euclid-ndk 0.2.0

package/dist/modules/eam.js

@@ -0,0 +1,641 @@
+/**
+ * EAM - euclid's access management module: login, users, groups, accounts, namespaces, keys.
+ *
+ * Two objects. {@link EuclidEam} is the login builder: it collects the server, the credentials and
+ * the options, and hands back a session. {@link EuclidSession} is that session - the authenticated
+ * client every other call goes through, and the thing that holds the token and the access key the
+ * login produced.
+ *
+ * The split exists because logging in and being logged in need different arguments. A builder that
+ * also carried the operations would let a caller write `.listUsers()` on an object that has not
+ * authenticated yet, and a session that also carried the login options would have a namespace field
+ * that means one thing before login and another after.
+ */
+import { SIGV4, SignableRequest } from "../auth/index.js";
+import { emptyCredentials, isTokenValid, load as loadCredentials, save as saveCredentials, updateNamespace as updateCachedNamespace, } from "../credentials.js";
+import { toAccessKey, toAccount, toCreateAccessKeyResult, toLoginResult, toNamespace, toPage, toUser, toUserGroup, } from "../dto/eam.js";
+import { EuclidAuthenticationError, EuclidServiceError } from "../errors.js";
+import { DEFAULT_CA_CERT_PATH, DEFAULT_TIMEOUT_MS, EuclidHttpClient } from "../http/client.js";
+import { authorityOf, hostHeaderOf, schemeOf, stripTrailingSlash } from "../url.js";
+import { listPayload } from "./base.js";
+// This module imports the clients and they import nothing of it but its types, which is what keeps the
+// two-way relationship - a client needs the session it authenticates as, a session hands out the
+// clients - out of the runtime module graph. See EuclidSession.alwaysSigns for the one place that
+// would otherwise have put it back.
+import { EuclidEag } from "./eag.js";
+import { EuclidEap } from "./eap.js";
+import { EuclidEkm } from "./ekm.js";
+import { EuclidEkv } from "./ekv.js";
+import { EuclidEns } from "./ens.js";
+import { EuclidEqs } from "./eqs.js";
+import { EuclidEsm } from "./esm.js";
+import { EuclidEss } from "./ess.js";
+export const TARGET = "eam";
+/**
+ * Authenticate with a signature when there is an access key to sign with, and with the bearer token
+ * otherwise. euclid accepts either for every action (`HttpActionServer::Authenticate`).
+ */
+export const AUTH_AUTO = "auto";
+/**
+ * Always sign. Fails loudly if the session has no access key, rather than quietly falling back to a
+ * token - which is what a caller who asked for signatures wants to know about.
+ */
+export const AUTH_SIGNATURE = "signature";
+/** Always present the bearer token, even when an access key is available. */
+export const AUTH_BEARER = "bearer";
+/**
+ * Builder for authenticating against a euclid server.
+ *
+ * ```ts
+ * const session = await EuclidEam.forServer("https://euclid.example.com")
+ *   .credentials("jens", "secret")
+ *   .login();
+ * ```
+ */
+export class EuclidEam {
+    #baseUrl;
+    #loginPath = "/";
+    #username = null;
+    #email = null;
+    #password = null;
+    #namespace = null;
+    // Applied only when the file is actually there, so this default is a no-op on a machine with no
+    // euclid deployment and the right thing on one that has.
+    #caCertPath = DEFAULT_CA_CERT_PATH;
+    #verify = true;
+    #timeoutMs = DEFAULT_TIMEOUT_MS;
+    #signingScheme = SIGV4;
+    #auth = AUTH_AUTO;
+    #useCache = true;
+    constructor(baseUrl) {
+        this.#baseUrl = stripTrailingSlash(baseUrl);
+    }
+    /** Targets a euclid server, e.g. `https://euclid.example.com`. */
+    static forServer(baseUrl) {
+        if (!baseUrl)
+            throw new Error("baseUrl must not be empty");
+        return new EuclidEam(baseUrl);
+    }
+    // -- builder ---------------------------------------------------------------------------------
+    /** The user ID to log in as. */
+    username(username) {
+        this.#username = username;
+        return this;
+    }
+    /**
+     * The email address to log in with, when there is no user ID.
+     *
+     * The server resolves the user by ID first and only falls back to the email, so setting both
+     * silently ignores the email; {@link login} sends whichever one identifies the account.
+     */
+    email(email) {
+        this.#email = email;
+        return this;
+    }
+    /** The password. */
+    password(password) {
+        this.#password = password;
+        return this;
+    }
+    /** User ID and password together. */
+    credentials(username, password) {
+        return this.username(username).password(password);
+    }
+    /**
+     * The namespace to make active once login succeeds.
+     *
+     * Applied with a follow-up `change-namespace` call, mirroring euclid-cli's `eam login
+     * --namespace`, and applied whether the login was fresh or served from the cache - a cached
+     * session may have been established before this was ever asked for, or scoped to another
+     * namespace.
+     */
+    namespace(namespace) {
+        this.#namespace = namespace;
+        return this;
+    }
+    /** The path to post the login to. `/` unless a deployment puts the gateway elsewhere. */
+    loginPath(path) {
+        this.#loginPath = path.startsWith("/") ? path : `/${path}`;
+        return this;
+    }
+    /** A PEM CA certificate to trust alongside the system store, or null for the store alone. */
+    caCertPath(path) {
+        this.#caCertPath = path;
+        return this;
+    }
+    /** Whether to verify the server's certificate. Turn it off for development servers only. */
+    verify(verify) {
+        this.#verify = verify;
+        return this;
+    }
+    /** How long to wait for a response, in milliseconds. */
+    timeout(milliseconds) {
+        this.#timeoutMs = milliseconds;
+        return this;
+    }
+    /**
+     * Which signing scheme the session signs with. SigV4 unless told otherwise, as euclid's server
+     * has understood that one from the start.
+     */
+    signingScheme(scheme) {
+        this.#signingScheme = scheme;
+        return this;
+    }
+    /** How the session authenticates: {@link AUTH_AUTO}, {@link AUTH_SIGNATURE} or {@link AUTH_BEARER}. */
+    auth(mode) {
+        if (mode !== AUTH_AUTO && mode !== AUTH_SIGNATURE && mode !== AUTH_BEARER) {
+            throw new Error(`auth must be one of "${AUTH_AUTO}", "${AUTH_SIGNATURE}", "${AUTH_BEARER}"`);
+        }
+        this.#auth = mode;
+        return this;
+    }
+    /**
+     * Whether `~/.euclid/credentials` may be read and written. On by default, which is what makes a
+     * login shared with euclid-cli, euclid-jdk and euclid-pdk.
+     */
+    useCache(useCache) {
+        this.#useCache = useCache;
+        return this;
+    }
+    // -- login -----------------------------------------------------------------------------------
+    /**
+     * Authenticates, and answers with the session every other call goes through.
+     *
+     * A still-valid cached session for this server is reused rather than re-authenticating, so
+     * calling this repeatedly costs nothing after the first time. Pass `useCache(false)` to force a
+     * fresh login.
+     *
+     * @throws {EuclidAuthenticationError} if the server refuses the credentials.
+     * @throws {Error} if no password, or neither a username nor an email, was set and there is no
+     *   cached session to fall back on.
+     */
+    async login() {
+        const cached = await this.#cachedSession();
+        if (cached !== null) {
+            if (this.#namespace !== null && this.#namespace !== cached.namespace) {
+                await cached.changeNamespace(this.#namespace);
+            }
+            return cached;
+        }
+        if (!this.#username && !this.#email)
+            throw new Error("username or email must be set before calling login()");
+        if (this.#password === null)
+            throw new Error("password must be set before calling login()");
+        // Only one identifier goes out: the server takes the user ID when it is present and only falls
+        // back to the email, so sending both would silently ignore the email.
+        const body = JSON.stringify({
+            userId: this.#username ?? "",
+            password: this.#password,
+            email: this.#username ? "" : (this.#email ?? ""),
+        });
+        const client = new EuclidHttpClient({
+            caCertPath: this.#caCertPath,
+            timeoutMs: this.#timeoutMs,
+            verify: this.#verify,
+        });
+        let response;
+        try {
+            response = await client.post(this.#baseUrl + this.#loginPath, body, TARGET, "login", {
+                "content-type": "application/json",
+                host: hostHeaderOf(this.#baseUrl),
+            });
+        }
+        finally {
+            client.close();
+        }
+        if (!response.ok)
+            throw new EuclidAuthenticationError(response.status, response.text);
+        const result = toLoginResult(response.json());
+        const session = new EuclidSession({
+            baseUrl: this.#baseUrl,
+            token: result.token,
+            userId: result.metadata.user,
+            accountId: result.metadata.accountId,
+            region: result.metadata.region,
+            accessKeyId: result.accessKeyId,
+            secretAccessKey: result.secretAccessKey,
+            isAdmin: result.isAdmin,
+            namespace: "",
+            raw: result.raw,
+            caCertPath: this.#caCertPath,
+            verify: this.#verify,
+            timeoutMs: this.#timeoutMs,
+            signingScheme: this.#signingScheme,
+            auth: this.#auth,
+            cache: this.#useCache,
+        });
+        if (this.#namespace)
+            await session.changeNamespace(this.#namespace);
+        if (this.#useCache)
+            await saveCredentials(session.toCachedCredentials());
+        return session;
+    }
+    /**
+     * A session rebuilt from `~/.euclid/credentials`, if one is cached for this server and its token
+     * has not expired.
+     */
+    async #cachedSession() {
+        if (!this.#useCache)
+            return null;
+        const cached = await loadCredentials();
+        if (cached === null || !cached.token || cached.baseUrl !== this.#baseUrl)
+            return null;
+        if (!isTokenValid(cached.token))
+            return null;
+        return new EuclidSession({
+            baseUrl: this.#baseUrl,
+            token: cached.token,
+            userId: cached.userId,
+            accountId: cached.accountId,
+            region: cached.region,
+            accessKeyId: cached.accessKeyId,
+            secretAccessKey: cached.secretAccessKey,
+            isAdmin: cached.isAdmin,
+            namespace: cached.namespace,
+            raw: cached.raw,
+            caCertPath: this.#caCertPath,
+            verify: this.#verify,
+            timeoutMs: this.#timeoutMs,
+            signingScheme: this.#signingScheme,
+            auth: this.#auth,
+            cache: this.#useCache,
+        });
+    }
+}
+/**
+ * An authenticated session, and every EAM operation that needs one.
+ *
+ * Holds two credentials, because the server accepts two. The bearer token is what a login always
+ * produces; the access key and secret are what it produces when the user has one, and they are what
+ * a signature is made with. Which of the two a request presents is decided per session by
+ * {@link EuclidSession.auth} - see {@link AUTH_AUTO}.
+ *
+ * Sessions are mutable: {@link EuclidSession.changeNamespace} changes this session rather than
+ * answering with a new one, since the namespace is a property of what the caller is doing next
+ * rather than of the login.
+ */
+export class EuclidSession {
+    baseUrl;
+    token;
+    userId;
+    accountId;
+    region;
+    accessKeyId;
+    secretAccessKey;
+    isAdmin;
+    namespace;
+    raw;
+    signingScheme;
+    auth;
+    /**
+     * Where the bearer token comes from, when it does not simply come from {@link EuclidSession.token}.
+     *
+     * A process that runs for days holds a token that does not last that long. euclid rewrites an
+     * application's credentials file before the token in it expires, so an application that cached the
+     * first token it saw would start collecting 401s about an hour in. Setting this to something that
+     * re-reads that file makes the session follow the rotation, and is what the retry on "credentials
+     * expired" then has something new to retry with.
+     */
+    tokenProvider = null;
+    #cache;
+    #hostHeader;
+    #scheme;
+    // Kept so that a module client this session hands out reaches the same server on the same terms,
+    // rather than having to be told the connection settings again.
+    #connection;
+    #modules = new Map();
+    #client;
+    constructor(options) {
+        this.baseUrl = options.baseUrl;
+        this.token = options.token;
+        this.userId = options.userId;
+        this.accountId = options.accountId;
+        this.region = options.region;
+        this.accessKeyId = options.accessKeyId;
+        this.secretAccessKey = options.secretAccessKey;
+        this.isAdmin = options.isAdmin;
+        this.namespace = options.namespace;
+        this.raw = options.raw;
+        this.signingScheme = options.signingScheme;
+        this.auth = options.auth;
+        this.#cache = options.cache;
+        this.#hostHeader = hostHeaderOf(options.baseUrl);
+        this.#scheme = schemeOf(options.baseUrl);
+        this.#connection = { caCertPath: options.caCertPath, timeoutMs: options.timeoutMs, verify: options.verify };
+        this.#client = this.newClient((action, body) => this.authHeaders(TARGET, action, body));
+    }
+    // -- identity --------------------------------------------------------------------------------
+    /** This session in the shape `~/.euclid/credentials` holds it. */
+    toCachedCredentials() {
+        return {
+            ...emptyCredentials(),
+            token: this.token,
+            userId: this.userId,
+            accountId: this.accountId,
+            region: this.region,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            isAdmin: this.isAdmin,
+            baseUrl: this.baseUrl,
+            namespace: this.namespace || "",
+        };
+    }
+    /** The `@authority` this session's signatures are made over, for diagnostics. */
+    get authority() {
+        return authorityOf(this.baseUrl);
+    }
+    /**
+     * Whether this session signs even the requests that would otherwise present the token.
+     *
+     * What {@link AUTH_SIGNATURE} means to a module whose action carries raw bytes: those present the
+     * token by default, and a session that asked for signatures gets them anyway. Asked of the session
+     * rather than read off {@link auth} by each module client, so that "what this mode means" is decided
+     * in one place - and so that a module client needs no value out of this module at all, which is what
+     * keeps the import between the two one-directional.
+     */
+    get alwaysSigns() {
+        return this.auth === AUTH_SIGNATURE;
+    }
+    /** Releases the connections this session was holding, its module clients' included. */
+    close() {
+        this.#client.close();
+        for (const module of this.#modules.values())
+            module.close();
+        this.#modules.clear();
+    }
+    // -- the other modules -----------------------------------------------------------------------
+    /**
+     * ESM - euclid's storage module - on this session's credentials.
+     *
+     * The same client each time, so an application that reaches for this inside a loop pays for one
+     * connection rather than one per iteration. It follows this session: a {@link changeNamespace}
+     * between two calls scopes the second one, and a {@link tokenProvider} set here is the token it
+     * presents.
+     */
+    esm() {
+        return this.#module("esm", () => new EuclidEsm(this));
+    }
+    /** EQS - euclid's queue module - on this session's credentials. */
+    eqs() {
+        return this.#module("eqs", () => new EuclidEqs(this));
+    }
+    /** ENS - euclid's notification module - on this session's credentials. */
+    ens() {
+        return this.#module("ens", () => new EuclidEns(this));
+    }
+    /** EKM - euclid's key management module - on this session's credentials. */
+    ekm() {
+        return this.#module("ekm", () => new EuclidEkm(this));
+    }
+    /** EKV - euclid's key-value store - on this session's credentials. */
+    ekv() {
+        return this.#module("ekv", () => new EuclidEkv(this));
+    }
+    /** EAP - euclid's application platform - on this session's credentials. */
+    eap() {
+        return this.#module("eap", () => new EuclidEap(this));
+    }
+    /** ESS - euclid's secret store - on this session's credentials. */
+    ess() {
+        return this.#module("ess", () => new EuclidEss(this));
+    }
+    /** EAG - euclid's API gateway - on this session's credentials. */
+    eag() {
+        return this.#module("eag", () => new EuclidEag(this));
+    }
+    /** One client per module rather than one per call, built the first time it is asked for. */
+    #module(name, factory) {
+        const existing = this.#modules.get(name);
+        if (existing !== undefined)
+            return existing;
+        const client = factory();
+        this.#modules.set(name, client);
+        return client;
+    }
+    // -- users -----------------------------------------------------------------------------------
+    /** One page of users, and how many exist in total. */
+    async listUsers(options = {}) {
+        return toPage(await this.call("list-users", listPayload(options, "userId")), "users", toUser);
+    }
+    /** Creates a user. `accountId` and `region` default to this session's own. */
+    async register(userId, password, options = {}) {
+        const response = await this.call("register", {
+            userId,
+            password,
+            email: options.email ?? "",
+            accountId: options.accountId || this.accountId,
+            region: options.region || this.region,
+            isAdmin: options.isAdmin ?? false,
+        });
+        return toUser(response.user);
+    }
+    /** Deletes a user. */
+    async deleteUser(userId) {
+        await this.call("delete-user", { userId });
+    }
+    // -- namespace scoping -----------------------------------------------------------------------
+    /**
+     * Switches the namespace every namespace-scoped call is restricted to, until changed again.
+     *
+     * The server validates it against the current account and the caller's grants, so this is a round
+     * trip rather than a local assignment. An empty string clears the scope.
+     *
+     * Answers with this session, so it can be chained onto a login.
+     */
+    async changeNamespace(namespace) {
+        await this.call("change-namespace", { namespace });
+        this.namespace = namespace;
+        if (this.#cache)
+            await updateCachedNamespace(this.baseUrl, namespace);
+        return this;
+    }
+    // -- access keys -----------------------------------------------------------------------------
+    /**
+     * Creates an access key for this session's user.
+     *
+     * The secret comes back here and nowhere else - {@link listAccessKeys} will never show it again -
+     * so a caller that does not store it has to create another key.
+     */
+    async createAccessKey() {
+        return toCreateAccessKeyResult(await this.call("create-access-key"));
+    }
+    /** This user's own access keys, without their secrets. */
+    async listAccessKeys() {
+        const response = await this.call("list-access-keys");
+        const keys = response.accessKeys;
+        return Array.isArray(keys) ? keys.map(toAccessKey) : [];
+    }
+    /** Deletes one of this user's own access keys. */
+    async deleteAccessKey(accessKeyId) {
+        await this.call("delete-access-key", { accessKeyId });
+    }
+    // -- user groups -----------------------------------------------------------------------------
+    /** Creates an empty user group. Administrator only. */
+    async createUserGroup(name, description = "") {
+        const response = await this.call("create-user-group", { name, description });
+        return toUserGroup(response.userGroup);
+    }
+    /** One page of user groups, and how many exist in total. */
+    async listUserGroups(options = {}) {
+        return toPage(await this.call("list-user-groups", listPayload(options, "name")), "userGroups", toUserGroup);
+    }
+    /** Adds a user to a group. Both are ERNs. */
+    async addUserToUserGroup(userGroup, user) {
+        await this.call("user-group-add-user", { userGroup, user });
+    }
+    /** Removes a user from a group. Both are ERNs. */
+    async removeUserFromUserGroup(userGroup, user) {
+        await this.call("user-group-remove-user", { userGroup, user });
+    }
+    /** Deletes a user group. Administrator only. */
+    async deleteUserGroup(name) {
+        await this.call("delete-user-group", { name });
+    }
+    // -- accounts --------------------------------------------------------------------------------
+    /**
+     * Creates an account. Administrator only - account creation is platform-level and is not
+     * delegated to account owners.
+     */
+    async createAccount(accountId, name, description = "") {
+        const response = await this.call("create-account", { accountId, name, description });
+        return toAccount(response.account);
+    }
+    /** One page of accounts, and how many exist in total. */
+    async listAccounts(options = {}) {
+        return toPage(await this.call("list-accounts", listPayload(options, "accountId")), "accounts", toAccount);
+    }
+    /** Deletes an account. Administrator only, and it must have no namespaces or grants left. */
+    async deleteAccount(accountId) {
+        await this.call("delete-account", { accountId });
+    }
+    // -- namespaces ------------------------------------------------------------------------------
+    /** Creates a namespace under an account. Requires admin rights on that account. */
+    async createNamespace(accountId, name, description = "") {
+        const response = await this.call("create-namespace", { accountId, name, description });
+        return toNamespace(response.namespace);
+    }
+    /** One page of an account's namespaces, and how many exist in total. */
+    async listNamespaces(accountId, options = {}) {
+        const payload = { accountId, ...listPayload(options, "name") };
+        return toPage(await this.call("list-namespaces", payload), "namespaces", toNamespace);
+    }
+    /** Deletes a namespace. Requires admin rights on the account, and no grants may remain. */
+    async deleteNamespace(accountId, name) {
+        await this.call("delete-namespace", { accountId, name });
+    }
+    /** Grants a user access to a namespace. Requires admin rights on the account. */
+    async grantNamespaceAccess(user, accountId, namespace) {
+        await this.call("grant-namespace-access", { user, accountId, namespace });
+    }
+    /** Revokes a user's access to a namespace. Requires admin rights on the account. */
+    async revokeNamespaceAccess(user, accountId, namespace) {
+        await this.call("revoke-namespace-access", { user, accountId, namespace });
+    }
+    // -- monitoring ------------------------------------------------------------------------------
+    /**
+     * EAM's own metrics, as the server collects them. Answered unparsed - the shape belongs to the
+     * monitoring module rather than to EAM.
+     */
+    async metrics() {
+        return this.call("get-metrics");
+    }
+    // -- transport -------------------------------------------------------------------------------
+    /**
+     * Sends any EAM action, for one this SDK does not wrap yet.
+     *
+     * Public on purpose: a server that gains an action should be reachable without waiting for a
+     * release here.
+     */
+    async call(action, payload = {}, timeoutMs) {
+        const body = Buffer.from(JSON.stringify(payload), "utf8");
+        const response = await this.#client.post(`${this.baseUrl}/`, body, TARGET, action, this.requestHeaders(TARGET, action, body), timeoutMs);
+        if (!response.ok)
+            throw new EuclidServiceError(TARGET, action, response.status, response.text);
+        const result = response.json();
+        return result !== null && typeof result === "object" && !Array.isArray(result)
+            ? result
+            : { result };
+    }
+    /**
+     * Every header a request to one of this session's modules goes out with, signature included.
+     *
+     * Takes the target rather than assuming EAM because the target is signed: a client for another
+     * module has to sign for *its* module, and signing here rather than in each module client is what
+     * keeps one implementation of how this session authenticates.
+     */
+    requestHeaders(target, action, body) {
+        return { ...this.routingHeaders(), ...this.authHeaders(target, action, body) };
+    }
+    /** Who is asking and what they are scoped to. Signed, apart from the namespace. */
+    routingHeaders() {
+        const headers = { "content-type": "application/json", host: this.#hostHeader };
+        if (this.region)
+            headers["x-euclid-region"] = this.region;
+        if (this.accountId)
+            headers["x-euclid-account-id"] = this.accountId;
+        if (this.userId)
+            headers["x-euclid-user-id"] = this.userId;
+        // Not covered by either signature scheme - see the note in auth/rfc9421.ts.
+        if (this.namespace)
+            headers["x-euclid-namespace"] = this.namespace;
+        return headers;
+    }
+    /**
+     * The authentication headers alone, rebuilt per request.
+     *
+     * Rebuilt rather than cached because a signature is only valid around the moment it was made, and
+     * because this is what the client calls again when the server says the credentials it just
+     * presented had expired.
+     */
+    authHeaders(target, action, body) {
+        if (!this.#shouldSign())
+            return this.bearerHeaders();
+        const request = new SignableRequest("POST", "/");
+        request.headersFrom(this.routingHeaders());
+        request.header("x-euclid-target", target);
+        request.header("x-euclid-action", action);
+        request.setBody(body);
+        request.setScheme(this.#scheme);
+        this.signingScheme.sign(request, this.accessKeyId, this.secretAccessKey, this.region, target);
+        const headers = {};
+        for (const name of this.signingScheme.signatureHeaderNames())
+            headers[name] = request.get(name);
+        return headers;
+    }
+    /**
+     * The bearer token, presented as an `Authorization` header.
+     *
+     * Its own method because a request is not always free to sign: a module whose action carries raw
+     * bytes presents the token whatever this session would otherwise do.
+     */
+    bearerHeaders() {
+        return { authorization: `Bearer ${this.currentToken()}` };
+    }
+    /** The bearer token to present now - {@link tokenProvider}'s, or {@link token}. */
+    currentToken() {
+        return this.tokenProvider === null ? this.token : this.tokenProvider();
+    }
+    /**
+     * A connection to this session's server, on the TLS and timeout settings it logged in with.
+     *
+     * The factory is what a request whose credentials expired in flight is rebuilt with, so a module
+     * client passes the one that rebuilds *its* headers - see {@link authHeaders}.
+     */
+    newClient(headerFactory) {
+        return new EuclidHttpClient(this.#connection).headerFactory(headerFactory);
+    }
+    #shouldSign() {
+        const hasKey = Boolean(this.accessKeyId && this.secretAccessKey);
+        if (this.auth === AUTH_BEARER)
+            return false;
+        if (this.auth === AUTH_SIGNATURE) {
+            if (!hasKey) {
+                throw new Error("auth='signature' was requested but this session has no access key - the login returned none, " +
+                    "so there is nothing to sign with");
+            }
+            return true;
+        }
+        return hasKey;
+    }
+}
+//# sourceMappingURL=eam.js.map

package/dist/modules/eam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eam.js","sourceRoot":"","sources":["../../src/modules/eam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,eAAe,EAAsB,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAEL,gBAAgB,EAChB,YAAY,EACZ,IAAI,IAAI,eAAe,EACvB,IAAI,IAAI,eAAe,EACvB,eAAe,IAAI,qBAAqB,GACzC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAML,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,aAAa,EACb,WAAW,EACX,MAAM,EACN,MAAM,EACN,WAAW,GAGZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,gBAAgB,EAAsB,MAAM,mBAAmB,CAAC;AACnH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,WAAW,EAAuC,MAAM,WAAW,CAAC;AAC7E,uGAAuG;AACvG,iGAAiG;AACjG,kGAAkG;AAClG,oCAAoC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC;AAE5B;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAChC;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAC1C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAyBpC;;;;;;;;GAQG;AACH,MAAM,OAAO,SAAS;IACpB,QAAQ,CAAS;IACjB,UAAU,GAAG,GAAG,CAAC;IACjB,SAAS,GAAkB,IAAI,CAAC;IAChC,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAAkB,IAAI,CAAC;IAChC,UAAU,GAAkB,IAAI,CAAC;IACjC,gGAAgG;IAChG,yDAAyD;IACzD,WAAW,GAAkB,oBAAoB,CAAC;IAClD,OAAO,GAAG,IAAI,CAAC;IACf,UAAU,GAAG,kBAAkB,CAAC;IAChC,cAAc,GAAkB,KAAK,CAAC;IACtC,KAAK,GAAa,SAAS,CAAC;IAC5B,SAAS,GAAG,IAAI,CAAC;IAEjB,YAAY,OAAe;QACzB,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,SAAS,CAAC,OAAe;QAC9B,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3D,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,+FAA+F;IAE/F,gCAAgC;IAChC,QAAQ,CAAC,QAAgB;QACvB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAa;QACjB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oBAAoB;IACpB,QAAQ,CAAC,QAAgB;QACvB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qCAAqC;IACrC,WAAW,CAAC,QAAgB,EAAE,QAAgB;QAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAiB;QACzB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yFAAyF;IACzF,SAAS,CAAC,IAAY;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6FAA6F;IAC7F,UAAU,CAAC,IAAmB;QAC5B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4FAA4F;IAC5F,MAAM,CAAC,MAAe;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,OAAO,CAAC,YAAoB;QAC1B,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,MAAqB;QACjC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uGAAuG;IACvG,IAAI,CAAC,IAAc;QACjB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,OAAO,cAAc,OAAO,WAAW,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,QAAiB;QACxB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+FAA+F;IAE/F;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrE,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC7G,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAE5F,+FAA+F;QAC/F,sEAAsE;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;YAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SACjD,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC;YAClC,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,MAAM,EAAE,IAAI,CAAC,OAAO;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;gBACnF,cAAc,EAAE,kBAAkB;gBAClC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEtF,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI;YAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;YACpC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,IAAI,CAAC,SAAS;SACtB,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,eAAe,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtF,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE7C,OAAO,IAAI,aAAa,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,IAAI,CAAC,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IACzB,KAAK,CAAS;IACL,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,MAAM,CAAS;IACf,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,OAAO,CAAU;IAC1B,SAAS,CAAS;IACT,GAAG,CAA0B;IACtC,aAAa,CAAgB;IACpB,IAAI,CAAW;IAExB;;;;;;;;OAQG;IACH,aAAa,GAA0B,IAAI,CAAC;IAEnC,MAAM,CAAU;IAChB,WAAW,CAAS;IACpB,OAAO,CAAS;IACzB,iGAAiG;IACjG,+DAA+D;IACtD,WAAW,CAAoE;IAC/E,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC3C,OAAO,CAAmB;IAEnC,YAAY,OAAuB;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC5G,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,+FAA+F;IAE/F,kEAAkE;IAClE,mBAAmB;QACjB,OAAO;YACL,GAAG,gBAAgB,EAAE;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,IAAI,SAAS;QACX,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC;IACtC,CAAC;IAED,uFAAuF;IACvF,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,+FAA+F;IAE/F;;;;;;;OAOG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,mEAAmE;IACnE,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,0EAA0E;IAC1E,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,4EAA4E;IAC5E,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,sEAAsE;IACtE,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,2EAA2E;IAC3E,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,mEAAmE;IACnE,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,kEAAkE;IAClE,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,4FAA4F;IAC5F,OAAO,CAAyB,IAAY,EAAE,OAAgB;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAa,CAAC;QACjD,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+FAA+F;IAE/F,sDAAsD;IACtD,KAAK,CAAC,SAAS,CAAC,UAAuB,EAAE;QACvC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,QAAgB,EAChB,UAAsF,EAAE;QAExF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;YAC3C,MAAM;YACN,QAAQ;YACR,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YAC9C,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;SAClC,CAAC,CAAC;QACH,OAAO,MAAM,CAAE,QAA+B,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,sBAAsB;IACtB,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,+FAA+F;IAE/F;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+FAA+F;IAE/F;;;;;OAKG;IACH,KAAK,CAAC,eAAe;QACnB,OAAO,uBAAuB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,cAAc;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACrD,MAAM,IAAI,GAAI,QAAqC,CAAC,UAAU,CAAC;QAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,+FAA+F;IAE/F,uDAAuD;IACvD,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,WAAW,GAAG,EAAE;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7E,OAAO,WAAW,CAAE,QAAoC,CAAC,SAAS,CAAC,CAAC;IACtE,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,cAAc,CAAC,UAAuB,EAAE;QAC5C,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAC9G,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,IAAY;QACtD,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,uBAAuB,CAAC,SAAiB,EAAE,IAAY;QAC3D,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,+FAA+F;IAE/F;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,IAAY,EAAE,WAAW,GAAG,EAAE;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,OAAO,SAAS,CAAE,QAAkC,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,YAAY,CAAC,UAAuB,EAAE;QAC1C,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5G,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,+FAA+F;IAE/F,mFAAmF;IACnF,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,IAAY,EAAE,WAAW,GAAG,EAAE;QACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvF,OAAO,WAAW,CAAE,QAAoC,CAAC,SAAS,CAAC,CAAC;IACtE,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,UAAuB,EAAE;QAC/D,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACxF,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,IAAY;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAiB;QAC3E,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,qBAAqB,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAiB;QAC5E,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,+FAA+F;IAE/F;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;IAED,+FAA+F;IAE/F;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CACR,MAAc,EACd,UAAmC,EAAE,EACrC,SAAkB;QAElB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CACtC,GAAG,IAAI,CAAC,OAAO,GAAG,EAClB,IAAI,EACJ,MAAM,EACN,MAAM,EACN,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EACzC,SAAS,CACV,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE/F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY;QACzD,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;IACjF,CAAC;IAED,mFAAmF;IACnF,cAAc;QACZ,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACvG,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1D,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3D,4EAA4E;QAC5E,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY;QACtD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;QAErD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9F,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,aAAa;QACX,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC;IAC5D,CAAC;IAED,mFAAmF;IACnF,YAAY;QACV,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,aAA4B;QACpC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7E,CAAC;IAED,WAAW;QACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,+FAA+F;oBAC7F,kCAAkC,CACrC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}