@toa.io/extensions.exposition 1.0.0-alpha.3 → 1.0.0-alpha.300

package/transpiled/directives/auth/Role.js

@@ -1,44 +1,64 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Role = void 0;
-class Role {
+import { quote } from '@toa.io/generic';
+export class Role {
     static remote = null;
     roles;
     discovery;
+    dynamic;
     constructor(roles, discovery) {
         this.roles = typeof roles === 'string' ? [roles] : roles;
         this.discovery = discovery;
+        this.dynamic = this.roles.some((role) => role.includes('{'));
     }
-    static async set(identity, discovery) {
+    static async get(identity, discovery) {
         this.remote ??= await discovery;
-        const query = { criteria: `identity==${identity.id}`, limit: 1024 };
-        const roles = await this.remote.invoke('list', { query });
-        identity.roles = roles;
+        const query = {
+            criteria: `identity==${quote(identity.id)}`,
+            limit: 1024
+        };
+        return await this.remote.invoke('list', { query });
     }
-    async authorize(identity) {
+    /**
+     * Reaching it takes a role, which is what `protected` says. A role of the `system` scope
+     * says so besides: what it guards is the machinery an application runs on rather than
+     * anything it serves, and a reader has no business being offered it as one.
+     */
+    describe(introspection) {
+        const system = this.roles.some((role) => role === SYSTEM || role.startsWith(SYSTEM + ':'));
+        return { ...introspection, protected: true, ...(system ? { system: true } : {}) };
+    }
+    async authorize(identity, _, parameters) {
         if (identity === null)
             return false;
-        await Role.set(identity, this.discovery);
-        if (identity.roles === undefined)
+        identity.roles ??= await Role.get(identity, this.discovery);
+        return this.match(identity.roles, parameters);
+    }
+    /** A role naming a route variable cannot be told from a description, which has no values. */
+    async admits(identity) {
+        if (this.dynamic)
+            return undefined;
+        if (identity === null)
             return false;
-        return this.match(identity.roles);
+        identity.roles ??= await Role.get(identity, this.discovery);
+        return this.match(identity.roles, []);
     }
-    match(roles) {
+    match(roles, parameters) {
+        const required = this.dynamic ? this.substitute(parameters) : this.roles;
         for (const role of roles) {
-            const index = this.roles.findIndex((expected) => compare(expected, role));
-            if (index !== -1)
+            const ok = required.some((expected) => expected === role || expected.startsWith(role + ':'));
+            if (ok)
                 return true;
         }
         return false;
     }
+    substitute(parameters) {
+        return this.roles.map((role) => role.replaceAll(/{(\w+)}/g, (_, key) => {
+            const value = parameters.find((parameter) => parameter.name === key)?.value;
+            if (value === undefined)
+                throw new Error(`Role '${role}' requires '${key}' route parameter`);
+            return value;
+        }));
+    }
 }
-exports.Role = Role;
-function compare(expected, actual) {
-    const exp = expected.split(':');
-    const act = actual.split(':');
-    for (let i = 0; i < act.length; i++)
-        if (exp[i] !== act[i])
-            return false;
-    return true;
-}
+/** The scope of what an application runs on, as opposed to what it serves. */
+const SYSTEM = 'system';
 //# sourceMappingURL=Role.js.map

package/transpiled/directives/auth/Role.js.map

@@ -1 +1 @@
-{"version":3,"file":"Role.js","sourceRoot":"","sources":["../../../source/directives/auth/Role.ts"],"names":[],"mappings":";;;AAGA,MAAa,IAAI;IACR,MAAM,CAAC,MAAM,GAAqB,IAAI,CAAA;IAC5B,KAAK,CAAU;IACf,SAAS,CAAoB;IAE9C,YAAoB,KAAwB,EAAE,SAA6B;QACzE,IAAI,CAAC,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAE,QAAkB,EAAE,SAA6B;QACxE,IAAI,CAAC,MAAM,KAAK,MAAM,SAAS,CAAA;QAE/B,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,aAAa,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAC1E,MAAM,KAAK,GAAa,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAEnE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAA;IACxB,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,QAAyB;QAC/C,IAAI,QAAQ,KAAK,IAAI;YACnB,OAAO,KAAK,CAAA;QAEd,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAExC,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;YAC9B,OAAO,KAAK,CAAA;QAEd,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAEO,KAAK,CAAE,KAAe;QAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;YAEzE,IAAI,KAAK,KAAK,CAAC,CAAC;gBACd,OAAO,IAAI,CAAA;QACf,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;;AAxCH,oBAyCC;AAED,SAAS,OAAO,CAAE,QAAgB,EAAE,MAAc;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QACjC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACnB,OAAO,KAAK,CAAA;IAEhB,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"Role.js","sourceRoot":"","sources":["../../../source/directives/auth/Role.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAOvC,MAAM,OAAO,IAAI;IACR,MAAM,CAAC,MAAM,GAAqB,IAAI,CAAA;IAC5B,KAAK,CAAU;IACf,SAAS,CAAoB;IAC7B,OAAO,CAAS;IAEjC,YAAmB,KAAwB,EAAE,SAA6B;QACxE,IAAI,CAAC,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9D,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAG,CACrB,QAAkB,EAClB,SAA6B;QAE7B,IAAI,CAAC,MAAM,KAAK,MAAM,SAAS,CAAA;QAE/B,MAAM,KAAK,GAAU;YACnB,QAAQ,EAAE,aAAa,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAC3C,KAAK,EAAE,IAAI;SACZ,CAAA;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;IAED;;;;OAIG;IACI,QAAQ,CAAC,aAA4B;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAC5B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAC3D,CAAA;QAED,OAAO,EAAE,GAAG,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACnF,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,QAAyB,EACzB,CAAU,EACV,UAAuB;QAEvB,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAEnC,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAE3D,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/C,CAAC;IAED,6FAA6F;IACtF,KAAK,CAAC,MAAM,CAAC,QAAyB;QAC3C,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAElC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAEnC,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAE3D,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,KAAe,EAAE,UAAuB;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;QAExE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CACtB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CACnE,CAAA;YAED,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAA;QACrB,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,UAAU,CAAC,UAAuB;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7B,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,CAAA;YAE3E,IAAI,KAAK,KAAK,SAAS;gBACrB,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,eAAe,GAAG,mBAAmB,CAAC,CAAA;YAErE,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CACH,CAAA;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,MAAM,GAAG,QAAQ,CAAA"}

package/transpiled/directives/auth/Rule.d.ts

@@ -1,9 +1,12 @@
-import { type Parameter } from '../../RTD';
-import type { Input, Directive, Identity } from './types';
+import { type Parameter } from '../../RTD/index.js';
+import type { Introspection } from '../../Introspection.js';
+import type { Context, Directive, Identity, Create } from './types.js';
 export declare class Rule implements Directive {
     private readonly directives;
     constructor(directives: Record<string, any>, create: Create);
-    authorize(identity: Identity | null, input: Input, parameters: Parameter[]): Promise<boolean>;
+    authorize(identity: Identity | null, context: Context, parameters: Parameter[]): Promise<boolean>;
+    /** Whatever each of them makes of it, in the order they were declared. */
+    describe(introspection: Introspection): Introspection;
+    /** All of them, so one that refuses ends it and one that cannot tell leaves it untold. */
+    admits(identity: Identity | null, context: Context): Promise<boolean | undefined>;
 }
-type Create = (name: string, value: any, ...args: any[]) => Directive;
-export {};

package/transpiled/directives/auth/Rule.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Rule = void 0;
-class Rule {
+export class Rule {
     directives = [];
     constructor(directives, create) {
         for (const [name, value] of Object.entries(directives)) {
@@ -9,14 +6,33 @@ class Rule {
             this.directives.push(directive);
         }
     }
-    async authorize(identity, input, parameters) {
+    async authorize(identity, context, parameters) {
         for (const directive of this.directives) {
-            const authorized = await directive.authorize(identity, input, parameters);
+            const authorized = await directive.authorize(identity, context, parameters);
             if (!authorized)
                 return false;
         }
         return true;
     }
+    /** Whatever each of them makes of it, in the order they were declared. */
+    describe(introspection) {
+        for (const directive of this.directives)
+            introspection = directive.describe?.(introspection) ?? introspection;
+        return introspection;
+    }
+    /** All of them, so one that refuses ends it and one that cannot tell leaves it untold. */
+    async admits(identity, context) {
+        let untold = false;
+        for (const directive of this.directives) {
+            const admits = await directive.admits?.(identity, context);
+            if (admits === undefined) {
+                untold = true;
+                continue;
+            }
+            if (!admits)
+                return false;
+        }
+        return untold ? undefined : true;
+    }
 }
-exports.Rule = Rule;
 //# sourceMappingURL=Rule.js.map

package/transpiled/directives/auth/Rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"Rule.js","sourceRoot":"","sources":["../../../source/directives/auth/Rule.ts"],"names":[],"mappings":";;;AAGA,MAAa,IAAI;IACE,UAAU,GAAgB,EAAE,CAAA;IAE7C,YAAoB,UAA+B,EAAE,MAAc;QACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAErC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CACrB,QAAyB,EAAE,KAAY,EAAE,UAAuB;QAC/D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;YAEzE,IAAI,CAAC,UAAU;gBACb,OAAO,KAAK,CAAA;QAChB,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAtBD,oBAsBC"}
+{"version":3,"file":"Rule.js","sourceRoot":"","sources":["../../../source/directives/auth/Rule.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,IAAI;IACE,UAAU,GAAgB,EAAE,CAAA;IAE7C,YAAmB,UAA+B,EAAE,MAAc;QAChE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAErC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,QAAyB,EACzB,OAAgB,EAChB,UAAuB;QAEvB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;YAE3E,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAA;QAC/B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0EAA0E;IACnE,QAAQ,CAAC,aAA4B;QAC1C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU;YACrC,aAAa,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,aAAa,CAAA;QAEtE,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,MAAM,CACjB,QAAyB,EACzB,OAAgB;QAEhB,IAAI,MAAM,GAAG,KAAK,CAAA;QAElB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,IAAI,CAAA;gBAEb,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAA;QAC3B,CAAC;QAED,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAClC,CAAC;CACF"}

package/transpiled/directives/auth/Scheme.d.ts

@@ -1,7 +1,9 @@
-import { type Directive, type Identity, type Input } from './types';
+import { type Directive, type Identity, type Context } from './types.js';
 export declare class Scheme implements Directive {
     private readonly scheme;
     private readonly Scheme;
     constructor(scheme: string);
-    authorize(_: Identity | null, input: Input): boolean;
+    authorize(_: Identity | null, context: Context): boolean;
+    /** It admits nobody: it is there to refuse a scheme, not to authorize one. */
+    admits(): boolean;
 }

package/transpiled/directives/auth/Scheme.js

@@ -1,47 +1,23 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Scheme = void 0;
-const http = __importStar(require("../../HTTP"));
-const split_1 = require("./split");
-class Scheme {
+import * as http from '../../HTTP/index.js';
+import { split } from './split.js';
+export class Scheme {
     scheme;
     Scheme;
     constructor(scheme) {
         this.scheme = scheme.toLowerCase();
         this.Scheme = scheme[0].toUpperCase() + scheme.substring(1);
     }
-    authorize(_, input) {
-        if (input.headers.authorization === undefined)
+    authorize(_, context) {
+        if (context.request.headers.authorization === undefined)
             return false;
-        const [scheme] = (0, split_1.split)(input.headers.authorization);
+        const [scheme] = split(context.request.headers.authorization);
         if (scheme !== this.scheme)
-            throw new http.Forbidden(this.Scheme +
-                ' authentication scheme is required to access this resource.');
+            throw new http.Forbidden(this.Scheme + ' authentication scheme is required to access this resource');
+        return false;
+    }
+    /** It admits nobody: it is there to refuse a scheme, not to authorize one. */
+    admits() {
         return false;
     }
 }
-exports.Scheme = Scheme;
 //# sourceMappingURL=Scheme.js.map

package/transpiled/directives/auth/Scheme.js.map

@@ -1 +1 @@
-{"version":3,"file":"Scheme.js","sourceRoot":"","sources":["../../../source/directives/auth/Scheme.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAkC;AAElC,mCAA+B;AAE/B,MAAa,MAAM;IACA,MAAM,CAAQ;IACd,MAAM,CAAQ;IAE/B,YAAoB,MAAc;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC;IAEM,SAAS,CAAE,CAAkB,EAAE,KAAY;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YAC3C,OAAO,KAAK,CAAA;QAEd,MAAM,CAAC,MAAM,CAAC,GAAG,IAAA,aAAK,EAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAEnD,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YACxB,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;gBAClC,6DAA6D,CAAC,CAAA;QAElE,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AArBD,wBAqBC"}
+{"version":3,"file":"Scheme.js","sourceRoot":"","sources":["../../../source/directives/auth/Scheme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAElC,MAAM,OAAO,MAAM;IACA,MAAM,CAAQ;IACd,MAAM,CAAQ;IAE/B,YAAmB,MAAc;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC;IAEM,SAAS,CAAC,CAAkB,EAAE,OAAgB;QACnD,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAErE,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAE7D,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YACxB,MAAM,IAAI,IAAI,CAAC,SAAS,CACtB,IAAI,CAAC,MAAM,GAAG,4DAA4D,CAC3E,CAAA;QAEH,OAAO,KAAK,CAAA;IACd,CAAC;IAED,8EAA8E;IACvE,MAAM;QACX,OAAO,KAAK,CAAA;IACd,CAAC;CACF"}

package/transpiled/directives/auth/create.d.ts

@@ -0,0 +1,2 @@
+import type { Identity } from './types.js';
+export declare function create(credentials?: string): Identity;

package/transpiled/directives/auth/create.js

@@ -0,0 +1,10 @@
+import { newid } from '@toa.io/generic';
+export function create(credentials) {
+    return {
+        id: newid(),
+        scheme: credentials?.split(' ')[0] ?? null,
+        refresh: false,
+        roles: []
+    };
+}
+//# sourceMappingURL=create.js.map

package/transpiled/directives/auth/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../source/directives/auth/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAGvC,MAAM,UAAU,MAAM,CAAC,WAAoB;IACzC,OAAO;QACL,EAAE,EAAE,KAAK,EAAE;QACX,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;QAC1C,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE;KACV,CAAA;AACH,CAAC"}

package/transpiled/directives/auth/index.d.ts

@@ -1,2 +1,2 @@
-import { Authorization } from './Authorization';
+import { Authorization } from './Authorization.js';
 export declare const authorization: Authorization;

package/transpiled/directives/auth/index.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorization = void 0;
-const Authorization_1 = require("./Authorization");
-exports.authorization = new Authorization_1.Authorization();
+import { Authorization } from './Authorization.js';
+export const authorization = new Authorization();
 //# sourceMappingURL=index.js.map

package/transpiled/directives/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../source/directives/auth/index.ts"],"names":[],"mappings":";;;AAAA,mDAA+C;AAElC,QAAA,aAAa,GAAG,IAAI,6BAAa,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../source/directives/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAA"}

package/transpiled/directives/auth/schemes.d.ts

@@ -1,3 +1,26 @@
-import { type Remote, type Scheme } from './types';
-export declare const PROVIDERS: Record<Scheme, Remote>;
-export declare const PRIMARY: Scheme;
+import type { Remote, Scheme } from './types.js';
+/**
+ * The providers of a scheme, in the order they are asked. More than one claims `Bearer`:
+ * an OpenID `id_token` is federated, and a token this gateway issued is presented that way
+ * by an OAuth client. Which of them a credential belongs to is each provider's own to say,
+ * so the order here is only which is asked first.
+ */
+export declare const PROVIDERS: Record<Scheme, Remote[]>;
+export declare const INCEPTION: Remote[];
+export declare const PRIMARY: Remote;
+/**
+ * The providers of a scheme, or nothing for a scheme that is not one — including a name a
+ * plain object answers on its own, like `constructor`.
+ */
+export declare function providers(scheme: string): Remote[] | undefined;
+/**
+ * What a provider answers when the credentials are not of its kind. The next provider of
+ * the scheme is asked; a provider that declines has done nothing, so asking is free of
+ * effect — which asking one that rejects would not be.
+ */
+export declare const UNRECOGNIZED = "UNRECOGNIZED";
+/**
+ * The rejection of credentials that are verifiable and owned by no identity: the one
+ * inception goes ahead with.
+ */
+export declare const UNKNOWN = "NOT_FOUND";

package/transpiled/directives/auth/schemes.js

@@ -1,10 +1,34 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PRIMARY = exports.PROVIDERS = void 0;
-exports.PROVIDERS = {
-    basic: 'basic',
-    token: 'tokens',
-    bearer: 'federation'
+/**
+ * The providers of a scheme, in the order they are asked. More than one claims `Bearer`:
+ * an OpenID `id_token` is federated, and a token this gateway issued is presented that way
+ * by an OAuth client. Which of them a credential belongs to is each provider's own to say,
+ * so the order here is only which is asked first.
+ */
+export const PROVIDERS = {
+    basic: ['basic'],
+    token: ['tokens'],
+    bearer: ['tokens', 'federation'],
+    code: ['federation'],
+    otp: ['otp']
 };
-exports.PRIMARY = 'token';
+export const INCEPTION = ['basic', 'federation'];
+export const PRIMARY = 'tokens';
+/**
+ * The providers of a scheme, or nothing for a scheme that is not one — including a name a
+ * plain object answers on its own, like `constructor`.
+ */
+export function providers(scheme) {
+    return Object.hasOwn(PROVIDERS, scheme) ? PROVIDERS[scheme] : undefined;
+}
+/**
+ * What a provider answers when the credentials are not of its kind. The next provider of
+ * the scheme is asked; a provider that declines has done nothing, so asking is free of
+ * effect — which asking one that rejects would not be.
+ */
+export const UNRECOGNIZED = 'UNRECOGNIZED';
+/**
+ * The rejection of credentials that are verifiable and owned by no identity: the one
+ * inception goes ahead with.
+ */
+export const UNKNOWN = 'NOT_FOUND';
 //# sourceMappingURL=schemes.js.map

package/transpiled/directives/auth/schemes.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemes.js","sourceRoot":"","sources":["../../../source/directives/auth/schemes.ts"],"names":[],"mappings":";;;AAEa,QAAA,SAAS,GAA2B;IAC/C,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,YAAY;CACrB,CAAA;AAEY,QAAA,OAAO,GAAW,OAAO,CAAA"}
+{"version":3,"file":"schemes.js","sourceRoot":"","sources":["../../../source/directives/auth/schemes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAA6B;IACjD,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,KAAK,EAAE,CAAC,QAAQ,CAAC;IACjB,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,IAAI,EAAE,CAAC,YAAY,CAAC;IACpB,GAAG,EAAE,CAAC,KAAK,CAAC;CACb,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;AAC1D,MAAM,CAAC,MAAM,OAAO,GAAW,QAAQ,CAAA;AAEvC;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAA"}

package/transpiled/directives/auth/split.d.ts

@@ -1,2 +1,2 @@
-import { type Scheme } from './types';
+import { type Scheme } from './types.js';
 export declare function split(authorization: string): [Scheme, string];

package/transpiled/directives/auth/split.js

@@ -1,38 +1,11 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.split = void 0;
-const http = __importStar(require("../../HTTP"));
-function split(authorization) {
+import * as http from '../../HTTP/index.js';
+export function split(authorization) {
     const space = authorization.indexOf(' ');
     if (space === -1)
-        throw new http.Unauthorized('Malformed authorization header.');
+        throw new http.Unauthorized('Malformed authorization header');
     const Scheme = authorization.slice(0, space);
     const scheme = Scheme.toLowerCase();
     const value = authorization.slice(space + 1);
     return [scheme, value];
 }
-exports.split = split;
 //# sourceMappingURL=split.js.map

package/transpiled/directives/auth/split.js.map

@@ -1 +1 @@
-{"version":3,"file":"split.js","sourceRoot":"","sources":["../../../source/directives/auth/split.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAkC;AAGlC,SAAgB,KAAK,CAAE,aAAqB;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,KAAK,KAAK,CAAC,CAAC;QACd,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,iCAAiC,CAAC,CAAA;IAEhE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAY,CAAA;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAE5C,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAXD,sBAWC"}
+{"version":3,"file":"split.js","sourceRoot":"","sources":["../../../source/directives/auth/split.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAG3C,MAAM,UAAU,KAAK,CAAC,aAAqB;IACzC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAA;IAE/E,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAY,CAAA;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAE5C,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC"}

package/transpiled/directives/auth/types.d.ts

@@ -1,31 +1,61 @@
 import { type Component } from '@toa.io/core';
-import { type Maybe } from '@toa.io/types';
-import { type Parameter } from '../../RTD';
-import type * as http from '../../HTTP';
-import type * as io from '../../io';
+import type { Maybe } from '@toa.io/core/types';
+import { type Parameter } from '../../RTD/index.js';
+import type { Introspection } from '../../Introspection.js';
+import type * as http from '../../HTTP/index.js';
+import type * as io from '../../io.js';
 export interface Directive {
-    authorize: (identity: Identity | null, input: Input, parameters: Parameter[]) => boolean | Promise<boolean>;
-    reply?: (identity: Identity | null) => http.OutgoingMessage;
-    settle?: (request: Input, response: http.OutgoingMessage) => Promise<void>;
+    priority?: number;
+    authorize: (identity: Identity | null, context: Context, parameters: Parameter[]) => boolean | Promise<boolean>;
+    /**
+     * Whether this admits the identity where that can be told without a request — which is
+     * what describing a method is. `undefined` says it cannot be told: a directive reading a
+     * route variable's value or the body has neither here, and one that is not implemented
+     * says the same by its absence. Nothing here may have an effect on the request.
+     */
+    admits?: (identity: Identity | null, context: Context) => boolean | undefined | Promise<boolean | undefined>;
+    /**
+     * What this directive makes of what the method says about itself, which is the reverse of
+     * what it does to a request: a property it fills from the identity is taken out of the
+     * input, because it is not the caller's to send — and a description that offers one invites
+     * a caller to name an identity that is not theirs. Nothing here may have an effect on the
+     * request.
+     */
+    describe?: (introspection: Introspection) => Introspection;
+    reply?: (context: Context) => http.OutgoingMessage | null;
+    settle?: (context: Context, response: http.OutgoingMessage) => Promise<void>;
 }
 export interface Identity {
     readonly id: string;
-    scheme: string;
     roles?: string[];
+    permissions?: Record<string, string[]>;
+    /**
+     * Resource URIs this credential may be presented at. Absent on a session token.
+     * Checked against the outer request, not a procedure a request forks.
+     */
+    aud?: string[];
+    scheme: string | null;
+    /** The component that verified the credentials; none for a transient identity. */
+    provider?: Remote;
     refresh: boolean;
 }
 export interface Extension {
     identity: Identity | null;
+    /** the error code the presented credentials were rejected with, when they were */
+    rejection?: string;
+    /** whether the identity was checked against the bans while being resolved */
+    vetted?: boolean;
 }
 export interface Ban {
     banned: boolean;
 }
-export type Input = io.Input & Extension;
+export type Context = io.Input & Extension;
 export type AuthenticationResult = Maybe<{
     identity: Identity;
     refresh: boolean;
 }>;
-export type Scheme = 'basic' | 'token' | 'bearer';
-export type Remote = 'basic' | 'federation' | 'tokens' | 'roles' | 'bans';
+export type Scheme = 'basic' | 'token' | 'bearer' | 'code' | 'otp';
+export type Remote = 'basic' | 'federation' | 'tokens' | 'roles' | 'bans' | 'otp';
 export type Discovery = Record<Remote, Promise<Component>>;
-export type Schemes = Record<Scheme, Component>;
+export type Components = Partial<Record<Remote, Component>>;
+export type Create = (name: string, value: any, ...args: any[]) => Directive;

package/transpiled/directives/auth/types.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+export {};
 //# sourceMappingURL=types.js.map

package/transpiled/directives/cache/Cache.d.ts

@@ -1,11 +1,11 @@
-import type { Input, Output } from '../../io';
-import type { Directive } from './types';
-import type { Family } from '../../Directive';
-import type * as http from '../../HTTP';
-export declare class Cache implements Family<Directive> {
+import type { Output } from '../../io.js';
+import type { AuthenticatedContext, Directive } from './types.js';
+import type { DirectiveFamily } from '../../RTD/index.js';
+import type * as http from '../../HTTP/index.js';
+export declare class Cache implements DirectiveFamily<Directive> {
     readonly name: string;
     readonly mandatory: boolean;
     create(name: string, value: any): Directive;
-    preflight(): Output;
-    settle(directives: Directive[], request: Input, response: http.OutgoingMessage): Promise<void>;
+    precall(): Output;
+    settle(directives: Directive[], context: AuthenticatedContext, response: http.OutgoingMessage): Promise<void>;
 }

package/transpiled/directives/cache/Cache.js

@@ -1,28 +1,68 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Cache = void 0;
-const Control_1 = require("./Control");
-const Exact_1 = require("./Exact");
-class Cache {
+import { Control } from './Control.js';
+import { Exact } from './Exact.js';
+import { matches, tag } from './etag.js';
+export class Cache {
     name = 'cache';
-    mandatory = false;
+    mandatory = true;
     create(name, value) {
         const Class = constructors[name];
         if (Class === undefined)
-            throw new Error(`Directive '${name}' is not provided by the '${this.name}' family.`);
+            throw new Error(`Directive 'cache:${name}' is not implemented`);
         return new Class(value);
     }
-    preflight() {
+    precall() {
         return null;
     }
-    async settle(directives, request, response) {
+    async settle(directives, context, response) {
+        const directive = directives[0];
+        const method = context.request.method;
+        const safe = method === 'GET' || method === 'HEAD';
         response.headers ??= new Headers();
-        directives[0]?.set(request, response.headers);
+        validate(context, response, response.headers, safe);
+        // `cache:exact` sets what it is given, whatever the method: whether a reply may be
+        // stored at all is not a question about the method's cacheability, and a token
+        // endpoint answers a POST it must not have kept
+        if (directive instanceof Exact) {
+            directive.set(context, response.headers);
+            return;
+        }
+        if (!safe)
+            return;
+        if (directive === undefined) {
+            if (context.identity !== null && !Control.disabled(response.headers)) {
+                response.headers.set('cache-control', 'private');
+                response.headers.append('vary', 'authorization');
+            }
+        }
+        else
+            directive.set(context, response.headers);
     }
 }
-exports.Cache = Cache;
+/**
+ * The validators a reply carries: the timestamp as `last-modified`, whatever the method, and
+ * on a safe one the version as its `etag`. A client that sends the tag back in `if-none-match`
+ * already has the representation and is told so, with the tag as it sent it. A reply without
+ * a version has no tag: nothing identifies it but its body, and hashing that on every reply
+ * is what a version is for.
+ */
+// eslint-disable-next-line max-params
+function validate(context, response, headers, safe) {
+    const { version, modified } = response;
+    if (modified !== undefined)
+        headers.set('last-modified', new Date(modified).toUTCString());
+    if (version === undefined || !safe)
+        return;
+    const sent = context.request.headers['if-none-match'];
+    if (sent !== undefined && matches(sent, version)) {
+        response.status = 304;
+        response.body = undefined;
+        headers.set('etag', sent);
+    }
+    else
+        headers.set('etag', tag(version));
+}
 const constructors = {
-    control: Control_1.Control,
-    exact: Exact_1.Exact
+    control: Control,
+    exact: Exact
 };
 //# sourceMappingURL=Cache.js.map

package/transpiled/directives/cache/Cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"Cache.js","sourceRoot":"","sources":["../../../source/directives/cache/Cache.ts"],"names":[],"mappings":";;;AAAA,uCAAmC;AACnC,mCAA+B;AAM/B,MAAa,KAAK;IACA,IAAI,GAAW,OAAO,CAAA;IACtB,SAAS,GAAY,KAAK,CAAA;IAEnC,MAAM,CAAE,IAAY,EAAE,KAAU;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,6BAA6B,IAAI,CAAC,IAAI,WAAW,CAAC,CAAA;QAEtF,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK,CAAC,MAAM,CAClB,UAAuB,EAAE,OAAc,EAAE,QAA8B;QACtE,QAAQ,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAA;QAClC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC/C,CAAC;CACF;AAtBD,sBAsBC;AAED,MAAM,YAAY,GAAkD;IAClE,OAAO,EAAE,iBAAO;IAChB,KAAK,EAAE,aAAK;CACb,CAAA"}
+{"version":3,"file":"Cache.js","sourceRoot":"","sources":["../../../source/directives/cache/Cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAMxC,MAAM,OAAO,KAAK;IACA,IAAI,GAAW,OAAO,CAAA;IACtB,SAAS,GAAY,IAAI,CAAA;IAElC,MAAM,CAAC,IAAY,EAAE,KAAU;QACpC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,sBAAsB,CAAC,CAAA;QAEjE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEM,OAAO;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,UAAuB,EACvB,OAA6B,EAC7B,QAA8B;QAE9B,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAA;QAElD,QAAQ,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAA;QAElC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAEnD,mFAAmF;QACnF,+EAA+E;QAC/E,gDAAgD;QAChD,IAAI,SAAS,YAAY,KAAK,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;YAExC,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAI;YAAE,OAAM;QAEjB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;gBAChD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;YAClD,CAAC;QACH,CAAC;;YAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC;CACF;AAED;;;;;;GAMG;AACH,sCAAsC;AACtC,SAAS,QAAQ,CACf,OAA6B,EAC7B,QAA8B,EAC9B,OAAgB,EAChB,IAAa;IAEb,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;IAEtC,IAAI,QAAQ,KAAK,SAAS;QACxB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IAEhE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI;QAAE,OAAM;IAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAErD,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAA;QACrB,QAAQ,CAAC,IAAI,GAAG,SAAS,CAAA;QACzB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3B,CAAC;;QAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,YAAY,GAAkD;IAClE,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,KAAK;CACb,CAAA"}