@atlasauth/emulator-core 0.2.0 → 0.3.0

package/dist/handlers/emu4-oauth-pub.js

@@ -0,0 +1,420 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publisherSectorOf = exports.GOOGLE_ACCESS_TOKEN_TYPE = exports.PUBLISHER_SKIP_SCOPES = exports.MAX_PUBLISHER_APPS = exports.MAX_PUBLISHERS = void 0;
+exports.homepageOnDomain = homepageOnDomain;
+exports.publisherOf = publisherOf;
+exports.publisherDecision = publisherDecision;
+exports.googleTokenExchange = googleTokenExchange;
+exports.emu4PublisherHandlers = emu4PublisherHandlers;
+const errors_1 = require("../errors");
+const store_1 = require("../store");
+const oauth_1 = require("./oauth");
+const oauth_flows_1 = require("./oauth-flows");
+const sessions_1 = require("./sessions");
+const emu4_oauth_audit_1 = require("./emu4-oauth-audit");
+const support_1 = require("./support");
+/**
+ * Verified OAuth publishers (`/v1/oauth_publishers`) and the Google access-token exchange, with the real rules.
+ *
+ * Publishers: a DNS TXT record (`_atlas-publisher.<domain>`, value `atlas-publisher-verification=...`) proves the
+ * domain; the emulator has no DNS, so `POST /__emulator/oauth/dns` plays the zone (a TXT record, or a transient
+ * lookup failure). Verified status is only ever set by `POST /v1/oauth_publishers/{id}/verify`.
+ *
+ * Google exchange: a first-party client trades a Google access token for an Atlas session at the token endpoint
+ * (`subject_token_type=urn:atlas:token-type:google_access_token`). The emulator has no Google; `POST
+ * /__emulator/google/tokens` registers the token Google would vouch for, and the checks Atlas makes against Google's
+ * tokeninfo and userinfo answers are the real ones.
+ */
+exports.MAX_PUBLISHERS = 50;
+exports.MAX_PUBLISHER_APPS = 200;
+exports.PUBLISHER_SKIP_SCOPES = new Set(['openid', 'email', 'profile']);
+exports.GOOGLE_ACCESS_TOKEN_TYPE = 'urn:atlas:token-type:google_access_token';
+const SESSION_TOKEN_TYPE = 'urn:atlas:token-type:session';
+const TOKEN_PREFIX = 'atlas-publisher-verification=';
+const ps = (0, support_1.engineState)((e) => ({
+    publishers: new store_1.Table('oauth_publishers', e.clock.now, 'opub'),
+    dns: new Map(),
+    google: { cfg: { enabled: false, clientIds: [], hostedDomains: [], allowSignUp: false, atlasClientIds: [] }, tokens: new Map(), links: new Map() },
+}));
+const bad = (message, param) => new errors_1.EmulatorError('VALIDATION_FAILED', message, param);
+const conflict = (message) => new errors_1.EmulatorError('CONFLICT', message);
+const notFoundPub = () => new errors_1.EmulatorError('NOT_FOUND', 'Unknown publisher.');
+const recordName = (domain) => `_atlas-publisher.${domain}`;
+function parseDomain(raw) {
+    const domain = typeof raw === 'string' ? raw.trim().toLowerCase().replace(/\.$/, '') : '';
+    if (!/^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/.test(domain))
+        throw bad('domain must be a host name such as example.com.', 'domain');
+    return domain;
+}
+function nameOf(raw) {
+    if (typeof raw !== 'string' || raw.trim().length < 1 || raw.trim().length > 100)
+        throw bad('name must be 1 to 100 characters.', 'name');
+    return raw.trim();
+}
+function boolOf(raw, param) {
+    if (typeof raw !== 'boolean')
+        throw bad(`${param} must be true or false.`, param);
+    return raw;
+}
+/** Does an https homepage live on `domain` (or a subdomain of it)? */
+function homepageOnDomain(url, domain) {
+    if (typeof url !== 'string' || !url)
+        return false;
+    try {
+        const u = new URL(url);
+        return u.protocol === 'https:' && (u.hostname.toLowerCase() === domain || u.hostname.toLowerCase().endsWith(`.${domain}`));
+    }
+    catch {
+        return false;
+    }
+}
+const liveClients = (e, publisherId) => e.db.oauthClients.filter((c) => !c.deleted && c.publisher_id === publisherId);
+function publisherView(e, p) {
+    const verified = p.verified_at !== null;
+    return {
+        object: 'oauth_publisher',
+        id: p.id,
+        name: p.name,
+        domain: p.domain,
+        verified,
+        verified_at: p.verified_at,
+        last_checked_at: p.last_checked_at,
+        record_name: recordName(p.domain),
+        record_value: p.verification_token,
+        shared_sector: p.shared_sector,
+        sector_identifier: p.shared_sector && verified ? p.domain : null,
+        skip_consent: p.skip_consent,
+        client_ids: liveClients(e, p.id).map((c) => c.id),
+        created_at: p.created_at,
+        updated_at: p.updated_at,
+    };
+}
+const find = (e, id) => {
+    const p = ps(e).publishers.get(id);
+    if (!p)
+        throw notFoundPub();
+    return p;
+};
+function announce(e, id, action, current, before) {
+    (0, emu4_oauth_audit_1.recordAudit)(e, `oauth_publisher.${action}`, 'api_key', 'oauth_publisher', id, { before, after: current });
+    e.webhooks.emit('oauth_publisher.updated', { object: 'oauth_publisher', publisher: id, action, current, at: e.clock.now() });
+}
+/** The verified publisher an app belongs to, or undefined. */
+function publisherOf(e, client) {
+    const p = client.publisher_id ? ps(e).publishers.get(client.publisher_id) : undefined;
+    return p && p.verified_at !== null && homepageOnDomain(client.homepage_url, p.domain) ? p : undefined;
+}
+/** The shared sector of the publisher an app belongs to (its subject settings are then the publisher's). */
+const publisherSectorOf = (e, client) => {
+    const p = client.publisher_id ? ps(e).publishers.get(client.publisher_id) : undefined;
+    return p?.shared_sector ? p.domain : null;
+};
+exports.publisherSectorOf = publisherSectorOf;
+/**
+ * The consent step for an app of a verified publisher: the name to show, and whether one consent covers the publisher's
+ * other apps (the publisher opted in, only openid/email/profile asked, and the user already consented to another
+ * enabled app of the publisher for at least those scopes).
+ */
+function publisherDecision(e, client, userId, requested) {
+    const p = publisherOf(e, client);
+    if (!p)
+        return { publisherName: null, skipConsent: false };
+    if (!p.skip_consent || !requested.every((s) => exports.PUBLISHER_SKIP_SCOPES.has(s)))
+        return { publisherName: p.name, skipConsent: false };
+    const covered = liveClients(e, p.id).filter((s) => s.id !== client.id).some((s) => {
+        const held = (0, oauth_flows_1.heldConsent)(e, userId, s.id);
+        return !!held && requested.every((r) => held.has(r));
+    });
+    return { publisherName: p.name, skipConsent: covered };
+}
+// ── Google access-token exchange ───────────────────────────────────
+const TOKEN_RE = /^[\x21-\x7e]{16,4096}$/;
+const SUB_RE = /^[0-9A-Za-z_-]{1,255}$/;
+const isTrue = (v) => v === true || v === 'true';
+/** The real checks, in the real order, against what the stubbed Google answers (tokeninfo, then userinfo). */
+function verifyGoogleToken(e, token) {
+    const g = ps(e).google;
+    const cfg = g.cfg;
+    if (!cfg.clientIds.length)
+        return { ok: false, reason: 'no_google_client_ids' };
+    if (!TOKEN_RE.test(token))
+        return { ok: false, reason: 'malformed_token' };
+    const rec = g.tokens.get(token);
+    if (!rec)
+        return { ok: false, reason: 'google_rejected_token' };
+    if (typeof rec.aud !== 'string' || !cfg.clientIds.includes(rec.aud))
+        return { ok: false, reason: 'audience_not_allowed' };
+    if (rec.azp !== undefined && (typeof rec.azp !== 'string' || !cfg.clientIds.includes(rec.azp)))
+        return { ok: false, reason: 'authorized_party_not_allowed' };
+    if (!(rec.issued_at + Number(rec.expires_in) * 1000 > e.clock.now()))
+        return { ok: false, reason: 'expired' };
+    if (typeof rec.sub !== 'string' || !SUB_RE.test(rec.sub))
+        return { ok: false, reason: 'no_subject' };
+    const scopes = typeof rec.scope === 'string' ? rec.scope.split(' ') : [];
+    if (!scopes.includes('openid') && !scopes.includes('https://www.googleapis.com/auth/userinfo.email'))
+        return { ok: false, reason: 'scope_missing' };
+    const email = typeof rec.email === 'string' ? rec.email.trim().toLowerCase() : '';
+    if (!email || !isTrue(rec.email_verified))
+        return { ok: false, reason: 'email_not_verified' };
+    if (cfg.hostedDomains.length) {
+        const hd = typeof rec.hd === 'string' ? rec.hd.toLowerCase() : '';
+        if (!hd || !cfg.hostedDomains.includes(hd) || !email.endsWith(`@${hd}`))
+            return { ok: false, reason: 'domain_not_allowed' };
+    }
+    return { ok: true, sub: rec.sub, email, user: rec };
+}
+/** The `urn:atlas:token-type:google_access_token` branch of the token-exchange grant. */
+async function googleTokenExchange(c, client) {
+    const e = c.engine;
+    const g = ps(e).google;
+    const b = c.body;
+    const refuse = (status, error, description) => (0, oauth_1.fail)(status, error, description);
+    if (!g.cfg.enabled)
+        return refuse(400, 'invalid_request', 'The Google token exchange is not enabled for this instance.');
+    if (client.first_party !== true || !g.cfg.atlasClientIds.includes(client.id))
+        return refuse(403, 'unauthorized_client', 'This client may not exchange a Google access token for a session.');
+    if (b.requested_token_type !== undefined && b.requested_token_type !== SESSION_TOKEN_TYPE)
+        return refuse(400, 'invalid_request', `A Google access token can only be exchanged for a session (requested_token_type ${SESSION_TOKEN_TYPE}).`);
+    if (b.actor_token)
+        return refuse(400, 'invalid_request', 'A Google token exchange takes no actor_token.');
+    const checked = verifyGoogleToken(e, String(b.subject_token ?? ''));
+    // One generic answer for every Google-side refusal, so a caller cannot probe the configuration.
+    if (!checked.ok)
+        return refuse(400, 'invalid_grant', 'The Google access token was not accepted.');
+    const key = `google:${checked.sub}`;
+    let user = e.db.users.get(g.links.get(key));
+    if (!user || user.deleted) {
+        user = e.db.users.filter((u) => !u.deleted && u.emails.some((m) => m.verified === true && m.email_address.toLowerCase() === checked.email))[0];
+        if (!user && g.cfg.allowSignUp) {
+            const res = await e.handle(new Request(`${e.issuer}/v1/users`, { method: 'POST', headers: { 'content-type': 'application/json', authorization: `Bearer ${e.keys[0].key}` }, body: JSON.stringify({ email_address: checked.email, first_name: checked.user.given_name, last_name: checked.user.family_name, image_url: checked.user.picture }) }));
+            if (res.status === 201)
+                user = e.db.users.get((await res.json()).id);
+        }
+        if (!user)
+            return refuse(403, 'access_denied', 'No Atlas account matches this Google account.');
+        g.links.set(key, user.id);
+    }
+    if (user.banned || user.locked || user.deleted)
+        return refuse(403, 'access_denied', 'This account cannot sign in.');
+    const now = e.clock.now();
+    const session = e.db.sessions.insert({ user_id: user.id, organization_id: null, status: 'active', created_at: now, expires_at: now + 7 * 86_400_000, last_active_at: now, minted_via: 'google_token_exchange', client_id: client.id, ...(typeof b.device_name === 'string' && b.device_name ? { device_name: b.device_name.slice(0, 100) } : {}) });
+    const minted = await e.tokens.mintSession({ userId: user.id, sessionId: session.id, claims: { azp: client.id } });
+    return { body: { access_token: minted.jwt, issued_token_type: SESSION_TOKEN_TYPE, token_type: 'Bearer', expires_in: minted.expiresIn, refresh_token: (0, sessions_1.issueRefreshToken)(e, session.id), session_id: session.id }, headers: { 'cache-control': 'no-store', pragma: 'no-cache' } };
+}
+// ── routes ──────────────────────────────────────────────────────────
+function emu4PublisherHandlers() {
+    const read = 'oauth_clients:read';
+    const write = 'oauth_clients:write';
+    return [
+        { method: 'GET', pattern: '/v1/oauth_publishers', scope: read, handler: (c) => ({ body: { object: 'list', data: ps(c.engine).publishers.all().reverse().map((p) => publisherView(c.engine, p)), has_more: false } }) },
+        {
+            method: 'POST',
+            pattern: '/v1/oauth_publishers',
+            scope: write,
+            handler: (c) => {
+                const e = c.engine;
+                const t = ps(e).publishers;
+                const domain = parseDomain(c.body.domain);
+                const name = nameOf(c.body.name);
+                const sharedSector = c.body.shared_sector === undefined ? false : boolOf(c.body.shared_sector, 'shared_sector');
+                const skipConsent = c.body.skip_consent === undefined ? false : boolOf(c.body.skip_consent, 'skip_consent');
+                if (sharedSector)
+                    throw bad('shared_sector can only be turned on once the domain is verified. Create the publisher, verify it, then set shared_sector.', 'shared_sector');
+                if (t.size >= exports.MAX_PUBLISHERS)
+                    throw bad(`An instance holds at most ${exports.MAX_PUBLISHERS} publishers.`, 'domain');
+                if (t.find((p) => p.domain === domain))
+                    throw conflict(`A publisher for ${domain} already exists.`);
+                const now = e.clock.now();
+                const row = t.insert({ name, domain, verification_token: `${TOKEN_PREFIX}${(0, store_1.randomToken)(18)}`, verified_at: null, last_checked_at: null, shared_sector: false, skip_consent: skipConsent, created_at: now, updated_at: now });
+                const view = publisherView(e, row);
+                announce(e, row.id, 'created', view, null);
+                return { status: 201, body: view };
+            },
+        },
+        { method: 'GET', pattern: '/v1/oauth_publishers/:id', scope: read, handler: (c) => ({ body: publisherView(c.engine, find(c.engine, c.params.id)) }) },
+        {
+            method: 'PATCH',
+            pattern: '/v1/oauth_publishers/:id',
+            scope: write,
+            handler: (c) => {
+                const e = c.engine;
+                const p = find(e, c.params.id);
+                const patch = {};
+                if (c.body.name !== undefined)
+                    patch.name = nameOf(c.body.name);
+                if (c.body.skip_consent !== undefined)
+                    patch.skip_consent = boolOf(c.body.skip_consent, 'skip_consent');
+                if (c.body.shared_sector !== undefined) {
+                    const on = boolOf(c.body.shared_sector, 'shared_sector');
+                    if (on && p.verified_at === null)
+                        throw bad('shared_sector needs a verified domain.', 'shared_sector');
+                    if (!on && p.shared_sector && liveClients(e, p.id).length)
+                        throw conflict("Detach the publisher's apps before turning shared_sector off: they keep the shared subject identifiers, and a publisher without the shared sector could no longer manage them.");
+                    patch.shared_sector = on;
+                }
+                const before = publisherView(e, p);
+                if (Object.entries(patch).every(([k, v]) => p[k] === v))
+                    return { body: before };
+                Object.assign(p, patch, { updated_at: e.clock.now() });
+                const view = publisherView(e, p);
+                announce(e, p.id, 'updated', view, before);
+                return { body: view };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/oauth_publishers/:id',
+            scope: write,
+            handler: (c) => {
+                const e = c.engine;
+                const p = find(e, c.params.id);
+                if (p.shared_sector && liveClients(e, p.id).length)
+                    throw conflict("Detach the publisher's apps first: they share its subject identifiers.");
+                const before = publisherView(e, p);
+                for (const cl of e.db.oauthClients.all())
+                    if (cl.publisher_id === p.id)
+                        cl.publisher_id = null;
+                ps(e).publishers.delete(p.id);
+                announce(e, p.id, 'deleted', null, before);
+                return { body: { object: 'oauth_publisher', id: p.id, deleted: true } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/oauth_publishers/:id/verify',
+            scope: write,
+            handler: (c) => {
+                const e = c.engine;
+                const p = find(e, c.params.id);
+                const zone = ps(e).dns.get(recordName(p.domain));
+                // NXDOMAIN / no data means the record is absent; any other failure says nothing, so a verified domain stays verified.
+                const lookupFailed = zone?.error != null && zone.error !== 'ENOTFOUND' && zone.error !== 'ENODATA';
+                const found = (zone && !zone.error ? zone.records : []).some((chunks) => chunks.join('') === p.verification_token);
+                const now = e.clock.now();
+                const wasVerified = p.verified_at !== null;
+                p.last_checked_at = now;
+                if (found && !wasVerified)
+                    p.verified_at = now;
+                if (!found && !lookupFailed)
+                    p.verified_at = null;
+                p.updated_at = now;
+                const view = { ...publisherView(e, p), record_found: found };
+                if ((p.verified_at !== null) !== wasVerified)
+                    announce(e, p.id, 'verified', { verified: p.verified_at !== null }, { verified: wasVerified });
+                return { body: view };
+            },
+        },
+        {
+            method: 'PUT',
+            pattern: '/v1/oauth_publishers/:id/clients/:client_id',
+            scope: write,
+            handler: (c) => {
+                const e = c.engine;
+                const p = find(e, c.params.id);
+                if (p.verified_at === null)
+                    throw bad("Verify the publisher's domain before attaching apps.", 'client_id');
+                const allowChange = c.body.allow_subject_change === undefined ? false : boolOf(c.body.allow_subject_change, 'allow_subject_change');
+                const client = e.db.oauthClients.get(c.params.client_id);
+                if (!client || client.deleted)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'Unknown app.');
+                if (!homepageOnDomain(client.homepage_url, p.domain))
+                    throw bad(`The app's homepage_url must be an https URL on ${p.domain}.`, 'client_id');
+                if (liveClients(e, p.id).length >= exports.MAX_PUBLISHER_APPS)
+                    throw bad(`A publisher holds at most ${exports.MAX_PUBLISHER_APPS} apps.`, 'client_id');
+                if (client.publisher_id === p.id)
+                    return { body: publisherView(e, p) };
+                const other = client.publisher_id ? ps(e).publishers.get(client.publisher_id) : undefined;
+                if (other)
+                    throw conflict(`The app already belongs to the publisher for ${other.domain}. Detach it there first.`);
+                if (p.shared_sector) {
+                    if (client.subject_type !== 'pairwise')
+                        throw bad("A publisher with a shared sector takes pairwise apps only. Set the app's subject_type to pairwise first.", 'client_id');
+                    if (client.sector_identifier && client.sector_identifier !== p.domain && !allowChange)
+                        throw conflict(`Attaching this app moves its sector from ${client.sector_identifier} to ${p.domain}, which changes every user's subject identifier in it. Send allow_subject_change: true to confirm.`);
+                }
+                const before = publisherView(e, p);
+                client.publisher_id = p.id;
+                if (p.shared_sector && client.sector_identifier !== p.domain)
+                    client.sector_identifier = p.domain;
+                const view = publisherView(e, p);
+                announce(e, p.id, 'client_attached', view, before);
+                return { body: view };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/oauth_publishers/:id/clients/:client_id',
+            scope: write,
+            handler: (c) => {
+                const e = c.engine;
+                const p = find(e, c.params.id);
+                const client = e.db.oauthClients.get(c.params.client_id);
+                if (!client || client.deleted)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'Unknown app.');
+                if (client.publisher_id !== p.id)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'That app does not belong to this publisher.');
+                const before = publisherView(e, p);
+                // A shared-sector app keeps the sector, so no subject identifier changes.
+                client.publisher_id = null;
+                const view = publisherView(e, p);
+                announce(e, p.id, 'client_detached', view, before);
+                return { body: view };
+            },
+        },
+        {
+            // The DNS zone: a TXT record (`records` is a list of strings or of string chunks), or `error` for a failed lookup (ENOTFOUND, ENODATA or anything else = transient).
+            method: 'POST',
+            pattern: '/__emulator/oauth/dns',
+            public: true,
+            handler: (c) => {
+                const name = c.body.name;
+                if (typeof name !== 'string' || !name)
+                    throw bad('name is required.', 'name');
+                const raw = c.body.records ?? [];
+                if (!Array.isArray(raw))
+                    throw bad('records must be a list of TXT values.', 'records');
+                ps(c.engine).dns.set(name.toLowerCase(), { records: raw.map((r) => (Array.isArray(r) ? r.map(String) : [String(r)])), error: typeof c.body.error === 'string' ? c.body.error : null });
+                return { status: 201, body: { ok: true } };
+            },
+        },
+        { method: 'DELETE', pattern: '/__emulator/oauth/dns', public: true, handler: (c) => (ps(c.engine).dns.delete(String(c.body.name ?? '').toLowerCase()), { body: { ok: true } }) },
+        {
+            method: 'POST',
+            pattern: '/__emulator/oauth/google_exchange',
+            public: true,
+            handler: (c) => {
+                const cfg = ps(c.engine).google.cfg;
+                const lists = [['client_ids', 'clientIds'], ['hosted_domains', 'hostedDomains'], ['atlas_client_ids', 'atlasClientIds']];
+                for (const [k, f] of lists) {
+                    if (c.body[k] === undefined)
+                        continue;
+                    if (!Array.isArray(c.body[k]) || c.body[k].some((x) => typeof x !== 'string'))
+                        throw bad(`${k} must be a list of strings.`, k);
+                    cfg[f] = f === 'hostedDomains' ? c.body[k].map((x) => x.toLowerCase()) : c.body[k];
+                }
+                for (const [k, f] of [['enabled', 'enabled'], ['allow_sign_up', 'allowSignUp']]) {
+                    if (c.body[k] === undefined)
+                        continue;
+                    if (typeof c.body[k] !== 'boolean')
+                        throw bad(`${k} must be true or false.`, k);
+                    cfg[f] = c.body[k];
+                }
+                return { body: { enabled: cfg.enabled, client_ids: cfg.clientIds, hosted_domains: cfg.hostedDomains, allow_sign_up: cfg.allowSignUp, atlas_client_ids: cfg.atlasClientIds } };
+            },
+        },
+        {
+            // Register the token Google would vouch for (its tokeninfo and userinfo answers).
+            method: 'POST',
+            pattern: '/__emulator/google/tokens',
+            public: true,
+            handler: (c) => {
+                const b = c.body;
+                const token = typeof b.token === 'string' && b.token ? b.token : `ya29.${(0, store_1.randomToken)(32)}`;
+                ps(c.engine).google.tokens.set(token, { aud: b.aud, azp: b.azp, sub: b.sub ?? (0, store_1.randomToken)(10), email: b.email, email_verified: b.email_verified ?? true, hd: b.hd, given_name: b.given_name, family_name: b.family_name, picture: b.picture, name: b.name, scope: typeof b.scope === 'string' ? b.scope : 'openid email profile', expires_in: typeof b.expires_in === 'number' ? b.expires_in : 3600, issued_at: c.engine.clock.now() });
+                return { status: 201, body: { access_token: token } };
+            },
+        },
+        { method: 'DELETE', pattern: '/__emulator/google/tokens/:token', public: true, handler: (c) => (ps(c.engine).google.tokens.delete(c.params.token ?? ''), { body: { ok: true } }) },
+    ];
+}
+//# sourceMappingURL=emu4-oauth-pub.js.map

package/dist/handlers/emu4-oauth-pub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-oauth-pub.js","sourceRoot":"","sources":["../../src/handlers/emu4-oauth-pub.ts"],"names":[],"mappings":";;;AAkEA,4CAQC;AAqCD,kCAGC;AAYD,8CASC;AAkCD,kDA4BC;AAID,sDAuLC;AA9XD,sCAA0C;AAE1C,oCAA8C;AAC9C,mCAA+B;AAC/B,+CAA4C;AAC5C,yCAA+C;AAC/C,yDAAiD;AACjD,uCAAwC;AAExC;;;;;;;;;;;GAWG;AACU,QAAA,cAAc,GAAG,EAAE,CAAC;AACpB,QAAA,kBAAkB,GAAG,GAAG,CAAC;AACzB,QAAA,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAChE,QAAA,wBAAwB,GAAG,0CAA0C,CAAC;AACnF,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAC1D,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAWrD,MAAM,EAAE,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAS,EAAY,EAAE,CAAC,CAAC;IAC/C,UAAU,EAAE,IAAI,aAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC;IAC9D,GAAG,EAAE,IAAI,GAAG,EAAE;IACd,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE;CACnJ,CAAC,CAAC,CAAC;AAEJ,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAc,EAAiB,EAAE,CAAC,IAAI,sBAAa,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACvH,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,IAAI,sBAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC5F,MAAM,WAAW,GAAG,GAAkB,EAAE,CAAC,IAAI,sBAAa,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;AAE9F,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,oBAAoB,MAAM,EAAE,CAAC;AAE5E,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC,6DAA6D,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,GAAG,CAAC,iDAAiD,EAAE,QAAQ,CAAC,CAAC;IACxJ,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,MAAM,CAAC,GAAY;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,GAAG,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IACxI,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AACD,SAAS,MAAM,CAAC,GAAY,EAAE,KAAa;IACzC,IAAI,OAAO,GAAG,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,GAAG,KAAK,yBAAyB,EAAE,KAAK,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,SAAgB,gBAAgB,CAAC,GAAY,EAAE,MAAc;IAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,WAAmB,EAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;AAE7I,SAAS,aAAa,CAAC,CAAS,EAAE,CAAM;IACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,iBAAiB;QACzB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ;QACR,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;QACjC,YAAY,EAAE,CAAC,CAAC,kBAAkB;QAClC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,iBAAiB,EAAE,CAAC,CAAC,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChE,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAsB,EAAO,EAAE;IACtD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,MAAM,WAAW,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAS,EAAE,EAAU,EAAE,MAAc,EAAE,OAAmB,EAAE,MAAkB;IAC9F,IAAA,8BAAW,EAAC,CAAC,EAAE,mBAAmB,MAAM,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1G,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC/H,CAAC;AAED,8DAA8D;AAC9D,SAAgB,WAAW,CAAC,CAAS,EAAE,MAAW;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxG,CAAC;AACD,4GAA4G;AACrG,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAE,MAAW,EAAiB,EAAE;IACzE,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC,CAAC;AAHW,QAAA,iBAAiB,qBAG5B;AAEF;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,CAAS,EAAE,MAAW,EAAE,MAAc,EAAE,SAAmB;IAC3F,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC3D,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6BAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACnI,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAChF,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AACzD,CAAC;AAED,sEAAsE;AAEtE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAC1C,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,CAAC;AAInE,8GAA8G;AAC9G,SAAS,iBAAiB,CAAC,CAAS,EAAE,KAAa;IACjD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAChF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAChE,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1H,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC7J,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9G,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACrG,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACpJ,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC9F,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC;AAED,yFAAyF;AAClF,KAAK,UAAU,mBAAmB,CAAC,CAAe,EAAE,MAAW;IACpE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACjB,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,WAAmB,EAAS,EAAE,CAAC,IAAA,YAAI,EAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC/G,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,6DAA6D,CAAC,CAAC;IACzH,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,qBAAqB,EAAE,mEAAmE,CAAC,CAAC;IAC7L,IAAI,CAAC,CAAC,oBAAoB,KAAK,SAAS,IAAI,CAAC,CAAC,oBAAoB,KAAK,kBAAkB;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,mFAAmF,kBAAkB,IAAI,CAAC,CAAC;IAC5O,IAAI,CAAC,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,gGAAgG;IAChG,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,2CAA2C,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC;IACpC,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAK,CAAC,CAAC,MAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1J,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACnV,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAS,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,+CAA+C,CAAC,CAAC;QAChG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,8BAA8B,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,GAAG,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpV,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClH,OAAO,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,IAAA,4BAAiB,EAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;AAClR,CAAC;AAED,uEAAuE;AAEvE,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,oBAAoB,CAAC;IAClC,MAAM,KAAK,GAAG,qBAAqB,CAAC;IACpC,OAAO;QACL,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE;QACtN;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sBAAsB;YAC/B,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;gBAChH,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;gBAC5G,IAAI,YAAY;oBAAE,MAAM,GAAG,CAAC,2HAA2H,EAAE,eAAe,CAAC,CAAC;gBAC1K,IAAI,CAAC,CAAC,IAAI,IAAI,sBAAc;oBAAE,MAAM,GAAG,CAAC,6BAA6B,sBAAc,cAAc,EAAE,QAAQ,CAAC,CAAC;gBAC7G,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;oBAAE,MAAM,QAAQ,CAAC,mBAAmB,MAAM,kBAAkB,CAAC,CAAC;gBACpG,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,YAAY,GAAG,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7N,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;SACF;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;QACrJ;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAQ,EAAE,CAAC;gBACtB,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;oBAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChE,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS;oBAAE,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;gBACxG,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;oBACvC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;oBACzD,IAAI,EAAE,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI;wBAAE,MAAM,GAAG,CAAC,wCAAwC,EAAE,eAAe,CAAC,CAAC;oBACvG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;wBAAE,MAAM,QAAQ,CAAC,gLAAgL,CAAC,CAAC;oBAC5P,KAAK,CAAC,aAAa,GAAG,EAAE,CAAC;gBAC3B,CAAC;gBACD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBACjF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxB,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/B,IAAI,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;oBAAE,MAAM,QAAQ,CAAC,wEAAwE,CAAC,CAAC;gBAC7I,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnC,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE;oBAAE,IAAI,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,EAAE;wBAAE,EAAE,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC/F,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC9B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC3C,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1E,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iCAAiC;YAC1C,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjD,sHAAsH;gBACtH,MAAM,YAAY,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;gBACnG,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBACnH,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC;gBAC3C,CAAC,CAAC,eAAe,GAAG,GAAG,CAAC;gBACxB,IAAI,KAAK,IAAI,CAAC,WAAW;oBAAE,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC;gBAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY;oBAAE,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;gBAClD,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC;gBACnB,MAAM,IAAI,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;gBAC7D,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,WAAW;oBAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7I,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxB,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,6CAA6C;YACtD,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/B,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI;oBAAE,MAAM,GAAG,CAAC,sDAAsD,EAAE,WAAW,CAAC,CAAC;gBAC3G,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;gBACpI,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;gBACpF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;oBAAE,MAAM,GAAG,CAAC,kDAAkD,CAAC,CAAC,MAAM,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5I,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,0BAAkB;oBAAE,MAAM,GAAG,CAAC,6BAA6B,0BAAkB,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACvI,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,EAAE;oBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC1F,IAAI,KAAK;oBAAE,MAAM,QAAQ,CAAC,gDAAgD,KAAK,CAAC,MAAM,0BAA0B,CAAC,CAAC;gBAClH,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;oBACpB,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU;wBAAE,MAAM,GAAG,CAAC,0GAA0G,EAAE,WAAW,CAAC,CAAC;oBAC3K,IAAI,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,iBAAiB,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW;wBAAE,MAAM,QAAQ,CAAC,4CAA4C,MAAM,CAAC,iBAAiB,OAAO,CAAC,CAAC,MAAM,oGAAoG,CAAC,CAAC;gBACjS,CAAC;gBACD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,KAAK,CAAC,CAAC,MAAM;oBAAE,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;gBAClG,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxB,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,6CAA6C;YACtD,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;gBACpF,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,EAAE;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAC;gBACtH,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnC,0EAA0E;gBAC1E,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxB,CAAC;SACF;QACD;YACE,qKAAqK;YACrK,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;oBAAE,MAAM,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;gBAC9E,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC,uCAAuC,EAAE,SAAS,CAAC,CAAC;gBACvF,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChM,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7C,CAAC;SACF;QACD,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;QAChL;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mCAAmC;YAC5C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACpC,MAAM,KAAK,GAAsE,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAC5L,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;oBAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;wBAAE,SAAS;oBACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;wBAAE,MAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;oBACxI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7F,CAAC;gBACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,CAAU,EAAE,CAAC;oBACzF,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;wBAAE,SAAS;oBACtC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;wBAAE,MAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;oBAChF,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,GAAG,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;YAChL,CAAC;SACF;QACD;YACE,kFAAkF;YAClF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2BAA2B;YACpC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,CAAC;gBAC3F,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACza,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC;YACxD,CAAC;SACF;QACD,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;KACnL,CAAC;AACJ,CAAC"}

package/dist/handlers/emu4-oauth.d.ts

@@ -0,0 +1,10 @@
+import type { Engine, RouteDef } from '../engine';
+/**
+ * Round-four OAuth routes: instance signing algorithms and the rotation schedule, request-object encryption,
+ * private_key_jwt client authentication, form_post and JARM response modes, retried back-channel logout and CIBA
+ * delivery, verified publishers, the Google access-token exchange and the registration extensions (software statements,
+ * pairwise subjects). Their wiring into the advanced provider lives in the modules they extend.
+ */
+export declare function emu4OauthHandlers(): RouteDef[];
+/** Everything the clock made due: the key rotation schedule, then delivery retries. Runs on every `time/advance`. */
+export declare function runOAuthClockWork(e: Engine): Promise<void>;

package/dist/handlers/emu4-oauth.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emu4OauthHandlers = emu4OauthHandlers;
+exports.runOAuthClockWork = runOAuthClockWork;
+const emu4_oauth_auth_1 = require("./emu4-oauth-auth");
+const emu4_oauth_delivery_1 = require("./emu4-oauth-delivery");
+const emu4_oauth_keys_1 = require("./emu4-oauth-keys");
+const emu4_oauth_pub_1 = require("./emu4-oauth-pub");
+/**
+ * Round-four OAuth routes: instance signing algorithms and the rotation schedule, request-object encryption,
+ * private_key_jwt client authentication, form_post and JARM response modes, retried back-channel logout and CIBA
+ * delivery, verified publishers, the Google access-token exchange and the registration extensions (software statements,
+ * pairwise subjects). Their wiring into the advanced provider lives in the modules they extend.
+ */
+function emu4OauthHandlers() {
+    return [...(0, emu4_oauth_keys_1.signingKeyHandlers)(), ...(0, emu4_oauth_delivery_1.emu4DeliveryHandlers)(), ...(0, emu4_oauth_pub_1.emu4PublisherHandlers)(), ...(0, emu4_oauth_auth_1.emu4AuthHandlers)()];
+}
+/** Everything the clock made due: the key rotation schedule, then delivery retries. Runs on every `time/advance`. */
+async function runOAuthClockWork(e) {
+    await (0, emu4_oauth_keys_1.runSigningSchedule)(e);
+    await (0, emu4_oauth_delivery_1.runDueDeliveries)(e);
+}
+//# sourceMappingURL=emu4-oauth.js.map

package/dist/handlers/emu4-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-oauth.js","sourceRoot":"","sources":["../../src/handlers/emu4-oauth.ts"],"names":[],"mappings":";;AAYA,8CAEC;AAGD,8CAGC;AAnBD,uDAAqD;AACrD,+DAA+E;AAC/E,uDAA2E;AAC3E,qDAAyD;AAEzD;;;;;GAKG;AACH,SAAgB,iBAAiB;IAC/B,OAAO,CAAC,GAAG,IAAA,oCAAkB,GAAE,EAAE,GAAG,IAAA,0CAAoB,GAAE,EAAE,GAAG,IAAA,sCAAqB,GAAE,EAAE,GAAG,IAAA,kCAAgB,GAAE,CAAC,CAAC;AACjH,CAAC;AAED,qHAAqH;AAC9G,KAAK,UAAU,iBAAiB,CAAC,CAAS;IAC/C,MAAM,IAAA,oCAAkB,EAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAA,sCAAgB,EAAC,CAAC,CAAC,CAAC;AAC5B,CAAC"}

package/dist/handlers/emu4-policies.d.ts

@@ -0,0 +1,2 @@
+import type { RouteDef } from '../engine';
+export declare function policyHandlers(): RouteDef[];