tapimo 0.0.0 → 0.0.2

package/dist/ApiKeySource.js

@@ -0,0 +1,234 @@
+/**
+ * Pluggable API-key sources for Tempo API.
+ *
+ * Every backend implements one shared contract ({@link Source}) covering both
+ * the read path ({@link Source.resolve}, wired into `Auth.middleware`'s
+ * `apiKey.source`) and the provisioning path ({@link Source.mint}/{@link
+ * Source.list}/{@link Source.revoke}), so backends are interchangeable wherever a
+ * source is accepted. {@link store} is the built-in store-backed source (e.g. a
+ * Cloudflare KV namespace); {@link from} type-checks a bring-your-own backend
+ * (D1, Postgres, …) against the contract. The persisted {@link Record}/{@link
+ * MintInput} shapes live here (derived from `ApiKey.schema` so they cannot drift
+ * from the resolved shape), while the shared credential primitives (token
+ * format/generation, storage-key derivation, redaction) live in `./ApiKey.js`.
+ */
+import * as z from 'zod/mini';
+import * as ApiKey from './ApiKey.js';
+/** Zod schemas owned by the API-key source module. */
+export var schema;
+(function (schema) {
+    /**
+     * Fields accepted when minting a key, and the single source of truth for the
+     * {@link MintInput} type and `mint` validation. Derived from the resolved
+     * `ApiKey.schema` (minus the generated `id`) so the scope vocabulary stays in
+     * lockstep with the resolved shape.
+     */
+    schema.MintInput = z.extend(z.omit(ApiKey.schema.ApiKey, { id: true }), {
+        createdBy: z
+            .optional(z.string())
+            .check(z.describe('Identity creating the key (e.g. admin email), recorded for audit.')),
+        expiresAt: z
+            .optional(z.string())
+            .check(z.describe('ISO 8601 expiry timestamp. Omit for a non-expiring key.')),
+        // TODO: make required once orgs exist.
+        orgId: z.optional(z.string()).check(z.describe('Owning organization id.')),
+    });
+    /**
+     * A persisted API-key record: the resolved `ApiKey.schema` plus
+     * persistence/display fields. Extending the resolved schema keeps the resolved
+     * and persisted shapes in lockstep.
+     */
+    schema.Record = z.extend(ApiKey.schema.ApiKey, {
+        createdAt: z.string().check(z.describe('ISO 8601 creation timestamp.')),
+        createdBy: z.optional(z.string()).check(z.describe('Identity that created the key.')),
+        expiresAt: z.optional(z.string()).check(z.describe('ISO 8601 expiry timestamp.')),
+        tokenLast4: z.string().check(z.describe('Last 4 chars of the plaintext token.')),
+    });
+})(schema || (schema = {}));
+/**
+ * Creates a {@link Source} from a value, type-checking it against the contract.
+ * The escape hatch for bringing your own backend (D1, Postgres, …): author the
+ * implementation inline and have it validated against {@link Source}.
+ */
+export function from(source) {
+    return source;
+}
+/**
+ * The default {@link Source} when none is configured: it resolves every token to
+ * `null` and lists nothing, so API-key access stays closed until a real source
+ * (e.g. {@link store}) is wired in. Its provisioning methods are inert —
+ * {@link Source.list} returns `[]`, {@link Source.revoke} returns `false`, and
+ * {@link Source.mint} throws, since there is nowhere to persist a key.
+ */
+export const noop = {
+    async list() {
+        return [];
+    },
+    async mint() {
+        throw new Error('cannot mint: no API-key source is configured');
+    },
+    async resolve() {
+        return null;
+    },
+    async revoke() {
+        return false;
+    },
+};
+/**
+ * Creates a store-backed {@link Source} over a {@link Store.State}. Records are
+ * persisted keyed by token hash (`ApiKey.keyFor`) and validated against the
+ * scope catalog on read; unknown, corrupt, expired, or invalid records resolve
+ * to `null`. An `id → recordKey` index makes revoke-by-id O(1).
+ */
+export function store(state) {
+    return {
+        async list(options = {}) {
+            const { keys } = await state.list({ prefix: ApiKey.recordPrefix });
+            const records = [];
+            for (const { name } of keys) {
+                const record = await read(state, name, Date.now());
+                if (record && (!options.orgId || record.orgId === options.orgId))
+                    records.push(record);
+            }
+            // Newest first; ids are random, so sort by creation time.
+            return records.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+        },
+        async mint(input) {
+            // Validate input (e.g. reject an unknown scope) at the write boundary so we
+            // never persist a record the reader would later refuse to resolve.
+            const valid = schema.MintInput.safeParse(input);
+            if (!valid.success)
+                throw new Error(`invalid API key input: ${z.prettifyError(valid.error)}`);
+            const data = valid.data;
+            const time = new Date();
+            const token = ApiKey.generateToken(data.environment);
+            const recordKey = ApiKey.keyFor(token);
+            const id = ApiKey.generateId();
+            const record = {
+                createdAt: time.toISOString(),
+                environment: data.environment,
+                id,
+                // TODO: drop fallback once a real org concept exists.
+                orgId: data.orgId ?? id,
+                scopes: data.scopes,
+                tokenLast4: token.slice(-4),
+                ...(data.createdBy === undefined ? {} : { createdBy: data.createdBy }),
+                ...(data.expiresAt === undefined ? {} : { expiresAt: data.expiresAt }),
+                ...(data.name === undefined ? {} : { name: data.name }),
+                ...(data.rateLimits === undefined ? {} : { rateLimits: data.rateLimits }),
+            };
+            // Bound the stored record by its expiry so the backend evicts it natively.
+            const ttl = data.expiresAt === undefined
+                ? undefined
+                : Math.max(1, Date.parse(data.expiresAt) - time.getTime());
+            await state.put(recordKey, JSON.stringify(record), { ttl });
+            // Index `id → recordKey` so revoke-by-id is O(1) (records are keyed by
+            // token hash, unrecoverable from the id alone). Shares the record's TTL so
+            // both entries expire together.
+            await state.put(idKeyFor(record.id), recordKey, { ttl });
+            return { record, token };
+        },
+        async resolve(token) {
+            return read(state, ApiKey.keyFor(token), Date.now());
+        },
+        async revoke(id) {
+            const recordKey = await state.get(idKeyFor(id));
+            if (!recordKey)
+                return false;
+            await state.delete(recordKey);
+            await state.delete(idKeyFor(id));
+            return true;
+        },
+    };
+}
+/**
+ * Wraps a source with a short-TTL in-memory cache on the resolve path, so hot
+ * keys skip the backend read (e.g. a KV `get`) on every request. Positive
+ * results cache for `ttl` (default 60s), negative for `negativeTtl` (default
+ * 10s) so a freshly minted key is usable quickly; concurrent misses for one
+ * token are single-flighted. Entries are keyed by the token's storage-key
+ * derivation (`ApiKey.keyFor`, a sha256) — never the plaintext token.
+ *
+ * The cache is per-isolate, so a revoked key may stay resolvable elsewhere
+ * for up to `ttl` — the accepted trade-off for removing a backend read from
+ * the auth path of every request. Provisioning methods pass through uncached.
+ */
+export function cached(source, options = {}) {
+    const { negativeTtl = 10_000, now = Date.now, ttl = 60_000 } = options;
+    const cells = new Map();
+    const flights = new Map();
+    return {
+        ...source,
+        async resolve(token) {
+            // Versioned so a future record-shape change can't serve stale shapes.
+            const key = `v1:${ApiKey.keyFor(token)}`;
+            const cell = cells.get(key);
+            if (cell && cell.expiresAt > now())
+                return cell.value;
+            if (cell)
+                cells.delete(key);
+            const existing = flights.get(key);
+            if (existing)
+                return existing;
+            const flight = (async () => {
+                const value = await source.resolve(token);
+                // Bound the cache: random invalid tokens each add a (negative) entry,
+                // so sweep expired cells at the cap and then drop the oldest.
+                if (cells.size >= cachedMaxEntries) {
+                    const time = now();
+                    for (const [name, entry] of cells)
+                        if (entry.expiresAt <= time)
+                            cells.delete(name);
+                    while (cells.size >= cachedMaxEntries)
+                        cells.delete(cells.keys().next().value);
+                }
+                cells.set(key, { expiresAt: now() + (value ? ttl : negativeTtl), value });
+                return value;
+            })();
+            flights.set(key, flight);
+            try {
+                return await flight;
+            }
+            finally {
+                flights.delete(key);
+            }
+        },
+    };
+}
+/** Maximum resolve-cache entries held per isolate before eviction. */
+const cachedMaxEntries = 10_000;
+/**
+ * Reads and validates a stored record by storage key. Invalid, corrupt, or
+ * expired records (`expiresAt <= now`) resolve to `null`. Expiry is enforced
+ * here — not just via the store's native TTL — so it holds on backends that
+ * evict lazily and regardless of TTL granularity.
+ */
+async function read(state, key, now) {
+    const raw = await state.get(key);
+    if (!raw)
+        return null;
+    const value = (() => {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (value === undefined)
+        return null;
+    const parsed = schema.Record.safeParse(value);
+    if (!parsed.success)
+        return null;
+    const record = parsed.data;
+    if (record.expiresAt !== undefined && Date.parse(record.expiresAt) <= now)
+        return null;
+    return record;
+}
+/** Storage-key prefix for the store source's `id → recordKey` index. */
+const idPrefix = 'apikey_id:';
+/** Storage key under which the store source's `id → recordKey` index entry is persisted. */
+function idKeyFor(id) {
+    return `${idPrefix}${id}`;
+}
+//# sourceMappingURL=ApiKeySource.js.map

package/dist/ApiKeySource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeySource.js","sourceRoot":"","sources":["../src/ApiKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAGrC,sDAAsD;AACtD,MAAM,KAAW,MAAM,CA6BtB;AA7BD,WAAiB,MAAM;IACrB;;;;;OAKG;IACU,gBAAS,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;QAC5E,SAAS,EAAE,CAAC;aACT,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACpB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;QACzF,SAAS,EAAE,CAAC;aACT,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACpB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC;QAC/E,uCAAuC;QACvC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;KAC3E,CAAC,CAAA;IAEF;;;;OAIG;IACU,aAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QACvE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;QACrF,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QACjF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;KACjF,CAAC,CAAA;AACJ,CAAC,EA7BgB,MAAM,KAAN,MAAM,QA6BtB;AAqDD;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAA8B,MAAc;IAC9D,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAW;IAC1B,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,CAAA;IACX,CAAC;IACD,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,CAAC,MAAM;QACV,OAAO,KAAK,CAAA;IACd,CAAC;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,KAAkB;IACtC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE;YACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;YAClE,MAAM,OAAO,GAAa,EAAE,CAAA;YAC5B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;gBAClD,IAAI,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACxF,CAAC;YACD,0DAA0D;YAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;QACvE,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,4EAA4E;YAC5E,mEAAmE;YACnE,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAC/C,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC7F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;YAEvB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACpD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YAC9B,MAAM,MAAM,GAAW;gBACrB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;gBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,EAAE;gBACF,sDAAsD;gBACtD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;aAC1E,CAAA;YAED,2EAA2E;YAC3E,MAAM,GAAG,GACP,IAAI,CAAC,SAAS,KAAK,SAAS;gBAC1B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3D,uEAAuE;YACvE,2EAA2E;YAC3E,gCAAgC;YAChC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACxD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QAC1B,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,OAAO,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACtD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAA;YAC5B,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;YAChC,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,OAAO,GAAmB,EAAE;IACjE,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,GAAG,OAAO,CAAA;IAEtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAA;IAEhE,OAAO;QACL,GAAG,MAAM;QACT,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,sEAAsE;YACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAA;YACrD,IAAI,IAAI;gBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAE7B,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBACzC,sEAAsE;gBACtE,8DAA8D;gBAC9D,IAAI,KAAK,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAA;oBAClB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK;wBAAE,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI;4BAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;oBAClF,OAAO,KAAK,CAAC,IAAI,IAAI,gBAAgB;wBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAA;gBAC1F,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;gBACzE,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,EAAE,CAAA;YACJ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACxB,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAA;YACrB,CAAC;oBAAS,CAAC;gBACT,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAcD,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B;;;;;GAKG;AACH,KAAK,UAAU,IAAI,CAAC,KAAkB,EAAE,GAAW,EAAE,GAAW;IAC9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE;QAClB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAA;IAC1B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA;IACtF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,wEAAwE;AACxE,MAAM,QAAQ,GAAG,YAAY,CAAA;AAE7B,4FAA4F;AAC5F,SAAS,QAAQ,CAAC,EAAU;IAC1B,OAAO,GAAG,QAAQ,GAAG,EAAE,EAAE,CAAA;AAC3B,CAAC"}