was-teaching-server 0.9.1

package/dist/config.default.d.ts

@@ -0,0 +1,360 @@
+import type { KmsRecordKekRegistry } from './types.js';
+/** Server version, read from package.json at startup. */
+export declare const SERVER_VERSION: string;
+/**
+ * Space Description cache (see src/requests/spaceContext.ts). The description is
+ * read on every authorized handler, so it is memoized per storage backend.
+ * Writes invalidate the entry explicitly; the short TTL is a backstop that also
+ * bounds staleness when several server processes share one storage backend (so
+ * one process's cache cannot serve another process's write indefinitely).
+ */
+export declare const SPACE_DESCRIPTION_CACHE_TTL = 5000;
+/** Max number of Space Descriptions held per backend cache (LRU-bounded). */
+export declare const SPACE_DESCRIPTION_CACHE_MAX = 1000;
+/**
+ * Max number of resolved external-backend adapters held per provider-registry
+ * cache (see src/lib/backendRegistry.ts), LRU-bounded. One adapter instance is
+ * memoized per selected `{spaceId}/{backendId}` and reused across requests;
+ * record changes bust the entry explicitly (no TTL backstop is needed because
+ * the provider registry itself is fixed for an instance's lifetime).
+ */
+export declare const RESOLVED_BACKEND_CACHE_MAX = 1000;
+/**
+ * Linkset relation URI for the access-control `policy` auxiliary resource
+ * (RFC9264 linkset discovery; see src/policy.ts and the linkset handlers).
+ */
+export declare const POLICY_LINK_RELATION = "https://wallet.storage/spec#policy";
+/**
+ * Linkset relation URI for a Collection's selected `backend` auxiliary resource
+ * (RFC9264 linkset discovery; advertised at `/space/{id}/{cid}/backend`).
+ */
+export declare const BACKEND_LINK_RELATION = "https://wallet.storage/spec#backend";
+/**
+ * Linkset relation URI for a Collection's `quota` report auxiliary resource
+ * (RFC9264 linkset discovery; advertised at `/space/{id}/{cid}/quota`).
+ */
+export declare const QUOTA_LINK_RELATION = "https://wallet.storage/spec#quota";
+/**
+ * Linkset relation URI for a Space's `backends-available` auxiliary resource
+ * (RFC9264 linkset discovery; advertised at `/space/{id}/backends`).
+ */
+export declare const BACKENDS_AVAILABLE_LINK_RELATION = "https://wallet.storage/spec#backends-available";
+/**
+ * Linkset relation URI for a Space's `quotas` report auxiliary resource
+ * (RFC9264 linkset discovery; advertised at `/space/{id}/quotas`).
+ */
+export declare const QUOTAS_LINK_RELATION = "https://wallet.storage/spec#quotas";
+/**
+ * Fraction of a backend's configured capacity at or above which its quota
+ * report `state` becomes `near-limit` (spec "Quotas"). Below this it is `ok`;
+ * at or above full capacity it is `over-quota`. Only applies when a finite
+ * capacity is configured (an unlimited backend is always `ok`).
+ */
+export declare const QUOTA_NEAR_LIMIT_FRACTION = 0.9;
+/**
+ * Write-path quota usage cache TTL (see
+ * `FileSystemBackend._assertSpaceHeadroom`). The quota pre-flight measures a
+ * Space's on-disk usage with `du`, which walks the whole Space tree -- too
+ * costly to repeat on every resource write. The measured total is cached per
+ * Space for this long, with each accepted write's incoming bytes added to the
+ * cached figure; deletes invalidate the entry. The TTL bounds the drift of
+ * that optimistic accounting (overwrites that replaced rather than added
+ * bytes, streamed bodies of undeclared size) -- the quota is a documented
+ * soft limit, and the TTL bounds the re-measurement window.
+ */
+export declare const QUOTA_USAGE_CACHE_TTL = 5000;
+/**
+ * The single in-process KMS module this server hard-wires.
+ * A keystore created without one gets this alias, and it is immutable thereafter.
+ */
+export declare const DEFAULT_KMS_MODULE = "local-v1";
+/**
+ * Max keystore configs returned by `GET /kms/keystores?controller=...` (the
+ * webkms protocol's list cap).
+ */
+export declare const KEYSTORE_LIST_LIMIT = 100;
+/**
+ * Max key descriptions returned per page by
+ * `GET /kms/keystores/:keystoreId/keys` (the List Keys fork extension). A
+ * further page is signalled by the response's `next` cursor URL; realistic
+ * keystores hold a handful of keys, so one page is the steady state.
+ */
+export declare const KEY_LIST_LIMIT = 100;
+/**
+ * Max capability delegation chain length accepted on `/kms` invocations, the
+ * root capability included (webkms-switch's `maxChainLength` default). A
+ * per-key `maxCapabilityChainLength` (1-10, set at generate time) may narrow
+ * this further for key operations; it can never widen it.
+ */
+export declare const KMS_MAX_CHAIN_LENGTH = 10;
+/**
+ * Max time-to-live of a delegated capability accepted on `/kms` invocations,
+ * measured `expires` minus the delegation proof's `created`, in milliseconds
+ * (90 days -- webkms-switch's `maxDelegationTtl` default). One unified bound
+ * for every `/kms` route family:
+ * revocation plus the mandatory `expires` is the real control.
+ */
+export declare const KMS_MAX_DELEGATION_TTL: number;
+/** TCP port the server listens on when `PORT` is unset. */
+export declare const DEFAULT_PORT = 3002;
+/**
+ * The default per-upload byte cap applied by BOTH backends when
+ * `MAX_UPLOAD_BYTES` is unset (a default-on limit, 64 MiB). Every blob write
+ * buffers through process memory on at least one path (the Postgres single
+ * `bytea`, multipart's in-memory `toBuffer()`), so "no cap" would be a footgun.
+ * Opt out explicitly with `MAX_UPLOAD_BYTES=unlimited`, which the backends
+ * accept only where an unbounded upload is actually safe (the filesystem
+ * streaming path; the Postgres backend rejects it at construction).
+ */
+export declare const DEFAULT_MAX_UPLOAD_BYTES: number;
+/**
+ * Default cap on the number of Spaces a single controller may create, applied
+ * by BOTH backends when `MAX_SPACES_PER_CONTROLLER` is unset (a default-on
+ * count quota). Chosen far above any teaching or conformance workload while
+ * still bounding runaway creation by one controller. Opt out with
+ * `MAX_SPACES_PER_CONTROLLER=unlimited`.
+ */
+export declare const DEFAULT_MAX_SPACES_PER_CONTROLLER = 100;
+/**
+ * Default cap on the number of Collections a single Space may hold, applied by
+ * BOTH backends when `MAX_COLLECTIONS_PER_SPACE` is unset (a default-on count
+ * quota). Opt out with `MAX_COLLECTIONS_PER_SPACE=unlimited`.
+ */
+export declare const DEFAULT_MAX_COLLECTIONS_PER_SPACE = 100;
+/**
+ * Default cap on the number of live Resources a single Space may hold across
+ * all its Collections, applied by BOTH backends when `MAX_RESOURCES_PER_SPACE`
+ * is unset (a default-on count quota). A tombstone (soft-deleted Resource) does
+ * not count against it. Opt out with `MAX_RESOURCES_PER_SPACE=unlimited`.
+ */
+export declare const DEFAULT_MAX_RESOURCES_PER_SPACE = 10000;
+/**
+ * The validated env-derived server configuration returned by
+ * {@link loadConfigFromEnv} and consumed by `start.ts`.
+ */
+export interface EnvConfig {
+    /** The server base URL (`SERVER_URL`); required, validated. */
+    serverUrl: string;
+    /** TCP port to listen on (`PORT`); defaults to {@link DEFAULT_PORT}. */
+    port: number;
+    /** Postgres connection string (`DATABASE_URL`); unset selects the filesystem backend. */
+    databaseUrl?: string;
+    /**
+     * Per-Space storage quota in bytes (`STORAGE_LIMIT_PER_SPACE`). `undefined`
+     * means unset -- unlimited, but `start.ts` warns to prompt an explicit
+     * choice; `Infinity` means `unlimited` was set explicitly (no warning).
+     */
+    storageLimitPerSpace?: number;
+    /**
+     * Per-upload size cap in bytes (`MAX_UPLOAD_BYTES`). `undefined` means unset
+     * -- the backends apply the {@link DEFAULT_MAX_UPLOAD_BYTES} default;
+     * `Infinity` means `unlimited` was set explicitly (no per-upload cap).
+     */
+    maxUploadBytes?: number;
+    /**
+     * Max Spaces a single controller may create (`MAX_SPACES_PER_CONTROLLER`).
+     * `undefined` means unset -- the backends apply the
+     * {@link DEFAULT_MAX_SPACES_PER_CONTROLLER} default; `Infinity` means
+     * `unlimited` was set explicitly (no cap).
+     */
+    maxSpacesPerController?: number;
+    /**
+     * Max Collections a single Space may hold (`MAX_COLLECTIONS_PER_SPACE`).
+     * `undefined` means unset -- the backends apply the
+     * {@link DEFAULT_MAX_COLLECTIONS_PER_SPACE} default; `Infinity` means
+     * `unlimited` was set explicitly (no cap).
+     */
+    maxCollectionsPerSpace?: number;
+    /**
+     * Max live Resources a single Space may hold across all its Collections
+     * (`MAX_RESOURCES_PER_SPACE`). `undefined` means unset -- the backends apply
+     * the {@link DEFAULT_MAX_RESOURCES_PER_SPACE} default; `Infinity` means
+     * `unlimited` was set explicitly (no cap).
+     */
+    maxResourcesPerSpace?: number;
+    /** Backend registration allowlist (`WAS_ENABLED_BACKENDS`); unset = permissive. */
+    enabledBackendProviders?: string[];
+    /**
+     * At-rest KMS key-record encryption registry (`KMS_RECORD_KEK` /
+     * `KMS_RECORD_KEKS` / `KMS_RECORD_CURRENT_KEK`); unset = plaintext.
+     */
+    kmsRecordKek?: KmsRecordKekRegistry;
+    /** Shared-secret provisioning gate (`WAS_ONBOARDING_TOKEN`); unset = open provisioning. */
+    onboardingToken?: string;
+}
+/**
+ * Reads and validates the server's whole env config surface in one place
+ * (fail-fast startup): a missing `SERVER_URL` or any malformed value throws
+ * with the offending variable named, before the server starts listening --
+ * instead of silently breaking ZCap matching at request time.
+ * @param [env] {NodeJS.ProcessEnv}   defaults to `process.env`
+ * @returns {EnvConfig}
+ */
+export declare function loadConfigFromEnv(env?: NodeJS.ProcessEnv): EnvConfig;
+/**
+ * Validates a server base URL (the `serverUrl` option / `SERVER_URL` env
+ * value): it must be an absolute `http:`/`https:` URL with no path, query, or
+ * fragment. ZCap `invocationTarget` URLs and `Location` headers are built by
+ * resolving absolute paths against this base (`new URL(path, serverUrl)`),
+ * which silently drops any base path -- so a sub-path deployment would break
+ * every delegated invocation. Rejected at startup instead (fail-fast).
+ * @param serverUrl {string}   the candidate base URL
+ * @returns {void}   throws on an invalid value
+ */
+export declare function assertValidServerUrl(serverUrl: string): void;
+/**
+ * Parses the `SERVER_URL` env value: the server's base URL, used to build and
+ * match ZCap `invocationTarget` URLs (host and port must match the client's
+ * exactly). Required -- unset would silently break all ZCap matching, so
+ * startup fails instead. The value is trimmed but otherwise preserved
+ * byte-for-byte (never normalized), since capability targets compare as exact
+ * strings. Validated by {@link assertValidServerUrl}.
+ * @param raw {string|undefined}   the raw env value
+ * @returns {string}   the trimmed, validated base URL
+ */
+export declare function parseServerUrl(raw: string | undefined): string;
+/**
+ * Parses the `PORT` env value into the TCP port to listen on. An unset or
+ * empty value returns {@link DEFAULT_PORT}.
+ * @param raw {string|undefined}   the raw env value
+ * @returns {number}   the port
+ */
+export declare function parsePort(raw: string | undefined): number;
+/**
+ * Parses the `DATABASE_URL` env value: a Postgres connection string that,
+ * when set, selects the PostgreSQL storage backend (unset keeps the default
+ * filesystem backend). The string's shape is left to the `pg` driver, which
+ * accepts several connection-string forms; an unset or empty value returns
+ * `undefined`.
+ * @param raw {string|undefined}   the raw env value
+ * @returns {string|undefined}   the trimmed connection string, or `undefined`
+ */
+export declare function parseDatabaseUrl(raw: string | undefined): string | undefined;
+/**
+ * Parses the at-rest key-record encryption env surface into a
+ * {@link KmsRecordKekRegistry} (the optional hardening increment). Each KEK is a
+ * single AES-256 key-encryption key in base58btc Multikey form
+ * (`secretKeyMultibase`, header `0xa2 0x01`), whose id is derived from its
+ * material (`deriveKekId`) and stored per record -- so registering a second KEK
+ * for rotation is a config change, not a schema migration. Three env variables
+ * feed it:
+ *
+ * - `KMS_RECORD_KEK` -- a single KEK (the teaching default alias);
+ * - `KMS_RECORD_KEKS` -- a comma-separated list of KEKs, each registered by its
+ *   derived id; the FIRST entry is the current KEK by default, so a rotation is
+ *   "prepend the new KEK, keep the old one behind it". Surrounding whitespace is
+ *   trimmed and empty entries ignored; a duplicate entry (same derived id twice)
+ *   throws;
+ * - `KMS_RECORD_CURRENT_KEK` -- optionally overrides which registered KEK wraps
+ *   NEW records: a `urn:kek:sha256:<hex>` id, a multibase KEK value (its id
+ *   derived), or the literal `none` (case-insensitive) which sets
+ *   `currentKekId: null` -- the decrypt-only posture (old records still read, new
+ *   records are written plaintext). It must name a registered KEK.
+ *
+ * All three unset/empty returns `undefined`, meaning encryption is disabled --
+ * key records are written plaintext (the default, honest about the teaching
+ * server's threat model). Setting both `KMS_RECORD_KEK` and `KMS_RECORD_KEKS` is
+ * ambiguous and throws; setting `KMS_RECORD_CURRENT_KEK` with no KEK configured
+ * throws. A malformed value throws (fails startup), naming the offending
+ * variable (and, for a list entry, its 1-based position) but never echoing the
+ * secret.
+ * @param options {object}
+ * @param [options.kek] {string}   the `KMS_RECORD_KEK` value
+ * @param [options.keks] {string}   the `KMS_RECORD_KEKS` value
+ * @param [options.currentKek] {string}   the `KMS_RECORD_CURRENT_KEK` value
+ * @returns {KmsRecordKekRegistry|undefined}   the registry, or `undefined` when
+ *   no KEK is configured
+ */
+export declare function parseKmsRecordKekRegistry({ kek, keks, currentKek }: {
+    kek?: string;
+    keks?: string;
+    currentKek?: string;
+}): KmsRecordKekRegistry | undefined;
+/**
+ * Parses the `STORAGE_LIMIT_PER_SPACE` env value into a per-Space capacity in
+ * bytes (spec "Quotas"). Accepts a plain non-negative integer number of bytes,
+ * or the literal `unlimited` (case-insensitive, trimmed) which returns
+ * `Infinity` -- an explicitly acknowledged unlimited quota (no startup
+ * warning). An unset or empty value returns `undefined`, meaning no limit is
+ * configured (still unlimited, but `start.ts` warns to prompt an explicit
+ * choice). A malformed value throws.
+ * @param raw {string|undefined}   the raw env value
+ * @returns {number|undefined}   capacity in bytes, `Infinity` for `unlimited`,
+ *   or `undefined` when unset
+ */
+export declare function parseStorageLimit(raw: string | undefined): number | undefined;
+/**
+ * Parses the `MAX_UPLOAD_BYTES` env value into a per-upload size cap in bytes
+ * (spec "Quotas", the backend's `maxUploadBytes` constraint). Accepts a plain
+ * non-negative integer number of bytes, or the literal `unlimited`
+ * (case-insensitive, trimmed) which returns `Infinity` -- explicitly no cap.
+ * An unset or empty value returns `undefined`, meaning not configured: the
+ * backends apply the {@link DEFAULT_MAX_UPLOAD_BYTES} default (a default-on
+ * limit). A single upload exceeding the cap is rejected with
+ * `payload-too-large` (413), while smaller uploads still succeed. A malformed
+ * value throws.
+ * @param raw {string|undefined}   the raw env value
+ * @returns {number|undefined}   the per-upload cap in bytes, `Infinity` for
+ *   `unlimited`, or `undefined` when unset
+ */
+export declare function parseMaxUploadBytes(raw: string | undefined): number | undefined;
+/**
+ * Parses one of the count-quota env values (`MAX_SPACES_PER_CONTROLLER`,
+ * `MAX_COLLECTIONS_PER_SPACE`, `MAX_RESOURCES_PER_SPACE`) into a maximum count.
+ * Accepts a plain non-negative integer, or the literal `unlimited`
+ * (case-insensitive, trimmed) which returns `Infinity` -- explicitly no cap. An
+ * unset or empty value returns `undefined`, meaning not configured: the backends
+ * apply the matching default-on limit ({@link DEFAULT_MAX_SPACES_PER_CONTROLLER}
+ * and friends). A malformed value throws, naming the variable and the
+ * `unlimited` escape hatch.
+ * @param raw {string|undefined}   the raw env value
+ * @param name {string}   the env variable name, for the error message
+ * @returns {number|undefined}   the max count, `Infinity` for `unlimited`, or
+ *   `undefined` when unset
+ */
+export declare function parseCountLimit(raw: string | undefined, name: string): number | undefined;
+/**
+ * Normalizes a count-quota constructor option to the internal instance field
+ * both backends store: an unset option (`undefined`) applies the default-on
+ * `fallback` limit; a non-finite option (`Infinity`, from an explicit
+ * `unlimited`) becomes `undefined` (no cap); a finite value passes through.
+ * Shared so the two backends cannot drift on the mapping (the same posture as
+ * the `maxUploadBytes` normalization each backend already applies), letting each
+ * count guard keep its plain `!== undefined` test.
+ * @param value {number|undefined}   the constructor option
+ * @param fallback {number}   the default-on limit applied when unset
+ * @returns {number|undefined}   the internal limit, or `undefined` for no cap
+ */
+export declare function normalizeCountLimit(value: number | undefined, fallback: number): number | undefined;
+/**
+ * Parses the `WAS_ENABLED_BACKENDS` env value into the server-wide registration
+ * allowlist: the backend `provider` names a client may register (spec
+ * "Backends"). A comma-separated list (e.g. `gdrive,s3`); surrounding whitespace
+ * and empty entries are ignored. An unset or empty value returns `undefined`,
+ * meaning no allowlist is configured -- any provider may be registered (the
+ * permissive default, preserving prior behavior). When set, a registration whose
+ * `provider` is not listed is rejected with `unsupported-backend` (409).
+ * @param raw {string|undefined}   the raw env value
+ * @returns {string[]|undefined}   the allowed provider names, or `undefined`
+ */
+export declare function parseEnabledBackends(raw: string | undefined): string[] | undefined;
+/**
+ * Parses the `WAS_ONBOARDING_TOKEN` env value into the shared-secret onboarding
+ * token gating the two open provisioning endpoints (`POST /spaces/`,
+ * `POST /kms/keystores`). An unset or empty/whitespace-only value returns
+ * `undefined`, meaning the feature is off -- provisioning is authorized by
+ * proving control of the body's controller DID (the teaching default). When
+ * set, those two endpoints instead require an `Authorization: Bearer <token>`
+ * header matching this value, which then substitutes for zcap verification.
+ * @param raw {string|undefined}   the raw env value
+ * @returns {string|undefined}   the trimmed token, or `undefined` when unset
+ */
+export declare function parseOnboardingToken(raw: string | undefined): string | undefined;
+export declare const SPEC_URL = "https://digitalcredentials.github.io/wallet-attached-storage-spec/";
+export declare const UBC_MANIFEST_URL = "https://codeberg.org/fediverse/fep/src/branch/main/fep/6fcd/fep-6fcd.md#manifest-file";
+export declare const SPACE_URL = "https://digitalcredentials.github.io/wallet-attached-storage-spec/#spaces";
+export declare const COLLECTION_URL = "https://digitalcredentials.github.io/wallet-attached-storage-spec/#collection-data-model";
+export declare const RESOURCE_URL = "https://digitalcredentials.github.io/wallet-attached-storage-spec/#resource-data-model";
+export declare const POLICY_URL = "https://digitalcredentials.github.io/wallet-attached-storage-spec/#policy";
+export declare const META_URL = "https://digitalcredentials.github.io/wallet-attached-storage-spec/#resource-metadata-data-model";
+//# sourceMappingURL=config.default.d.ts.map

package/dist/config.default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.default.d.ts","sourceRoot":"","sources":["../src/config.default.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAa,MAAM,YAAY,CAAA;AAMjE,yDAAyD;AACzD,eAAO,MAAM,cAAc,EAEd,MAAM,CAAA;AAEnB;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,OAAQ,CAAA;AAChD,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,OAAQ,CAAA;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,OAAQ,CAAA;AAE/C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,uCAAuC,CAAA;AAExE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,wCAAwC,CAAA;AAE1E;;;GAGG;AACH,eAAO,MAAM,mBAAmB,sCAAsC,CAAA;AAEtE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,mDACK,CAAA;AAElD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,uCAAuC,CAAA;AAExE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,OAAQ,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAAa,CAAA;AAE5C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,MAAM,CAAA;AAEjC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D,2DAA2D;AAC3D,eAAO,MAAM,YAAY,OAAO,CAAA;AAEhC;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAmB,CAAA;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAA;AAEpD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAA;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,QAAS,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAA;IACjB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAA;IACZ,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAA;IACnC,2FAA2F;IAC3F,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,SAAS,CA2BX;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAqB5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAU9D;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAWzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAAG,EACH,IAAI,EACJ,UAAU,EACX,EAAE;IACD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG,oBAAoB,GAAG,SAAS,CA2DnC;AA+BD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAe7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAepB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAcpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,EAAE,GAAG,SAAS,CAStB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAKpB;AAED,eAAO,MAAM,QAAQ,uEACiD,CAAA;AACtE,eAAO,MAAM,gBAAgB,0FAC4D,CAAA;AACzF,eAAO,MAAM,SAAS,8EACuD,CAAA;AAC7E,eAAO,MAAM,cAAc,6FACiE,CAAA;AAC5F,eAAO,MAAM,YAAY,2FACiE,CAAA;AAC1F,eAAO,MAAM,UAAU,8EACsD,CAAA;AAC7E,eAAO,MAAM,QAAQ,oGAC8E,CAAA"}