stellarium-ts 0.12.0 → 0.13.0

package/dist/grant/repository.d.ts

@@ -0,0 +1,57 @@
+import type { Database } from "sqlite";
+import type { Capability, Grant } from "./grant.js";
+export interface IssuedGrant {
+    id: string;
+    audience: string;
+    capabilities: Capability[];
+    /** The held grant this one was delegated from, or null for a root grant. */
+    parent: GrantKey | null;
+    lifetimeMs: number;
+    renewableUntil: string | null;
+}
+export interface BlockedCaller {
+    publicKey: string;
+    reason: string | null;
+    blockedAt: string;
+}
+/**
+ * Identifies a grant, such as a held chain's leaf or a revoked grant. Issuers choose their own
+ * ids, so the id alone isn't enough.
+ */
+export interface GrantKey {
+    issuer: string;
+    id: string;
+}
+/** Grants this node issued, grants it holds, grants it revoked, nonces it has seen, and caller keys it blocked. */
+export declare class GrantRepository {
+    private readonly db;
+    constructor(db: Database);
+    saveIssued(grant: IssuedGrant): Promise<void>;
+    getIssued(id: string): Promise<IssuedGrant | undefined>;
+    /** Saves a chain this node holds, replacing an earlier copy of the same leaf grant. */
+    saveHeld(chain: Grant[]): Promise<void>;
+    getHeld(key: GrantKey): Promise<Grant[] | undefined>;
+    /** Every held chain whose leaf has this id, whoever issued it. */
+    getHeldById(id: string): Promise<Grant[][]>;
+    deleteHeld(key: GrantKey): Promise<void>;
+    /** Unexpired chains rooted at the node serving `rootIssuerBaseUrl`, latest expiry first. */
+    getUnexpiredHeldByRoot(rootIssuerBaseUrl: string, now: number): Promise<Grant[][]>;
+    /** Expired chains rooted at the node serving `rootIssuerBaseUrl`, latest expiry first. */
+    getExpiredHeldByRoot(rootIssuerBaseUrl: string, now: number): Promise<Grant[][]>;
+    getAllHeld(): Promise<Grant[][]>;
+    /** The key of the peer serving `baseUrl`, if this node knows it. */
+    getPeerKey(baseUrl: string): Promise<string | undefined>;
+    revoke(key: GrantKey): Promise<void>;
+    anyRevoked(keys: GrantKey[]): Promise<boolean>;
+    /** False when `key` was already claimed. */
+    claimNonce(key: string, expiresAt: number): Promise<boolean>;
+    deleteExpiredNonces(now: number): Promise<void>;
+    /** Blocking a blocked key again updates its reason and keeps the original time. */
+    block(publicKey: string, reason: string | null): Promise<void>;
+    /** False when the key wasn't blocked. */
+    unblock(publicKey: string): Promise<boolean>;
+    anyBlocked(publicKeys: string[]): Promise<boolean>;
+    /** In the order they were blocked. */
+    getBlocked(offset: number, limit: number): Promise<BlockedCaller[]>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/grant/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/grant/repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,WAAW;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAYD,MAAM,WAAW,aAAa;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACrB;AAQD;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACd;AASD,mHAAmH;AACnH,qBAAa,eAAe;IACZ,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,QAAQ,EAAI;IAEvC,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlD;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAa5D;IAED,uFAAuF;IACjF,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5C;IAEK,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,CAGzD;IAED,kEAAkE;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAGhD;IAEK,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7C;IAED,4FAA4F;IACtF,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAGvF;IAED,0FAA0F;IACpF,oBAAoB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAGrF;IAEK,UAAU,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAGrC;IAED,oEAAoE;IAC9D,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7D;IAEK,MAAM,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzC;IAEK,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnD;IAED,4CAA4C;IACtC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjE;IAEK,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAED,mFAAmF;IAC7E,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnE;IAED,yCAAyC;IACnC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjD;IAEK,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvD;IAED,sCAAsC;IAChC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAGxE;CACJ"}

package/dist/grant/repository.js

@@ -0,0 +1,105 @@
+/** Stored times are normalized so that SQL can order and compare them as text. */
+const isoTime = (time) => new Date(typeof time === 'string' ? Date.parse(time) : time).toISOString();
+/** Grants this node issued, grants it holds, grants it revoked, nonces it has seen, and caller keys it blocked. */
+export class GrantRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async saveIssued(grant) {
+        await this.db.run('INSERT INTO issued_grant (id, audience, capabilities, parent_grant_issuer, parent_grant_id, lifetime_ms, renewable_until, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)', [grant.id, grant.audience, JSON.stringify(grant.capabilities), grant.parent?.issuer ?? null, grant.parent?.id ?? null, grant.lifetimeMs, grant.renewableUntil, new Date().toISOString()]);
+    }
+    async getIssued(id) {
+        const row = await this.db.get('SELECT * FROM issued_grant WHERE id = ?', [id]);
+        if (!row) {
+            return undefined;
+        }
+        return {
+            id: row.id,
+            audience: row.audience,
+            capabilities: JSON.parse(row.capabilities),
+            parent: row.parent_grant_issuer !== null && row.parent_grant_id !== null ? { issuer: row.parent_grant_issuer, id: row.parent_grant_id } : null,
+            lifetimeMs: row.lifetime_ms,
+            renewableUntil: row.renewable_until,
+        };
+    }
+    /** Saves a chain this node holds, replacing an earlier copy of the same leaf grant. */
+    async saveHeld(chain) {
+        const leaf = chain[chain.length - 1];
+        await this.db.run(`INSERT INTO held_grant (issuer, id, root_issuer_base_url, chain, issued_at, expires_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)
+             ON CONFLICT (issuer, id) DO UPDATE SET root_issuer_base_url = excluded.root_issuer_base_url, chain = excluded.chain,
+                issued_at = excluded.issued_at, expires_at = excluded.expires_at, updated_at = excluded.updated_at`, [leaf.issuer, leaf.id, chain[0].issuerBaseUrl, JSON.stringify(chain), isoTime(leaf.issuedAt), isoTime(leaf.expiresAt), new Date().toISOString()]);
+    }
+    async getHeld(key) {
+        const row = await this.db.get('SELECT chain FROM held_grant WHERE issuer = ? AND id = ?', [key.issuer, key.id]);
+        return row ? JSON.parse(row.chain) : undefined;
+    }
+    /** Every held chain whose leaf has this id, whoever issued it. */
+    async getHeldById(id) {
+        const rows = await this.db.all('SELECT chain FROM held_grant WHERE id = ? ORDER BY issuer', [id]);
+        return rows.map(row => JSON.parse(row.chain));
+    }
+    async deleteHeld(key) {
+        await this.db.run('DELETE FROM held_grant WHERE issuer = ? AND id = ?', [key.issuer, key.id]);
+    }
+    /** Unexpired chains rooted at the node serving `rootIssuerBaseUrl`, latest expiry first. */
+    async getUnexpiredHeldByRoot(rootIssuerBaseUrl, now) {
+        const rows = await this.db.all('SELECT chain FROM held_grant WHERE root_issuer_base_url = ? AND expires_at > ? ORDER BY expires_at DESC', [rootIssuerBaseUrl, isoTime(now)]);
+        return rows.map(row => JSON.parse(row.chain));
+    }
+    /** Expired chains rooted at the node serving `rootIssuerBaseUrl`, latest expiry first. */
+    async getExpiredHeldByRoot(rootIssuerBaseUrl, now) {
+        const rows = await this.db.all('SELECT chain FROM held_grant WHERE root_issuer_base_url = ? AND expires_at <= ? ORDER BY expires_at DESC', [rootIssuerBaseUrl, isoTime(now)]);
+        return rows.map(row => JSON.parse(row.chain));
+    }
+    async getAllHeld() {
+        const rows = await this.db.all('SELECT chain FROM held_grant ORDER BY issuer, id');
+        return rows.map(row => JSON.parse(row.chain));
+    }
+    /** The key of the peer serving `baseUrl`, if this node knows it. */
+    async getPeerKey(baseUrl) {
+        const row = await this.db.get('SELECT public_key FROM peer WHERE base_url = ?', [baseUrl]);
+        return row?.public_key;
+    }
+    async revoke(key) {
+        await this.db.run('INSERT INTO revoked_grant (issuer, grant_id, revoked_at) VALUES (?, ?, ?) ON CONFLICT (issuer, grant_id) DO NOTHING', [key.issuer, key.id, new Date().toISOString()]);
+    }
+    async anyRevoked(keys) {
+        if (keys.length === 0) {
+            return false;
+        }
+        const conditions = keys.map(() => '(issuer = ? AND grant_id = ?)').join(' OR ');
+        const row = await this.db.get(`SELECT 1 FROM revoked_grant WHERE ${conditions} LIMIT 1`, keys.flatMap(key => [key.issuer, key.id]));
+        return row !== undefined;
+    }
+    /** False when `key` was already claimed. */
+    async claimNonce(key, expiresAt) {
+        const result = await this.db.run('INSERT INTO seen_nonce (key, expires_at) VALUES (?, ?) ON CONFLICT (key) DO NOTHING', [key, expiresAt]);
+        return (result.changes ?? 0) > 0;
+    }
+    async deleteExpiredNonces(now) {
+        await this.db.run('DELETE FROM seen_nonce WHERE expires_at <= ?', [now]);
+    }
+    /** Blocking a blocked key again updates its reason and keeps the original time. */
+    async block(publicKey, reason) {
+        await this.db.run('INSERT INTO blocked_caller (public_key, reason, blocked_at) VALUES (?, ?, ?) ON CONFLICT (public_key) DO UPDATE SET reason = excluded.reason', [publicKey, reason, new Date().toISOString()]);
+    }
+    /** False when the key wasn't blocked. */
+    async unblock(publicKey) {
+        const result = await this.db.run('DELETE FROM blocked_caller WHERE public_key = ?', [publicKey]);
+        return (result.changes ?? 0) > 0;
+    }
+    async anyBlocked(publicKeys) {
+        if (publicKeys.length === 0) {
+            return false;
+        }
+        const placeholders = publicKeys.map(() => '?').join(', ');
+        const row = await this.db.get(`SELECT 1 FROM blocked_caller WHERE public_key IN (${placeholders}) LIMIT 1`, publicKeys);
+        return row !== undefined;
+    }
+    /** In the order they were blocked. */
+    async getBlocked(offset, limit) {
+        const rows = await this.db.all('SELECT * FROM blocked_caller ORDER BY blocked_at, public_key LIMIT ? OFFSET ?', [limit, offset]);
+        return rows.map(row => ({ publicKey: row.public_key, reason: row.reason, blockedAt: row.blocked_at }));
+    }
+}

package/dist/grant/service.d.ts

@@ -0,0 +1,141 @@
+import type { ResourceFunctionCallParameter } from "requestscript";
+import type { NodeConfig } from "../service.js";
+import { type Capability, type Grant, type GrantRenewalRequest, type GrantRequest, type InvocationAuthorization } from "./grant.js";
+import type { BlockedCaller, GrantRepository, GrantKey } from "./repository.js";
+export interface GrantOptions {
+    /** How long each issued copy lasts. At most `MAX_GRANT_LIFETIME_MS`. */
+    lifetimeMs: number;
+    /** Access ends at this time: no copy expires later, and none is renewed after it. Omit to allow renewal until revoked. */
+    renewableUntil?: string;
+}
+/** What an approval hook decides: how long the grant lasts, and optionally narrower capabilities than requested. */
+export interface GrantApproval extends GrantOptions {
+    capabilities?: Capability[];
+}
+/**
+ * Decides a signed grant request. The caller's key and the request's freshness are already
+ * checked. Return undefined to refuse.
+ */
+export type ApproveGrant = (request: {
+    publicKey: string;
+    capabilities: Capability[];
+    details: Record<string, unknown> | null;
+}) => GrantApproval | undefined | Promise<GrantApproval | undefined>;
+export interface InvocationTarget {
+    resourcePath: string;
+    resourceName: string;
+    functionName: string;
+    parameters: ResourceFunctionCallParameter[];
+}
+export interface RefreshResult {
+    renewed: string[];
+    failed: {
+        id: string;
+        error: string;
+    }[];
+    /** Chains expired for longer than `HELD_GRANT_RETENTION_MS` whose issuer still refused renewal. They are deleted. */
+    removed: string[];
+}
+/** Per grant request or renewal. */
+export declare const GRANT_RENEW_TIMEOUT_MS = 10000;
+/**
+ * How long a held chain is kept after it expires while its issuer refuses to renew it. A refusal
+ * may be temporary, such as while this node's key is blocked, so chains aren't deleted at once.
+ */
+export declare const HELD_GRANT_RETENTION_MS: number;
+/** Thrown by `block` for a key that isn't an Ed25519 SPKI key. */
+export declare class InvalidPublicKeyError extends Error {
+    constructor();
+}
+/**
+ * Issues, holds, renews and verifies capability grants. Every node plays all three roles:
+ * a provider issues root grants, a holder can delegate narrower grants and renew them for
+ * its own audiences, and renewal of either kind goes through `renew`.
+ */
+export declare class GrantService {
+    private readonly repository;
+    private readonly config;
+    private readonly approveGrant?;
+    private lastNonceSweep;
+    /** Without `approveGrant`, this node refuses every grant request. */
+    constructor(repository: GrantRepository, config: Pick<NodeConfig, "baseUrl" | "publicKey" | "privateKey">, approveGrant?: ApproveGrant | undefined);
+    get acceptsRequests(): boolean;
+    /** Issues a root grant for this node's resources. Returns it as a one-grant chain. */
+    issue(audience: string, capabilities: Capability[], options: GrantOptions): Promise<Grant[]>;
+    /**
+     * Narrows a grant this node holds for another audience. The child expires no later than the
+     * held grant. Name the held grant by its id, or by its issuer and id when two issuers used the same id.
+     */
+    delegate(heldGrant: string | GrantKey, audience: string, capabilities: Capability[], options: GrantOptions): Promise<Grant[]>;
+    /**
+     * Revoked grants are refused in any chain this node verifies, and are never renewed. A
+     * delegator's revocation only stops renewal, since the provider never sees it, so it
+     * takes effect when the current copy expires. Name a grant this node issued by its id, and
+     * any other grant, such as one delegated further down a chain, by its issuer and id.
+     */
+    revoke(grant: string | GrantKey): Promise<void>;
+    /**
+     * Refuses `publicKey` everywhere this node can identify a caller: in any position of a
+     * restricted call's chain, and in renewals, grant requests and payment vouchers.
+     */
+    block(publicKey: string, reason?: string): Promise<void>;
+    /** False when the key wasn't blocked. */
+    unblock(publicKey: string): Promise<boolean>;
+    isBlocked(publicKey: string): Promise<boolean>;
+    getBlocked(offset: number, limit: number): Promise<BlockedCaller[]>;
+    /** Handles a holder's renewal request for a grant this node issued. Returns the fresh chain, or undefined if refused. */
+    renew(request: GrantRenewalRequest): Promise<Grant[] | undefined>;
+    /**
+     * Handles a caller's request for a new root grant: checks its signature and nonce, then
+     * asks the approval hook. Returns the issued chain, or undefined if refused. Throws if the
+     * hook throws or returns an invalid approval; the caller must then sign a new request.
+     */
+    handleRequest(request: GrantRequest): Promise<Grant[] | undefined>;
+    /**
+     * Asks the node at `providerBaseUrl` for a root grant and stores it. Throws if refused.
+     * The provider verifies the grant again on every call, so a grant from the wrong key only fails there.
+     */
+    request(providerBaseUrl: string, capabilities: Capability[], details?: Record<string, unknown>): Promise<Grant[]>;
+    /** Stores a chain whose leaf names this node as its audience. Throws if the chain is invalid. */
+    add(chain: Grant[]): Promise<void>;
+    /**
+     * Stores a chain passed in the node's start options. A held copy of the same grant that
+     * expires no earlier is a renewal of it, so it is kept. Returns false, storing nothing, for
+     * an expired chain. Throws if the chain is otherwise invalid.
+     */
+    seed(chain: Grant[]): Promise<boolean>;
+    /**
+     * A held chain, rooted at the node serving `rootBaseUrl`, that covers the call. When every
+     * such chain has expired, the latest-expiring one is renewed, once, before giving up, so a
+     * call waits on at most one renewal. Undefined when this node holds no usable grant.
+     */
+    chainFor(rootBaseUrl: string, target: InvocationTarget): Promise<Grant[] | undefined>;
+    /** Builds the authorization sent with a call. Sign a new one per attempt: providers refuse a reused nonce. */
+    authorize(chain: Grant[], target: InvocationTarget): InvocationAuthorization;
+    /**
+     * Renews every held chain past half its lifetime. A failed renewal keeps the current copy,
+     * unless the issuer refused it and the chain expired more than `HELD_GRANT_RETENTION_MS` ago.
+     */
+    refreshDue(): Promise<RefreshResult>;
+    /**
+     * True when `authorization` lets its signer make exactly this call: the chain is rooted at
+     * this node, unrevoked, addressed to the signer and covers the call, and the nonce is new.
+     */
+    verifyInvocation(authorization: unknown, target: InvocationTarget): Promise<boolean>;
+    /**
+     * Nonces are kept in the node's database, so they survive a restart. Replicas of a node that
+     * don't share a database don't see each other's nonces.
+     */
+    private claimNonce;
+    private findHeld;
+    /** Asks the leaf grant's issuer for a fresh chain and stores it. Throws if refused or invalid. */
+    private renewHeld;
+    /**
+     * POSTs a signed request to another node's grant endpoint and returns the chain it answered
+     * with, unverified. Throws `GrantRefusedError` if the node refused, and an Error if it failed.
+     */
+    private postForGrants;
+    /** The copy expires after `lifetimeMs`, but no later than its parent or `renewableUntil`. */
+    private sign;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/grant/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/grant/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAGnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACH,KAAK,UAAU,EAIf,KAAK,KAAK,EACV,KAAK,mBAAmB,EACxB,KAAK,YAAY,EAKjB,KAAK,uBAAuB,EAU/B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhF,MAAM,WAAW,YAAY;IACzB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,0HAA0H;IAC1H,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,oHAAoH;AACpH,MAAM,WAAW,aAAc,SAAQ,YAAY;IAC/C,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,UAAU,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAAE,KAAK,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;AAEnM,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,6BAA6B,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,aAAa;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxC,qHAAqH;IACrH,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,oCAAoC;AACpC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C;;;GAGG;AACH,eAAO,MAAM,uBAAuB,QAAwB,CAAC;AAM7D,kEAAkE;AAClE,qBAAa,qBAAsB,SAAQ,KAAK;IAC5C,cAEC;CACJ;AAeD;;;;GAIG;AACH,qBAAa,YAAY;IAIT,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAmB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAA4D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAH3K,OAAO,CAAC,cAAc,CAAK;IAE3B,qEAAqE;IACrE,YAA6B,UAAU,EAAE,eAAe,EAAmB,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC,EAAmB,YAAY,CAAC,EAAE,YAAY,YAAA,EAAI;IAE7L,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,sFAAsF;IAChF,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAMjG;IAED;;;OAGG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAkBlI;IAED;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAED;;;OAGG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D;IAED,yCAAyC;IACnC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAEK,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnD;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAExE;IAED,yHAAyH;IACnH,KAAK,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,CA2BtE;IAED;;;;OAIG;IACG,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,CAmCvE;IAED;;;OAGG;IACG,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAWtH;IAED,iGAAiG;IAC3F,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CASvC;IAED;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3C;IAED;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,CAqB1F;IAED,8GAA8G;IAC9G,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,GAAG,uBAAuB,CAM3E;IAED;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CA4CzC;IAED;;;OAGG;IACG,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBzF;IAED;;;OAGG;YACW,UAAU;YASV,QAAQ;IAkBtB,kGAAkG;YACpF,SAAS;IAevB;;;OAGG;YACW,aAAa;IAgB3B,6FAA6F;IAC7F,OAAO,CAAC,IAAI;CAcf"}