), by the request's path. The
+ * internal surface vertical-host's `mountPlatformSurface` gates (`/internal/*`) takes calls from
+ * the control plane, and its peer invocation (`/internal/vertical-invoke`) from the router too,
+ * which makes those calls. Every other path is a routed request. A verifier judges by this, and a
+ * signer signs what it says.
+ *
+ * The surface is matched on the path its router decodes (Hono's `getPath`: `decodeURI`, with `%25`
+ * kept escaped), so the path is judged in every form a router could read it: as sent, decoded that
+ * way, decoded fully, each with empty and dot segments collapsed, in any letter case. Any form under
+ * `/internal` makes it a call: the stricter reading wins. Only the exact path the router sends a peer
+ * invocation to admits the router.
+ */
+export declare function wireEndpoint(pathname: string): WireEndpoint;
+/**
+ * The internal calls that take a body but change nothing, so a call to one keeps no nonce memory
+ * (RFC §4): each only reads the scope it names. Named by the exact path the platform calls, so any
+ * other spelling of one keeps nonces.
+ */
+export declare const WIRE_REPLAY_FREE_CALLS: readonly string[];
+/**
+ * A call's replay policy as its endpoint states it (RFC §4), never inferred from what an envelope
+ * names: `'none'` for a safe method or a call {@link WIRE_REPLAY_FREE_CALLS} lists, and `'nonce'`
+ * for every other call, a new endpoint included, whether or not its envelope names a scope. A call
+ * that keeps nonces and names no scope has no store to spend one in, which is its deployment's fault.
+ */
+export declare function wireReplayOf(method: string, pathname: string): 'none' | 'nonce';
+/**
+ * How one request fared (RFC §8). `legacy-accepted` is an envelope refused beside a legacy
+ * credential that was valid, and carries the refusal's reason; `refused` is an envelope refused
+ * with no valid legacy credential beside it.
+ */
+export declare const WIRE_OUTCOMES: readonly ['signed-accepted', 'legacy-accepted', 'dual-mismatch', 'refused', 'fault'];
+export type WireOutcome = (typeof WIRE_OUTCOMES)[number];
+/**
+ * Which of the deployment's own faults a `fault` was: its key lists could not be loaded, it has
+ * no nonce store for a call that needs one, its nonce store threw or did not answer in time, or
+ * the verifier threw for any other reason.
+ */
+export declare const WIRE_FAULTS: readonly ['keys', 'no-nonce-store', 'nonce-store', 'verifier'];
+export type WireFault = (typeof WIRE_FAULTS)[number];
+/** The legacy credential beside the envelope: present and valid, present and not, or not sent. */
+export type WireLegacyCredential = 'valid' | 'invalid' | 'absent';
+/**
+ * The line an entry writes for every request it judged (RFC §8), beside the invocation line and
+ * sharing its request id. Never written in `legacy-only`. Names, ids and outcomes only: never a
+ * header, a credential, a body or an error's text. Add fields; never rename one.
+ */
+export interface WireVerificationLine {
+    readonly substrat: 'wire';
+    readonly state: Exclude<WireState, 'legacy-only'>;
+    /**
+     * Who signed: the issuer the envelope was verified as. An envelope not verified is the endpoint's
+     * one issuer, or `null` at an endpoint that admits two, since its claim is not trusted.
+     */
+    readonly issuer: WireIssuer | null;
+    /** The kind the endpoint takes. */
+    readonly kind: WireKind;
+    readonly outcome: WireOutcome;
+    /** Why the envelope was refused, beside `legacy-accepted` and `refused`; otherwise null. */
+    readonly reason: WireRefusalReason | null;
+    /** Beside `fault`; otherwise null. */
+    readonly fault: WireFault | null;
+    readonly legacy: WireLegacyCredential;
+    /** The tenant and scope the request was served as, when a credential proved one. */
+    readonly tenantId: string | null;
+    readonly scopeId: string | null;
+    /** The platform's `SUBSTRAT_VERSION_ID`, as on the invocation line. */
+    readonly versionId: string | null;
+}
+/**
+ * Whether a signer's `sign` flag (RFC §5) is on: exactly `on`, around whitespace. Absent, empty or
+ * anything else is off, so a signer nobody configured adds nothing to any request.
+ */
+export declare function wireSigningOn(value: unknown): boolean;
+/**
+ * {@link importWireSigningKey}, once per isolate for a given value: the signer's key is imported on
+ * the first request that needs it and reused after. A value that will not import keeps rejecting,
+ * with the same {@link WireKeyError}, until the value changes.
+ */
+export declare function wireSigningKeyOf(pkcs8: string): Promise<WireSigningKey>;
+/** What a signer names on one request, beside what the request itself says: its method, target and body. */
+export type WireRequestClaims = Omit<WireEnvelopeInput, 'method' | 'target' | 'body'>;
+/**
+ * The request with one fresh envelope on it ({@link WIRE_ENVELOPE_HEADER} and
+ * {@link WIRE_SIGNATURE_HEADER}), every other header kept as it was. The method and target are read
+ * with {@link wireRequestBinding}, as the verifier reads them. A call binds the request's exact body,
+ * read whole here and handed on as the same bytes (an absent body is the empty one, as the verifier
+ * reads it); a route binds none, and its body is not read. Sign each attempt: a resend carries a
+ * spent nonce (RFC §4).
+ */
+export declare function signWireRequest(key: WireSigningKey, request: Request, claims: WireRequestClaims): Promise<Request>;
+/**
+ * What a signer did with one request (RFC §8): signed it, or sent it as it came because it could
+ * not, saying why: `unset` (no key), the key form's refusal (a {@link WireKeyError} reason), `claims`
+ * (claims the encoder refuses), or `error` (anything else).
+ */
+export type WireSignResult = {
+    readonly request: Request;
+    readonly outcome: 'signed';
+} | {
+    readonly request: Request;
+    readonly outcome: 'failed';
+    readonly reason: string;
+};
+/**
+ * One signer's decision for one request. `named`, when given, adds the tenant and scope the call's
+ * own body names, read from the bytes the signer already holds.
+ */
+export type WireSigner = (request: Request, claims: WireRequestClaims, named?: (request: Request, body: ArrayBuffer | undefined) => {
+    readonly tenantId: string;
+    readonly scopeId: string;
+} | null) => Promise<WireSignResult>;
+/**
+ * A signer's whole decision (RFC §5, §8): `null` while its `sign` flag is off, which is the default,
+ * so nothing is read and nothing is signed. On, each request is signed afresh with the key, imported
+ * once per isolate. A signer that cannot sign never fails the request: it is handed back with its
+ * legacy headers and its whole body (a call's body is read once, and the request rebuilt from those
+ * bytes when signing fails after reading it), and the result says why, never with the key.
+ */
+export declare function wireSignerOf(settings: {
+    readonly sign?: unknown;
+    readonly key?: string;
+}): WireSigner | null;
+/** The listed headers by name, each with the kind of request it rides on. */
+export declare const WIRE_UNSIGNED_HEADERS: Readonly<Record<string, WireKind>>;
+/**
+ * The listed headers ({@link WIRE_UNSIGNED_HEADERS}) a request of `kind` hands on, as name and value:
+ * only those listed for that kind, and only a value its reader's check accepts. A header sent twice
+ * reads as both values joined, which is not one id, so it is dropped whole.
+ */
+export declare function wireUnsignedHeadersOf(kind: WireKind, headers: {
+    get(name: string): string | null;
+}): [name: string, value: string][];
+export {};
+//# sourceMappingURL=wire-signing.d.ts.map

package/dist/wire-signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-signing.d.ts","sourceRoot":"","sources":["../src/wire-signing.ts"],"names":[],"mappings":"AAiDA,OAAO,EAQL,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,mBAAoD,CAAC;AACnF,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAC/D,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AACjE,6EAA6E;AAC7E,eAAO,MAAM,8BAA8B,KAAK,CAAC;AACjD,sEAAsE;AACtE,eAAO,MAAM,kCAAkC,MAAM,CAAC;AACtD,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAC/C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAExC,8FAA8F;AAC9F,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AAoBD,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAG1F;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAyCD,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAiC3E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG,SAAS,CAY1H;AAED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,qBAAqB;CAC5C;AAED,6GAA6G;AAC7G,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CA8BhE;AAED,sFAAsF;AACtF,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,eAAe,CAAC;AAS/D,wFAAwF;AACxF,wBAAsB,UAAU,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAC9F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAGA;AAED,2FAA2F;AAC3F,qBAAa,YAAa,SAAQ,KAAK;IAInC,QAAQ,CAAC,MAAM,EAAE,oBAAoB;IAHvC,SAAkB,IAAI,kBAAkB;IACxC,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,oBAAoB,EAGtC;CACF;AAED,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAajF;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,gHAAgH;AAChH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8BjH;AAMD;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AASD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAW1I;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,cAAc,CAAC;AAEvD,kGAAkG;AAClG,UAAU,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IAC5C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;AAEhF,MAAM,MAAM,eAAe,GACvB,iBAAiB,CAAC,OAAO,CAAC,GAC1B,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG;IAC3B,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,cAAc,CAAC;IAC1C,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC,CAAC;AAEP,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,YAC/B,SAAS,EACT,WAAW,EACX,QAAQ,EACR,MAAM,EACN,KAAK,EACL,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,OAAO,EACP,mBAAmB,EACnB,QAAQ,CACA,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;CACpB;AACD,eAAO,MAAM,YAAY,EAAE,WAA0C,CAAC;AAEtE,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAErD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC,0GAA0G;IAC1G,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC;CAC7D,GAAG,OAAO,CAAC,WAAW,CAAC,CAoEvB;AAQD,yGAAyG;AACzG,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,wEAAwE;AACxE,eAAO,MAAM,cAAc,wBAAwB,CAAC;AAEpD,yDAAyD;AACzD,eAAO,MAAM,WAAW,YAAI,aAAa,EAAE,MAAM,EAAE,aAAa,CAAU,CAAC;AAC3E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAI3I;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,SAA6B,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAClJ,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;CACjC,CAAC,CAgBD;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;CACzC;AAiCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAK3D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAMlD,CAAC;AAIH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAE/E;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAAI,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAClH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,WAAW,YAAI,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,CAAU,CAAC;AAC1F,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,kGAAkG;AAClG,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IACnC,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC1C,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AASD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErD;AAKD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAGvE;AAED,4GAA4G;AAC5G,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAC;AAEtF;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAExH;AAeD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,iBAAiB,EACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS,KAAK;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,KACxH,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,IAAI,CAuB5G;AAoBD,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAmF,CAAC;AAEzJ;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAOpI"}