@tribe-nest/media-protocol 1.0.0

package/build/mp-build/claims.d.ts

@@ -0,0 +1,299 @@
+import { z } from "zod";
+/**
+ * The join token's claims: the whole authorization decision, made once by the
+ * backend and carried to a media plane that never asks it anything.
+ *
+ * Names here were contested by the parallel phase plans; each disagreement is
+ * resolved once, in this file, and everything else imports it.
+ */
+/**
+ * `iss` IS the instance id (`legal-de`, `main`), not a service name.
+ *
+ * One plan proposed `iss: "tribenest-backend"` with the instance in a separate
+ * `inst` claim. That displaces the one value a verifier actually checks, and a
+ * legal-de token would then verify happily on the main instance - which is the
+ * whole reason instances are separate.
+ */
+export declare const mediaJoinClaimsSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    iss: z.ZodString;
+    aud: z.ZodLiteral<"media">;
+    room: z.ZodString;
+    /** `identity`, not `sub`: it is a first-class concept the barrier rules name. */
+    identity: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    /** Top level, NOT inside grants - it decides what may be minted at all. */
+    kind: z.ZodEnum<["human", "agent", "egress", "sip", "ingress"]>;
+    /** Top level. Transport authority is not media authority. */
+    transport: z.ZodEnum<["webrtc", "plain", "pipe"]>;
+    grants: z.ZodObject<{
+        canPublish: z.ZodBoolean;
+        canSubscribe: z.ZodBoolean;
+        canPublishData: z.ZodBoolean;
+        subscribe: z.ZodOptional<z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+            mode: z.ZodLiteral<"all">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "all";
+        }, {
+            mode: "all";
+        }>, z.ZodObject<{
+            mode: z.ZodLiteral<"none">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "none";
+        }, {
+            mode: "none";
+        }>, z.ZodObject<{
+            mode: z.ZodLiteral<"allow">;
+            identities: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "allow";
+            identities: string[];
+        }, {
+            mode: "allow";
+            identities: string[];
+        }>, z.ZodObject<{
+            mode: z.ZodLiteral<"deny">;
+            identities: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "deny";
+            identities: string[];
+        }, {
+            mode: "deny";
+            identities: string[];
+        }>]>>;
+        visibleTo: z.ZodOptional<z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+            mode: z.ZodLiteral<"all">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "all";
+        }, {
+            mode: "all";
+        }>, z.ZodObject<{
+            mode: z.ZodLiteral<"none">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "none";
+        }, {
+            mode: "none";
+        }>, z.ZodObject<{
+            mode: z.ZodLiteral<"allow">;
+            identities: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "allow";
+            identities: string[];
+        }, {
+            mode: "allow";
+            identities: string[];
+        }>, z.ZodObject<{
+            mode: z.ZodLiteral<"deny">;
+            identities: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "deny";
+            identities: string[];
+        }, {
+            mode: "deny";
+            identities: string[];
+        }>]>>;
+        publishKinds: z.ZodOptional<z.ZodArray<z.ZodEnum<["audio", "video", "screen"]>, "many">>;
+        subscribeExempt: z.ZodOptional<z.ZodBoolean>;
+        maxSubscriptions: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        canPublish: boolean;
+        canSubscribe: boolean;
+        canPublishData: boolean;
+        subscribe?: {
+            mode: "all";
+        } | {
+            mode: "none";
+        } | {
+            mode: "allow";
+            identities: string[];
+        } | {
+            mode: "deny";
+            identities: string[];
+        } | undefined;
+        visibleTo?: {
+            mode: "all";
+        } | {
+            mode: "none";
+        } | {
+            mode: "allow";
+            identities: string[];
+        } | {
+            mode: "deny";
+            identities: string[];
+        } | undefined;
+        publishKinds?: ("audio" | "video" | "screen")[] | undefined;
+        subscribeExempt?: boolean | undefined;
+        maxSubscriptions?: number | undefined;
+    }, {
+        canPublish: boolean;
+        canSubscribe: boolean;
+        canPublishData: boolean;
+        subscribe?: {
+            mode: "all";
+        } | {
+            mode: "none";
+        } | {
+            mode: "allow";
+            identities: string[];
+        } | {
+            mode: "deny";
+            identities: string[];
+        } | undefined;
+        visibleTo?: {
+            mode: "all";
+        } | {
+            mode: "none";
+        } | {
+            mode: "allow";
+            identities: string[];
+        } | {
+            mode: "deny";
+            identities: string[];
+        } | undefined;
+        publishKinds?: ("audio" | "video" | "screen")[] | undefined;
+        subscribeExempt?: boolean | undefined;
+        maxSubscriptions?: number | undefined;
+    }>;
+    jti: z.ZodString;
+    iat: z.ZodNumber;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    exp: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    v: 1;
+    iss: string;
+    aud: "media";
+    room: string;
+    identity: string;
+    kind: "human" | "agent" | "egress" | "sip" | "ingress";
+    transport: "webrtc" | "plain" | "pipe";
+    grants: {
+        canPublish: boolean;
+        canSubscribe: boolean;
+        canPublishData: boolean;
+        subscribe?: {
+            mode: "all";
+        } | {
+            mode: "none";
+        } | {
+            mode: "allow";
+            identities: string[];
+        } | {
+            mode: "deny";
+            identities: string[];
+        } | undefined;
+        visibleTo?: {
+            mode: "all";
+        } | {
+            mode: "none";
+        } | {
+            mode: "allow";
+            identities: string[];
+        } | {
+            mode: "deny";
+            identities: string[];
+        } | undefined;
+        publishKinds?: ("audio" | "video" | "screen")[] | undefined;
+        subscribeExempt?: boolean | undefined;
+        maxSubscriptions?: number | undefined;
+    };
+    jti: string;
+    iat: number;
+    exp: number;
+    name?: string | undefined;
+    nbf?: number | undefined;
+}, {
+    v: 1;
+    iss: string;
+    aud: "media";
+    room: string;
+    identity: string;
+    kind: "human" | "agent" | "egress" | "sip" | "ingress";
+    transport: "webrtc" | "plain" | "pipe";
+    grants: {
+        canPublish: boolean;
+        canSubscribe: boolean;
+        canPublishData: boolean;
+        subscribe?: {
+            mode: "all";
+        } | {
+            mode: "none";
+        } | {
+            mode: "allow";
+            identities: string[];
+        } | {
+            mode: "deny";
+            identities: string[];
+        } | undefined;
+        visibleTo?: {
+            mode: "all";
+        } | {
+            mode: "none";
+        } | {
+            mode: "allow";
+            identities: string[];
+        } | {
+            mode: "deny";
+            identities: string[];
+        } | undefined;
+        publishKinds?: ("audio" | "video" | "screen")[] | undefined;
+        subscribeExempt?: boolean | undefined;
+        maxSubscriptions?: number | undefined;
+    };
+    jti: string;
+    iat: number;
+    exp: number;
+    name?: string | undefined;
+    nbf?: number | undefined;
+}>;
+export type MediaJoinClaims = z.infer<typeof mediaJoinClaimsSchema>;
+/**
+ * Server-to-server control calls (create room, end room, attach an agent).
+ *
+ * A separate audience so a join token can never be replayed as a control call.
+ * It carries no room, identity, kind, transport or grants: a control caller is
+ * not a participant, and giving it participant-shaped claims invites code that
+ * treats it as one.
+ */
+export declare const mediaControlClaimsSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    iss: z.ZodString;
+    aud: z.ZodLiteral<"control">;
+    jti: z.ZodString;
+    iat: z.ZodNumber;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    exp: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    v: 1;
+    iss: string;
+    aud: "control";
+    jti: string;
+    iat: number;
+    exp: number;
+    nbf?: number | undefined;
+}, {
+    v: 1;
+    iss: string;
+    aud: "control";
+    jti: string;
+    iat: number;
+    exp: number;
+    nbf?: number | undefined;
+}>;
+export type MediaControlClaims = z.infer<typeof mediaControlClaimsSchema>;
+/**
+ * Why a token was refused.
+ *
+ * Deliberately granular for the SERVER's logs and deliberately NOT returned to
+ * the client, which gets `unauthorized` and nothing else. Telling a caller
+ * whether the signature or the room was wrong is an oracle.
+ */
+export type JoinTokenRejection = "malformed" | "unknown_kid" | "bad_signature" | "expired" | "not_yet_valid" | "ttl_too_long" | "wrong_audience" | "wrong_issuer" | "wrong_room" | "bad_claims";
+export type VerifyResult<T> = {
+    ok: true;
+    claims: T;
+    kid: string;
+} | {
+    ok: false;
+    reason: JoinTokenRejection;
+};
+//# sourceMappingURL=claims.d.ts.map

package/build/mp-build/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;;IAM9B,iFAAiF;;;IAGjF,2EAA2E;;IAE3E,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQtD,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;EAU1B,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,aAAa,GACb,eAAe,GACf,SAAS,GACT,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,YAAY,GACZ,YAAY,CAAC;AAEjB,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC"}

package/build/mp-build/claims.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mediaControlClaimsSchema = exports.mediaJoinClaimsSchema = void 0;
+const zod_1 = require("zod");
+const grants_1 = require("./grants");
+/**
+ * The join token's claims: the whole authorization decision, made once by the
+ * backend and carried to a media plane that never asks it anything.
+ *
+ * Names here were contested by the parallel phase plans; each disagreement is
+ * resolved once, in this file, and everything else imports it.
+ */
+/**
+ * `iss` IS the instance id (`legal-de`, `main`), not a service name.
+ *
+ * One plan proposed `iss: "tribenest-backend"` with the instance in a separate
+ * `inst` claim. That displaces the one value a verifier actually checks, and a
+ * legal-de token would then verify happily on the main instance - which is the
+ * whole reason instances are separate.
+ */
+exports.mediaJoinClaimsSchema = zod_1.z
+    .object({
+    v: zod_1.z.literal(1),
+    iss: zod_1.z.string().min(1),
+    aud: zod_1.z.literal("media"),
+    room: zod_1.z.string().min(1).max(200),
+    /** `identity`, not `sub`: it is a first-class concept the barrier rules name. */
+    identity: zod_1.z.string().min(1).max(200),
+    name: zod_1.z.string().max(200).optional(),
+    /** Top level, NOT inside grants - it decides what may be minted at all. */
+    kind: grants_1.participantKindSchema,
+    /** Top level. Transport authority is not media authority. */
+    transport: grants_1.transportKindSchema,
+    grants: grants_1.mediaGrantsSchema,
+    jti: zod_1.z.string().min(8),
+    iat: zod_1.z.number().int().positive(),
+    nbf: zod_1.z.number().int().positive().optional(),
+    exp: zod_1.z.number().int().positive(),
+})
+    .strict();
+/**
+ * Server-to-server control calls (create room, end room, attach an agent).
+ *
+ * A separate audience so a join token can never be replayed as a control call.
+ * It carries no room, identity, kind, transport or grants: a control caller is
+ * not a participant, and giving it participant-shaped claims invites code that
+ * treats it as one.
+ */
+exports.mediaControlClaimsSchema = zod_1.z
+    .object({
+    v: zod_1.z.literal(1),
+    iss: zod_1.z.string().min(1),
+    aud: zod_1.z.literal("control"),
+    jti: zod_1.z.string().min(8),
+    iat: zod_1.z.number().int().positive(),
+    nbf: zod_1.z.number().int().positive().optional(),
+    exp: zod_1.z.number().int().positive(),
+})
+    .strict();
+//# sourceMappingURL=claims.js.map

package/build/mp-build/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,qCAAyF;AAEzF;;;;;;GAMG;AAEH;;;;;;;GAOG;AACU,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,CAAC,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,OAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,iFAAiF;IACjF,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,2EAA2E;IAC3E,IAAI,EAAE,8BAAqB;IAC3B,6DAA6D;IAC7D,SAAS,EAAE,4BAAmB;IAC9B,MAAM,EAAE,0BAAiB;IACzB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;;;;GAOG;AACU,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,CAAC,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,OAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/build/mp-build/errorSchema.d.ts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+/**
+ * Separate from `errors.ts` so that file stays a plain union with no zod
+ * import, and so `frames.ts` can validate a code without a circular import
+ * through the error class.
+ */
+export declare const mediaErrorCodeSchema: z.ZodEnum<["unauthorized", "replayed", "protocol_version", "forbidden_transport", "forbidden", "not_subscribable", "subscription_limit", "room_closed", "no_such_room", "no_such_producer", "no_such_transport", "duplicate_identity", "node_draining", "capacity", "bad_request", "internal"]>;
+//# sourceMappingURL=errorSchema.d.ts.map

package/build/mp-build/errorSchema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorSchema.d.ts","sourceRoot":"","sources":["../src/errorSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,iSAA4B,CAAC"}

package/build/mp-build/errorSchema.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mediaErrorCodeSchema = void 0;
+const zod_1 = require("zod");
+const errors_1 = require("./errors");
+/**
+ * Separate from `errors.ts` so that file stays a plain union with no zod
+ * import, and so `frames.ts` can validate a code without a circular import
+ * through the error class.
+ */
+exports.mediaErrorCodeSchema = zod_1.z.enum(errors_1.MEDIA_ERROR_CODES);
+//# sourceMappingURL=errorSchema.js.map

package/build/mp-build/errorSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorSchema.js","sourceRoot":"","sources":["../src/errorSchema.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,qCAA6C;AAE7C;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,IAAI,CAAC,0BAAiB,CAAC,CAAC"}

package/build/mp-build/errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Every way the media plane refuses, named once.
+ *
+ * A closed union rather than free-text messages, because three surfaces (the
+ * SDK, the harness, the egress client) branch on these, and a string compare
+ * against prose drifts the moment someone improves the wording.
+ */
+export declare const MEDIA_ERROR_CODES: readonly ["unauthorized", "replayed", "protocol_version", "forbidden_transport", "forbidden", "not_subscribable", "subscription_limit", "room_closed", "no_such_room", "no_such_producer", "no_such_transport", "duplicate_identity", "node_draining", "capacity", "bad_request", "internal"];
+export type MediaErrorCode = (typeof MEDIA_ERROR_CODES)[number];
+export declare class MediaError extends Error {
+    readonly code: MediaErrorCode;
+    /** Safe to show a user? Most of these are not. */
+    readonly retryable: boolean;
+    constructor(code: MediaErrorCode, message?: string, 
+    /** Safe to show a user? Most of these are not. */
+    retryable?: boolean);
+}
+//# sourceMappingURL=errors.d.ts.map

package/build/mp-build/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,+RAsBpB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAAE,cAAc;IAEpC,kDAAkD;aAClC,SAAS;gBAHT,IAAI,EAAE,cAAc,EACpC,OAAO,CAAC,EAAE,MAAM;IAChB,kDAAkD;IAClC,SAAS,UAAQ;CAKpC"}

package/build/mp-build/errors.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MediaError = exports.MEDIA_ERROR_CODES = void 0;
+/**
+ * Every way the media plane refuses, named once.
+ *
+ * A closed union rather than free-text messages, because three surfaces (the
+ * SDK, the harness, the egress client) branch on these, and a string compare
+ * against prose drifts the moment someone improves the wording.
+ */
+exports.MEDIA_ERROR_CODES = [
+    // token / session
+    "unauthorized", // token missing, malformed, or rejected
+    "replayed", // jti already consumed (a session concern, not a verifier one)
+    "protocol_version", // client and node disagree on MEDIA_PROTOCOL_VERSION
+    "forbidden_transport", // token's `transport` claim does not permit this transport kind
+    // authorization
+    "forbidden", // grants do not permit this operation
+    "not_subscribable", // maySubscribe said no - an information barrier, not an error
+    "subscription_limit", // maxSubscriptions or the active-set ceiling
+    // state
+    "room_closed",
+    "no_such_room",
+    "no_such_producer",
+    "no_such_transport",
+    "duplicate_identity", // that identity is already connected to this room
+    // capacity / lifecycle
+    "node_draining", // reconnect via the URL; the LB or a redirect will place you
+    "capacity",
+    // catch-alls
+    "bad_request",
+    "internal",
+];
+class MediaError extends Error {
+    code;
+    retryable;
+    constructor(code, message, 
+    /** Safe to show a user? Most of these are not. */
+    retryable = false) {
+        super(message ?? code);
+        this.code = code;
+        this.retryable = retryable;
+        this.name = "MediaError";
+    }
+}
+exports.MediaError = MediaError;
+//# sourceMappingURL=errors.js.map

package/build/mp-build/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACU,QAAA,iBAAiB,GAAG;IAC/B,kBAAkB;IAClB,cAAc,EAAW,wCAAwC;IACjE,UAAU,EAAe,+DAA+D;IACxF,kBAAkB,EAAO,qDAAqD;IAC9E,qBAAqB,EAAI,gEAAgE;IACzF,gBAAgB;IAChB,WAAW,EAAc,sCAAsC;IAC/D,kBAAkB,EAAO,8DAA8D;IACvF,oBAAoB,EAAK,6CAA6C;IACtE,QAAQ;IACR,aAAa;IACb,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,oBAAoB,EAAK,kDAAkD;IAC3E,uBAAuB;IACvB,eAAe,EAAU,6DAA6D;IACtF,UAAU;IACV,aAAa;IACb,aAAa;IACb,UAAU;CACF,CAAC;AAIX,MAAa,UAAW,SAAQ,KAAK;IAEjB;IAGA;IAJlB,YACkB,IAAoB,EACpC,OAAgB;IAChB,kDAAkD;IAClC,YAAY,KAAK;QAEjC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QALP,SAAI,GAAJ,IAAI,CAAgB;QAGpB,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAVD,gCAUC"}