@astram/guard 0.19.0 → 0.20.0

package/dist/request-auth/session-token-binder.js

@@ -133,6 +133,46 @@ function stripCachedFacts(claims) {
     const { cachedFacts: _drop, ...rest } = claims;
     return rest;
 }
+/** The mandatory-2FA state keys (D-2), authoritative on the session-claims entry. */
+const MFA_STATE_KEYS = [
+    'restriction',
+    'mfaEnrollmentDeadlineMs',
+    'mfaRequirementVersion',
+    'mfaStateEpoch',
+];
+/**
+ * Read the mandatory-2FA state from an (untrusted) session-claims payload. Fail closed: an unknown
+ * reason counts as `'mfa_enrollment'`, a non-numeric deadline as passed (0); a junk stamp or epoch is
+ * dropped (→ the next request re-evaluates; the compare-and-set reads it as 0).
+ */
+function readMfaState(sess) {
+    const out = {};
+    if (sess === null || typeof sess !== 'object')
+        return out;
+    const s = sess;
+    if (s.restriction !== undefined && s.restriction !== null) {
+        out.restriction = s.restriction === 'reenroll' ? 'reenroll' : 'mfa_enrollment';
+    }
+    if (s.mfaEnrollmentDeadlineMs !== undefined && s.mfaEnrollmentDeadlineMs !== null) {
+        const d = s.mfaEnrollmentDeadlineMs;
+        out.mfaEnrollmentDeadlineMs = typeof d === 'number' && Number.isFinite(d) ? d : 0;
+    }
+    if (isSubtreeVersion(s.mfaRequirementVersion)) {
+        out.mfaRequirementVersion = s.mfaRequirementVersion;
+    }
+    if (isSubtreeVersion(s.mfaStateEpoch))
+        out.mfaStateEpoch = s.mfaStateEpoch;
+    return out;
+}
+/** Return the claims without any mandatory-2FA state key. */
+function stripMfaState(claims) {
+    if (!MFA_STATE_KEYS.some((k) => k in claims))
+        return claims;
+    const next = { ...claims };
+    for (const k of MFA_STATE_KEYS)
+        delete next[k];
+    return next;
+}
 /** Redis key prefix for the access-token → claims binding. */
 const AT_KEY_PREFIX = 'shield:at:';
 /** Redis key prefix for the session-id → claims binding (survives token rotation). */
@@ -204,6 +244,18 @@ end
 redis.call('DEL', KEYS[5])
 return 1`;
 const REBIND_REFUSED = 0;
+/**
+ * The mandatory-2FA recompute's compare-and-set (review round 1, item A): write ARGV[2] only if the
+ * entry is still exactly ARGV[1] (the value the caller read and judged), keeping its remaining TTL.
+ * One script, so of N concurrent recomputes exactly one writes. Returns 1 when written, else 0.
+ */
+const MFA_STATE_CAS_SCRIPT = `
+local cur = redis.call('GET', KEYS[1])
+if cur ~= ARGV[1] then return 0 end
+local ttl = redis.call('PTTL', KEYS[1])
+if ttl <= 0 then return 0 end
+redis.call('SET', KEYS[1], ARGV[2], 'PX', ttl, 'XX')
+return 1`;
 /** How long refresh waits for Redis to answer PING before answering 503 (ADR-0035, F1). */
 const DEFAULT_PING_TIMEOUT_MS = 1_000;
 class SessionTokenBinder {
@@ -521,12 +573,19 @@ class SessionTokenBinder {
         if (rawAt === null || rawSess === null)
             return false; // token/session gone → fail closed.
         let current;
+        let sessMfa;
         try {
             current = JSON.parse(rawAt);
+            sessMfa = readMfaState(JSON.parse(rawSess));
         }
         catch {
             return false; // malformed → fail closed (a later request re-denies anyway).
         }
+        // The mandatory-2FA state (D-2) comes from the authoritative session-claims entry and is kept
+        // across the switch (a restriction or a grace deadline never drops on a switch), minus the
+        // requirement stamp: versions are per node, so the next request re-evaluates for the new node.
+        const { mfaRequirementVersion: _perNode, ...keptMfa } = sessMfa;
+        current = { ...stripMfaState(current), ...keptMfa };
         // Build the re-scoped claims: new active node (tenantId) + new subtree, facts stripped.
         // An empty subtree is stored as absent (→ per-request self-node fallback, non-widening) —
         // but the switch caller always passes at least `[targetNodeId]`, so this is defensive.
@@ -693,14 +752,157 @@ class SessionTokenBinder {
         // legacy session-claims entry that lacks the flag is treated as `false` (default
         // safe: an old binding predating this field must not spuriously lock a session).
         let mustReenroll = parsed.mustReenroll;
+        // The mandatory-2FA state (D-2) is authoritative on the same entry, for the same reason: a
+        // recompute or a device confirm keyed by session id reaches every live token at once. The
+        // per-token copies are never trusted.
+        let mfa = {};
         try {
             const sess = JSON.parse(liveness);
             mustReenroll = sess?.mustReenroll === true;
+            mfa = readMfaState(sess);
         }
         catch {
             mustReenroll = false; // unparseable session-claims → treat as not-reenroll.
         }
-        return mustReenroll === parsed.mustReenroll ? parsed : { ...parsed, mustReenroll };
+        const hasMfa = Object.keys(mfa).length > 0;
+        if (!hasMfa && !MFA_STATE_KEYS.some((k) => k in parsed)) {
+            return mustReenroll === parsed.mustReenroll ? parsed : { ...parsed, mustReenroll };
+        }
+        return { ...stripMfaState(parsed), mustReenroll, ...mfa };
+    }
+    /**
+     * MANDATORY-2FA RECOMPUTE write (R2.5, D-2): store a re-evaluated requirement on the
+     * session-claims entry (authoritative for every live token of the session; see `resolve()`).
+     * Compare-and-set, so a slow recompute never undoes a newer change:
+     *  - the entry must still belong to `sessionId` + `tenantId` (a scope-switch moved it → refused);
+     *  - its `mfaStateEpoch` (absent = 0) must equal `expectedEpoch`, the value the evaluation started
+     *    from (a device confirm or another recompute since → refused);
+     *  - a stored stamp NEWER than `state.mfaRequirementVersion` wins (nothing written, refused).
+     * The write is ONE script that compares the exact entry it read (review round 1, item A), so of N
+     * concurrent recomputes exactly one writes; it keeps the remaining TTL (never extends the
+     * session) and increments the epoch. The re-enrol flag is never touched. Returns `false` when
+     * refused, gone, or Redis failed — the caller then re-reads the stored state with
+     * {@link mfaRequirementOf} and enforces it, or denies (fail closed).
+     */
+    async updateMfaRequirement(sessionId, tenantId, expectedEpoch, state) {
+        const key = sessClaimsKey(sessionId);
+        try {
+            const raw = await this.redis.get(key);
+            if (raw === null)
+                return false;
+            const current = JSON.parse(raw);
+            if (current?.sessionId !== sessionId || current?.tenantId !== tenantId)
+                return false;
+            const stored = readMfaState(current);
+            if ((stored.mfaStateEpoch ?? 0) !== expectedEpoch)
+                return false;
+            if (stored.mfaRequirementVersion !== undefined &&
+                stored.mfaRequirementVersion > state.mfaRequirementVersion) {
+                return false;
+            }
+            const next = {
+                ...stripMfaState(current),
+                ...(stored.restriction === 'reenroll' ? { restriction: 'reenroll' } : {}),
+                ...(state.restriction === 'mfa_enrollment' && stored.restriction !== 'reenroll'
+                    ? { restriction: 'mfa_enrollment' }
+                    : {}),
+                ...(typeof state.mfaEnrollmentDeadlineMs === 'number'
+                    ? { mfaEnrollmentDeadlineMs: state.mfaEnrollmentDeadlineMs }
+                    : {}),
+                mfaRequirementVersion: state.mfaRequirementVersion,
+                mfaStateEpoch: expectedEpoch + 1,
+            };
+            const written = await this.redis.eval(MFA_STATE_CAS_SCRIPT, 1, key, raw, JSON.stringify(next));
+            return Number(written) === 1;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * The mandatory-2FA state stored on the session-claims entry, for a recompute whose
+     * compare-and-set was refused (review round 1, item A): `null` when the entry is gone, belongs to
+     * another node, or Redis failed. A Redis error yields `null` (the caller denies).
+     */
+    async mfaRequirementOf(sessionId, tenantId) {
+        try {
+            const raw = await this.redis.get(sessClaimsKey(sessionId));
+            if (raw === null)
+                return null;
+            const current = JSON.parse(raw);
+            if (current?.sessionId !== sessionId || current?.tenantId !== tenantId)
+                return null;
+            return readMfaState(current);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * R2.7 defence in depth: restrict the session NOW (`restriction: 'mfa_enrollment'`, any grace
+     * deadline dropped) after a removal left the user with no confirmed factor while a policy applies.
+     * Unconditional rather than compare-and-set (restricting is always the safe direction), and it
+     * increments the epoch, so an in-flight recompute that read the old state cannot lift it. The
+     * re-enrol flag and the requirement stamp are kept. Returns `false` when the entry is gone or Redis
+     * failed.
+     */
+    async restrictMfaEnrollment(sessionId) {
+        const key = sessClaimsKey(sessionId);
+        try {
+            const raw = await this.redis.get(key);
+            if (raw === null)
+                return false;
+            const current = JSON.parse(raw);
+            const stored = readMfaState(current);
+            const ttl = await this.redis.pttl(key);
+            if (ttl <= 0)
+                return false;
+            const next = {
+                ...stripMfaState(current),
+                restriction: stored.restriction === 'reenroll' ? 'reenroll' : 'mfa_enrollment',
+                ...(stored.mfaRequirementVersion !== undefined
+                    ? { mfaRequirementVersion: stored.mfaRequirementVersion }
+                    : {}),
+                mfaStateEpoch: (stored.mfaStateEpoch ?? 0) + 1,
+            };
+            return (await this.redis.set(key, JSON.stringify(next), 'PX', ttl, 'XX')) === 'OK';
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * DEVICE CONFIRM clear (R2.3, AC-7): the user now has a confirmed factor, so lift BOTH reasons
+     * (`mustReenroll` and `restriction`) and any grace deadline on the session-claims entry, keeping
+     * its remaining TTL and the requirement stamp, and increment the epoch so an in-flight recompute
+     * that started before the confirm cannot write its stale result back. The live token's next
+     * request is unrestricted (it is not re-minted). Best-effort: a gone entry or a Redis error leaves
+     * the session as it is (still restricted: the safe direction).
+     */
+    async clearRestriction(sessionId) {
+        const key = sessClaimsKey(sessionId);
+        try {
+            const raw = await this.redis.get(key);
+            if (raw === null)
+                return;
+            const current = JSON.parse(raw);
+            const stored = readMfaState(current);
+            const ttl = await this.redis.pttl(key);
+            if (ttl <= 0)
+                return;
+            const next = {
+                ...stripMfaState(current),
+                mustReenroll: false,
+                ...(stored.mfaRequirementVersion !== undefined
+                    ? { mfaRequirementVersion: stored.mfaRequirementVersion }
+                    : {}),
+                mfaStateEpoch: (stored.mfaStateEpoch ?? 0) + 1,
+            };
+            await this.redis.set(key, JSON.stringify(next), 'PX', ttl, 'XX');
+        }
+        catch {
+            // best-effort: the session stays restricted; the user can confirm again or sign in again.
+        }
     }
     /**
      * Clear the ENFORCED-RE-ENROLL flag for a session — the re-secure is complete

package/dist/session/mfa-requirement-service.d.ts

@@ -0,0 +1,168 @@
+/**
+ * MfaRequirementService — mandatory 2FA in the guard (auth capabilities R2.3–R2.5, R2.7, D-2, D-11).
+ * One evaluation (core `evaluateMfaRequirement`, B-2) over the guard's `MfaRequirementSource` (B-1),
+ * used at four points:
+ *
+ *  1. SIGN-IN ({@link atLogin}, a lifecycle event: DB reads allowed). The result is bound on the
+ *     session: `'required'` ⇒ `restriction: 'mfa_enrollment'` (the controller also marks the durable
+ *     column), `'grace'` ⇒ `mfaEnrollmentDeadlineMs`; always the version stamp the grants were read
+ *     at. Any failure throws; the controller revokes the session and answers 503 (fail closed).
+ *  2. THE REQUEST PATH ({@link refresh}), on gated AND self-authenticating routes. It re-evaluates
+ *     ONLY when the tenant's current permission version is newer than the session's stamp (or there
+ *     is no stamp yet); otherwise it returns at once with NO DB query (N1, Shield #12, ADR-0035).
+ *     Gated routes pass the version (and the reloaded grants) gate 5 already has; self-authenticating
+ *     routes read the version from Redis ({@link currentVersionReader}: a hit is Redis only, a miss is
+ *     the one DB fill gate 5 also does, a Redis error denies). A transition writes the durable column
+ *     (a lifecycle write), then the session-claims entry by compare-and-set
+ *     (`SessionTokenBinder.updateMfaRequirement`). Any failure throws
+ *     {@link MfaRequirementUnavailableError} (503) and advances nothing, so the next request retries.
+ *  3. DEVICE CONFIRM ({@link onFactorConfirmed}): lifts the restriction on the current session (Redis
+ *     claims and the durable column) and deletes the grace clock (AC-7, AC-10).
+ *  4. LAST-DEVICE REMOVAL ({@link requiresFactor}, R2.7): whether any policy applies (no clock write).
+ *
+ * The subject (decision (2) of slice D): the node chain comes from the session's ACTIVE node (scope
+ * closure); roles and permission keys from the grants (gate 5's reload, or the session-facts
+ * projector, the same `loadCoarseGrants` the decision authority uses). Root accounts are subject
+ * only to platform-floor policies (D-11, in the core rule).
+ *
+ * Constructed only when the policy feature is wired (`SHIELD_MFA_POLICY_FEATURE`); without it the
+ * guard behaves exactly as before.
+ */
+import { HttpException } from '@nestjs/common';
+import { type CoarseGrants, type MfaRequirement, type MfaRequirementSource, type Principal } from '@astram/core';
+import { type BoundPrincipalClaims, type MfaRequirementState, type SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import type { SessionRestrictionStore } from './session-restriction-store.js';
+/** The fail-closed answer when the requirement cannot be evaluated or recorded (503). */
+export declare class MfaRequirementUnavailableError extends HttpException {
+    constructor();
+}
+/** What a sign-in binds (see {@link MfaRequirementState}). */
+export type MfaSessionState = MfaRequirementState;
+/** The facts one evaluation needs. */
+export interface MfaSubjectFacts {
+    readonly principalId: string;
+    readonly isRoot: boolean;
+    /** The session's ACTIVE node (its claims' `tenantId`). */
+    readonly tenantId: string;
+    readonly roleIds: readonly string[];
+    readonly permissionKeys: readonly string[];
+}
+/** The admin users list's 2FA state (auth capabilities R11.3). Never device data. */
+export type MfaAdminStatus = 'enrolled' | 'required' | 'grace' | 'not_required';
+/** One user of a page for {@link MfaRequirementService.statusesFor}. */
+export interface MfaStatusSubject {
+    readonly principalId: string;
+    /** Strictly `true` for a root account: only platform-floor policies apply. */
+    readonly isRoot: boolean;
+    /** The user's ACTIVE membership nodes; empty ⇒ judged by the platform floor only. */
+    readonly nodeIds: readonly string[];
+}
+/** Batched reads for a page (R11.3); the guard's MariaDB source implements them. */
+export interface MfaStatusBatchSource {
+    /** The ids among `principalIds` with a confirmed factor. One query. */
+    confirmedFactorsOf(principalIds: readonly string[]): Promise<ReadonlySet<string>>;
+    /** Stored grace clocks for `principalIds` (absent ⇒ none). One query. */
+    requiredSinceOf(principalIds: readonly string[]): Promise<ReadonlyMap<string, number>>;
+    /** Each node with its ancestors, the node itself included. One query. */
+    scopeChainsOf(nodeIds: readonly string[]): Promise<ReadonlyMap<string, readonly string[]>>;
+    /**
+     * The principal's ACTIVE membership nodes (review item E2: the sign-in clock check). Optional;
+     * absent ⇒ a stored clock is never cleared at sign-in (only enrolment clears it).
+     */
+    activeNodesOf?(principalId: string): Promise<readonly string[]>;
+}
+export interface MfaRequirementServiceDeps {
+    readonly source: MfaRequirementSource;
+    /** Batched page reads for {@link MfaRequirementService.statusesFor}; absent ⇒ it throws. */
+    readonly batch?: MfaStatusBatchSource | null;
+    /** Coarse grants + live roles for (principal, node): the session-facts projector. */
+    readonly loadGrants: (principalId: string, tenantId: string) => Promise<CoarseGrants | null>;
+    /** The node's current permission version (see {@link currentVersionReader}). */
+    readonly currentVersion: (tenantId: string) => Promise<number>;
+    readonly binder?: (Pick<SessionTokenBinder, 'updateMfaRequirement' | 'clearRestriction'> & Partial<Pick<SessionTokenBinder, 'restrictMfaEnrollment' | 'mfaRequirementOf'>>) | null;
+    readonly restrictions?: SessionRestrictionStore | null;
+    readonly now?: () => number;
+}
+/**
+ * The tenant's current permission version for the self-authenticating routes, read like gate 5
+ * reads it (ADR-0035): a Redis hit answers alone; a miss is filled once from the source of truth and
+ * written back (best-effort); a Redis ERROR throws {@link MfaRequirementUnavailableError} (deny,
+ * never served from the DB).
+ */
+export declare function currentVersionReader(cache: {
+    get(tenantId: string): Promise<number | null>;
+    raise(tenantId: string, version: number): Promise<void>;
+}, fill: (tenantId: string) => Promise<number>): (tenantId: string) => Promise<number>;
+export declare class MfaRequirementService {
+    private readonly deps;
+    private readonly now;
+    constructor(deps: MfaRequirementServiceDeps);
+    /**
+     * Evaluate the requirement and persist the clock the rule asks for (`start` keeps the EARLIER
+     * stored value, R2.4; `clear` deletes it). Throws on any store error (the caller fails closed).
+     */
+    evaluateFor(subject: MfaSubjectFacts): Promise<MfaRequirement>;
+    /**
+     * The admin users list's `mfaStatus` for a page (auth capabilities R11.3, AC-17). READ ONLY: no
+     * clock is started or cleared (that stays a sign-in / request-path lifecycle write). Batched:
+     * one confirmed-factor read for the page; for the rest one scope-chain read, one policy read, and
+     * (only when a policy exists) one clock read. Grants are loaded per (user, node) ONLY where a
+     * `role` or `permission` policy could apply at that node (the documented per-row cost); `tenant`
+     * and platform policies need none. A confirmed device ⇒ `enrolled` whatever the policies; else the
+     * strictest answer over the user's active memberships (no membership ⇒ the platform floor only).
+     * Throws on any store error (the caller fails closed).
+     */
+    statusesFor(subjects: readonly MfaStatusSubject[]): Promise<Map<string, MfaAdminStatus>>;
+    /**
+     * The state to bind at sign-in. `projected` is the login's own projection (reused: no second
+     * grants read); absent or `null` ⇒ the grants are loaded here. Throws on any failure.
+     */
+    atLogin(principal: Principal, projected?: CoarseGrants | null): Promise<MfaSessionState>;
+    /**
+     * Review item E2: sign-in is a lifecycle event, so a stored clock that the CURRENT node does not
+     * need is checked against every active membership of the user (the users-page evaluation,
+     * {@link statusesFor}, plus the platform floor). Required nowhere ⇒ the clock is cleared, so a
+     * policy added later gives the full grace from that moment. Required (or in grace) anywhere ⇒
+     * kept, so switching nodes cannot dodge a deadline. Not wired, or a read error ⇒ kept (the safe
+     * direction; the sign-in itself already evaluated its own node).
+     */
+    private clearClockIfRequiredNowhere;
+    /**
+     * The request-path recompute (R2.5). Returns the claims to enforce for THIS request: unchanged
+     * when nothing is due (NO DB query), else re-evaluated and recorded. `known.version` /
+     * `known.grants`: what gate 5 already has on a gated route. Throws
+     * {@link MfaRequirementUnavailableError} on any failure (the caller denies).
+     */
+    refresh(accessToken: string, claims: BoundPrincipalClaims, known?: {
+        readonly version?: number | undefined;
+        readonly grants?: CoarseGrants | undefined;
+    }): Promise<BoundPrincipalClaims>;
+    /**
+     * After a refused write, bring the durable mandatory-2FA column back in line with the stored
+     * (authoritative) state when this recompute moved it the other way. Best-effort: the column is
+     * only read by a refresh rebuild, which is unstamped and so re-evaluated on its next request.
+     */
+    private reconcileDurable;
+    /**
+     * A factor was just confirmed on this session (R2.3, AC-7): lift the restriction (Redis claims
+     * and the durable mandatory-2FA reason) and delete the grace clock (R2.4). Best-effort, like the
+     * re-enrol clear: a failure leaves the session restricted (the safe direction).
+     */
+    onFactorConfirmed(claims: BoundPrincipalClaims): Promise<void>;
+    /**
+     * R2.7 defence in depth: a removal left no confirmed factor while a policy applies — restrict this
+     * session now (durable column, then the session-claims entry; see
+     * `SessionTokenBinder.restrictMfaEnrollment`) instead of waiting for the next sign-in. Throws when
+     * the restriction could not be recorded (the caller answers 503; the removal already happened, so
+     * the user retries into a restricted session or signs in again into one).
+     */
+    restrictNow(claims: BoundPrincipalClaims): Promise<void>;
+    /**
+     * Whether a policy applies to the session's principal at its active node (R2.7): true for
+     * `enrolled` / `grace` / `required`. Reads only, never the clock. Throws on failure.
+     */
+    requiresFactor(claims: BoundPrincipalClaims): Promise<boolean>;
+    /** The grants for (principal, node), or throw: an evaluation never runs on guessed grants. */
+    private grantsOf;
+}
+//# sourceMappingURL=mfa-requirement-service.d.ts.map

package/dist/session/mfa-requirement-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-requirement-service.d.ts","sourceRoot":"","sources":["../../src/session/mfa-requirement-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,aAAa,EAAc,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAExB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,yFAAyF;AACzF,qBAAa,8BAA+B,SAAQ,aAAa;;CAIhE;AAED,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAElD,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,qFAAqF;AACrF,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;AAEhF,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,kBAAkB,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,yEAAyE;IACzE,eAAe,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvF,yEAAyE;IACzE,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F;;;OAGG;IACH,aAAa,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACjE;AAQD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC7C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC7F,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,QAAQ,CAAC,MAAM,CAAC,EACZ,CAAC,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,kBAAkB,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,uBAAuB,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAClF,IAAI,CAAC;IACT,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE;IACL,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9C,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD,EACD,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC1C,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAsBvC;AAkBD,qBAAa,qBAAqB;IAGpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,IAAI,EAAE,yBAAyB;IAI5D;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAkCpE;;;;;;;;;OASG;IACG,WAAW,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAiE9F;;;OAGG;IACG,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IAgB9F;;;;;;;OAOG;YACW,2BAA2B;IAgBzC;;;;;OAKG;IACG,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,oBAAoB,EAC5B,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;KAAE,GAC5F,OAAO,CAAC,oBAAoB,CAAC;IA0EhC;;;;OAIG;YACW,gBAAgB;IAgB9B;;;;OAIG;IACG,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpE;;;;;;OAMG;IACG,WAAW,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB9D;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBpE,8FAA8F;YAChF,QAAQ;CAOvB"}