@usearete/sdk 0.1.0

package/dist/ssr/nextjs-app.d.ts

@@ -0,0 +1,143 @@
+import { NextRequest } from 'next/server';
+
+/**
+ * Arete Auth Server - Drop-in Endpoint Handlers
+ *
+ * These are framework-agnostic API route handlers that users can mount however they like.
+ * They handle token minting and JWKS serving directly using Ed25519 signing.
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts (Next.js App Router)
+ * import { handleSessionRequest, handleJwksRequest } from '@usearete/sdk/ssr/handlers';
+ *
+ * export async function POST(request: Request) {
+ *   const user = await getAuthenticatedUser(request);
+ *   if (!user) return new Response('Unauthorized', { status: 401 });
+ *   return handleSessionRequest({}, user.id);
+ * }
+ *
+ * export async function GET() {
+ *   return handleJwksRequest();
+ * }
+ * ```
+ */
+interface AuthHandlerConfig {
+    /**
+     * Ed25519 signing key seed (base64-encoded, 32 bytes).
+     * Set ARETE_SIGNING_KEY env var OR pass here.
+     * Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+     */
+    signingKey?: string;
+    /**
+     * Optional: Pre-derived public key (base64-encoded, 32 bytes).
+     * If not provided, will be derived from the signing key.
+     */
+    publicKey?: string;
+    /**
+     * Token issuer (defaults to ARETE_ISSUER env var or 'arete')
+     */
+    issuer?: string;
+    /**
+     * Token audience (defaults to ARETE_AUDIENCE env var)
+     */
+    audience?: string;
+    /**
+     * Token TTL in seconds (defaults to 300 = 5 minutes)
+     */
+    ttlSeconds?: number;
+    /**
+     * Key ID for JWKS (defaults to 'key-1')
+     */
+    keyId?: string;
+    /**
+     * Custom limits for tokens
+     */
+    limits?: {
+        max_connections?: number;
+        max_subscriptions?: number;
+        max_snapshot_rows?: number;
+    };
+}
+interface TokenResponse {
+    token: string;
+    expires_at: number;
+}
+/**
+ * Authenticated session data resolved by framework adapters.
+ * Always derive this from verified server-side auth, never request headers.
+ */
+interface ResolvedSession {
+    subject: string;
+    scope?: string;
+}
+
+/**
+ * Next.js App Router integration for Arete Auth
+ *
+ * Drop-in route handlers for Next.js App Router.
+ * `resolveSession` must derive the subject from verified server-side auth.
+ * Never trust caller-supplied headers for identity or scope.
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts
+ * import { createNextJsSessionRoute, createNextJsJwksRoute } from '@usearete/sdk/ssr/nextjs-app';
+ *
+ * async function getAuthenticatedUser() {
+ *   // Return your verified server-side user/session here.
+ * }
+ *
+ * export const POST = createNextJsSessionRoute({
+ *   resolveSession: async () => {
+ *     const user = await getAuthenticatedUser();
+ *     if (!user) return null;
+ *     return { subject: user.id };
+ *   },
+ * });
+ * export const GET = createNextJsJwksRoute();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts (with custom config)
+ * import { createNextJsSessionRoute, createNextJsJwksRoute } from '@usearete/sdk/ssr/nextjs-app';
+ *
+ * export const POST = createNextJsSessionRoute({
+ *   signingKey: process.env.ARETE_SIGNING_KEY,
+ *   resolveSession: async () => {
+ *     const user = await getAuthenticatedUser();
+ *     if (!user) return null;
+ *     return { subject: user.id, scope: 'read' };
+ *   },
+ *   ttlSeconds: 600,
+ * });
+ *
+ * export const GET = createNextJsJwksRoute({
+ *   signingKey: process.env.ARETE_SIGNING_KEY,
+ * });
+ * ```
+ */
+
+interface NextJsSessionRouteConfig extends AuthHandlerConfig {
+    resolveSession?: (request: NextRequest) => Promise<ResolvedSession | null> | ResolvedSession | null;
+}
+/**
+ * Create a Next.js App Router POST handler for /ws/sessions
+ */
+declare function createNextJsSessionRoute(config?: NextJsSessionRouteConfig): (request: NextRequest) => Promise<Response>;
+/**
+ * Create a Next.js App Router GET handler for /.well-known/jwks.json
+ */
+declare function createNextJsJwksRoute(config?: AuthHandlerConfig): () => Promise<Response>;
+/**
+ * Create a combined route handler that supports both POST (sessions) and GET (JWKS)
+ * Mount at a single route like /api/arete/auth
+ */
+declare function createNextJsAuthRoute(config?: NextJsSessionRouteConfig): {
+    POST: (request: NextRequest) => Promise<Response>;
+    GET: () => Promise<Response>;
+};
+
+export { createNextJsAuthRoute, createNextJsJwksRoute, createNextJsSessionRoute };
+export type { AuthHandlerConfig, NextJsSessionRouteConfig, ResolvedSession, TokenResponse };

package/dist/ssr/nextjs-app.esm.js

@@ -0,0 +1,336 @@
+import * as ed25519 from '@noble/ed25519';
+
+/**
+ * Base64URL encoding/decoding utilities
+ */
+/**
+ * Encode Uint8Array to base64url string (RFC 4648)
+ */
+function encode(bytes) {
+    // Convert to regular base64
+    const base64 = Buffer.from(bytes).toString('base64');
+    // Convert to base64url: replace + with -, / with _, remove padding
+    return base64
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Decode base64url string to Uint8Array
+ */
+function decode(base64url) {
+    // Convert from base64url to regular base64
+    let base64 = base64url
+        .replace(/-/g, '+')
+        .replace(/_/g, '/');
+    // Add padding if needed
+    const padding = 4 - (base64.length % 4);
+    if (padding !== 4) {
+        base64 += '='.repeat(padding);
+    }
+    return new Uint8Array(Buffer.from(base64, 'base64'));
+}
+const base64url = {
+    encode,
+    decode,
+};
+
+/**
+ * Arete Auth Server - Drop-in Endpoint Handlers
+ *
+ * These are framework-agnostic API route handlers that users can mount however they like.
+ * They handle token minting and JWKS serving directly using Ed25519 signing.
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts (Next.js App Router)
+ * import { handleSessionRequest, handleJwksRequest } from '@usearete/sdk/ssr/handlers';
+ *
+ * export async function POST(request: Request) {
+ *   const user = await getAuthenticatedUser(request);
+ *   if (!user) return new Response('Unauthorized', { status: 401 });
+ *   return handleSessionRequest({}, user.id);
+ * }
+ *
+ * export async function GET() {
+ *   return handleJwksRequest();
+ * }
+ * ```
+ */
+/**
+ * Decode base64 to Uint8Array
+ */
+function decodeBase64(base64) {
+    const binary = Buffer.from(base64, 'base64');
+    return new Uint8Array(binary);
+}
+/**
+ * Encode Uint8Array to base64url
+ */
+function encodeBase64url(bytes) {
+    return base64url.encode(bytes);
+}
+/**
+ * Generate a key ID from public key bytes
+ */
+function deriveKeyId(publicKey) {
+    // Use first 8 bytes of public key as hex for kid
+    return Array.from(publicKey.slice(0, 8))
+        .map(b => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Create JWT header for Ed25519
+ */
+function createJwtHeader(keyId) {
+    const header = {
+        alg: 'EdDSA',
+        typ: 'JWT',
+        kid: keyId,
+    };
+    return encodeBase64url(new TextEncoder().encode(JSON.stringify(header)));
+}
+/**
+ * Create JWT payload from claims
+ */
+function createJwtPayload(claims) {
+    return encodeBase64url(new TextEncoder().encode(JSON.stringify(claims)));
+}
+/**
+ * Sign data with Ed25519
+ */
+async function signEd25519(data, privateKey) {
+    const messageBytes = new TextEncoder().encode(data);
+    return await ed25519.signAsync(messageBytes, privateKey);
+}
+/**
+ * Mint a session token using Ed25519 signing
+ * `subject` must come from verified server-side auth or trusted service code.
+ */
+async function mintSessionToken(config, subject = 'anonymous', scope = 'read', origin) {
+    const signingKeyBase64 = config.signingKey || process.env.ARETE_SIGNING_KEY;
+    if (!signingKeyBase64) {
+        throw new Error('ARETE_SIGNING_KEY not set. Generate with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'base64\'))"');
+    }
+    const privateKeyBytes = decodeBase64(signingKeyBase64);
+    if (privateKeyBytes.length !== 32) {
+        throw new Error(`Invalid signing key length: expected 32 bytes, got ${privateKeyBytes.length}. ` +
+            'Ed25519 signing key must be 32 bytes (base64-encoded).');
+    }
+    // Derive public key from private key
+    const publicKeyBytes = await ed25519.getPublicKeyAsync(privateKeyBytes);
+    const keyId = config.keyId || deriveKeyId(publicKeyBytes);
+    const issuer = config.issuer || process.env.ARETE_ISSUER || 'arete';
+    const audience = config.audience || process.env.ARETE_AUDIENCE || 'arete';
+    const ttlSeconds = config.ttlSeconds || 300;
+    const now = Math.floor(Date.now() / 1000);
+    const expiresAt = now + ttlSeconds;
+    const claims = {
+        iss: issuer,
+        sub: subject,
+        aud: audience,
+        iat: now,
+        nbf: now,
+        exp: expiresAt,
+        jti: crypto.randomUUID(),
+        scope,
+        metering_key: `meter:${subject}`,
+        key_class: 'secret',
+        limits: config.limits || {
+            max_connections: 10,
+            max_subscriptions: 100,
+            max_snapshot_rows: 1000,
+            max_messages_per_minute: 10000,
+            max_bytes_per_minute: 100 * 1024 * 1024,
+        },
+    };
+    // Add origin binding if provided
+    if (origin) {
+        claims.origin = origin;
+    }
+    // Create JWT
+    const header = createJwtHeader(keyId);
+    const payload = createJwtPayload(claims);
+    const signingInput = `${header}.${payload}`;
+    const signature = await signEd25519(signingInput, privateKeyBytes);
+    const signatureBase64 = encodeBase64url(signature);
+    const token = `${signingInput}.${signatureBase64}`;
+    return {
+        token,
+        expires_at: expiresAt,
+    };
+}
+/**
+ * Generate JWKS response from signing key
+ */
+async function generateJwks(config) {
+    const signingKeyBase64 = config.signingKey || process.env.ARETE_SIGNING_KEY;
+    const publicKeyBase64 = config.publicKey || process.env.ARETE_PUBLIC_KEY;
+    if (!signingKeyBase64 && !publicKeyBase64) {
+        return { keys: [] };
+    }
+    let publicKeyBytes;
+    if (publicKeyBase64) {
+        // Use provided public key
+        publicKeyBytes = decodeBase64(publicKeyBase64);
+        if (publicKeyBytes.length !== 32) {
+            throw new Error(`Invalid public key length: expected 32 bytes, got ${publicKeyBytes.length}`);
+        }
+    }
+    else {
+        // Derive public key from private key
+        const privateKeyBytes = decodeBase64(signingKeyBase64);
+        if (privateKeyBytes.length !== 32) {
+            throw new Error(`Invalid signing key length: expected 32 bytes, got ${privateKeyBytes.length}`);
+        }
+        publicKeyBytes = await ed25519.getPublicKeyAsync(privateKeyBytes);
+    }
+    const keyId = config.keyId ||
+        (publicKeyBase64 ? 'key-1' : deriveKeyId(publicKeyBytes));
+    return {
+        keys: [
+            {
+                kty: 'OKP',
+                crv: 'Ed25519',
+                kid: keyId,
+                use: 'sig',
+                alg: 'EdDSA',
+                x: encodeBase64url(publicKeyBytes),
+            },
+        ],
+    };
+}
+
+/**
+ * Next.js App Router integration for Arete Auth
+ *
+ * Drop-in route handlers for Next.js App Router.
+ * `resolveSession` must derive the subject from verified server-side auth.
+ * Never trust caller-supplied headers for identity or scope.
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts
+ * import { createNextJsSessionRoute, createNextJsJwksRoute } from '@usearete/sdk/ssr/nextjs-app';
+ *
+ * async function getAuthenticatedUser() {
+ *   // Return your verified server-side user/session here.
+ * }
+ *
+ * export const POST = createNextJsSessionRoute({
+ *   resolveSession: async () => {
+ *     const user = await getAuthenticatedUser();
+ *     if (!user) return null;
+ *     return { subject: user.id };
+ *   },
+ * });
+ * export const GET = createNextJsJwksRoute();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts (with custom config)
+ * import { createNextJsSessionRoute, createNextJsJwksRoute } from '@usearete/sdk/ssr/nextjs-app';
+ *
+ * export const POST = createNextJsSessionRoute({
+ *   signingKey: process.env.ARETE_SIGNING_KEY,
+ *   resolveSession: async () => {
+ *     const user = await getAuthenticatedUser();
+ *     if (!user) return null;
+ *     return { subject: user.id, scope: 'read' };
+ *   },
+ *   ttlSeconds: 600,
+ * });
+ *
+ * export const GET = createNextJsJwksRoute({
+ *   signingKey: process.env.ARETE_SIGNING_KEY,
+ * });
+ * ```
+ */
+/**
+ * Create a Next.js App Router POST handler for /ws/sessions
+ */
+function createNextJsSessionRoute(config = {}) {
+    return async function POST(request) {
+        const origin = request.headers.get('origin') || undefined;
+        try {
+            if (!config.resolveSession) {
+                return new Response(JSON.stringify({
+                    error: 'createNextJsSessionRoute requires resolveSession to derive the subject from authenticated server-side state',
+                }), {
+                    status: 500,
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                });
+            }
+            const session = await config.resolveSession(request);
+            if (!session) {
+                return new Response(JSON.stringify({
+                    error: 'Unauthorized',
+                }), {
+                    status: 401,
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                });
+            }
+            const tokenData = await mintSessionToken(config, session.subject, session.scope || 'read', origin);
+            return new Response(JSON.stringify(tokenData), {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+        catch (error) {
+            return new Response(JSON.stringify({
+                error: error instanceof Error ? error.message : 'Failed to mint token',
+            }), {
+                status: 500,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+    };
+}
+/**
+ * Create a Next.js App Router GET handler for /.well-known/jwks.json
+ */
+function createNextJsJwksRoute(config = {}) {
+    return async function GET() {
+        try {
+            const jwks = await generateJwks(config);
+            return new Response(JSON.stringify(jwks), {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+        catch (error) {
+            return new Response(JSON.stringify({
+                error: error instanceof Error ? error.message : 'Failed to generate JWKS',
+            }), {
+                status: 500,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+    };
+}
+/**
+ * Create a combined route handler that supports both POST (sessions) and GET (JWKS)
+ * Mount at a single route like /api/arete/auth
+ */
+function createNextJsAuthRoute(config = {}) {
+    return {
+        POST: createNextJsSessionRoute(config),
+        GET: createNextJsJwksRoute(config),
+    };
+}
+
+export { createNextJsAuthRoute, createNextJsJwksRoute, createNextJsSessionRoute };
+//# sourceMappingURL=nextjs-app.esm.js.map

package/dist/ssr/nextjs-app.esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs-app.esm.js","sources":["../../src/ssr/utils.ts","../../src/ssr/handlers.ts","../../src/ssr/nextjs-app.ts"],"sourcesContent":[null,null,null],"names":[],"mappings":";;AAAA;;AAEG;AAEH;;AAEG;AACG,SAAU,MAAM,CAAC,KAAiB,EAAA;;AAEtC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;;AAErD,IAAA,OAAO,MAAM;AACV,SAAA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;AACnB,SAAA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;AACnB,SAAA,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED;;AAEG;AACG,SAAU,MAAM,CAAC,SAAiB,EAAA;;IAEtC,IAAI,MAAM,GAAG,SAAS;AACnB,SAAA,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAClB,SAAA,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;;IAGtB,MAAM,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACxC,IAAA,IAAI,OAAO,KAAK,CAAC,EAAE;AACjB,QAAA,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KAC/B;AAED,IAAA,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAEM,MAAM,SAAS,GAAG;IACvB,MAAM;IACN,MAAM;CACP;;ACtCD;;;;;;;;;;;;;;;;;;;;;AAqBG;AAoGH;;AAEG;AACH,SAAS,YAAY,CAAC,MAAc,EAAA;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7C,IAAA,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;AAEG;AACH,SAAS,eAAe,CAAC,KAAiB,EAAA;AACxC,IAAA,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;AAEG;AACH,SAAS,WAAW,CAAC,SAAqB,EAAA;;AAExC,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrC,SAAA,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACzC,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;AAEG;AACH,SAAS,eAAe,CAAC,KAAa,EAAA;AACpC,IAAA,MAAM,MAAM,GAAG;AACb,QAAA,GAAG,EAAE,OAAO;AACZ,QAAA,GAAG,EAAE,KAAK;AACV,QAAA,GAAG,EAAE,KAAK;KACX,CAAC;AACF,IAAA,OAAO,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;AAEG;AACH,SAAS,gBAAgB,CAAC,MAAqB,EAAA;AAC7C,IAAA,OAAO,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;AAEG;AACH,eAAe,WAAW,CACxB,IAAY,EACZ,UAAsB,EAAA;IAEtB,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED;;;AAGG;AACI,eAAe,gBAAgB,CACpC,MAAyB,EACzB,OAAA,GAAkB,WAAW,EAC7B,KAAgB,GAAA,MAAM,EACtB,MAAe,EAAA;IAEf,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5E,IAAI,CAAC,gBAAgB,EAAE;AACrB,QAAA,MAAM,IAAI,KAAK,CACb,2HAA2H,CAC5H,CAAC;KACH;AAED,IAAA,MAAM,eAAe,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AACvD,IAAA,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE;AACjC,QAAA,MAAM,IAAI,KAAK,CACb,sDAAsD,eAAe,CAAC,MAAM,CAAI,EAAA,CAAA;AAChF,YAAA,wDAAwD,CACzD,CAAC;KACH;;IAGD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;AAE1D,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC;AACpE,IAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC;AAC1E,IAAA,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;AAE5C,IAAA,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1C,IAAA,MAAM,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC;AAEnC,IAAA,MAAM,MAAM,GAAkB;AAC5B,QAAA,GAAG,EAAE,MAAM;AACX,QAAA,GAAG,EAAE,OAAO;AACZ,QAAA,GAAG,EAAE,QAAQ;AACb,QAAA,GAAG,EAAE,GAAG;AACR,QAAA,GAAG,EAAE,GAAG;AACR,QAAA,GAAG,EAAE,SAAS;AACd,QAAA,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;QACxB,KAAK;QACL,YAAY,EAAE,CAAS,MAAA,EAAA,OAAO,CAAE,CAAA;AAChC,QAAA,SAAS,EAAE,QAAQ;AACnB,QAAA,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI;AACvB,YAAA,eAAe,EAAE,EAAE;AACnB,YAAA,iBAAiB,EAAE,GAAG;AACtB,YAAA,iBAAiB,EAAE,IAAI;AACvB,YAAA,uBAAuB,EAAE,KAAK;AAC9B,YAAA,oBAAoB,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;AACxC,SAAA;KACF,CAAC;;IAGF,IAAI,MAAM,EAAE;AACV,QAAA,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;KACxB;;AAGD,IAAA,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;AACtC,IAAA,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACzC,IAAA,MAAM,YAAY,GAAG,CAAA,EAAG,MAAM,CAAI,CAAA,EAAA,OAAO,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AACnE,IAAA,MAAM,eAAe,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;AAEnD,IAAA,MAAM,KAAK,GAAG,CAAA,EAAG,YAAY,CAAI,CAAA,EAAA,eAAe,EAAE,CAAC;IAEnD,OAAO;QACL,KAAK;AACL,QAAA,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC;AAED;;AAEG;AACI,eAAe,YAAY,CAAC,MAAyB,EAAA;IAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5E,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAEzE,IAAA,IAAI,CAAC,gBAAgB,IAAI,CAAC,eAAe,EAAE;AACzC,QAAA,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;KACrB;AAED,IAAA,IAAI,cAA0B,CAAC;IAE/B,IAAI,eAAe,EAAE;;AAEnB,QAAA,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAC/C,QAAA,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,KAAK,CACb,CAAA,kDAAA,EAAqD,cAAc,CAAC,MAAM,CAAE,CAAA,CAC7E,CAAC;SACH;KACF;SAAM;;AAEL,QAAA,MAAM,eAAe,GAAG,YAAY,CAAC,gBAAiB,CAAC,CAAC;AACxD,QAAA,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,KAAK,CACb,CAAA,mDAAA,EAAsD,eAAe,CAAC,MAAM,CAAE,CAAA,CAC/E,CAAC;SACH;QACD,cAAc,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;KACnE;AAED,IAAA,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK;AACxB,SAAC,eAAe,GAAG,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;IAE5D,OAAO;AACL,QAAA,IAAI,EAAE;AACJ,YAAA;AACE,gBAAA,GAAG,EAAE,KAAK;AACV,gBAAA,GAAG,EAAE,SAAS;AACd,gBAAA,GAAG,EAAE,KAAK;AACV,gBAAA,GAAG,EAAE,KAAK;AACV,gBAAA,GAAG,EAAE,OAAO;AACZ,gBAAA,CAAC,EAAE,eAAe,CAAC,cAAc,CAAC;AACnC,aAAA;AACF,SAAA;KACF,CAAC;AACJ;;AC3SA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CG;AAiBH;;AAEG;AACa,SAAA,wBAAwB,CAAC,MAAA,GAAmC,EAAE,EAAA;AAC5E,IAAA,OAAO,eAAe,IAAI,CAAC,OAAoB,EAAA;AAC7C,QAAA,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;AAE1D,QAAA,IAAI;AACF,YAAA,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE;AAC1B,gBAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,oBAAA,KAAK,EAAE,6GAA6G;AACrH,iBAAA,CAAC,EACF;AACE,oBAAA,MAAM,EAAE,GAAG;AACX,oBAAA,OAAO,EAAE;AACP,wBAAA,cAAc,EAAE,kBAAkB;AACnC,qBAAA;AACF,iBAAA,CACF,CAAC;aACH;YAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,EAAE;AACZ,gBAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,oBAAA,KAAK,EAAE,cAAc;AACtB,iBAAA,CAAC,EACF;AACE,oBAAA,MAAM,EAAE,GAAG;AACX,oBAAA,OAAO,EAAE;AACP,wBAAA,cAAc,EAAE,kBAAkB;AACnC,qBAAA;AACF,iBAAA,CACF,CAAC;aACH;AAED,YAAA,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;YAEnG,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;AAC7C,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,OAAO,EAAE;AACP,oBAAA,cAAc,EAAE,kBAAkB;AACnC,iBAAA;AACF,aAAA,CAAC,CAAC;SACJ;QAAC,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,gBAAA,KAAK,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,sBAAsB;AACvE,aAAA,CAAC,EACF;AACE,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,OAAO,EAAE;AACP,oBAAA,cAAc,EAAE,kBAAkB;AACnC,iBAAA;AACF,aAAA,CACF,CAAC;SACH;AACH,KAAC,CAAC;AACJ,CAAC;AAED;;AAEG;AACa,SAAA,qBAAqB,CAAC,MAAA,GAA4B,EAAE,EAAA;IAClE,OAAO,eAAe,GAAG,GAAA;AACvB,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AACxC,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,OAAO,EAAE;AACP,oBAAA,cAAc,EAAE,kBAAkB;AACnC,iBAAA;AACF,aAAA,CAAC,CAAC;SACJ;QAAC,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,gBAAA,KAAK,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,yBAAyB;AAC1E,aAAA,CAAC,EACF;AACE,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,OAAO,EAAE;AACP,oBAAA,cAAc,EAAE,kBAAkB;AACnC,iBAAA;AACF,aAAA,CACF,CAAC;SACH;AACH,KAAC,CAAC;AACJ,CAAC;AAED;;;AAGG;AACa,SAAA,qBAAqB,CAAC,MAAA,GAAmC,EAAE,EAAA;IACzE,OAAO;AACL,QAAA,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC;AACtC,QAAA,GAAG,EAAE,qBAAqB,CAAC,MAAM,CAAC;KACnC,CAAC;AACJ;;;;"}