tapimo 0.0.2 → 0.2.0

package/dist/ApiKeys.js

@@ -0,0 +1,282 @@
+/**
+ * API-key persistence over the app's KV state store (`App.create({ kv })`).
+ *
+ * Records are keyed by token hash (`ApiKey.keyFor`) — the plaintext token is
+ * never stored — and validated against the scope catalog on read; unknown,
+ * corrupt, expired, or invalid records resolve to `null`. An `id → recordKey`
+ * index makes revoke-by-id O(1). The persisted {@link Record}/{@link
+ * MintInput} shapes live here (derived from `ApiKey.schema` so they cannot
+ * drift from the resolved shape), while the shared credential primitives
+ * (token format/generation, storage-key derivation, redaction) live in
+ * `./ApiKey.js`.
+ */
+import * as z from 'zod/mini';
+import * as ApiKey from './ApiKey.js';
+/** Zod schemas owned by the API-keys module. */
+export var schema;
+(function (schema) {
+    /**
+     * Fields accepted when minting a key, and the single source of truth for the
+     * {@link MintInput} type and `mint` validation. Derived from the resolved
+     * `ApiKey.schema` (minus the generated `id`) so the scope vocabulary stays in
+     * lockstep with the resolved shape.
+     */
+    schema.MintInput = z.extend(z.omit(ApiKey.schema.ApiKey, { id: true }), {
+        createdBy: z
+            .optional(z.string())
+            .check(z.describe('Identity creating the key (e.g. admin email), recorded for audit.')),
+        expiresAt: z
+            .optional(z.string())
+            .check(z.describe('ISO 8601 expiry timestamp. Omit for a non-expiring key.')),
+        // TODO: make required once orgs exist.
+        orgId: z.optional(z.string()).check(z.describe('Owning organization id.')),
+    });
+    /**
+     * A persisted API-key record: the resolved `ApiKey.schema` plus
+     * persistence/display fields. Extending the resolved schema keeps the resolved
+     * and persisted shapes in lockstep.
+     */
+    schema.Record = z.extend(ApiKey.schema.ApiKey, {
+        createdAt: z.string().check(z.describe('ISO 8601 creation timestamp.')),
+        createdBy: z.optional(z.string()).check(z.describe('Identity that created the key.')),
+        expiresAt: z.optional(z.string()).check(z.describe('ISO 8601 expiry timestamp.')),
+        tokenLast4: z.string().check(z.describe('Last 4 chars of the plaintext token.')),
+    });
+})(schema || (schema = {}));
+/**
+ * Mints a key: validates the input (e.g. rejects an unknown scope at the write
+ * boundary), persists its hashed record, and returns the record plus the
+ * one-time plaintext token (shown once, unrecoverable afterward).
+ *
+ * @param state - The KV state store holding key records.
+ * @param input - The key to mint.
+ * @returns The persisted record and its one-time token.
+ */
+export async function mint(state, input) {
+    const valid = schema.MintInput.safeParse(input);
+    if (!valid.success)
+        throw new Error(`invalid API key input: ${z.prettifyError(valid.error)}`);
+    const data = valid.data;
+    const time = new Date();
+    const token = ApiKey.generateToken(data.environment);
+    const recordKey = ApiKey.keyFor(token);
+    const id = ApiKey.generateId();
+    const record = {
+        createdAt: time.toISOString(),
+        environment: data.environment,
+        id,
+        // TODO: drop fallback once a real org concept exists.
+        orgId: data.orgId ?? id,
+        scopes: data.scopes,
+        tokenLast4: token.slice(-4),
+        ...(data.createdBy === undefined ? {} : { createdBy: data.createdBy }),
+        ...(data.expiresAt === undefined ? {} : { expiresAt: data.expiresAt }),
+        ...(data.name === undefined ? {} : { name: data.name }),
+        ...(data.projectId === undefined ? {} : { projectId: data.projectId }),
+        ...(data.rateLimits === undefined ? {} : { rateLimits: data.rateLimits }),
+    };
+    // Bound the stored record by its expiry so the backend evicts it natively.
+    const ttl = data.expiresAt === undefined
+        ? undefined
+        : Math.max(1, Date.parse(data.expiresAt) - time.getTime());
+    await state.put(recordKey, JSON.stringify(record), { ttl });
+    // Index `id → recordKey` so revoke-by-id is O(1) (records are keyed by
+    // token hash, unrecoverable from the id alone). Shares the record's TTL so
+    // both entries expire together.
+    await state.put(idKeyFor(record.id), recordKey, { ttl });
+    // Index `org → recordKey` (one entry per key, so concurrent mints never
+    // race a shared value) backing org-scoped listing without a full scan.
+    await state.put(orgKeyFor(record.orgId, record.id), recordKey, { ttl });
+    return { record, token };
+}
+/**
+ * Resolves a plaintext API key token to its metadata, or `null`. Expiry is
+ * enforced on read — not just via the store's native TTL — so it holds on
+ * backends that evict lazily and regardless of TTL granularity.
+ *
+ * @param state - The KV state store holding key records.
+ * @param token - The presented plaintext token.
+ * @returns The resolved key metadata, or `null`.
+ */
+export async function resolve(state, token) {
+    return read(state, ApiKey.keyFor(token), Date.now());
+}
+/**
+ * Reads a key record by id (metadata only — never the token), or `null`.
+ *
+ * @param state - The KV state store holding key records.
+ * @param id - The key id (`key_…`).
+ * @returns The record, or `null`.
+ */
+export async function get(state, id) {
+    const recordKey = await state.get(idKeyFor(id));
+    if (!recordKey)
+        return null;
+    return read(state, recordKey, Date.now());
+}
+/**
+ * Lists key records (metadata only — never tokens), newest first. Expired or
+ * catalog-invalid records are skipped.
+ *
+ * @param state - The KV state store holding key records.
+ * @param options - Optional owner filter.
+ * @returns The records.
+ */
+export async function list(state, options = {}) {
+    const { keys } = await state.list({ prefix: ApiKey.recordPrefix });
+    const records = [];
+    for (const { name } of keys) {
+        const record = await read(state, name, Date.now());
+        if (record && (!options.orgId || record.orgId === options.orgId))
+            records.push(record);
+    }
+    // Newest first; ids are random, so sort by creation time.
+    return records.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+}
+/**
+ * Lists an organization's key records through the org index (no full scan),
+ * newest first. Dangling index entries (revoked or expired records) are
+ * skipped and lazily deleted.
+ *
+ * @param state - The KV state store holding key records.
+ * @param orgId - The owning organization id (`org_…`).
+ * @param options - Optional project filter.
+ * @returns The records.
+ */
+export async function listByOrg(state, orgId, options = {}) {
+    const { keys } = await state.list({ prefix: `${orgPrefix}${orgId}:` });
+    const records = [];
+    for (const { name } of keys) {
+        const recordKey = await state.get(name);
+        const record = recordKey ? await read(state, recordKey, Date.now()) : null;
+        if (!record) {
+            await state.delete(name);
+            continue;
+        }
+        if (!options.projectId || record.projectId === options.projectId)
+            records.push(record);
+    }
+    return records.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+}
+/**
+ * Revokes a key by id, deleting its record and index entries.
+ *
+ * @param state - The KV state store holding key records.
+ * @param id - The key id (`key_…`).
+ * @returns Whether a matching record was deleted.
+ */
+export async function revoke(state, id) {
+    const recordKey = await state.get(idKeyFor(id));
+    if (!recordKey)
+        return false;
+    // Parse loosely for the org index entry: even a record the catalog no
+    // longer validates must clean up its index on revoke.
+    const raw = await state.get(recordKey);
+    const orgId = (() => {
+        try {
+            return raw ? JSON.parse(raw).orgId : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    await state.delete(recordKey);
+    await state.delete(idKeyFor(id));
+    if (orgId)
+        await state.delete(orgKeyFor(orgId, id));
+    return true;
+}
+/**
+ * Re-attributes a key to an organization and/or project, rewriting its record
+ * in place (same token hash) and moving the org index entry when the org
+ * changes. The backfill path for legacy keys.
+ *
+ * @param state - The KV state store holding key records.
+ * @param id - The key id (`key_…`).
+ * @param input - The attribution to apply.
+ * @returns The updated record, or `null` when the key is absent.
+ */
+export async function attribute(state, id, input) {
+    const recordKey = await state.get(idKeyFor(id));
+    if (!recordKey)
+        return null;
+    const record = await read(state, recordKey, Date.now());
+    if (!record)
+        return null;
+    const updated = {
+        ...record,
+        ...(input.orgId === undefined ? {} : { orgId: input.orgId }),
+        ...(input.projectId === undefined ? {} : { projectId: input.projectId }),
+    };
+    const ttl = updated.expiresAt === undefined
+        ? undefined
+        : Math.max(1, Date.parse(updated.expiresAt) - Date.now());
+    await state.put(recordKey, JSON.stringify(updated), { ttl });
+    if (updated.orgId !== record.orgId)
+        await state.delete(orgKeyFor(record.orgId, id));
+    await state.put(orgKeyFor(updated.orgId, id), recordKey, { ttl });
+    return updated;
+}
+/**
+ * Rebuilds the `id` and `org` index entries for every stored record — the
+ * run-once backfill making legacy keys visible to org-scoped listing. Records
+ * themselves are never modified, so existing tokens keep resolving.
+ *
+ * @param state - The KV state store holding key records.
+ * @returns Scanned and indexed record counts.
+ */
+export async function backfill(state) {
+    const { keys } = await state.list({ prefix: ApiKey.recordPrefix });
+    let indexed = 0;
+    for (const { name } of keys) {
+        const record = await read(state, name, Date.now());
+        if (!record)
+            continue;
+        const ttl = record.expiresAt === undefined
+            ? undefined
+            : Math.max(1, Date.parse(record.expiresAt) - Date.now());
+        await state.put(idKeyFor(record.id), name, { ttl });
+        await state.put(orgKeyFor(record.orgId, record.id), name, { ttl });
+        indexed += 1;
+    }
+    return { indexed, scanned: keys.length };
+}
+/**
+ * Reads and validates a stored record by storage key. Invalid, corrupt, or
+ * expired records (`expiresAt <= now`) resolve to `null`.
+ */
+async function read(state, key, now) {
+    const raw = await state.get(key);
+    if (!raw)
+        return null;
+    const value = (() => {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (value === undefined)
+        return null;
+    const parsed = schema.Record.safeParse(value);
+    if (!parsed.success)
+        return null;
+    const record = parsed.data;
+    if (record.expiresAt !== undefined && Date.parse(record.expiresAt) <= now)
+        return null;
+    return record;
+}
+/** Storage-key prefix for the `id → recordKey` index. */
+const idPrefix = 'apikey_id:';
+/** Storage key under which a key's `id → recordKey` index entry is persisted. */
+function idKeyFor(id) {
+    return `${idPrefix}${id}`;
+}
+/** Storage-key prefix for the per-key `org → recordKey` listing index. */
+const orgPrefix = 'apikey_org:';
+/** Storage key under which a key's org index entry is persisted. */
+function orgKeyFor(orgId, id) {
+    return `${orgPrefix}${orgId}:${id}`;
+}
+//# sourceMappingURL=ApiKeys.js.map

package/dist/ApiKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeys.js","sourceRoot":"","sources":["../src/ApiKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAGrC,gDAAgD;AAChD,MAAM,KAAW,MAAM,CA6BtB;AA7BD,WAAiB,MAAM;IACrB;;;;;OAKG;IACU,gBAAS,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;QAC5E,SAAS,EAAE,CAAC;aACT,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACpB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;QACzF,SAAS,EAAE,CAAC;aACT,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACpB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC;QAC/E,uCAAuC;QACvC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;KAC3E,CAAC,CAAA;IAEF;;;;OAIG;IACU,aAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QACvE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;QACrF,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QACjF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;KACjF,CAAC,CAAA;AACJ,CAAC,EA7BgB,MAAM,KAAN,MAAM,QA6BtB;AAyBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,KAAkB,EAAE,KAAgB;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC7F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IAEvB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IACvB,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAW;QACrB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,EAAE;QACF,sDAAsD;QACtD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;KAC1E,CAAA;IAED,2EAA2E;IAC3E,MAAM,GAAG,GACP,IAAI,CAAC,SAAS,KAAK,SAAS;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3D,uEAAuE;IACvE,2EAA2E;IAC3E,gCAAgC;IAChC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IACxD,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IACvE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAkB,EAAE,KAAa;IAC7D,OAAO,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,KAAkB,EAAE,EAAU;IACtD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,KAAkB,EAClB,OAAO,GAAiB,EAAE;IAE1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;IAClE,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAClD,IAAI,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACxF,CAAC;IACD,0DAA0D;IAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AACvE,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAkB,EAClB,KAAa,EACb,OAAO,GAAsB,EAAE;IAE/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,KAAK,GAAG,EAAE,CAAC,CAAA;IACtE,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACxB,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AACvE,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAkB,EAAE,EAAU;IACzD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAC5B,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE;QAClB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IAChC,IAAI,KAAK;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAkB,EAClB,EAAU,EACV,KAAsB;IAEtB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,OAAO,GAAW;QACtB,GAAG,MAAM;QACT,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;KACzE,CAAA;IACD,MAAM,GAAG,GACP,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7D,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5D,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IACnF,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IACjE,OAAO,OAAO,CAAA;AAChB,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAkB;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;IAClE,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,GAAG,GACP,MAAM,CAAC,SAAS,KAAK,SAAS;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAC5D,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAClE,OAAO,IAAI,CAAC,CAAA;IACd,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAC1C,CAAC;AAYD;;;GAGG;AACH,KAAK,UAAU,IAAI,CAAC,KAAkB,EAAE,GAAW,EAAE,GAAW;IAC9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE;QAClB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAA;IAC1B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA;IACtF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,yDAAyD;AACzD,MAAM,QAAQ,GAAG,YAAY,CAAA;AAE7B,iFAAiF;AACjF,SAAS,QAAQ,CAAC,EAAU;IAC1B,OAAO,GAAG,QAAQ,GAAG,EAAE,EAAE,CAAA;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,SAAS,GAAG,aAAa,CAAA;AAE/B,oEAAoE;AACpE,SAAS,SAAS,CAAC,KAAa,EAAE,EAAU;IAC1C,OAAO,GAAG,SAAS,GAAG,KAAK,IAAI,EAAE,EAAE,CAAA;AACrC,CAAC"}