was-teaching-server 0.9.1

package/dist/requests/CollectionRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CollectionRequest.js","sourceRoot":"","sources":["../../src/requests/CollectionRequest.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAGnC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAA;AACnE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC7B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,WAAW,EACX,WAAW,EACX,SAAS,EACT,SAAS,EACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EAC1B,MAAM,cAAc,CAAA;AAErB,MAAM,OAAO,iBAAiB;IAC5B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,OAEE,EACF,KAAmB;QAEnB,MAAM,EACJ,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAClC,GAAG,OAAO,CAAA;QACX,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7C,MAAM,WAAW,GAAG,iBAAiB,CAAA;QAErC,sEAAsE;QACtE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAE1D,4EAA4E;QAC5E,iDAAiD;QACjD,MAAM,mBAAmB,CAAC;YACxB,OAAO;YACP,OAAO;YACP,UAAU,EAAE,cAAc,CAAC;gBACzB,OAAO;gBACP,YAAY;gBACZ,aAAa,EAAE,IAAI;aACpB,CAAC;YACF,WAAW;SACZ,CAAC,CAAA;QAEF,yBAAyB;QACzB,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;YACvD,OAAO;YACP,OAAO;YACP,YAAY;YACZ,WAAW;SACZ,CAAC,CAAA;QAEF,8EAA8E;QAC9E,6EAA6E;QAC7E,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,uEAAuE;QACvE,4BAA4B,CAAC;YAC3B,qBAAqB;YACrB,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAA;QAEF,4BAA4B;QAC5B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAA;QAC3B,IAAI,QAA+D,CAAA;QACnE,IAAI,OAA4B,CAAA;QAEhC,0EAA0E;QAC1E,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC;YACvC,OAAO;YACP,OAAO;YACP,YAAY;YACZ,qBAAqB;SACtB,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QAC9D,4EAA4E;QAC5E,6EAA6E;QAC7E,mEAAmE;QACnE,4EAA4E;QAC5E,MAAM,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC;gBACxC,OAAO;gBACP,YAAY;gBACZ,UAAU;gBACV,KAAK;gBACL,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC;gBAC9B,KAAK;aACN,CAAC,CAAA;YACF,QAAQ,GAAG;gBACT,EAAE,EAAE,UAAU;gBACd,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;aAChD,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yBAAyB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EACnD,SAAS,CACV,CAAC,QAAQ,EAAE,CAAA;QACZ,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QACpC,0EAA0E;QAC1E,0CAA0C;QAC1C,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;QACjD,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAA;QAEzB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,CACd,OAQE,EACF,KAAmB;QAEnB,MAAM,EACJ,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EACjC,IAAI,EACL,GAAG,OAAO,CAAA;QACX,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,WAAW,GAAG,mBAAmB,CAAA;QAEvC,sEAAsE;QACtE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAE1D,2EAA2E;QAC3E,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,uBAAuB,CAAC;gBAChC,WAAW;gBACX,MAAM,EAAE,gCAAgC,IAAI,CAAC,EAAE,2CAA2C,YAAY,IAAI;gBAC1G,OAAO,EAAE,MAAM;aAChB,CAAC,CAAA;QACJ,CAAC;QACD,kEAAkE;QAClE,uEAAuE;QACvE,2EAA2E;QAC3E,6EAA6E;QAC7E,qBAAqB;QACrB,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;YACnD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW;SACZ,CAAC,CAAA;QAEF,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,mBAAmB,CAAC;YACjE,OAAO;YACP,OAAO;YACP,UAAU,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACrD,WAAW;SACZ,CAAC,CAAA;QAEF,6BAA6B;QAC7B,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,+DAA+D;QAC/D,MAAM,eAAe,GACnB,IAAI,CAAC,OAAO,KAAK,SAAS;YACxB,CAAC,CAAC,MAAM,sBAAsB,CAAC;gBAC3B,OAAO;gBACP,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW;aACZ,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC;YAChE,OAAO;YACP,YAAY;SACb,CAAC,CAAA;QACF,oEAAoE;QACpE,wEAAwE;QACxE,mEAAmE;QACnE,2EAA2E;QAC3E,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,gCAAgC,CAAC;gBAC/B,QAAQ,EAAE,kBAAkB,EAAE,UAAU;gBACxC,QAAQ,EAAE,kBAAkB;aAC7B,CAAC,CAAA;QACJ,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,0EAA0E;QAC1E,kBAAkB;QAClB,MAAM,qBAAqB,GAAG,kBAAkB;YAC9C,CAAC,CAAC,2CAA2C;gBAC3C;oBACE,GAAG,kBAAkB;oBACrB,EAAE,EAAE,YAAY;oBAChB,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnD,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;oBAClE,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI;wBACtC,UAAU,EAAE,kBAAkB;qBAC/B,CAAC;iBACH;YACH,CAAC,CAAC,iBAAiB;gBACjB;oBACE,EAAE,EAAE,YAAY;oBAChB,IAAI,EAAE,CAAC,YAAY,CAAC;oBACpB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,YAAY;oBAC/B,OAAO,EAAE,eAAe,IAAI,EAAE,EAAE,EAAE,kBAAkB,EAAE;oBACtD,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI;wBACtC,UAAU,EAAE,kBAAkB;qBAC/B,CAAC;iBACH,CAAA;QAEL,6EAA6E;QAC7E,sEAAsE;QACtE,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,8DAA8D;QAC9D,8CAA8C;QAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,OAA4B,CAAA;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC;gBACtC,OAAO;gBACP,YAAY;gBACZ,qBAAqB;gBACrB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC;gBAC9B,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;gBACzC,qEAAqE;gBACrE,mEAAmE;gBACnE,6DAA6D;gBAC7D,qEAAqE;gBACrE,oEAAoE;gBACpE,kEAAkE;gBAClE,8CAA8C;gBAC9C,gBAAgB,EAAE,KAAK,CAAC,EAAE,CACxB,gCAAgC,CAAC;oBAC/B,QAAQ,EAAE,KAAK,EAAE,UAAU;oBAC3B,QAAQ,EAAE,qBAAqB,CAAC,UAAU;iBAC3C,CAAC;aACL,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,4EAA4E;YAC5E,yBAAyB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;QACjD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;QACvC,uEAAuE;QACvE,0CAA0C;QAC1C,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;QACjD,OAAO,kBAAkB;YACvB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS;YACpC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA,CAAC,SAAS;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,CACd,OAEE,EACF,KAAmB;QAEnB,MAAM,EACJ,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAClC,GAAG,OAAO,CAAA;QACX,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,WAAW,GAAG,gBAAgB,CAAA;QAEpC,sEAAsE;QACtE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAE1D,0EAA0E;QAC1E,gFAAgF;QAChF,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,OAAO;YACP,YAAY;YACZ,UAAU,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACrD,WAAW;SACZ,CAAC,CAAA;QAEF,yBAAyB;QACzB,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;YACvD,OAAO;YACP,OAAO;YACP,YAAY;YACZ,WAAW;SACZ,CAAC,CAAA;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,eAAe;QACf,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACrD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QAEtD,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAA;QAE3E,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,mEAAmE;QACnE,gDAAgD;QAChD,MAAM,EAAE,kBAAkB,EAAE,GAAG,eAAe,EAAE,GAAG,qBAAqB,CAAA;QACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC3D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,eAAe;YAClB,IAAI,EAAE,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YAC5C,OAAO;YACP,GAAG;YACH,OAAO;SACwB,CAAC,CACnC,CAAA;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,OAEE,EACF,KAAmB;QAEnB,MAAM,EACJ,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAClC,GAAG,OAAO,CAAA;QACX,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,WAAW,GAAG,wBAAwB,CAAA;QAE5C,sEAAsE;QACtE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAE1D,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,OAAO;YACP,YAAY;YACZ,UAAU,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YAClD,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACtE,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,0BAA0B,CAAC;aAChC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAClC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CACrB,OAEE,EACF,KAAmB;QAEnB,MAAM,EACJ,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAClC,GAAG,OAAO,CAAA;QACX,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,WAAW,GAAG,wBAAwB,CAAA;QAE5C,sEAAsE;QACtE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAE1D,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,OAAO;YACP,YAAY;YACZ,UAAU,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YAClD,WAAW;SACZ,CAAC,CAAA;QAEF,yBAAyB;QACzB,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;YACvD,OAAO;YACP,OAAO;YACP,YAAY;YACZ,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;YAC7C,OAAO;YACP,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjE,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CACnB,OAEE,EACF,KAAmB;QAEnB,MAAM,EACJ,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAClC,GAAG,OAAO,CAAA;QACX,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,WAAW,GAAG,sBAAsB,CAAA;QAE1C,sEAAsE;QACtE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAE1D,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,OAAO;YACP,YAAY;YACZ,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YAChD,WAAW;SACZ,CAAC,CAAA;QAEF,yBAAyB;QACzB,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;YACvD,OAAO;YACP,OAAO;YACP,YAAY;YACZ,WAAW;SACZ,CAAC,CAAA;QAEF,2EAA2E;QAC3E,6EAA6E;QAC7E,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC;YACvC,OAAO;YACP,OAAO;YACP,YAAY;YACZ,qBAAqB;SACtB,CAAC,CAAA;QACF,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC;YACvC,MAAM,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC;YACpD,OAAO;YACP,YAAY;SACb,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,OAYE,EACF,KAAmB;QAEnB,MAAM,EACJ,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EACjC,IAAI,EACL,GAAG,OAAO,CAAA;QACX,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,WAAW,GAAG,kBAAkB,CAAA;QAEtC,sEAAsE;QACtE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAE1D,qEAAqE;QACrE,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,OAAO;YACP,YAAY;YACZ,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YAChD,WAAW;SACZ,CAAC,CAAA;QAEF,yBAAyB;QACzB,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;YACvD,OAAO;YACP,OAAO;YACP,YAAY;YACZ,WAAW;SACZ,CAAC,CAAA;QAEF,uEAAuE;QACvE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC;YACvC,OAAO;YACP,OAAO;YACP,YAAY;YACZ,qBAAqB;SACtB,CAAC,CAAA;QAEF,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC5D,OAAO,iBAAiB,CAAC,aAAa,CAAC;gBACrC,KAAK;gBACL,WAAW;gBACX,OAAO;gBACP,YAAY;gBACZ,IAAI;gBACJ,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,IAAI,EAAE,OAAO,KAAK,eAAe,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACzE,mEAAmE;YACnE,sDAAsD;YACtD,MAAM,MAAM,GAAG,0BAA0B,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;YAChE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC;gBACnD,OAAO;gBACP,YAAY;gBACZ,GAAG,MAAM;aACV,CAAC,CAAA;YACF,OAAO,KAAK;iBACT,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,kBAAkB,CAAC;iBACxB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QACjC,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACtD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EACzB,KAAK,EACL,WAAW,EACX,OAAO,EACP,YAAY,EACZ,IAAI,EACJ,WAAW,EAWZ;QACC,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,UAAyD,CAAA;QAC7D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,CAAA;YACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,IAAI,uBAAuB,CAAC;oBAChC,WAAW;oBACX,MAAM,EAAE,0DAA0D;oBAClE,OAAO,EAAE,cAAc;iBACxB,CAAC,CAAA;YACJ,CAAC;YACD,UAAU,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAA;QAChC,CAAC;QAED,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,aAAa,GAAG,GAAG,CAAA;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtC,MAAM,KAAK,GACT,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;YAC9C,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,aAAa,CAAA;QAEnB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,YAAa,CAAC;YAC7C,OAAO;YACP,YAAY;YACZ,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,KAAK;SACN,CAAC,CAAA;QAEF,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,8EAA8E;QAC9E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,aAAa;QACb,MAAM,SAAS,GAAqB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/D,EAAE,EAAE,GAAG,CAAC,UAAU;YAClB,QAAQ,EAAE,GAAG,CAAC,OAAO;YACrB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;YACtE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;YAChE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YACvD,0EAA0E;YAC1E,6EAA6E;YAC7E,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACrD,CAAC,CAAC,CAAA;QAEH,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,kBAAkB,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAEE,EACF,KAAmB;QAEnB,MAAM,EACJ,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAClC,GAAG,OAAO,CAAA;QACX,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,WAAW,GAAG,mBAAmB,CAAA;QAEvC,sEAAsE;QACtE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAE1D,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,mBAAmB,CAAC;YACxB,OAAO;YACP,OAAO;YACP,UAAU,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACrD,WAAW;SACZ,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,4EAA4E;YAC5E,yBAAyB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;QACjD,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,OAGE,EACF,KAAmB;QAEnB,MAAM,EACJ,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EACjC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EACzB,GAAG,OAAO,CAAA;QACX,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,WAAW,GAAG,iBAAiB,CAAA;QAErC,sEAAsE;QACtE,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAE1D,0EAA0E;QAC1E,gFAAgF;QAChF,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,OAAO;YACP,YAAY;YACZ,UAAU,EAAE,cAAc,CAAC;gBACzB,OAAO;gBACP,YAAY;gBACZ,aAAa,EAAE,IAAI;aACpB,CAAC;YACF,WAAW;YACX,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,yBAAyB;QACzB,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;YACvD,OAAO;YACP,OAAO;YACP,YAAY;YACZ,WAAW;SACZ,CAAC,CAAA;QAEF,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,+CAA+C;QAC/C,4DAA4D;QAC5D,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC;YACvC,OAAO;YACP,OAAO;YACP,YAAY;YACZ,qBAAqB;SACtB,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QAC7D,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC;YAC5D,OAAO;YACP,YAAY;YACZ,2EAA2E;YAC3E,6EAA6E;YAC7E,qBAAqB;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;gBAClD,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE;gBACxB,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;SACxC,CAAC,CAAA;QAEF,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,kBAAkB,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAA;IAC1C,CAAC;CACF"}

package/dist/requests/KeyRequest.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Request handlers for WebKMS key operations (the `/kms` facet):
+ * - POST /kms/keystores/:keystoreId/keys (GenerateKeyOperation)
+ * - GET /kms/keystores/:keystoreId/keys (List Keys -- a fork extension beyond
+ *   upstream webkms-switch; enumerate the keystore's public key descriptions)
+ * - POST /kms/keystores/:keystoreId/keys/:keyId (Sign / Verify / DeriveSecret /
+ *   WrapKey / UnwrapKey operation, dispatched by envelope `type`)
+ * - GET /kms/keystores/:keystoreId/keys/:keyId (public key description)
+ *
+ * The wire contract is protocol-fixed by webkms-switch /
+ * `@interop/webkms-client` (the conformance suite): operation envelopes carry
+ * an optional `@context`, generate responds 200 (not 201) with a `Location`
+ * header and a `{ keyId, keyDescription }` body, every other operation
+ * responds 200 with its own single-field result. Every route roots its
+ * capability in the **keystore** URL (never the key -- the client computes the
+ * root zcap by stripping the key URL at the last `/keys/`), with the key URL
+ * accepted as an attenuated target; the expected zcap action is the operation
+ * name, decapitalized, minus `Operation` (`generateKey`, `sign`, ...), and
+ * `read` for the description GET (which this server authorizes rather than
+ * leaving open).
+ */
+import type { FastifyReply, FastifyRequest } from 'fastify';
+export declare class KeyRequest {
+    /**
+     * POST /kms/keystores/:keystoreId/keys
+     * Generate Key (`GenerateKeyOperation`). The envelope's `invocationTarget`
+     * is an *object* (`{ type, maxCapabilityChainLength?, publicAlias? |
+     * publicAliasTemplate? }`), unlike every other operation's string. Verified
+     * against the keystore's controller with the `generateKey` action; the new
+     * key's local id is server-generated (the same bnid multihash scheme as
+     * keystore ids, per webkms-switch `generateRandom`). Responds 200 with a
+     * `Location` header and `{ keyId, keyDescription }` -- the client reads the
+     * key id from the *body*, never the header.
+     *
+     * @param request {import('fastify').FastifyRequest}
+     * @param reply {import('fastify').FastifyReply}
+     * @returns {Promise<FastifyReply>}
+     */
+    static generate(request: FastifyRequest<{
+        Params: {
+            keystoreId: string;
+        };
+        Body: Record<string, unknown>;
+    }>, reply: FastifyReply): Promise<FastifyReply>;
+    /**
+     * POST /kms/keystores/:keystoreId/keys/:keyId
+     * Key operation dispatch by envelope `type` (Sign / Verify / DeriveSecret /
+     * WrapKey / UnwrapKey). The envelope's string `invocationTarget` must equal
+     * the request URL exactly (400, per webkms-switch); the expected zcap action
+     * is the decapitalized operation name, verified against the keystore's
+     * controller with the key URL as an attenuated target. An operation the KMS
+     * does not recognize -- or does not serve for the key's type, e.g.
+     * `VerifyOperation` on an asymmetric key -- is a clean 400 not-supported.
+     * Responds 200 with the operation's single-field result.
+     *
+     * @param request {import('fastify').FastifyRequest}
+     * @param reply {import('fastify').FastifyReply}
+     * @returns {Promise<FastifyReply>}
+     */
+    static operation(request: FastifyRequest<{
+        Params: {
+            keystoreId: string;
+            keyId: string;
+        };
+        Body: Record<string, unknown>;
+    }>, reply: FastifyReply): Promise<FastifyReply>;
+    /**
+     * GET /kms/keystores/:keystoreId/keys/:keyId
+     * Public key description: capability-verified against the keystore's
+     * controller (`read`, with the key URL as an attenuated target -- this
+     * server authorizes the route rather than serving it open). The
+     * description's `controller` is the keystore's *live*
+     * controller, and the `publicAlias` / `publicAliasTemplate` override is
+     * re-applied on every read, so descriptions are stable (the client caches
+     * them for five minutes).
+     *
+     * @param request {import('fastify').FastifyRequest}
+     * @param reply {import('fastify').FastifyReply}
+     * @returns {Promise<FastifyReply>}
+     */
+    static get(request: FastifyRequest<{
+        Params: {
+            keystoreId: string;
+            keyId: string;
+        };
+    }>, reply: FastifyReply): Promise<FastifyReply>;
+    /**
+     * GET /kms/keystores/:keystoreId/keys
+     * List Keys (a fork extension beyond upstream webkms-switch). Enumerates the
+     * keystore's public key descriptions -- the Get Key Description projection
+     * per key (`describeKmsKey`: allowlisted public fields, the keystore's live
+     * controller, alias re-applied; never a secret field), plus `keyUrl`, the
+     * key's canonical invocation URL (which the alias override erases from `id`
+     * for precisely the keys a recovery client must rediscover) --
+     * sorted by local id and paginated (`KEY_LIST_LIMIT` per page, an opaque
+     * `cursor` following the standard convention). Capability-verified against the
+     * keystore's controller (`read`), with the `<keystoreId>/keys` URL accepted as
+     * an attenuated target (the same treatment Get Key gives the key URL). An
+     * empty keystore returns `{ results: [] }`, not a 404. Responds `{ results }`,
+     * plus a `next` cursor URL when a further page follows.
+     *
+     * @param request {import('fastify').FastifyRequest}
+     * @param reply {import('fastify').FastifyReply}
+     * @returns {Promise<FastifyReply>}
+     */
+    static list(request: FastifyRequest<{
+        Params: {
+            keystoreId: string;
+        };
+        Querystring: {
+            cursor?: string;
+        };
+    }>, reply: FastifyReply): Promise<FastifyReply>;
+}
+//# sourceMappingURL=KeyRequest.d.ts.map

package/dist/requests/KeyRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyRequest.d.ts","sourceRoot":"","sources":["../../src/requests/KeyRequest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAyR3D,qBAAa,UAAU;IACrB;;;;;;;;;;;;;;OAcG;WACU,QAAQ,CACnB,OAAO,EAAE,cAAc,CAAC;QACtB,MAAM,EAAE;YAAE,UAAU,EAAE,MAAM,CAAA;SAAE,CAAA;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAC9B,CAAC,EACF,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,YAAY,CAAC;IAgExB;;;;;;;;;;;;;;OAcG;WACU,SAAS,CACpB,OAAO,EAAE,cAAc,CAAC;QACtB,MAAM,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;QAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAC9B,CAAC,EACF,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,YAAY,CAAC;IA2ExB;;;;;;;;;;;;;OAaG;WACU,GAAG,CACd,OAAO,EAAE,cAAc,CAAC;QACtB,MAAM,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAC9C,CAAC,EACF,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,YAAY,CAAC;IAuBxB;;;;;;;;;;;;;;;;;;OAkBG;WACU,IAAI,CACf,OAAO,EAAE,cAAc,CAAC;QACtB,MAAM,EAAE;YAAE,UAAU,EAAE,MAAM,CAAA;SAAE,CAAA;QAC9B,WAAW,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KACjC,CAAC,EACF,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,YAAY,CAAC;CAiEzB"}

package/dist/requests/KeyRequest.js

@@ -0,0 +1,468 @@
+import { generateId } from '@digitalcredentials/bnid';
+import { fetchKeystoreAndVerify } from './keystoreContext.js';
+import { generateKmsKey, describeKmsKey, runKeyOperation } from '../lib/kmsModule.js';
+import { encryptKeyRecord, decryptKeyRecord, currentRecordKek, recordKekLoader } from '../lib/kmsRecordCipher.js';
+import { isUrlSafeSegment } from '../lib/validateId.js';
+import { kmsKeysPath } from '../lib/paths.js';
+import { encodeCursor, decodeCursor } from '../lib/cursor.js';
+import { KEY_LIST_LIMIT } from '../config.default.js';
+import { InvalidRequestBodyError, KeyNotFoundError, KmsRecordCipherError, UnauthorizedError, UnsupportedKeyOperationError } from '../errors.js';
+/**
+ * The operation-specific body fields of each dispatchable (non-generate)
+ * operation envelope. Doubles as the recognized-operation registry: an
+ * envelope `type` outside this table is the clean 400 not-supported. The
+ * fields' *values* are validated by the KMS module's per-operation
+ * implementations; the request layer enforces the envelope shape
+ * (`additionalProperties: false`, per the webkms-switch schemas).
+ */
+const OPERATION_FIELDS = {
+    SignOperation: ['verifyData'],
+    VerifyOperation: ['verifyData', 'signatureValue'],
+    DeriveSecretOperation: ['publicKey'],
+    WrapKeyOperation: ['unwrappedKey'],
+    UnwrapKeyOperation: ['wrappedKey']
+};
+/**
+ * Derives the expected zcap action from an operation envelope `type`:
+ * decapitalized, minus the `Operation` suffix (webkms-switch `_parseAction`) --
+ * `SignOperation` to `sign`, `DeriveSecretOperation` to `deriveSecret`, etc.
+ * @param operationType {string}
+ * @returns {string}
+ */
+function operationAction(operationType) {
+    const name = operationType.slice(0, operationType.indexOf('Operation'));
+    return name.charAt(0).toLowerCase() + name.slice(1);
+}
+/**
+ * Asserts the request body is a JSON object envelope of the given operation
+ * `type` carrying only the allowed keys (`additionalProperties: false`).
+ * `@context` is allowed but never required -- the webkms-switch schemas make
+ * it optional and `@interop/webkms-client` omits it entirely.
+ *
+ * @param options {object}
+ * @param options.body {unknown}   the parsed request body
+ * @param options.allowedKeys {string[]}   allowed keys beyond `@context`/`type`
+ * @param options.requestName {string}   request name used in error titles
+ * @returns {Record<string, unknown>}   the body, narrowed
+ */
+function assertOperationEnvelope({ body, allowedKeys, requestName }) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body)) {
+        throw new InvalidRequestBodyError({
+            requestName,
+            detail: 'Operation body must be a JSON object.'
+        });
+    }
+    const envelope = body;
+    for (const key of Object.keys(envelope)) {
+        if (key !== '@context' && key !== 'type' && !allowedKeys.includes(key)) {
+            throw new InvalidRequestBodyError({
+                requestName,
+                detail: `Unexpected operation property "${key}".`,
+                pointer: `#/${key}`
+            });
+        }
+    }
+    return envelope;
+}
+/**
+ * Decrypts a stored key record through the at-rest cipher seam
+ * (`KMS_RECORD_KEK`): a plaintext record passes through untouched; an encrypted
+ * one is unwrapped under its stored `kekId` (a failure -- missing KEK / bad
+ * ciphertext -- is a 500 `KmsRecordCipherError`, a server misconfiguration).
+ * The single funnel every path that needs the *secret* (operation dispatch,
+ * description GET) goes through, so no operation can read a ciphertext envelope
+ * as key material. List Keys deliberately does NOT use it: it projects only
+ * public fields, which stay plaintext at rest, so it never unwraps a secret.
+ *
+ * @param options {object}
+ * @param options.record {KmsKeyRecord}   the record as stored (maybe encrypted)
+ * @param [options.kmsRecordKek] {KmsRecordKekRegistry}   the configured KEK
+ *   registry (`request.server.kmsRecordKek`), or `undefined` when disabled
+ * @param options.requestName {string}   request name used in error titles
+ * @returns {KmsKeyRecord}   the decrypted (secret-bearing) record
+ */
+function decryptStoredKeyRecord({ record, kmsRecordKek, requestName }) {
+    try {
+        return decryptKeyRecord({
+            record,
+            kekLoader: recordKekLoader(kmsRecordKek)
+        });
+    }
+    catch (err) {
+        throw new KmsRecordCipherError({ cause: err, requestName });
+    }
+}
+/**
+ * Loads a key record by its URL params, masking an unknown (or non-URL-safe)
+ * key id as the 404 `KeyNotFoundError`. Call after capability verification,
+ * so an under-authorized caller cannot distinguish absent from forbidden. The
+ * record is decrypted through the cipher seam (see `decryptStoredKeyRecord`)
+ * before it is returned.
+ *
+ * @param options {object}
+ * @param options.request {FastifyRequest}   supplies `request.server.storage`
+ * @param options.keystoreId {string}   the keystore's local id (URL param)
+ * @param options.keyId {string}   the key's local id (URL param)
+ * @param options.requestName {string}   request name used in error titles
+ * @returns {Promise<KmsKeyRecord>}   the decrypted (secret-bearing) record
+ */
+async function fetchKeyRecord({ request, keystoreId, keyId, requestName }) {
+    if (!isUrlSafeSegment(keyId)) {
+        throw new KeyNotFoundError({ requestName });
+    }
+    const record = await request.server.storage.getKey({
+        keystoreId,
+        localId: keyId
+    });
+    if (!record) {
+        throw new KeyNotFoundError({ requestName });
+    }
+    return decryptStoredKeyRecord({
+        record,
+        kmsRecordKek: request.server.kmsRecordKek,
+        requestName
+    });
+}
+/**
+ * Asserts a `GenerateKeyOperation`'s object `invocationTarget`: a required
+ * non-empty string `type`, an optional integer `maxCapabilityChainLength`
+ * (1-10; the chain includes the root, so 1 means controller-only), and at
+ * most one of `publicAlias` / `publicAliasTemplate` (non-empty strings).
+ *
+ * @param options {object}
+ * @param options.invocationTarget {unknown}   the envelope's invocationTarget
+ * @param options.requestName {string}   request name used in error titles
+ * @returns {object}   the narrowed target fields
+ */
+function assertGenerateKeyTarget({ invocationTarget, requestName }) {
+    if (typeof invocationTarget !== 'object' ||
+        invocationTarget === null ||
+        Array.isArray(invocationTarget)) {
+        throw new InvalidRequestBodyError({
+            requestName,
+            detail: 'Operation "invocationTarget" must be an object.',
+            pointer: '#/invocationTarget'
+        });
+    }
+    const allowedKeys = [
+        'type',
+        'maxCapabilityChainLength',
+        'publicAlias',
+        'publicAliasTemplate'
+    ];
+    for (const key of Object.keys(invocationTarget)) {
+        if (!allowedKeys.includes(key)) {
+            throw new InvalidRequestBodyError({
+                requestName,
+                detail: `Unexpected invocationTarget property "${key}".`,
+                pointer: `#/invocationTarget/${key}`
+            });
+        }
+    }
+    const target = invocationTarget;
+    if (typeof target.type !== 'string' || target.type.length === 0) {
+        throw new InvalidRequestBodyError({
+            requestName,
+            detail: 'invocationTarget "type" must be a non-empty string.',
+            pointer: '#/invocationTarget/type'
+        });
+    }
+    if (target.maxCapabilityChainLength !== undefined &&
+        (!Number.isInteger(target.maxCapabilityChainLength) ||
+            target.maxCapabilityChainLength < 1 ||
+            target.maxCapabilityChainLength > 10)) {
+        throw new InvalidRequestBodyError({
+            requestName,
+            detail: 'invocationTarget "maxCapabilityChainLength" must be an integer' +
+                ' between 1 and 10.',
+            pointer: '#/invocationTarget/maxCapabilityChainLength'
+        });
+    }
+    for (const aliasField of ['publicAlias', 'publicAliasTemplate']) {
+        const value = target[aliasField];
+        if (value !== undefined &&
+            (typeof value !== 'string' || value.length === 0)) {
+            throw new InvalidRequestBodyError({
+                requestName,
+                detail: `invocationTarget "${aliasField}" must be a non-empty string.`,
+                pointer: `#/invocationTarget/${aliasField}`
+            });
+        }
+    }
+    if (target.publicAlias !== undefined &&
+        target.publicAliasTemplate !== undefined) {
+        throw new InvalidRequestBodyError({
+            requestName,
+            detail: 'Only one of "publicAlias" or "publicAliasTemplate" may be given.',
+            pointer: '#/invocationTarget/publicAlias'
+        });
+    }
+    return target;
+}
+export class KeyRequest {
+    /**
+     * POST /kms/keystores/:keystoreId/keys
+     * Generate Key (`GenerateKeyOperation`). The envelope's `invocationTarget`
+     * is an *object* (`{ type, maxCapabilityChainLength?, publicAlias? |
+     * publicAliasTemplate? }`), unlike every other operation's string. Verified
+     * against the keystore's controller with the `generateKey` action; the new
+     * key's local id is server-generated (the same bnid multihash scheme as
+     * keystore ids, per webkms-switch `generateRandom`). Responds 200 with a
+     * `Location` header and `{ keyId, keyDescription }` -- the client reads the
+     * key id from the *body*, never the header.
+     *
+     * @param request {import('fastify').FastifyRequest}
+     * @param reply {import('fastify').FastifyReply}
+     * @returns {Promise<FastifyReply>}
+     */
+    static async generate(request, reply) {
+        const requestName = 'Generate Key';
+        const { keystoreId } = request.params;
+        const { storage } = request.server;
+        const envelope = assertOperationEnvelope({
+            body: request.body,
+            allowedKeys: ['invocationTarget'],
+            requestName
+        });
+        if (envelope.type !== 'GenerateKeyOperation') {
+            throw new InvalidRequestBodyError({
+                requestName,
+                detail: 'Operation "type" must be "GenerateKeyOperation".',
+                pointer: '#/type'
+            });
+        }
+        const target = assertGenerateKeyTarget({
+            invocationTarget: envelope.invocationTarget,
+            requestName
+        });
+        const { config } = await fetchKeystoreAndVerify({
+            request,
+            keystoreId,
+            allowedAction: 'generateKey',
+            requestName,
+            allowTargetAttenuation: true
+        });
+        // Server-generated local id, per webkms-switch `generateRandom`: multibase
+        // base58btc of a multihash-framed (identity, 16-byte) 128-bit random value.
+        const localId = await generateId({ multihash: true });
+        const keyId = `${config.id}/keys/${localId}`;
+        const { key, keyDescription } = await generateKmsKey({
+            keyId,
+            type: target.type,
+            controller: config.controller,
+            maxCapabilityChainLength: target.maxCapabilityChainLength,
+            publicAlias: target.publicAlias,
+            publicAliasTemplate: target.publicAliasTemplate
+        });
+        const now = new Date().toISOString();
+        // At-rest cipher seam (`KMS_RECORD_KEK`): when a current KEK is configured,
+        // encrypt the record's secret fields before it reaches storage (the record
+        // stays opaque to the backend); unconfigured, it is stored plaintext.
+        let record = {
+            keystoreId,
+            localId,
+            meta: { created: now, updated: now },
+            key
+        };
+        const kek = currentRecordKek(request.server.kmsRecordKek);
+        if (kek !== undefined) {
+            record = encryptKeyRecord({ record, kek });
+        }
+        await storage.insertKey({ keystoreId, localId, record });
+        // 200 (not the keystore create's 201) with a Location header, per
+        // webkms-switch `runOperationMiddleware`.
+        reply.header('Location', keyId);
+        return reply.send({ keyId, keyDescription });
+    }
+    /**
+     * POST /kms/keystores/:keystoreId/keys/:keyId
+     * Key operation dispatch by envelope `type` (Sign / Verify / DeriveSecret /
+     * WrapKey / UnwrapKey). The envelope's string `invocationTarget` must equal
+     * the request URL exactly (400, per webkms-switch); the expected zcap action
+     * is the decapitalized operation name, verified against the keystore's
+     * controller with the key URL as an attenuated target. An operation the KMS
+     * does not recognize -- or does not serve for the key's type, e.g.
+     * `VerifyOperation` on an asymmetric key -- is a clean 400 not-supported.
+     * Responds 200 with the operation's single-field result.
+     *
+     * @param request {import('fastify').FastifyRequest}
+     * @param reply {import('fastify').FastifyReply}
+     * @returns {Promise<FastifyReply>}
+     */
+    static async operation(request, reply) {
+        const requestName = 'Key Operation';
+        const { keystoreId, keyId } = request.params;
+        const { serverUrl } = request.server;
+        if (typeof request.body !== 'object' ||
+            request.body === null ||
+            typeof request.body.type !== 'string') {
+            throw new InvalidRequestBodyError({
+                requestName,
+                detail: 'Operation body must be a JSON object with a string "type".',
+                pointer: '#/type'
+            });
+        }
+        const operationType = request.body
+            .type;
+        const operationFields = OPERATION_FIELDS[operationType];
+        if (operationFields === undefined) {
+            // Unknown-but-well-formed operation types (GenerateKeyOperation included:
+            // it is only dispatchable at the keys-collection URL) are not served.
+            throw new UnsupportedKeyOperationError({ operationType });
+        }
+        const envelope = assertOperationEnvelope({
+            body: request.body,
+            allowedKeys: ['invocationTarget', ...operationFields],
+            requestName
+        });
+        // The envelope names the key it operates on; it must be the key it was
+        // posted to (webkms-switch's invocation-target-vs-request-URL 400).
+        const fullRequestUrl = new URL(kmsKeysPath({ keystoreId, keyId }), serverUrl).toString();
+        if (envelope.invocationTarget !== fullRequestUrl) {
+            throw new InvalidRequestBodyError({
+                requestName,
+                detail: 'Operation "invocationTarget" does not match the request URL.',
+                pointer: '#/invocationTarget'
+            });
+        }
+        const { dereferencedChainLength } = await fetchKeystoreAndVerify({
+            request,
+            keystoreId,
+            allowedAction: operationAction(operationType),
+            requestName,
+            allowTargetAttenuation: true
+        });
+        const record = await fetchKeyRecord({
+            request,
+            keystoreId,
+            keyId,
+            requestName
+        });
+        // Per-key invocation chain bound, set at generate time and enforced at
+        // operation time. The chain includes the root, so a bound of 1 means
+        // controller-only. An
+        // over-long chain is an authorization failure: masked 404, per the
+        // server-wide convention.
+        if (record.key.maxCapabilityChainLength !== undefined &&
+            dereferencedChainLength > record.key.maxCapabilityChainLength) {
+            throw new UnauthorizedError({ requestName });
+        }
+        const result = await runKeyOperation({
+            key: record.key,
+            operation: envelope
+        });
+        return reply.send(result);
+    }
+    /**
+     * GET /kms/keystores/:keystoreId/keys/:keyId
+     * Public key description: capability-verified against the keystore's
+     * controller (`read`, with the key URL as an attenuated target -- this
+     * server authorizes the route rather than serving it open). The
+     * description's `controller` is the keystore's *live*
+     * controller, and the `publicAlias` / `publicAliasTemplate` override is
+     * re-applied on every read, so descriptions are stable (the client caches
+     * them for five minutes).
+     *
+     * @param request {import('fastify').FastifyRequest}
+     * @param reply {import('fastify').FastifyReply}
+     * @returns {Promise<FastifyReply>}
+     */
+    static async get(request, reply) {
+        const requestName = 'Get Key Description';
+        const { keystoreId, keyId } = request.params;
+        const { config } = await fetchKeystoreAndVerify({
+            request,
+            keystoreId,
+            allowedAction: 'read',
+            requestName,
+            allowTargetAttenuation: true
+        });
+        const record = await fetchKeyRecord({
+            request,
+            keystoreId,
+            keyId,
+            requestName
+        });
+        return reply.send(describeKmsKey({ key: record.key, controller: config.controller }));
+    }
+    /**
+     * GET /kms/keystores/:keystoreId/keys
+     * List Keys (a fork extension beyond upstream webkms-switch). Enumerates the
+     * keystore's public key descriptions -- the Get Key Description projection
+     * per key (`describeKmsKey`: allowlisted public fields, the keystore's live
+     * controller, alias re-applied; never a secret field), plus `keyUrl`, the
+     * key's canonical invocation URL (which the alias override erases from `id`
+     * for precisely the keys a recovery client must rediscover) --
+     * sorted by local id and paginated (`KEY_LIST_LIMIT` per page, an opaque
+     * `cursor` following the standard convention). Capability-verified against the
+     * keystore's controller (`read`), with the `<keystoreId>/keys` URL accepted as
+     * an attenuated target (the same treatment Get Key gives the key URL). An
+     * empty keystore returns `{ results: [] }`, not a 404. Responds `{ results }`,
+     * plus a `next` cursor URL when a further page follows.
+     *
+     * @param request {import('fastify').FastifyRequest}
+     * @param reply {import('fastify').FastifyReply}
+     * @returns {Promise<FastifyReply>}
+     */
+    static async list(request, reply) {
+        const requestName = 'List Keys';
+        const { keystoreId } = request.params;
+        const { cursor } = request.query;
+        const { storage } = request.server;
+        // The `?cursor` pagination parameter rides the signed request URL, so
+        // verification runs in target-query mode (as List Keystores / List
+        // Collection do). Authorization runs before any cursor validation below, so
+        // an under-authorized caller gets the merged 404 -- never `invalid-cursor`.
+        const { config } = await fetchKeystoreAndVerify({
+            request,
+            keystoreId,
+            allowedAction: 'read',
+            requestName,
+            allowTargetAttenuation: true,
+            allowTargetQuery: true
+        });
+        // The backend returns every record sorted by local id; key records are
+        // insert-once and immutable, so the cursor's `after` names a stable
+        // position -- resume from just past it (falling back to a keyset compare
+        // should the id somehow be absent). The cursor is opaque and validated
+        // here (400 `invalid-cursor` on a malformed token).
+        const keys = await storage.listKeys({ keystoreId });
+        let remaining = keys;
+        if (cursor !== undefined) {
+            const { after } = decodeCursor(cursor);
+            const index = keys.findIndex(entry => entry.localId === after);
+            remaining =
+                index === -1
+                    ? keys.filter(entry => entry.localId > after)
+                    : keys.slice(index + 1);
+        }
+        const hasMore = remaining.length > KEY_LIST_LIMIT;
+        const page = remaining.slice(0, KEY_LIST_LIMIT);
+        // Project directly from the stored record -- NO decrypt. The description
+        // reads only public fields, which stay plaintext at rest even under the
+        // record cipher (the `encrypted` envelope replaces only the secret subset).
+        // So listing never unwraps a key: it does not bulk-materialize private
+        // material in memory, and it still enumerates keys whose KEK is rotated out
+        // or whose envelope is corrupt -- the recovery-path robustness this endpoint
+        // exists for. (Contrast `fetchKeyRecord`, which must decrypt: get/operation
+        // need the secret.)
+        // Each entry additionally carries `keyUrl`, the key's canonical invocation
+        // URL. The alias override rewrites the description's `id`, erasing the one
+        // handle (`<keystoreId>/keys/<localId>`) a recovery client needs to invoke
+        // sign -- and a lister, unlike a Get Key caller, does not already hold it.
+        // Always stamped (aliased or not), so consumers need no fallback logic; it
+        // discloses only addressing an authorized lister already has, never key
+        // material.
+        const results = page.map(({ localId, record }) => ({
+            ...describeKmsKey({ key: record.key, controller: config.controller }),
+            keyUrl: `${config.id}/keys/${localId}`
+        }));
+        let next;
+        if (hasMore) {
+            const lastId = page[page.length - 1].localId;
+            next = `${kmsKeysPath({ keystoreId })}?cursor=${encodeCursor(lastId)}`;
+        }
+        return reply.send({ results, ...(next !== undefined && { next }) });
+    }
+}
+//# sourceMappingURL=KeyRequest.js.map

package/dist/requests/KeyRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyRequest.js","sourceRoot":"","sources":["../../src/requests/KeyRequest.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAChB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,4BAA4B,EAC7B,MAAM,cAAc,CAAA;AAGrB;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAA6B;IACjD,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,eAAe,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACjD,qBAAqB,EAAE,CAAC,WAAW,CAAC;IACpC,gBAAgB,EAAE,CAAC,cAAc,CAAC;IAClC,kBAAkB,EAAE,CAAC,YAAY,CAAC;CACnC,CAAA;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,aAAqB;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAA;IACvE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAAC,EAC/B,IAAI,EACJ,WAAW,EACX,WAAW,EAKZ;IACC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,uBAAuB,CAAC;YAChC,WAAW;YACX,MAAM,EAAE,uCAAuC;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAA+B,CAAA;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,uBAAuB,CAAC;gBAChC,WAAW;gBACX,MAAM,EAAE,kCAAkC,GAAG,IAAI;gBACjD,OAAO,EAAE,KAAK,GAAG,EAAE;aACpB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,sBAAsB,CAAC,EAC9B,MAAM,EACN,YAAY,EACZ,WAAW,EAKZ;IACC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC;YACtB,MAAM;YACN,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC;SACzC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,GAAY,EAAE,WAAW,EAAE,CAAC,CAAA;IACtE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,OAAO,EACP,UAAU,EACV,KAAK,EACL,WAAW,EAMZ;IACC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACjD,UAAU;QACV,OAAO,EAAE,KAAK;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,sBAAsB,CAAC;QAC5B,MAAM;QACN,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;QACzC,WAAW;KACZ,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAAC,EAC/B,gBAAgB,EAChB,WAAW,EAIZ;IAMC,IACE,OAAO,gBAAgB,KAAK,QAAQ;QACpC,gBAAgB,KAAK,IAAI;QACzB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,WAAW;YACX,MAAM,EAAE,iDAAiD;YACzD,OAAO,EAAE,oBAAoB;SAC9B,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,MAAM;QACN,0BAA0B;QAC1B,aAAa;QACb,qBAAqB;KACtB,CAAA;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,uBAAuB,CAAC;gBAChC,WAAW;gBACX,MAAM,EAAE,yCAAyC,GAAG,IAAI;gBACxD,OAAO,EAAE,sBAAsB,GAAG,EAAE;aACrC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,gBAKd,CAAA;IACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,uBAAuB,CAAC;YAChC,WAAW;YACX,MAAM,EAAE,qDAAqD;YAC7D,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAA;IACJ,CAAC;IACD,IACE,MAAM,CAAC,wBAAwB,KAAK,SAAS;QAC7C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,wBAAwB,CAAC;YAChD,MAAM,CAAC,wBAAmC,GAAG,CAAC;YAC9C,MAAM,CAAC,wBAAmC,GAAG,EAAE,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,WAAW;YACX,MAAM,EACJ,gEAAgE;gBAChE,oBAAoB;YACtB,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAU,EAAE,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;QAChC,IACE,KAAK,KAAK,SAAS;YACnB,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC;gBAChC,WAAW;gBACX,MAAM,EAAE,qBAAqB,UAAU,+BAA+B;gBACtE,OAAO,EAAE,sBAAsB,UAAU,EAAE;aAC5C,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,mBAAmB,KAAK,SAAS,EACxC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,WAAW;YACX,MAAM,EACJ,kEAAkE;YACpE,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAKN,CAAA;AACH,CAAC;AAED,MAAM,OAAO,UAAU;IACrB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CACnB,OAGE,EACF,KAAmB;QAEnB,MAAM,WAAW,GAAG,cAAc,CAAA;QAClC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QACrC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAElC,MAAM,QAAQ,GAAG,uBAAuB,CAAC;YACvC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,CAAC,kBAAkB,CAAC;YACjC,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC7C,MAAM,IAAI,uBAAuB,CAAC;gBAChC,WAAW;gBACX,MAAM,EAAE,kDAAkD;gBAC1D,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC;YAC9C,OAAO;YACP,UAAU;YACV,aAAa,EAAE,aAAa;YAC5B,WAAW;YACX,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAA;QAEF,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;QAC5C,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,MAAM,cAAc,CAAC;YACnD,KAAK;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;YACzD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpC,4EAA4E;QAC5E,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,MAAM,GAAiB;YACzB,UAAU;YACV,OAAO;YACP,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACpC,GAAG;SACJ,CAAA;QACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QAExD,kEAAkE;QAClE,0CAA0C;QAC1C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,OAGE,EACF,KAAmB;QAEnB,MAAM,WAAW,GAAG,eAAe,CAAA;QACnC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAEpC,IACE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAChC,OAAO,CAAC,IAAI,KAAK,IAAI;YACrB,OAAQ,OAAO,CAAC,IAAgC,CAAC,IAAI,KAAK,QAAQ,EAClE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC;gBAChC,WAAW;gBACX,MAAM,EAAE,4DAA4D;gBACpE,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,aAAa,GAAI,OAAO,CAAC,IAAgC;aAC5D,IAAc,CAAA;QACjB,MAAM,eAAe,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAA;QACvD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,0EAA0E;YAC1E,sEAAsE;YACtE,MAAM,IAAI,4BAA4B,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC;YACvC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,CAAC,kBAAkB,EAAE,GAAG,eAAe,CAAC;YACrD,WAAW;SACZ,CAAC,CAAA;QACF,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,WAAW,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAClC,SAAS,CACV,CAAC,QAAQ,EAAE,CAAA;QACZ,IAAI,QAAQ,CAAC,gBAAgB,KAAK,cAAc,EAAE,CAAC;YACjD,MAAM,IAAI,uBAAuB,CAAC;gBAChC,WAAW;gBACX,MAAM,EAAE,8DAA8D;gBACtE,OAAO,EAAE,oBAAoB;aAC9B,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,sBAAsB,CAAC;YAC/D,OAAO;YACP,UAAU;YACV,aAAa,EAAE,eAAe,CAAC,aAAa,CAAC;YAC7C,WAAW;YACX,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,OAAO;YACP,UAAU;YACV,KAAK;YACL,WAAW;SACZ,CAAC,CAAA;QACF,uEAAuE;QACvE,qEAAqE;QACrE,sBAAsB;QACtB,mEAAmE;QACnE,0BAA0B;QAC1B,IACE,MAAM,CAAC,GAAG,CAAC,wBAAwB,KAAK,SAAS;YACjD,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAC7D,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,CACd,OAEE,EACF,KAAmB;QAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAA;QACzC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAE5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC;YAC9C,OAAO;YACP,UAAU;YACV,aAAa,EAAE,MAAM;YACrB,WAAW;YACX,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,OAAO;YACP,UAAU;YACV,KAAK;YACL,WAAW;SACZ,CAAC,CAAA;QAEF,OAAO,KAAK,CAAC,IAAI,CACf,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CACnE,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,OAGE,EACF,KAAmB;QAEnB,MAAM,WAAW,GAAG,WAAW,CAAA;QAC/B,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QACrC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAElC,sEAAsE;QACtE,mEAAmE;QACnE,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC;YAC9C,OAAO;YACP,UAAU;YACV,aAAa,EAAE,MAAM;YACrB,WAAW;YACX,sBAAsB,EAAE,IAAI;YAC5B,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,uEAAuE;QACvE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,oDAAoD;QACpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;QACnD,IAAI,SAAS,GAAG,IAAI,CAAA;QACpB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAA;YAC9D,SAAS;gBACP,KAAK,KAAK,CAAC,CAAC;oBACV,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;oBAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,cAAc,CAAA;QACjD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAA;QAC/C,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,oBAAoB;QACpB,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,YAAY;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACjD,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;YACrE,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE;SACvC,CAAC,CAAC,CAAA;QAEH,IAAI,IAAwB,CAAA;QAC5B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,OAAO,CAAA;YAC7C,IAAI,GAAG,GAAG,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,WAAW,YAAY,CAAC,MAAM,CAAC,EAAE,CAAA;QACxE,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IACrE,CAAC;CACF"}