@atproto/oauth-provider 0.1.0

package/dist/oauth-errors.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WWWAuthenticateError = exports.UseDpopNonceError = exports.UnauthorizedClientError = exports.LoginRequiredError = exports.InvalidTokenError = exports.InvalidRequestError = exports.InvalidRedirectUriError = exports.InvalidParametersError = exports.InvalidGrantError = exports.InvalidDpopProofError = exports.InvalidDpopKeyBindingError = exports.InvalidClientMetadataError = exports.InvalidClientIdError = exports.InvalidClientError = exports.InvalidAuthorizationDetailsError = exports.ConsentRequiredError = exports.AccountSelectionRequiredError = exports.AccessDeniedError = exports.OAuthError = void 0;
+// Root Error class
+var oauth_error_js_1 = require("./errors/oauth-error.js");
+Object.defineProperty(exports, "OAuthError", { enumerable: true, get: function () { return oauth_error_js_1.OAuthError; } });
+var access_denied_error_js_1 = require("./errors/access-denied-error.js");
+Object.defineProperty(exports, "AccessDeniedError", { enumerable: true, get: function () { return access_denied_error_js_1.AccessDeniedError; } });
+var account_selection_required_error_js_1 = require("./errors/account-selection-required-error.js");
+Object.defineProperty(exports, "AccountSelectionRequiredError", { enumerable: true, get: function () { return account_selection_required_error_js_1.AccountSelectionRequiredError; } });
+var consent_required_error_js_1 = require("./errors/consent-required-error.js");
+Object.defineProperty(exports, "ConsentRequiredError", { enumerable: true, get: function () { return consent_required_error_js_1.ConsentRequiredError; } });
+var invalid_authorization_details_error_js_1 = require("./errors/invalid-authorization-details-error.js");
+Object.defineProperty(exports, "InvalidAuthorizationDetailsError", { enumerable: true, get: function () { return invalid_authorization_details_error_js_1.InvalidAuthorizationDetailsError; } });
+var invalid_client_error_js_1 = require("./errors/invalid-client-error.js");
+Object.defineProperty(exports, "InvalidClientError", { enumerable: true, get: function () { return invalid_client_error_js_1.InvalidClientError; } });
+var invalid_client_id_error_js_1 = require("./errors/invalid-client-id-error.js");
+Object.defineProperty(exports, "InvalidClientIdError", { enumerable: true, get: function () { return invalid_client_id_error_js_1.InvalidClientIdError; } });
+var invalid_client_metadata_error_js_1 = require("./errors/invalid-client-metadata-error.js");
+Object.defineProperty(exports, "InvalidClientMetadataError", { enumerable: true, get: function () { return invalid_client_metadata_error_js_1.InvalidClientMetadataError; } });
+var invalid_dpop_key_binding_error_js_1 = require("./errors/invalid-dpop-key-binding-error.js");
+Object.defineProperty(exports, "InvalidDpopKeyBindingError", { enumerable: true, get: function () { return invalid_dpop_key_binding_error_js_1.InvalidDpopKeyBindingError; } });
+var invalid_dpop_proof_error_js_1 = require("./errors/invalid-dpop-proof-error.js");
+Object.defineProperty(exports, "InvalidDpopProofError", { enumerable: true, get: function () { return invalid_dpop_proof_error_js_1.InvalidDpopProofError; } });
+var invalid_grant_error_js_1 = require("./errors/invalid-grant-error.js");
+Object.defineProperty(exports, "InvalidGrantError", { enumerable: true, get: function () { return invalid_grant_error_js_1.InvalidGrantError; } });
+var invalid_parameters_error_js_1 = require("./errors/invalid-parameters-error.js");
+Object.defineProperty(exports, "InvalidParametersError", { enumerable: true, get: function () { return invalid_parameters_error_js_1.InvalidParametersError; } });
+var invalid_redirect_uri_error_js_1 = require("./errors/invalid-redirect-uri-error.js");
+Object.defineProperty(exports, "InvalidRedirectUriError", { enumerable: true, get: function () { return invalid_redirect_uri_error_js_1.InvalidRedirectUriError; } });
+var invalid_request_error_js_1 = require("./errors/invalid-request-error.js");
+Object.defineProperty(exports, "InvalidRequestError", { enumerable: true, get: function () { return invalid_request_error_js_1.InvalidRequestError; } });
+var invalid_token_error_js_1 = require("./errors/invalid-token-error.js");
+Object.defineProperty(exports, "InvalidTokenError", { enumerable: true, get: function () { return invalid_token_error_js_1.InvalidTokenError; } });
+var login_required_error_js_1 = require("./errors/login-required-error.js");
+Object.defineProperty(exports, "LoginRequiredError", { enumerable: true, get: function () { return login_required_error_js_1.LoginRequiredError; } });
+var unauthorized_client_error_js_1 = require("./errors/unauthorized-client-error.js");
+Object.defineProperty(exports, "UnauthorizedClientError", { enumerable: true, get: function () { return unauthorized_client_error_js_1.UnauthorizedClientError; } });
+var use_dpop_nonce_error_js_1 = require("./errors/use-dpop-nonce-error.js");
+Object.defineProperty(exports, "UseDpopNonceError", { enumerable: true, get: function () { return use_dpop_nonce_error_js_1.UseDpopNonceError; } });
+var www_authenticate_error_js_1 = require("./errors/www-authenticate-error.js");
+Object.defineProperty(exports, "WWWAuthenticateError", { enumerable: true, get: function () { return www_authenticate_error_js_1.WWWAuthenticateError; } });
+//# sourceMappingURL=oauth-errors.js.map

package/dist/oauth-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-errors.js","sourceRoot":"","sources":["../src/oauth-errors.ts"],"names":[],"mappings":";;;AAAA,mBAAmB;AACnB,0DAAoD;AAA3C,4GAAA,UAAU,OAAA;AAEnB,0EAAmE;AAA1D,2HAAA,iBAAiB,OAAA;AAC1B,oGAA4F;AAAnF,oJAAA,6BAA6B,OAAA;AACtC,gFAAyE;AAAhE,iIAAA,oBAAoB,OAAA;AAC7B,0GAAkG;AAAzF,0JAAA,gCAAgC,OAAA;AACzC,4EAAqE;AAA5D,6HAAA,kBAAkB,OAAA;AAC3B,kFAA0E;AAAjE,kIAAA,oBAAoB,OAAA;AAC7B,8FAAsF;AAA7E,8IAAA,0BAA0B,OAAA;AACnC,gGAAuF;AAA9E,+IAAA,0BAA0B,OAAA;AACnC,oFAA4E;AAAnE,oIAAA,qBAAqB,OAAA;AAC9B,0EAAmE;AAA1D,2HAAA,iBAAiB,OAAA;AAC1B,oFAA6E;AAApE,qIAAA,sBAAsB,OAAA;AAC/B,wFAAgF;AAAvE,wIAAA,uBAAuB,OAAA;AAChC,8EAAuE;AAA9D,+HAAA,mBAAmB,OAAA;AAC5B,0EAAmE;AAA1D,2HAAA,iBAAiB,OAAA;AAC1B,4EAAqE;AAA5D,6HAAA,kBAAkB,OAAA;AAC3B,sFAA+E;AAAtE,uIAAA,uBAAuB,OAAA;AAChC,4EAAoE;AAA3D,4HAAA,iBAAiB,OAAA;AAC1B,gFAAyE;AAAhE,iIAAA,oBAAoB,OAAA"}

package/dist/oauth-hooks.d.ts

@@ -0,0 +1,42 @@
+import { Jwks } from '@atproto/jwk';
+import { OAuthAuthenticationRequestParameters, OAuthAuthorizationDetails, OAuthClientMetadata, OAuthTokenResponse } from '@atproto/oauth-types';
+import { Account } from './account/account.js';
+import { ClientAuth } from './client/client-auth.js';
+import { ClientId } from './client/client-id.js';
+import { ClientInfo } from './client/client-info.js';
+import { Client } from './client/client.js';
+import { Awaitable } from './lib/util/type.js';
+export type { Account, Client, ClientAuth, ClientId, ClientInfo, Jwks, OAuthAuthenticationRequestParameters, OAuthAuthorizationDetails, OAuthClientMetadata, OAuthTokenResponse, };
+export type OAuthHooks = {
+    /**
+     * Use this to alter, override or validate the client metadata & jwks returned
+     * by the client store.
+     *
+     * @throws {InvalidClientMetadataError} if the metadata is invalid
+     * @see {@link InvalidClientMetadataError}
+     */
+    onClientInfo?: (clientId: ClientId, data: {
+        metadata: OAuthClientMetadata;
+        jwks?: Jwks;
+    }) => Awaitable<void | undefined | Partial<ClientInfo>>;
+    /**
+     * Allows enriching the authorization details with additional information
+     * before the tokens are issued.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc9396 | RFC 9396}
+     */
+    onAuthorizationDetails?: (data: {
+        client: Client;
+        parameters: OAuthAuthenticationRequestParameters;
+        account: Account;
+    }) => Awaitable<undefined | OAuthAuthorizationDetails>;
+    /**
+     * Allows altering the token response before it is sent to the client.
+     */
+    onTokenResponse?: (tokenResponse: OAuthTokenResponse, data: {
+        client: Client;
+        parameters: OAuthAuthenticationRequestParameters;
+        account: Account;
+    }) => Awaitable<void>;
+};
+//# sourceMappingURL=oauth-hooks.d.ts.map

package/dist/oauth-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-hooks.d.ts","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EACL,oCAAoC,EACpC,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAG9C,YAAY,EACV,OAAO,EACP,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,oCAAoC,EACpC,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,GACnB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CACb,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QAAE,QAAQ,EAAE,mBAAmB,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,KACjD,SAAS,CAAC,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAEtD;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,oCAAoC,CAAA;QAChD,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,SAAS,GAAG,yBAAyB,CAAC,CAAA;IAEtD;;OAEG;IACH,eAAe,CAAC,EAAE,CAChB,aAAa,EAAE,kBAAkB,EACjC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,oCAAoC,CAAA;QAChD,OAAO,EAAE,OAAO,CAAA;KACjB,KACE,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA"}

package/dist/oauth-hooks.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=oauth-hooks.js.map

package/dist/oauth-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":""}

package/dist/oauth-provider.d.ts

@@ -0,0 +1,179 @@
+/// <reference types="node" />
+import { SimpleStore } from '@atproto-labs/simple-store';
+import { Jwks, Keyset, SignedJwt } from '@atproto/jwk';
+import { AccessToken, OAuthAuthenticationRequestParameters, OAuthAuthorizationServerMetadata, OAuthClientIdentification, OAuthClientMetadata, OAuthEndpointName, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
+import { Redis, type RedisOptions } from 'ioredis';
+import { AccountManager } from './account/account-manager.js';
+import { AccountInfo, AccountStore, DeviceAccountInfo, LoginCredentials } from './account/account-store.js';
+import { Account } from './account/account.js';
+import { ClientAuth } from './client/client-auth.js';
+import { ClientId } from './client/client-id.js';
+import { ClientManager, LoopbackMetadataGetter } from './client/client-manager.js';
+import { ClientStore } from './client/client-store.js';
+import { Client } from './client/client.js';
+import { DeviceId } from './device/device-id.js';
+import { DeviceStore } from './device/device-store.js';
+import { Handler, IncomingMessage, Router, ServerResponse } from './lib/http/index.js';
+import { Override } from './lib/util/type.js';
+import { CustomMetadata } from './metadata/build-metadata.js';
+import { OAuthHooks } from './oauth-hooks.js';
+import { OAuthVerifier, OAuthVerifierOptions } from './oauth-verifier.js';
+import { Userinfo } from './oidc/userinfo.js';
+import { Customization } from './output/customization.js';
+import { AuthorizationResultAuthorize } from './output/send-authorize-page.js';
+import { AuthorizationResultRedirect } from './output/send-authorize-redirect.js';
+import { ReplayStore } from './replay/replay-store.js';
+import { RequestManager } from './request/request-manager.js';
+import { RequestStore } from './request/request-store.js';
+import { RequestUri } from './request/request-uri.js';
+import { AuthorizationRequestJar, AuthorizationRequestQuery, PushedAuthorizationRequest } from './request/types.js';
+import { TokenManager } from './token/token-manager.js';
+import { TokenInfo, TokenStore } from './token/token-store.js';
+import { CodeGrantRequest, Introspect, IntrospectionResponse, RefreshGrantRequest, Revoke, TokenRequest } from './token/types.js';
+import { VerifyTokenClaimsOptions } from './token/verify-token-claims.js';
+export type OAuthProviderStore = Partial<ClientStore & AccountStore & DeviceStore & TokenStore & RequestStore & ReplayStore>;
+export { Keyset, type CustomMetadata, type Customization, type Handler, type OAuthAuthorizationServerMetadata, };
+export type RouterOptions<Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse> = {
+    onError?: (req: Req, res: Res, err: unknown, message: string) => void;
+};
+export type OAuthProviderOptions = Override<OAuthVerifierOptions & OAuthHooks, {
+    /**
+     * Maximum age a device/account session can be before requiring
+     * re-authentication. This can be overridden on a authorization request basis
+     * using the `max_age` parameter and on a client basis using the
+     * `default_max_age` client metadata.
+     */
+    authenticationMaxAge?: number;
+    /**
+     * Maximum age access & id tokens can be before requiring a refresh.
+     */
+    tokenMaxAge?: number;
+    /**
+     * Additional metadata to be included in the discovery document.
+     */
+    metadata?: CustomMetadata;
+    /**
+     * UI customizations
+     */
+    customization?: Customization;
+    /**
+     * A custom fetch function that can be used to fetch the client metadata from
+     * the internet. By default, the fetch function is a safeFetchWrap() function
+     * that protects against SSRF attacks, large responses & known bad domains. If
+     * you want to disable all protections, you can provide `globalThis.fetch` as
+     * fetch function.
+     */
+    safeFetch?: typeof globalThis.fetch;
+    /**
+     * A redis instance to use for replay protection. If not provided, replay
+     * protection will use memory storage.
+     */
+    redis?: Redis | RedisOptions | string;
+    /**
+     * This will be used as the default store for all the stores. If a store is
+     * not provided, this store will be used instead. If the `store` does not
+     * implement a specific store, a runtime error will be thrown. Make sure that
+     * this store implements all the interfaces not provided in the other
+     * `<name>Store` options.
+     */
+    store?: OAuthProviderStore;
+    accountStore?: AccountStore;
+    deviceStore?: DeviceStore;
+    clientStore?: ClientStore;
+    replayStore?: ReplayStore;
+    requestStore?: RequestStore;
+    tokenStore?: TokenStore;
+    /**
+     * In order to speed up the client fetching process, you can provide a cache
+     * to store HTTP responses.
+     *
+     * @note the cached entries should automatically expire after a certain time (typically 10 minutes)
+     */
+    clientJwksCache?: SimpleStore<string, Jwks>;
+    /**
+     * In order to speed up the client fetching process, you can provide a cache
+     * to store HTTP responses.
+     *
+     * @note the cached entries should automatically expire after a certain time (typically 10 minutes)
+     */
+    clientMetadataCache?: SimpleStore<string, OAuthClientMetadata>;
+    /**
+     * In order to enable loopback clients, you can provide a function that
+     * returns the client metadata for a given loopback URL. This is useful for
+     * development and testing purposes. This function is not called for internet
+     * clients.
+     *
+     * @default is as specified by ATPROTO
+     */
+    loopbackMetadata?: null | false | LoopbackMetadataGetter;
+}>;
+export declare class OAuthProvider extends OAuthVerifier {
+    readonly metadata: OAuthAuthorizationServerMetadata;
+    readonly customization?: Customization;
+    readonly authenticationMaxAge: number;
+    readonly accountManager: AccountManager;
+    readonly deviceStore: DeviceStore;
+    readonly clientManager: ClientManager;
+    readonly requestManager: RequestManager;
+    readonly tokenManager: TokenManager;
+    constructor({ metadata, customization, authenticationMaxAge, tokenMaxAge, safeFetch, redis, store, // compound store implementation
+    accountStore, deviceStore, tokenStore, clientStore, replayStore, requestStore, clientJwksCache, clientMetadataCache, loopbackMetadata, ...rest }: OAuthProviderOptions);
+    get jwks(): Jwks;
+    protected loginRequired(client: Client, parameters: OAuthAuthenticationRequestParameters, info: DeviceAccountInfo): boolean;
+    protected authenticateClient(client: Client, endpoint: OAuthEndpointName, credentials: OAuthClientIdentification): Promise<ClientAuth>;
+    protected decodeJAR(client: Client, input: AuthorizationRequestJar): Promise<{
+        payload: OAuthAuthenticationRequestParameters;
+    } | {
+        payload: OAuthAuthenticationRequestParameters;
+        protectedHeader: {
+            kid: string;
+            alg: string;
+        };
+        jkt: string;
+    }>;
+    /**
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc9126}
+     */
+    protected pushedAuthorizationRequest(input: PushedAuthorizationRequest, dpopJkt: null | string): Promise<{
+        request_uri: `urn:ietf:params:oauth:request_uri:req-${string}`;
+        expires_in: number;
+    }>;
+    private loadAuthorizationRequest;
+    private deleteRequest;
+    protected authorize(deviceId: DeviceId, input: AuthorizationRequestQuery): Promise<AuthorizationResultRedirect | AuthorizationResultAuthorize>;
+    protected getSessions(client: Client, clientAuth: ClientAuth, deviceId: DeviceId, parameters: OAuthAuthenticationRequestParameters): Promise<{
+        account: Account;
+        info: DeviceAccountInfo;
+        selected: boolean;
+        loginRequired: boolean;
+        consentRequired: boolean;
+        matchesHint: boolean;
+    }[]>;
+    protected signIn(deviceId: DeviceId, credentials: LoginCredentials): Promise<AccountInfo>;
+    protected acceptRequest(deviceId: DeviceId, uri: RequestUri, clientId: ClientId, sub: string): Promise<AuthorizationResultRedirect>;
+    protected rejectRequest(deviceId: DeviceId, uri: RequestUri, clientId: ClientId): Promise<AuthorizationResultRedirect>;
+    protected token(input: TokenRequest, dpopJkt: null | string): Promise<OAuthTokenResponse>;
+    protected codeGrant(client: Client, clientAuth: ClientAuth, input: CodeGrantRequest, dpopJkt: null | string): Promise<OAuthTokenResponse>;
+    refreshTokenGrant(client: Client, clientAuth: ClientAuth, input: RefreshGrantRequest, dpopJkt: null | string): Promise<OAuthTokenResponse>;
+    /**
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 rfc7009}
+     */
+    protected revoke(input: Revoke): Promise<void>;
+    /**
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7662#section-2.1 rfc7662}
+     */
+    protected introspect(input: Introspect): Promise<IntrospectionResponse>;
+    /**
+     * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.5.3.2 Successful UserInfo Response}
+     */
+    protected userinfo({ data, account }: TokenInfo): Promise<Userinfo>;
+    protected signUserinfo(userinfo: Userinfo): Promise<SignedJwt>;
+    protected authenticateToken(tokenType: OAuthTokenType, token: AccessToken, dpopJkt: string | null, verifyOptions?: VerifyTokenClaimsOptions): Promise<import("./token/verify-token-claims.js").VerifyTokenClaimsResult>;
+    /**
+     * @returns An http request handler that can be used with node's http server
+     * or as a middleware with express / connect.
+     */
+    httpHandler<T = void, Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse>(options?: RouterOptions<Req, Res>): Handler<T, Req, Res>;
+    buildRouter<T = void, Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse>({ onError, }?: RouterOptions<Req, Res>): Router<T, Req, Res>;
+}
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAmB,MAAM,cAAc,CAAA;AACvE,OAAO,EACL,WAAW,EAEX,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EAGf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAA;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAEjB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE9C,OAAO,EAAE,UAAU,EAAqB,MAAM,yBAAyB,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAkB,MAAM,uBAAuB,CAAA;AAChE,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAYrE,OAAO,EACL,OAAO,EACP,eAAe,EAEf,MAAM,EACN,cAAc,EAWf,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAiB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAK7C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACzD,OAAO,EACL,4BAA4B,EAE7B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,2BAA2B,EAE5B,MAAM,qCAAqC,CAAA;AAG5C,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAG7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,UAAU,EAAoB,MAAM,0BAA0B,CAAA;AACvE,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAG3B,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAgB,MAAM,wBAAwB,CAAA;AAC5E,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,MAAM,EACN,YAAY,EAIb,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AAEzE,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACtC,WAAW,GACT,YAAY,GACZ,WAAW,GACX,UAAU,GACV,YAAY,GACZ,WAAW,CACd,CAAA;AAED,OAAO,EACL,MAAM,EACN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,gCAAgC,GACtC,CAAA;AAED,MAAM,MAAM,aAAa,CACvB,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,IACzC;IACF,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACtE,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CACzC,oBAAoB,GAAG,UAAU,EACjC;IACE;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAE1B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CACF,CAAA;AAED,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,WAAW,EAAE,WAAW,CAAA;IACxC,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;gBAEvB,EACjB,QAAQ,EACR,aAAyB,EACzB,oBAA6C,EAC7C,WAA2B,EAE3B,SAA2B,EAC3B,KAAK,EACL,KAAK,EAAE,gCAAgC;IAGvC,YAAoC,EACpC,WAAkC,EAClC,UAAgC,EAGhC,WAAkC,EAClC,WAAkC,EAClC,YAAoC,EAEpC,eAGE,EACF,mBAGE,EAEF,gBAAgD,EAGhD,GAAG,IAAI,EACR,EAAE,oBAAoB;IAsCvB,IAAI,IAAI,IAAI,IAAI,CAEf;IAED,SAAS,CAAC,aAAa,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,oCAAoC,EAChD,IAAI,EAAE,iBAAiB;cAoBT,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAAC,UAAU,CAAC;cAiBN,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CACN;QACE,OAAO,EAAE,oCAAoC,CAAA;KAC9C,GACD;QACE,OAAO,EAAE,oCAAoC,CAAA;QAC7C,eAAe,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;QAC7C,GAAG,EAAE,MAAM,CAAA;KACZ,CACJ;IA6CD;;OAEG;cACa,0BAA0B,CACxC,KAAK,EAAE,0BAA0B,EACjC,OAAO,EAAE,IAAI,GAAG,MAAM;;;;YAyCV,wBAAwB;YAmDxB,aAAa;cAWX,SAAS,CACvB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,2BAA2B,GAAG,4BAA4B,CAAC;cA0FtD,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,oCAAoC,GAC/C,OAAO,CACR;QACE,OAAO,EAAE,OAAO,CAAA;QAChB,IAAI,EAAE,iBAAiB,CAAA;QAEvB,QAAQ,EAAE,OAAO,CAAA;QACjB,aAAa,EAAE,OAAO,CAAA;QACtB,eAAe,EAAE,OAAO,CAAA;QAExB,WAAW,EAAE,OAAO,CAAA;KACrB,EAAE,CACJ;cAsBe,MAAM,CACpB,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,gBAAgB,GAC5B,OAAO,CAAC,WAAW,CAAC;cAIP,aAAa,CAC3B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,2BAA2B,CAAC;cAsDvB,aAAa,CAC3B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,2BAA2B,CAAC;cA0BvB,KAAK,CACnB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,IAAI,GAAG,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;cAwBd,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,IAAI,GAAG,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAgCxB,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,IAAI,GAAG,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAI9B;;OAEG;cACa,MAAM,CAAC,KAAK,EAAE,MAAM;IAMpC;;OAEG;cACa,UAAU,CACxB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAsDjC;;OAEG;cACa,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;cAWzD,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;cAW3C,iBAAiB,CACxC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,aAAa,CAAC,EAAE,wBAAwB;IAgB1C;;;OAGG;IACI,WAAW,CAChB,CAAC,GAAG,IAAI,EACR,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAC3C,OAAO,CAAC,EAAE,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;IAKnD,WAAW,CAChB,CAAC,GAAG,IAAI,EACR,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAC3C,EACA,OAGa,GACd,GAAE,aAAa,CAAC,GAAG,EAAE,GAAG,CAAM;CA8bhC"}