euclid-ndk 0.2.0

package/dist/modules/eam.d.ts

@@ -0,0 +1,314 @@
+/**
+ * EAM - euclid's access management module: login, users, groups, accounts, namespaces, keys.
+ *
+ * Two objects. {@link EuclidEam} is the login builder: it collects the server, the credentials and
+ * the options, and hands back a session. {@link EuclidSession} is that session - the authenticated
+ * client every other call goes through, and the thing that holds the token and the access key the
+ * login produced.
+ *
+ * The split exists because logging in and being logged in need different arguments. A builder that
+ * also carried the operations would let a caller write `.listUsers()` on an object that has not
+ * authenticated yet, and a session that also carried the login options would have a namespace field
+ * that means one thing before login and another after.
+ */
+import { type SigningScheme } from "../auth/index.js";
+import { type CachedCredentials } from "../credentials.js";
+import { type Account, type AccessKey, type CreateAccessKeyResult, type Namespace, type Page, type User, type UserGroup } from "../dto/eam.js";
+import { EuclidHttpClient, type HeaderFactory } from "../http/client.js";
+import { type ListOptions } from "./base.js";
+import { EuclidEag } from "./eag.js";
+import { EuclidEap } from "./eap.js";
+import { EuclidEkm } from "./ekm.js";
+import { EuclidEkv } from "./ekv.js";
+import { EuclidEns } from "./ens.js";
+import { EuclidEqs } from "./eqs.js";
+import { EuclidEsm } from "./esm.js";
+import { EuclidEss } from "./ess.js";
+export type { ListOptions } from "./base.js";
+export declare const TARGET = "eam";
+/**
+ * Authenticate with a signature when there is an access key to sign with, and with the bearer token
+ * otherwise. euclid accepts either for every action (`HttpActionServer::Authenticate`).
+ */
+export declare const AUTH_AUTO = "auto";
+/**
+ * Always sign. Fails loudly if the session has no access key, rather than quietly falling back to a
+ * token - which is what a caller who asked for signatures wants to know about.
+ */
+export declare const AUTH_SIGNATURE = "signature";
+/** Always present the bearer token, even when an access key is available. */
+export declare const AUTH_BEARER = "bearer";
+/** How a session authenticates: {@link AUTH_AUTO}, {@link AUTH_SIGNATURE} or {@link AUTH_BEARER}. */
+export type AuthMode = typeof AUTH_AUTO | typeof AUTH_SIGNATURE | typeof AUTH_BEARER;
+/** Everything {@link EuclidSession} needs to exist, which is what a login produces. */
+export interface SessionOptions {
+    baseUrl: string;
+    token: string;
+    userId: string;
+    accountId: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    isAdmin: boolean;
+    namespace: string;
+    raw: Record<string, unknown>;
+    caCertPath: string | null;
+    verify: boolean;
+    timeoutMs: number;
+    signingScheme: SigningScheme;
+    auth: AuthMode;
+    cache: boolean;
+}
+/**
+ * Builder for authenticating against a euclid server.
+ *
+ * ```ts
+ * const session = await EuclidEam.forServer("https://euclid.example.com")
+ *   .credentials("jens", "secret")
+ *   .login();
+ * ```
+ */
+export declare class EuclidEam {
+    #private;
+    constructor(baseUrl: string);
+    /** Targets a euclid server, e.g. `https://euclid.example.com`. */
+    static forServer(baseUrl: string): EuclidEam;
+    /** The user ID to log in as. */
+    username(username: string): this;
+    /**
+     * The email address to log in with, when there is no user ID.
+     *
+     * The server resolves the user by ID first and only falls back to the email, so setting both
+     * silently ignores the email; {@link login} sends whichever one identifies the account.
+     */
+    email(email: string): this;
+    /** The password. */
+    password(password: string): this;
+    /** User ID and password together. */
+    credentials(username: string, password: string): this;
+    /**
+     * The namespace to make active once login succeeds.
+     *
+     * Applied with a follow-up `change-namespace` call, mirroring euclid-cli's `eam login
+     * --namespace`, and applied whether the login was fresh or served from the cache - a cached
+     * session may have been established before this was ever asked for, or scoped to another
+     * namespace.
+     */
+    namespace(namespace: string): this;
+    /** The path to post the login to. `/` unless a deployment puts the gateway elsewhere. */
+    loginPath(path: string): this;
+    /** A PEM CA certificate to trust alongside the system store, or null for the store alone. */
+    caCertPath(path: string | null): this;
+    /** Whether to verify the server's certificate. Turn it off for development servers only. */
+    verify(verify: boolean): this;
+    /** How long to wait for a response, in milliseconds. */
+    timeout(milliseconds: number): this;
+    /**
+     * Which signing scheme the session signs with. SigV4 unless told otherwise, as euclid's server
+     * has understood that one from the start.
+     */
+    signingScheme(scheme: SigningScheme): this;
+    /** How the session authenticates: {@link AUTH_AUTO}, {@link AUTH_SIGNATURE} or {@link AUTH_BEARER}. */
+    auth(mode: AuthMode): this;
+    /**
+     * Whether `~/.euclid/credentials` may be read and written. On by default, which is what makes a
+     * login shared with euclid-cli, euclid-jdk and euclid-pdk.
+     */
+    useCache(useCache: boolean): this;
+    /**
+     * Authenticates, and answers with the session every other call goes through.
+     *
+     * A still-valid cached session for this server is reused rather than re-authenticating, so
+     * calling this repeatedly costs nothing after the first time. Pass `useCache(false)` to force a
+     * fresh login.
+     *
+     * @throws {EuclidAuthenticationError} if the server refuses the credentials.
+     * @throws {Error} if no password, or neither a username nor an email, was set and there is no
+     *   cached session to fall back on.
+     */
+    login(): Promise<EuclidSession>;
+}
+/**
+ * An authenticated session, and every EAM operation that needs one.
+ *
+ * Holds two credentials, because the server accepts two. The bearer token is what a login always
+ * produces; the access key and secret are what it produces when the user has one, and they are what
+ * a signature is made with. Which of the two a request presents is decided per session by
+ * {@link EuclidSession.auth} - see {@link AUTH_AUTO}.
+ *
+ * Sessions are mutable: {@link EuclidSession.changeNamespace} changes this session rather than
+ * answering with a new one, since the namespace is a property of what the caller is doing next
+ * rather than of the login.
+ */
+export declare class EuclidSession {
+    #private;
+    readonly baseUrl: string;
+    token: string;
+    readonly userId: string;
+    readonly accountId: string;
+    readonly region: string;
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly isAdmin: boolean;
+    namespace: string;
+    readonly raw: Record<string, unknown>;
+    signingScheme: SigningScheme;
+    readonly auth: AuthMode;
+    /**
+     * Where the bearer token comes from, when it does not simply come from {@link EuclidSession.token}.
+     *
+     * A process that runs for days holds a token that does not last that long. euclid rewrites an
+     * application's credentials file before the token in it expires, so an application that cached the
+     * first token it saw would start collecting 401s about an hour in. Setting this to something that
+     * re-reads that file makes the session follow the rotation, and is what the retry on "credentials
+     * expired" then has something new to retry with.
+     */
+    tokenProvider: (() => string) | null;
+    constructor(options: SessionOptions);
+    /** This session in the shape `~/.euclid/credentials` holds it. */
+    toCachedCredentials(): CachedCredentials;
+    /** The `@authority` this session's signatures are made over, for diagnostics. */
+    get authority(): string;
+    /**
+     * Whether this session signs even the requests that would otherwise present the token.
+     *
+     * What {@link AUTH_SIGNATURE} means to a module whose action carries raw bytes: those present the
+     * token by default, and a session that asked for signatures gets them anyway. Asked of the session
+     * rather than read off {@link auth} by each module client, so that "what this mode means" is decided
+     * in one place - and so that a module client needs no value out of this module at all, which is what
+     * keeps the import between the two one-directional.
+     */
+    get alwaysSigns(): boolean;
+    /** Releases the connections this session was holding, its module clients' included. */
+    close(): void;
+    /**
+     * ESM - euclid's storage module - on this session's credentials.
+     *
+     * The same client each time, so an application that reaches for this inside a loop pays for one
+     * connection rather than one per iteration. It follows this session: a {@link changeNamespace}
+     * between two calls scopes the second one, and a {@link tokenProvider} set here is the token it
+     * presents.
+     */
+    esm(): EuclidEsm;
+    /** EQS - euclid's queue module - on this session's credentials. */
+    eqs(): EuclidEqs;
+    /** ENS - euclid's notification module - on this session's credentials. */
+    ens(): EuclidEns;
+    /** EKM - euclid's key management module - on this session's credentials. */
+    ekm(): EuclidEkm;
+    /** EKV - euclid's key-value store - on this session's credentials. */
+    ekv(): EuclidEkv;
+    /** EAP - euclid's application platform - on this session's credentials. */
+    eap(): EuclidEap;
+    /** ESS - euclid's secret store - on this session's credentials. */
+    ess(): EuclidEss;
+    /** EAG - euclid's API gateway - on this session's credentials. */
+    eag(): EuclidEag;
+    /** One page of users, and how many exist in total. */
+    listUsers(options?: ListOptions): Promise<Page<User>>;
+    /** Creates a user. `accountId` and `region` default to this session's own. */
+    register(userId: string, password: string, options?: {
+        email?: string;
+        accountId?: string;
+        region?: string;
+        isAdmin?: boolean;
+    }): Promise<User>;
+    /** Deletes a user. */
+    deleteUser(userId: string): Promise<void>;
+    /**
+     * Switches the namespace every namespace-scoped call is restricted to, until changed again.
+     *
+     * The server validates it against the current account and the caller's grants, so this is a round
+     * trip rather than a local assignment. An empty string clears the scope.
+     *
+     * Answers with this session, so it can be chained onto a login.
+     */
+    changeNamespace(namespace: string): Promise<this>;
+    /**
+     * Creates an access key for this session's user.
+     *
+     * The secret comes back here and nowhere else - {@link listAccessKeys} will never show it again -
+     * so a caller that does not store it has to create another key.
+     */
+    createAccessKey(): Promise<CreateAccessKeyResult>;
+    /** This user's own access keys, without their secrets. */
+    listAccessKeys(): Promise<AccessKey[]>;
+    /** Deletes one of this user's own access keys. */
+    deleteAccessKey(accessKeyId: string): Promise<void>;
+    /** Creates an empty user group. Administrator only. */
+    createUserGroup(name: string, description?: string): Promise<UserGroup>;
+    /** One page of user groups, and how many exist in total. */
+    listUserGroups(options?: ListOptions): Promise<Page<UserGroup>>;
+    /** Adds a user to a group. Both are ERNs. */
+    addUserToUserGroup(userGroup: string, user: string): Promise<void>;
+    /** Removes a user from a group. Both are ERNs. */
+    removeUserFromUserGroup(userGroup: string, user: string): Promise<void>;
+    /** Deletes a user group. Administrator only. */
+    deleteUserGroup(name: string): Promise<void>;
+    /**
+     * Creates an account. Administrator only - account creation is platform-level and is not
+     * delegated to account owners.
+     */
+    createAccount(accountId: string, name: string, description?: string): Promise<Account>;
+    /** One page of accounts, and how many exist in total. */
+    listAccounts(options?: ListOptions): Promise<Page<Account>>;
+    /** Deletes an account. Administrator only, and it must have no namespaces or grants left. */
+    deleteAccount(accountId: string): Promise<void>;
+    /** Creates a namespace under an account. Requires admin rights on that account. */
+    createNamespace(accountId: string, name: string, description?: string): Promise<Namespace>;
+    /** One page of an account's namespaces, and how many exist in total. */
+    listNamespaces(accountId: string, options?: ListOptions): Promise<Page<Namespace>>;
+    /** Deletes a namespace. Requires admin rights on the account, and no grants may remain. */
+    deleteNamespace(accountId: string, name: string): Promise<void>;
+    /** Grants a user access to a namespace. Requires admin rights on the account. */
+    grantNamespaceAccess(user: string, accountId: string, namespace: string): Promise<void>;
+    /** Revokes a user's access to a namespace. Requires admin rights on the account. */
+    revokeNamespaceAccess(user: string, accountId: string, namespace: string): Promise<void>;
+    /**
+     * EAM's own metrics, as the server collects them. Answered unparsed - the shape belongs to the
+     * monitoring module rather than to EAM.
+     */
+    metrics(): Promise<Record<string, unknown>>;
+    /**
+     * Sends any EAM action, for one this SDK does not wrap yet.
+     *
+     * Public on purpose: a server that gains an action should be reachable without waiting for a
+     * release here.
+     */
+    call(action: string, payload?: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;
+    /**
+     * Every header a request to one of this session's modules goes out with, signature included.
+     *
+     * Takes the target rather than assuming EAM because the target is signed: a client for another
+     * module has to sign for *its* module, and signing here rather than in each module client is what
+     * keeps one implementation of how this session authenticates.
+     */
+    requestHeaders(target: string, action: string, body: Buffer): Record<string, string>;
+    /** Who is asking and what they are scoped to. Signed, apart from the namespace. */
+    routingHeaders(): Record<string, string>;
+    /**
+     * The authentication headers alone, rebuilt per request.
+     *
+     * Rebuilt rather than cached because a signature is only valid around the moment it was made, and
+     * because this is what the client calls again when the server says the credentials it just
+     * presented had expired.
+     */
+    authHeaders(target: string, action: string, body: Buffer): Record<string, string>;
+    /**
+     * The bearer token, presented as an `Authorization` header.
+     *
+     * Its own method because a request is not always free to sign: a module whose action carries raw
+     * bytes presents the token whatever this session would otherwise do.
+     */
+    bearerHeaders(): Record<string, string>;
+    /** The bearer token to present now - {@link tokenProvider}'s, or {@link token}. */
+    currentToken(): string;
+    /**
+     * A connection to this session's server, on the TLS and timeout settings it logged in with.
+     *
+     * The factory is what a request whose credentials expired in flight is rebuilt with, so a module
+     * client passes the one that rebuilds *its* headers - see {@link authHeaders}.
+     */
+    newClient(headerFactory: HeaderFactory): EuclidHttpClient;
+}
+//# sourceMappingURL=eam.d.ts.map

package/dist/modules/eam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eam.d.ts","sourceRoot":"","sources":["../../src/modules/eam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EACL,KAAK,iBAAiB,EAMvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,IAAI,EAST,KAAK,IAAI,EACT,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAA4C,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEnH,OAAO,EAAe,KAAK,WAAW,EAAqB,MAAM,WAAW,CAAC;AAK7E,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,eAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;;GAGG;AACH,eAAO,MAAM,SAAS,SAAS,CAAC;AAChC;;;GAGG;AACH,eAAO,MAAM,cAAc,cAAc,CAAC;AAC1C,6EAA6E;AAC7E,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,qGAAqG;AACrG,MAAM,MAAM,QAAQ,GAAG,OAAO,SAAS,GAAG,OAAO,cAAc,GAAG,OAAO,WAAW,CAAC;AAErF,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,qBAAa,SAAS;;gBAgBR,OAAO,EAAE,MAAM;IAI3B,kEAAkE;IAClE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS;IAO5C,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKhC;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAK1B,oBAAoB;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKhC,qCAAqC;IACrC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIrD;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKlC,yFAAyF;IACzF,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAK7B,6FAA6F;IAC7F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAKrC,4FAA4F;IAC5F,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAK7B,wDAAwD;IACxD,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAKnC;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAK1C,uGAAuG;IACvG,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI;IAQ1B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI;IAOjC;;;;;;;;;;OAUG;IACG,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC;CA2FtC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,aAAa;;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAQ;gBAWhC,OAAO,EAAE,cAAc;IAuBnC,kEAAkE;IAClE,mBAAmB,IAAI,iBAAiB;IAexC,iFAAiF;IACjF,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,uFAAuF;IACvF,KAAK,IAAI,IAAI;IAQb;;;;;;;OAOG;IACH,GAAG,IAAI,SAAS;IAIhB,mEAAmE;IACnE,GAAG,IAAI,SAAS;IAIhB,0EAA0E;IAC1E,GAAG,IAAI,SAAS;IAIhB,4EAA4E;IAC5E,GAAG,IAAI,SAAS;IAIhB,sEAAsE;IACtE,GAAG,IAAI,SAAS;IAIhB,2EAA2E;IAC3E,GAAG,IAAI,SAAS;IAIhB,mEAAmE;IACnE,GAAG,IAAI,SAAS;IAIhB,kEAAkE;IAClE,GAAG,IAAI,SAAS;IAehB,sDAAsD;IAChD,SAAS,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAI/D,8EAA8E;IACxE,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GACvF,OAAO,CAAC,IAAI,CAAC;IAYhB,sBAAsB;IAChB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C;;;;;;;OAOG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvD;;;;;OAKG;IACG,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAIvD,0DAA0D;IACpD,cAAc,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAM5C,kDAAkD;IAC5C,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzD,uDAAuD;IACjD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,OAAO,CAAC,SAAS,CAAC;IAKzE,4DAA4D;IACtD,cAAc,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAIzE,6CAA6C;IACvC,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,kDAAkD;IAC5C,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7E,gDAAgD;IAC1C,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlD;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxF,yDAAyD;IACnD,YAAY,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAIrE,6FAA6F;IACvF,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrD,mFAAmF;IAC7E,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,OAAO,CAAC,SAAS,CAAC;IAK5F,wEAAwE;IAClE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAK5F,2FAA2F;IACrF,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrE,iFAAiF;IAC3E,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7F,oFAAoF;IAC9E,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9F;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAMjD;;;;;OAKG;IACG,IAAI,CACR,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACrC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAkBnC;;;;;;OAMG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIpF,mFAAmF;IACnF,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAUxC;;;;;;OAMG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAgBjF;;;;;OAKG;IACH,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIvC,mFAAmF;IACnF,YAAY,IAAI,MAAM;IAItB;;;;;OAKG;IACH,SAAS,CAAC,aAAa,EAAE,aAAa,GAAG,gBAAgB;CAkB1D"}