@atlasauth/emulator-core 0.1.0 → 0.2.0

package/dist/handlers/scim.js

@@ -0,0 +1,408 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scimHandlers = scimHandlers;
+const errors_1 = require("../errors");
+const store_1 = require("../store");
+const util_1 = require("./util");
+const users_1 = require("./users");
+/**
+ * SCIM 2.0 server (RFC 7643/7644) over the engine's users: `/scim/v2/{ServiceProviderConfig,ResourceTypes,Schemas,Users,Groups}`
+ * (and the `/scim/v2/d/:directoryId` alias), authenticated with a SCIM token minted at `POST /v1/scim_tokens`, which names the
+ * organization it provisions into. A read-only token (`scopes: ["read"]`) refuses every write with 403. Errors use the SCIM
+ * error schema (`urn:ietf:params:scim:api:messages:2.0:Error`).
+ */
+const USER_SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:User';
+const GROUP_SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:Group';
+const LIST = 'urn:ietf:params:scim:api:messages:2.0:ListResponse';
+const PATCH_OP = 'urn:ietf:params:scim:api:messages:2.0:PatchOp';
+const ERR = 'urn:ietf:params:scim:api:messages:2.0:Error';
+const JSON_SCIM = { 'content-type': 'application/scim+json' };
+const scimError = (status, detail, scimType) => ({ status, headers: JSON_SCIM, body: { schemas: [ERR], status: String(status), ...(scimType ? { scimType } : {}), detail } });
+const presentToken = (t) => ({
+    object: 'scim_token',
+    id: t.id,
+    name: t.name ?? null,
+    organization_id: t.organization_id,
+    connection_id: t.connection_id ?? null,
+    prefix: t.prefix,
+    scopes: t.scopes ?? null,
+    role_mappings: t.role_mappings ?? null,
+    revoked: t.revoked === true,
+    created_at: t.created_at,
+});
+function authenticate(e, c) {
+    const bearer = /^Bearer\s+(.+)$/i.exec(c.request.headers.get('authorization') ?? '')?.[1];
+    const token = bearer ? e.db.scimTokens.find((t) => t.secret === bearer && !t.revoked) : undefined;
+    if (!token)
+        return scimError(401, 'A valid SCIM token is required.');
+    return { token, orgId: token.organization_id, canWrite: !Array.isArray(token.scopes) || token.scopes.includes('write') };
+}
+const primaryEmail = (u) => u.emails.find((m) => m.id === u.primary_email_address_id) ?? u.emails[0];
+function scimUser(e, u, base) {
+    const mail = primaryEmail(u);
+    return {
+        schemas: [USER_SCHEMA],
+        id: u.id,
+        externalId: u.external_id ?? undefined,
+        userName: mail?.email_address ?? u.username ?? u.id,
+        name: { givenName: u.first_name ?? undefined, familyName: u.last_name ?? undefined, formatted: [u.first_name, u.last_name].filter(Boolean).join(' ') || undefined },
+        displayName: [u.first_name, u.last_name].filter(Boolean).join(' ') || undefined,
+        emails: u.emails.map((m) => ({ value: m.email_address, primary: m.id === u.primary_email_address_id })),
+        active: u.scim_active !== false && u.banned !== true,
+        meta: { resourceType: 'User', created: new Date(u.created_at).toISOString(), lastModified: new Date(u.updated_at).toISOString(), location: `${base}/Users/${u.id}` },
+    };
+}
+const scimGroup = (e, g, base) => ({
+    schemas: [GROUP_SCHEMA],
+    id: g.id,
+    externalId: g.external_id ?? undefined,
+    displayName: g.display_name,
+    members: g.members.map((id) => ({ value: id, $ref: `${base}/Users/${id}` })),
+    meta: { resourceType: 'Group', created: new Date(g.created_at).toISOString(), lastModified: new Date(g.updated_at).toISOString(), location: `${base}/Groups/${g.id}` },
+});
+/** The small filter subset IdPs use: `attr eq "value"`, joined by `and`; `attr co/sw` too. */
+function matcher(filter) {
+    if (!filter)
+        return () => true;
+    const parts = filter.split(/\s+and\s+/i).map((p) => /^([\w.]+)\s+(eq|ne|co|sw|ew|pr)(?:\s+"((?:[^"\\]|\\.)*)")?$/i.exec(p.trim()));
+    if (parts.some((p) => !p))
+        return scimError(400, `Unsupported filter: ${filter}`, 'invalidFilter');
+    return (o) => parts.every((p) => {
+        const [, attr, op, val] = p;
+        const have = String(o[attr] ?? '').toLowerCase();
+        const want = (val ?? '').toLowerCase();
+        return { eq: have === want, ne: have !== want, co: have.includes(want), sw: have.startsWith(want), ew: have.endsWith(want), pr: have !== '' }[op.toLowerCase()];
+    });
+}
+function scimHandlers() {
+    const base = (c) => `${c.engine.issuer}${new URL(c.request.url).pathname.startsWith('/scim/v2/d/') ? `/scim/v2/d/${c.params.directoryId}` : '/scim/v2'}`;
+    /** Run a handler with the token resolved; `write` demands a write-capable token. */
+    const guard = (write, fn) => (c) => {
+        const a = authenticate(c.engine, c);
+        if (!('orgId' in a))
+            return a;
+        if (write && !a.canWrite)
+            return scimError(403, 'This SCIM token is read-only.');
+        return fn(c, a, base(c));
+    };
+    const page = (c, items, present) => {
+        const start = Math.max(Number(c.query.get('startIndex') ?? 1) || 1, 1);
+        const count = Math.min(Math.max(Number(c.query.get('count') ?? 100) || 0, 0), 200);
+        const slice = items.slice(start - 1, start - 1 + count);
+        return { headers: JSON_SCIM, body: { schemas: [LIST], totalResults: items.length, startIndex: start, itemsPerPage: slice.length, Resources: slice.map(present) } };
+    };
+    const memberUsers = (e, orgId) => e.db.memberships
+        .filter((m) => m.organization_id === orgId)
+        .flatMap((m) => {
+        const u = e.db.users.get(m.user_id);
+        return u && !u.deleted ? [u] : [];
+    });
+    const userRoutes = (prefix) => [
+        {
+            method: 'GET',
+            pattern: `${prefix}/Users`,
+            public: true,
+            handler: guard(false, (c, a, b) => {
+                const m = matcher(c.query.get('filter'));
+                if (typeof m !== 'function')
+                    return m;
+                const flat = (u) => ({ ...u, userName: primaryEmail(u)?.email_address, externalId: u.external_id, id: u.id, active: u.scim_active !== false });
+                return page(c, memberUsers(c.engine, a.orgId).filter((u) => m(flat(u))), (u) => scimUser(c.engine, u, b));
+            }),
+        },
+        {
+            method: 'POST',
+            pattern: `${prefix}/Users`,
+            public: true,
+            handler: guard(true, (c, a, b) => {
+                const e = c.engine;
+                const userName = String(c.body.userName ?? '').trim();
+                const addr = c.body.emails?.find((m) => m.primary)?.value ?? c.body.emails?.[0]?.value ?? userName;
+                if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(String(addr)))
+                    return scimError(400, 'userName or emails[].value must be an email address.', 'invalidValue');
+                const taken = e.db.users.all().find((u) => !u.deleted && u.emails.some((m) => m.email_address.toLowerCase() === String(addr).toLowerCase()));
+                if (taken)
+                    return scimError(409, `${addr} is already in use.`, 'uniqueness');
+                const now = e.clock.now();
+                const mail = { id: e.db.newId('idn'), email_address: String(addr), verified: true };
+                const u = e.db.users.insert({
+                    username: null,
+                    first_name: c.body.name?.givenName ?? null,
+                    last_name: c.body.name?.familyName ?? null,
+                    image_url: null,
+                    external_id: c.body.externalId ?? null,
+                    emails: [mail],
+                    primary_email_address_id: mail.id,
+                    has_password: false,
+                    public_metadata: {},
+                    unsafe_metadata: {},
+                    private_metadata: {},
+                    banned: false,
+                    locked: false,
+                    scim_active: c.body.active !== false,
+                    created_at: now,
+                    updated_at: now,
+                    version: 1,
+                });
+                const role = a.token.role_mappings?.find((r) => c.body.roles?.some((x) => x.value === r.value))?.role ?? 'org:member';
+                const mem = e.db.memberships.insert({ organization_id: a.orgId, user_id: u.id, role, role_source: 'scim', created_at: now });
+                e.changed({ type: 'user.created', data: (0, users_1.presentUser)(e, u), resource: 'user', id: u.id, op: 'create' });
+                e.changed({ type: 'organization_membership.created', data: { id: mem.id, organization_id: a.orgId, user_id: u.id, role }, resource: 'membership', id: mem.id, op: 'create' });
+                e.webhooks.emit('scim_user.created', { object: 'scim_user', id: u.id, organization_id: a.orgId, scim_token_id: a.token.id });
+                return { status: 201, headers: { ...JSON_SCIM, location: `${b}/Users/${u.id}` }, body: scimUser(e, u, b) };
+            }),
+        },
+        {
+            method: 'GET',
+            pattern: `${prefix}/Users/:uid`,
+            public: true,
+            handler: guard(false, (c, a, b) => {
+                const u = memberUsers(c.engine, a.orgId).find((x) => x.id === c.params.uid);
+                return u ? { headers: JSON_SCIM, body: scimUser(c.engine, u, b) } : scimError(404, 'User not found.');
+            }),
+        },
+        ...['PUT', 'PATCH'].map((method) => ({
+            method,
+            pattern: `${prefix}/Users/:uid`,
+            public: true,
+            handler: guard(true, (c, a, b) => {
+                const e = c.engine;
+                const u = memberUsers(e, a.orgId).find((x) => x.id === c.params.uid);
+                if (!u)
+                    return scimError(404, 'User not found.');
+                const apply = (path, value) => {
+                    if (path === 'active')
+                        u.scim_active = value === true || value === 'true';
+                    else if (path === 'name.givenName')
+                        u.first_name = value;
+                    else if (path === 'name.familyName')
+                        u.last_name = value;
+                    else if (path === 'externalId')
+                        u.external_id = value;
+                };
+                if (method === 'PUT') {
+                    apply('active', c.body.active ?? true);
+                    apply('name.givenName', c.body.name?.givenName ?? null);
+                    apply('name.familyName', c.body.name?.familyName ?? null);
+                    apply('externalId', c.body.externalId ?? null);
+                }
+                else {
+                    if (!Array.isArray(c.body.Operations))
+                        return scimError(400, 'Operations is required.', 'invalidSyntax');
+                    for (const op of c.body.Operations) {
+                        const verb = String(op.op ?? '').toLowerCase();
+                        if (verb !== 'replace' && verb !== 'add' && verb !== 'remove')
+                            return scimError(400, `Unsupported op ${op.op}.`, 'invalidSyntax');
+                        if (op.path)
+                            apply(String(op.path), verb === 'remove' ? null : op.value);
+                        else
+                            for (const [k, v] of Object.entries((op.value ?? {})))
+                                apply(k, v);
+                    }
+                }
+                u.updated_at = e.clock.now();
+                u.version = (u.version ?? 0) + 1;
+                const inactive = u.scim_active === false;
+                e.changed({ type: 'user.updated', data: (0, users_1.presentUser)(e, u), resource: 'user', id: u.id, op: 'update' });
+                e.webhooks.emit(inactive ? 'scim_user.deactivated' : 'scim_user.updated', { object: 'scim_user', id: u.id, organization_id: a.orgId, scim_token_id: a.token.id });
+                return { headers: JSON_SCIM, body: scimUser(e, u, b) };
+            }),
+        })),
+        {
+            method: 'DELETE',
+            pattern: `${prefix}/Users/:uid`,
+            public: true,
+            handler: guard(true, (c, a) => {
+                const e = c.engine;
+                const mem = e.db.memberships.find((m) => m.organization_id === a.orgId && m.user_id === c.params.uid);
+                if (!mem)
+                    return scimError(404, 'User not found.');
+                // De-provisioning removes the membership; the user account itself stays (it may belong elsewhere).
+                e.db.memberships.delete(mem.id);
+                e.changed({ type: 'organization_membership.deleted', data: { id: mem.id, organization_id: a.orgId, user_id: mem.user_id }, resource: 'membership', id: mem.id, op: 'delete' });
+                e.webhooks.emit('scim_user.deactivated', { object: 'scim_user', id: mem.user_id, organization_id: a.orgId, scim_token_id: a.token.id });
+                return { status: 204 };
+            }),
+        },
+        // ── groups ──
+        {
+            method: 'GET',
+            pattern: `${prefix}/Groups`,
+            public: true,
+            handler: guard(false, (c, a, b) => {
+                const m = matcher(c.query.get('filter'));
+                if (typeof m !== 'function')
+                    return m;
+                return page(c, c.engine.db.scimGroups.filter((g) => g.organization_id === a.orgId && m({ displayName: g.display_name, externalId: g.external_id, id: g.id })), (g) => scimGroup(c.engine, g, b));
+            }),
+        },
+        {
+            method: 'POST',
+            pattern: `${prefix}/Groups`,
+            public: true,
+            handler: guard(true, (c, a, b) => {
+                const e = c.engine;
+                const name = String(c.body.displayName ?? '').trim();
+                if (!name)
+                    return scimError(400, 'displayName is required.', 'invalidValue');
+                if (e.db.scimGroups.find((g) => g.organization_id === a.orgId && g.display_name === name))
+                    return scimError(409, 'A group with that displayName exists.', 'uniqueness');
+                const now = e.clock.now();
+                const g = e.db.scimGroups.insert({ organization_id: a.orgId, display_name: name, external_id: c.body.externalId ?? null, members: (c.body.members ?? []).map((m) => String(m.value)), created_at: now, updated_at: now });
+                e.webhooks.emit('scim_group.created', { object: 'scim_group', id: g.id, organization_id: a.orgId, display_name: name });
+                return { status: 201, headers: { ...JSON_SCIM, location: `${b}/Groups/${g.id}` }, body: scimGroup(e, g, b) };
+            }),
+        },
+        {
+            method: 'GET',
+            pattern: `${prefix}/Groups/:gid`,
+            public: true,
+            handler: guard(false, (c, a, b) => {
+                const g = c.engine.db.scimGroups.get(c.params.gid);
+                return g && g.organization_id === a.orgId ? { headers: JSON_SCIM, body: scimGroup(c.engine, g, b) } : scimError(404, 'Group not found.');
+            }),
+        },
+        {
+            method: 'PATCH',
+            pattern: `${prefix}/Groups/:gid`,
+            public: true,
+            handler: guard(true, (c, a, b) => {
+                const e = c.engine;
+                const g = e.db.scimGroups.get(c.params.gid);
+                if (!g || g.organization_id !== a.orgId)
+                    return scimError(404, 'Group not found.');
+                if (!Array.isArray(c.body.Operations))
+                    return scimError(400, 'Operations is required.', 'invalidSyntax');
+                for (const op of c.body.Operations) {
+                    const verb = String(op.op ?? '').toLowerCase();
+                    const path = String(op.path ?? 'members');
+                    if (path === 'displayName')
+                        g.display_name = String(op.value);
+                    else if (path.startsWith('members')) {
+                        const given = (Array.isArray(op.value) ? op.value : []).map((m) => String(m.value));
+                        const quoted = /members\[value eq "([^"]+)"\]/.exec(path)?.[1];
+                        if (verb === 'add') {
+                            for (const id of given) {
+                                if (g.members.includes(id))
+                                    continue;
+                                g.members.push(id);
+                                e.webhooks.emit('scim_group.member_added', { object: 'scim_group', id: g.id, user_id: id });
+                            }
+                        }
+                        else if (verb === 'remove') {
+                            const drop = quoted ? [quoted] : given.length ? given : [...g.members];
+                            g.members = g.members.filter((id) => !drop.includes(id));
+                            for (const id of drop)
+                                e.webhooks.emit('scim_group.member_removed', { object: 'scim_group', id: g.id, user_id: id });
+                        }
+                        else if (verb === 'replace')
+                            g.members = given;
+                    }
+                }
+                g.updated_at = e.clock.now();
+                e.webhooks.emit('scim_group.updated', { object: 'scim_group', id: g.id, organization_id: a.orgId, display_name: g.display_name });
+                return { headers: JSON_SCIM, body: scimGroup(e, g, b) };
+            }),
+        },
+        {
+            method: 'DELETE',
+            pattern: `${prefix}/Groups/:gid`,
+            public: true,
+            handler: guard(true, (c, a) => {
+                const g = c.engine.db.scimGroups.get(c.params.gid);
+                if (!g || g.organization_id !== a.orgId)
+                    return scimError(404, 'Group not found.');
+                c.engine.db.scimGroups.delete(g.id);
+                c.engine.webhooks.emit('scim_group.deleted', { object: 'scim_group', id: g.id, organization_id: a.orgId });
+                return { status: 204 };
+            }),
+        },
+        // ── discovery ──
+        {
+            method: 'GET',
+            pattern: `${prefix}/ServiceProviderConfig`,
+            public: true,
+            handler: guard(false, () => ({
+                headers: JSON_SCIM,
+                body: {
+                    schemas: ['urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig'],
+                    patch: { supported: true },
+                    bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+                    filter: { supported: true, maxResults: 200 },
+                    changePassword: { supported: false },
+                    sort: { supported: false },
+                    etag: { supported: false },
+                    authenticationSchemes: [{ type: 'oauthbearertoken', name: 'Bearer token', description: 'A SCIM token from the Backend API.' }],
+                },
+            })),
+        },
+        {
+            method: 'GET',
+            pattern: `${prefix}/ResourceTypes`,
+            public: true,
+            handler: guard(false, () => ({
+                headers: JSON_SCIM,
+                body: { schemas: [LIST], totalResults: 2, Resources: [{ schemas: ['urn:ietf:params:scim:schemas:core:2.0:ResourceType'], id: 'User', name: 'User', endpoint: '/Users', schema: USER_SCHEMA }, { schemas: ['urn:ietf:params:scim:schemas:core:2.0:ResourceType'], id: 'Group', name: 'Group', endpoint: '/Groups', schema: GROUP_SCHEMA }] },
+            })),
+        },
+        {
+            method: 'GET',
+            pattern: `${prefix}/Schemas`,
+            public: true,
+            handler: guard(false, () => ({ headers: JSON_SCIM, body: { schemas: [LIST], totalResults: 2, Resources: [{ id: USER_SCHEMA, name: 'User' }, { id: GROUP_SCHEMA, name: 'Group' }] } })),
+        },
+    ];
+    return [
+        // ── token management (Backend API) ──
+        {
+            method: 'POST',
+            pattern: '/v1/scim_tokens',
+            handler: (c) => {
+                const e = c.engine;
+                const orgId = String((0, util_1.need)(c.body, 'organization_id'));
+                if (!e.db.organizations.get(orgId))
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'organization_id is not an organization.', 'organization_id');
+                const secret = `scim_${(0, store_1.randomToken)(32)}`;
+                const t = e.db.scimTokens.insert({ name: c.body.name ?? null, organization_id: orgId, connection_id: c.body.connection_id ?? null, scopes: c.body.scopes ?? null, role_mappings: c.body.role_mappings ?? null, secret, prefix: secret.slice(0, 10), revoked: false, created_at: e.clock.now() });
+                e.webhooks.emit('scim_token.created', presentToken(t));
+                return { status: 201, body: { ...presentToken(t), token: secret } };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/scim_tokens',
+            handler: (c) => {
+                const org = c.query.get('organization_id');
+                return (0, util_1.listReply)(c, c.engine.db.scimTokens.filter((t) => !org || t.organization_id === org), presentToken);
+            },
+        },
+        {
+            method: 'PATCH',
+            pattern: '/v1/scim_tokens/:id',
+            handler: (c) => {
+                const t = c.engine.db.scimTokens.get(c.params.id);
+                if (!t)
+                    throw (0, errors_1.notFound)('SCIM token');
+                for (const k of ['name', 'scopes', 'role_mappings'])
+                    if (k in c.body)
+                        t[k] = c.body[k];
+                return { body: presentToken(t) };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/scim_tokens/:id/revoke',
+            handler: (c) => {
+                const t = c.engine.db.scimTokens.get(c.params.id);
+                if (!t)
+                    throw (0, errors_1.notFound)('SCIM token');
+                t.revoked = true;
+                c.engine.webhooks.emit('scim_token.revoked', presentToken(t));
+                return { body: { object: 'scim_token', id: t.id, revoked: true, note: 'Requests with this token now answer 401.' } };
+            },
+        },
+        ...userRoutes('/scim/v2'),
+        ...userRoutes('/scim/v2/d/:directoryId'),
+    ];
+}
+//# sourceMappingURL=scim.js.map

package/dist/handlers/scim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.js","sourceRoot":"","sources":["../../src/handlers/scim.ts"],"names":[],"mappings":";;AAuFA,oCA6SC;AAlYD,sCAAoD;AAEpD,oCAAuC;AACvC,iCAAyC;AACzC,mCAAsC;AAEtC;;;;;GAKG;AACH,MAAM,WAAW,GAAG,4CAA4C,CAAC;AACjE,MAAM,YAAY,GAAG,6CAA6C,CAAC;AACnE,MAAM,IAAI,GAAG,oDAAoD,CAAC;AAClE,MAAM,QAAQ,GAAG,+CAA+C,CAAC;AACjE,MAAM,GAAG,GAAG,6CAA6C,CAAC;AAC1D,MAAM,SAAS,GAAG,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC;AAE9D,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,QAAiB,EAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAE9M,MAAM,YAAY,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC;IACrC,MAAM,EAAE,YAAY;IACpB,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;IACpB,eAAe,EAAE,CAAC,CAAC,eAAe;IAClC,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;IACxB,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI;IAC3B,UAAU,EAAE,CAAC,CAAC,UAAU;CACzB,CAAC,CAAC;AAOH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAe;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACrE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;AAC3H,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAM,EAAmB,EAAE,CAAE,CAAC,CAAC,MAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,wBAAwB,CAAC,IAAK,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC;AAEjJ,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAM,EAAE,IAAY;IAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO;QACL,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;QACtC,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE;QACnD,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE;QACnK,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;QAC/E,MAAM,EAAG,CAAC,CAAC,MAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAClH,MAAM,EAAE,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE;KACrK,CAAC;AACJ,CAAC;AACD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,CAAM,EAAE,IAAY,EAAO,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC,YAAY,CAAC;IACvB,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;IACtC,WAAW,EAAE,CAAC,CAAC,YAAY;IAC3B,OAAO,EAAG,CAAC,CAAC,OAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;CACvK,CAAC,CAAC;AAEH,8FAA8F;AAC9F,SAAS,OAAO,CAAC,MAAqB;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8DAA8D,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACnI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,uBAAuB,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC,EAAE,EAAE,CACX,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QAChB,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAE,CAAS,CAAC,IAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,IAAI,KAAK,IAAI,EAAE,EAAE,EAAE,IAAI,KAAK,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC,EAAG,CAAC,WAAW,EAAU,CAAC,CAAC;IAC3K,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAgB,YAAY;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAe,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAC/K,oFAAoF;IACpF,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAsE,EAAE,EAAE,CAAC,CAAC,CAAe,EAA0B,EAAE;QACpJ,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACjF,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAe,EAAE,KAAY,EAAE,OAAwB,EAAS,EAAE;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IACrK,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,KAAa,EAAS,EAAE,CACtD,CAAC,CAAC,EAAE,CAAC,WAAW;SACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,KAAK,CAAC;SAC1C,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACb,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEP,MAAM,UAAU,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC;QACjD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG,MAAM,QAAQ;YAC1B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAChC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzC,IAAI,OAAO,CAAC,KAAK,UAAU;oBAAE,OAAO,CAAC,CAAC;gBACtC,MAAM,IAAI,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC,CAAC;gBACzJ,OAAO,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5G,CAAC,CAAC;SACH;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,MAAM,QAAQ;YAC1B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,MAAM,IAAI,GAAI,CAAC,CAAC,IAAI,CAAC,MAA4B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,IAAK,CAAC,CAAC,IAAI,CAAC,MAA4B,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC;gBACjJ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,sDAAsD,EAAE,cAAc,CAAC,CAAC;gBACpJ,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAK,CAAC,CAAC,MAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBACxJ,IAAI,KAAK;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,qBAAqB,EAAE,YAAY,CAAC,CAAC;gBAC7E,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACpF,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC1B,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,IAAI;oBAC1C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI;oBAC1C,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI;oBACtC,MAAM,EAAE,CAAC,IAAI,CAAC;oBACd,wBAAwB,EAAE,IAAI,CAAC,EAAE;oBACjC,YAAY,EAAE,KAAK;oBACnB,eAAe,EAAE,EAAE;oBACnB,eAAe,EAAE,EAAE;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;oBACpC,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,CAAC;iBACX,CAAC,CAAC;gBACH,MAAM,IAAI,GAAI,CAAC,CAAC,KAAK,CAAC,aAA8B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,IAAI,CAAC,KAA2B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,YAAY,CAAC;gBAC/J,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7H,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAA,mBAAW,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACvG,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC9K,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7H,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7G,CAAC,CAAC;SACH;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG,MAAM,aAAa;YAC/B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAChC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5E,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACxG,CAAC,CAAC;SACH;QACD,GAAI,CAAC,KAAK,EAAE,OAAO,CAAW,CAAC,GAAG,CAChC,CAAC,MAAM,EAAY,EAAE,CAAC,CAAC;YACrB,MAAM;YACN,OAAO,EAAE,GAAG,MAAM,aAAa;YAC/B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,KAAU,EAAQ,EAAE;oBAC/C,IAAI,IAAI,KAAK,QAAQ;wBAAE,CAAC,CAAC,WAAW,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;yBACrE,IAAI,IAAI,KAAK,gBAAgB;wBAAE,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC;yBACpD,IAAI,IAAI,KAAK,iBAAiB;wBAAE,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;yBACpD,IAAI,IAAI,KAAK,YAAY;wBAAE,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC;gBACxD,CAAC,CAAC;gBACF,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;oBACvC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;oBACxD,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC;oBAC1D,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;gBACjD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;wBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,eAAe,CAAC,CAAC;oBACzG,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAmB,EAAE,CAAC;wBAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;wBAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ;4BAAE,OAAO,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;wBAClI,IAAI,EAAE,CAAC,IAAI;4BAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;;4BACpE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAQ,CAAC;gCAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBACjF,CAAC;gBACH,CAAC;gBACD,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC7B,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC;gBACzC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAA,mBAAW,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACvG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClK,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACzD,CAAC,CAAC;SACH,CAAC,CACH;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,GAAG,MAAM,aAAa;YAC/B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtG,IAAI,CAAC,GAAG;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;gBACnD,mGAAmG;gBACnG,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC/K,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxI,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzB,CAAC,CAAC;SACH;QACD,eAAe;QACf;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG,MAAM,SAAS;YAC3B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAChC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzC,IAAI,OAAO,CAAC,KAAK,UAAU;oBAAE,OAAO,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACnM,CAAC,CAAC;SACH;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,MAAM,SAAS;YAC3B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrD,IAAI,CAAC,IAAI;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,0BAA0B,EAAE,cAAc,CAAC,CAAC;gBAC7E,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,uCAAuC,EAAE,YAAY,CAAC,CAAC;gBACxK,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,OAAO,EAAE,CAAE,CAAC,CAAC,IAAI,CAAC,OAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/G,CAAC,CAAC;SACH;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG,MAAM,cAAc;YAChC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAChC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC3I,CAAC,CAAC;SACH;QACD;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,GAAG,MAAM,cAAc;YAChC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,KAAK;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACnF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,eAAe,CAAC,CAAC;gBACzG,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAmB,EAAE,CAAC;oBAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;oBAC1C,IAAI,IAAI,KAAK,aAAa;wBAAE,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;yBACzD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;wBACpC,MAAM,KAAK,GAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC/F,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;wBAC/D,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;4BACnB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gCACvB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oCAAE,SAAS;gCACrC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gCACnB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;4BAC9F,CAAC;wBACH,CAAC;6BAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;4BAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;4BACvE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;4BACjE,KAAK,MAAM,EAAE,IAAI,IAAI;gCAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;wBACvH,CAAC;6BAAM,IAAI,IAAI,KAAK,SAAS;4BAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;oBACnD,CAAC;gBACH,CAAC;gBACD,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBAClI,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,CAAC,CAAC;SACH;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,GAAG,MAAM,cAAc;YAChC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,KAAK;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACnF,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3G,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzB,CAAC,CAAC;SACH;QACD,kBAAkB;QAClB;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG,MAAM,wBAAwB;YAC1C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3B,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE;oBACJ,OAAO,EAAE,CAAC,6DAA6D,CAAC;oBACxE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;oBAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE;oBAC/D,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;oBAC5C,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;oBACpC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;oBAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;oBAC1B,qBAAqB,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;iBAC/H;aACF,CAAC,CAAC;SACJ;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG,MAAM,gBAAgB;YAClC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3B,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,oDAAoD,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,oDAAoD,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE;aAC5U,CAAC,CAAC;SACJ;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG,MAAM,UAAU;YAC5B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;SACvL;KACF,CAAC;IAEF,OAAO;QACL,uCAAuC;QACvC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAA,WAAI,EAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,yCAAyC,EAAE,iBAAiB,CAAC,CAAC;gBACvI,MAAM,MAAM,GAAG,QAAQ,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;YACtE,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,OAAO,IAAA,gBAAS,EAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,eAAe,KAAK,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;YAC7G,CAAC;SACF;QACD;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,YAAY,CAAC,CAAC;gBACrC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI;wBAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvF,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4BAA4B;YACrC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,YAAY,CAAC,CAAC;gBACrC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9D,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,0CAA0C,EAAE,EAAE,CAAC;YACvH,CAAC;SACF;QACD,GAAG,UAAU,CAAC,UAAU,CAAC;QACzB,GAAG,UAAU,CAAC,yBAAyB,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/handlers/sessions.d.ts

@@ -1,13 +1,17 @@
 import type { Engine, RouteDef } from '../engine';
+/** A replay of a just-rotated token within this window is a client that lost the reply, not theft (the real service uses 30 s). */
+export declare const REFRESH_GRACE_MS = 30000;
 export declare const resetSessions: (e: Engine) => void;
-export declare function issueRefreshToken(e: Engine, sessionId: string): string;
+export declare function issueRefreshToken(e: Engine, sessionId: string, token?: string): string;
 /**
- * Rotate a refresh token: the old one becomes single-use spent, a new one is issued. Presenting a spent
- * token again revokes the session (reuse detection) and answers REFRESH_REUSE_DETECTED.
+ * Rotate a refresh token, like the real service: the old one is spent and a new one issued. A replay of the
+ * spent token inside the grace window is idempotent (a fresh JWT and the token already issued, no second
+ * rotation); outside it the replay is theft: the session is revoked and REFRESH_REUSE_DETECTED answers.
  */
 export declare function refreshSession(e: Engine, token: string): Promise<{
     jwt: string;
     refresh_token: string;
     expires_in: number;
+    session_id: string;
 }>;
 export declare function sessionsHandlers(): RouteDef[];

package/dist/handlers/sessions.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resetSessions = void 0;
+exports.resetSessions = exports.REFRESH_GRACE_MS = void 0;
 exports.issueRefreshToken = issueRefreshToken;
 exports.refreshSession = refreshSession;
 exports.sessionsHandlers = sessionsHandlers;
 const errors_1 = require("../errors");
 const store_1 = require("../store");
+const oauth_1 = require("./oauth");
+const round2_1 = require("./round2");
 const util_1 = require("./util");
 const memberOrgRole = (e, userId, orgId) => {
     if (!orgId)
@@ -27,6 +29,8 @@ const presentSession = (s) => ({
     expires_at: s.expires_at,
     last_active_at: s.last_active_at,
 });
+/** A replay of a just-rotated token within this window is a client that lost the reply, not theft (the real service uses 30 s). */
+exports.REFRESH_GRACE_MS = 30_000;
 const refreshTokens = new WeakMap();
 const refreshMap = (e) => {
     let m = refreshTokens.get(e);
@@ -36,32 +40,41 @@ const refreshMap = (e) => {
 };
 const resetSessions = (e) => void refreshTokens.delete(e);
 exports.resetSessions = resetSessions;
-function issueRefreshToken(e, sessionId) {
-    const t = `rt_${(0, store_1.randomToken)(32)}`;
-    refreshMap(e).set(t, { sessionId, used: false });
+function issueRefreshToken(e, sessionId, token) {
+    const t = token ?? `rt_${(0, store_1.randomToken)(32)}`;
+    refreshMap(e).set(t, { sessionId });
     return t;
 }
 /**
- * Rotate a refresh token: the old one becomes single-use spent, a new one is issued. Presenting a spent
- * token again revokes the session (reuse detection) and answers REFRESH_REUSE_DETECTED.
+ * Rotate a refresh token, like the real service: the old one is spent and a new one issued. A replay of the
+ * spent token inside the grace window is idempotent (a fresh JWT and the token already issued, no second
+ * rotation); outside it the replay is theft: the session is revoked and REFRESH_REUSE_DETECTED answers.
  */
 async function refreshSession(e, token) {
     const rec = refreshMap(e).get(token);
     if (!rec)
-        throw new errors_1.EmulatorError('UNAUTHENTICATED', 'Unknown refresh token.');
+        throw new errors_1.EmulatorError('UNAUTHENTICATED', 'That session is no longer valid.');
     const s = e.db.sessions.get(rec.sessionId);
-    if (!s || s.status !== 'active')
+    if (!s || s.status === 'revoked')
         throw new errors_1.EmulatorError('SESSION_REVOKED', 'The session is no longer active.');
-    if (rec.used) {
-        s.status = 'revoked';
-        throw new errors_1.EmulatorError('REFRESH_REUSE_DETECTED', 'This refresh token was already used; the session was revoked.');
-    }
-    if (s.expires_at <= e.clock.now())
+    const now = e.clock.now();
+    if (s.expires_at <= now)
         throw new errors_1.EmulatorError('SESSION_EXPIRED', 'The session has expired.');
-    rec.used = true;
-    s.last_active_at = e.clock.now();
-    const minted = await e.tokens.mintSession({ userId: s.user_id, sessionId: s.id, organizationId: s.organization_id, claims: memberOrgRole(e, s.user_id, s.organization_id) });
-    return { jwt: minted.jwt, refresh_token: issueRefreshToken(e, s.id), expires_in: minted.expiresIn };
+    const mint = async () => (await e.tokens.mintSession({ userId: s.user_id, sessionId: s.id, organizationId: s.organization_id, claims: memberOrgRole(e, s.user_id, s.organization_id) }));
+    if (rec.rotatedAt !== undefined) {
+        if (now - rec.rotatedAt <= exports.REFRESH_GRACE_MS && rec.successor) {
+            const minted = await mint();
+            return { jwt: minted.jwt, refresh_token: rec.successor, expires_in: minted.expiresIn, session_id: s.id };
+        }
+        (0, round2_1.revokeSession)(e, s, 'refresh_token_reuse');
+        throw new errors_1.EmulatorError('REFRESH_REUSE_DETECTED', 'This session was ended for security reasons. Please sign in again.');
+    }
+    s.last_active_at = now;
+    const minted = await mint();
+    const next = issueRefreshToken(e, s.id);
+    rec.rotatedAt = now;
+    rec.successor = next;
+    return { jwt: minted.jwt, refresh_token: next, expires_in: minted.expiresIn, session_id: s.id };
 }
 function sessionsHandlers() {
     const SESSION_TTL = 7 * 86_400_000;
@@ -72,13 +85,29 @@ function sessionsHandlers() {
             public: true,
             handler: async (c) => ({ body: await c.engine.tokens.jwks() }),
         },
+        { method: 'GET', pattern: '/.well-known/openid-configuration', public: true, handler: (c) => ({ body: (0, oauth_1.discoveryDocument)(c.engine) }) },
         {
-            method: 'GET',
-            pattern: '/.well-known/openid-configuration',
+            // The real Frontend API route (same path, credential sources and answer): the refresh credential is the
+            // `__atlas_rt` cookie, the `x-refresh-token` header or the `refresh_token` body field; a cookieless caller gets
+            // the rotated token back in the body. The session id in the path must be the token's session.
+            method: 'POST',
+            pattern: '/v1/client/sessions/:id/tokens',
             public: true,
-            handler: (c) => {
-                const iss = c.engine.issuer;
-                return { body: { issuer: iss, jwks_uri: `${iss}/.well-known/jwks.json`, authorization_endpoint: `${iss}/oauth2/authorize`, token_endpoint: `${iss}/oauth2/token`, response_types_supported: ['code'], subject_types_supported: ['public'], id_token_signing_alg_values_supported: ['RS256', 'ES256'], atlas_emulator: true } };
+            handler: async (c) => {
+                const cookie = /(?:^|;\s*)__atlas_rt=([^;]+)/.exec(c.request.headers.get('cookie') ?? '')?.[1];
+                const header = c.request.headers.get('x-refresh-token');
+                const bodyToken = typeof c.body.refresh_token === 'string' ? c.body.refresh_token : undefined;
+                const presented = cookie ? decodeURIComponent(cookie) : (header ?? bodyToken);
+                if (!presented)
+                    throw new errors_1.EmulatorError('UNAUTHENTICATED', 'No refresh token was presented.');
+                const out = await refreshSession(c.engine, presented);
+                if (out.session_id !== c.params.id)
+                    throw (0, errors_1.notFound)('Session');
+                const attrs = 'Path=/; HttpOnly; SameSite=Lax';
+                return {
+                    body: { object: 'session_tokens', jwt: out.jwt, session_id: out.session_id, expires_in: out.expires_in, ...(cookie ? {} : { refresh_token: out.refresh_token }) },
+                    headers: { 'set-cookie': [`__session=${out.jwt}; ${attrs}; Max-Age=${out.expires_in}`, `__atlas_rt=${encodeURIComponent(out.refresh_token)}; ${attrs}`] },
+                };
             },
         },
         {
@@ -101,8 +130,9 @@ function sessionsHandlers() {
             },
         },
         { method: 'GET', pattern: '/v1/sessions', handler: (c) => {
-                const uid = c.query.get('user_id');
-                return (0, util_1.listReply)(c, c.engine.db.sessions.filter((s) => !uid || s.user_id === uid), presentSession);
+                const q = (k) => c.query.get(k);
+                const sessions = c.engine.db.sessions.filter((s) => (!q('user_id') || s.user_id === q('user_id')) && (!q('organization_id') || s.organization_id === q('organization_id')) && (q('active') === null || (s.status === 'active') === (q('active') === 'true')) && (!q('created_after') || s.created_at >= Date.parse(q('created_after'))) && (!q('created_before') || s.created_at <= Date.parse(q('created_before'))));
+                return (0, util_1.listReply)(c, sessions, presentSession);
             } },
         {
             method: 'GET',
@@ -121,7 +151,7 @@ function sessionsHandlers() {
                 const s = c.engine.db.sessions.get(c.params.id);
                 if (!s)
                     throw (0, errors_1.notFound)('Session');
-                s.status = 'revoked';
+                (0, round2_1.revokeSession)(c.engine, s, 'admin');
                 return { body: presentSession(s) };
             },
         },