@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/app/modules/identity/repositories/provider/account/module.mjs

@@ -1,28 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { IdentityProviderAccountEntity } from "../../../../../../adapters/database/domains/identity-provider-account/entity.mjs";
-import "../../../../../../adapters/database/domains/index.mjs";
-//#region src/app/modules/identity/repositories/provider/account/module.ts
-var IdentityProviderAccountRepository = class {
-	dataSource;
-	constructor(dataSource) {
-		this.dataSource = dataSource;
-	}
-	async findOneByProviderIdentity(identity) {
-		return this.dataSource.getRepository(IdentityProviderAccountEntity).findOne({
-			where: {
-				providerUserId: identity.id,
-				providerId: identity.provider.id
-			},
-			relations: { user: true }
-		});
-	}
-	async save(entity) {
-		return this.dataSource.getRepository(IdentityProviderAccountEntity).save(entity);
-	}
-};
-//#endregion
-export { IdentityProviderAccountRepository };
-
-//# sourceMappingURL=module.mjs.map

package/dist/app/modules/identity/repositories/provider/account/module.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"module.mjs","names":["IdentityProviderAccountEntity","IdentityProviderAccountRepository","dataSource","findOneByProviderIdentity","identity","repository","getRepository","findOne","where","providerUserId","id","providerId","provider","relations","user","save","entity"],"sources":["../../../../../../../src/app/modules/identity/repositories/provider/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport type { DataSource, DeepPartial } from 'typeorm';\nimport type { IIdentityProviderAccountRepository, IdentityProviderIdentity } from '../../../../../../core/index.ts';\nimport { IdentityProviderAccountEntity } from '../../../../../../adapters/database/domains/index.ts';\n\nexport class IdentityProviderAccountRepository implements IIdentityProviderAccountRepository {\n    protected dataSource : DataSource;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n    }\n\n    async findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null> {\n        const repository = this.dataSource.getRepository(IdentityProviderAccountEntity);\n\n        return repository.findOne({\n            where: {\n                providerUserId: identity.id,\n                providerId: identity.provider.id,\n            },\n            relations: { user: true },\n        });\n    }\n\n    async save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount> {\n        const repository = this.dataSource.getRepository(IdentityProviderAccountEntity);\n\n        return repository.save(entity);\n    }\n}\n"],"mappings":";;;;;;AAYA,IAAaC,oCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAwB;EAChC,KAAKA,aAAaA;CACtB;CAEA,MAAMC,0BAA0BC,UAA6E;EAGzG,OAFmB,KAAKF,WAAWI,cAAcN,6BAE1CK,CAAAA,CAAWE,QAAQ;GACtBC,OAAO;IACHC,gBAAgBL,SAASM;IACzBC,YAAYP,SAASQ,SAASF;GAClC;GACAG,WAAW,EAAEC,MAAM,KAAK;EAC5B,CAAA;CACJ;CAEA,MAAMC,KAAKC,QAAgF;EAGvF,OAFmB,KAAKd,WAAWI,cAAcN,6BAE1CK,CAAAA,CAAWU,KAAKC,MAAAA;CAC3B;AACJ"}

package/dist/core/entities/client/web-client.d.ts

@@ -1,72 +0,0 @@
-import type { Client, Realm } from '@authup/core-kit';
-import type { Logger } from '@authup/server-kit';
-import type { IClientScopeRepository } from '../client-scope/types.ts';
-import type { IScopeRepository } from '../scope/types.ts';
-import type { IClientRepository, IWebClientProvisioner } from './types.ts';
-export type WebClientProvisionerContext = {
-    clientRepository: IClientRepository;
-    scopeRepository: IScopeRepository;
-    clientScopeRepository: IClientScopeRepository;
-    appOrigins: string[];
-    logger?: Logger;
-};
-/**
- * The scopes a realm's public `web` client is granted.
- *
- * `global` lets the issued token drive the management API (parity with the
- * legacy password-grant admin login); `openid` yields the id-token.
- */
-export declare const WEB_CLIENT_SCOPE_NAMES: string[];
-/**
- * Build the attribute set for a realm's public `web` client.
- *
- * Public (PKCE) client used by authup's own client-web and any downstream
- * UI embedding client-web-kit. `builtIn` makes it auto-consent in the
- * /authorize flow and protects it from the API reserved-name guard.
- *
- * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
- * /token grants and the /authorize code-request verifier; null = allow-all),
- * so it must list every flow the client uses. `redirectUri` and
- * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
- * origin (matched by isSimpleMatch).
- *
- * The `scope` column is descriptive only. Scope authorization resolves
- * through the `auth_client_scopes` junction, which
- * `WebClientProvisioner.ensureForRealm` fills from
- * {@see WEB_CLIENT_SCOPE_NAMES}.
- */
-export declare function buildWebClientAttributes(realm: Realm | {
-    id: string;
-}, appOrigins: string[]): Partial<Client>;
-export declare class WebClientProvisioner implements IWebClientProvisioner {
-    protected clientRepository: IClientRepository;
-    protected scopeRepository: IScopeRepository;
-    protected clientScopeRepository: IClientScopeRepository;
-    protected appOrigins: string[];
-    protected logger?: Logger;
-    constructor(ctx: WebClientProvisionerContext);
-    ensureForRealm(realm: Realm | {
-        id: string;
-    }): Promise<void>;
-    /**
-     * Upsert the client row itself.
-     *
-     * `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row
-     * belongs to the system whatever state it is in. A non-built-in one
-     * predates the reservation and is taken over rather than left to shadow
-     * the realm's login client.
-     */
-    protected ensureClient(realm: Realm | {
-        id: string;
-    }): Promise<Client>;
-    /**
-     * Bind the built-in global scopes through `auth_client_scopes`. That
-     * junction is the only source the /authorize code-request verifier reads
-     * scopes from.
-     *
-     * Additive like the attribute MERGE above: an extra scope an admin bound
-     * by hand is left in place.
-     */
-    protected ensureScopes(client: Client): Promise<void>;
-}
-//# sourceMappingURL=web-client.d.ts.map

package/dist/core/entities/client/web-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAG1C,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;IAExD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAQtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASlE;;;;;;;OAOG;cACa,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAsD5E;;;;;;;OAOG;cACa,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiC9D"}

package/dist/core/entities/client/web-client.mjs

@@ -1,123 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { CLIENT_WEB_NAME, ClientAuthMethod, ClientTokenBindingMethod, ScopeName } from "@authup/core-kit";
-//#region src/core/entities/client/web-client.ts
-/**
-* The scopes a realm's public `web` client is granted.
-*
-* `global` lets the issued token drive the management API (parity with the
-* legacy password-grant admin login); `openid` yields the id-token.
-*/ const WEB_CLIENT_SCOPE_NAMES = [ScopeName.GLOBAL, ScopeName.OPEN_ID];
-/**
-* Build the attribute set for a realm's public `web` client.
-*
-* Public (PKCE) client used by authup's own client-web and any downstream
-* UI embedding client-web-kit. `builtIn` makes it auto-consent in the
-* /authorize flow and protects it from the API reserved-name guard.
-*
-* `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
-* /token grants and the /authorize code-request verifier; null = allow-all),
-* so it must list every flow the client uses. `redirectUri` and
-* `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
-* origin (matched by isSimpleMatch).
-*
-* The `scope` column is descriptive only. Scope authorization resolves
-* through the `auth_client_scopes` junction, which
-* `WebClientProvisioner.ensureForRealm` fills from
-* {@see WEB_CLIENT_SCOPE_NAMES}.
-*/ function buildWebClientAttributes(realm, appOrigins) {
-	const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(",");
-	return {
-		name: CLIENT_WEB_NAME,
-		realmId: realm.id,
-		authMethod: ClientAuthMethod.NONE,
-		tokenBindingMethod: ClientTokenBindingMethod.NONE,
-		builtIn: true,
-		active: true,
-		grantTypes: "authorization_code refresh_token",
-		scope: WEB_CLIENT_SCOPE_NAMES.join(" "),
-		redirectUri: originPatterns,
-		postLogoutRedirectUri: originPatterns
-	};
-}
-var WebClientProvisioner = class {
-	clientRepository;
-	scopeRepository;
-	clientScopeRepository;
-	appOrigins;
-	logger;
-	constructor(ctx) {
-		this.clientRepository = ctx.clientRepository;
-		this.scopeRepository = ctx.scopeRepository;
-		this.clientScopeRepository = ctx.clientScopeRepository;
-		this.appOrigins = ctx.appOrigins;
-		this.logger = ctx.logger;
-	}
-	async ensureForRealm(realm) {
-		const client = await this.ensureClient(realm);
-		await this.ensureScopes(client);
-	}
-	/**
-	* Upsert the client row itself.
-	*
-	* `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row
-	* belongs to the system whatever state it is in. A non-built-in one
-	* predates the reservation and is taken over rather than left to shadow
-	* the realm's login client.
-	*/ async ensureClient(realm) {
-		const attributes = buildWebClientAttributes(realm, this.appOrigins);
-		const existing = await this.clientRepository.findOneBy({
-			name: CLIENT_WEB_NAME,
-			realmId: realm.id
-		});
-		if (existing) {
-			if (!Object.keys(attributes).some((key) => existing[key] !== attributes[key])) return existing;
-			let target = existing;
-			if (!existing.builtIn) {
-				if (this.logger) this.logger.warn(`Taking over the non-built-in client named '${CLIENT_WEB_NAME}' in realm ${realm.id}: the name is reserved for the built-in web client.`);
-				target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;
-				target.secret = null;
-				target.secretHashed = false;
-				target.secretEncrypted = false;
-			}
-			const merged = this.clientRepository.merge(target, attributes);
-			return this.clientRepository.save(merged);
-		}
-		const entity = this.clientRepository.create(attributes);
-		return this.clientRepository.save(entity);
-	}
-	/**
-	* Bind the built-in global scopes through `auth_client_scopes`. That
-	* junction is the only source the /authorize code-request verifier reads
-	* scopes from.
-	*
-	* Additive like the attribute MERGE above: an extra scope an admin bound
-	* by hand is left in place.
-	*/ async ensureScopes(client) {
-		for (const name of WEB_CLIENT_SCOPE_NAMES) {
-			const scope = await this.scopeRepository.findOneBy({
-				name,
-				realmId: null
-			});
-			if (!scope) {
-				if (this.logger) this.logger.warn(`Skipping scope '${name}' for the web client of realm ${client.realmId}: the scope is not provisioned.`);
-				continue;
-			}
-			if (await this.clientScopeRepository.findOneBy({
-				clientId: client.id,
-				scopeId: scope.id
-			})) continue;
-			await this.clientScopeRepository.save(this.clientScopeRepository.create({
-				clientId: client.id,
-				clientRealmId: client.realmId,
-				scopeId: scope.id,
-				scopeRealmId: scope.realmId
-			}));
-		}
-	}
-};
-//#endregion
-export { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes };
-
-//# sourceMappingURL=web-client.mjs.map

package/dist/core/entities/client/web-client.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","WEB_CLIENT_SCOPE_NAMES","GLOBAL","OPEN_ID","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realmId","id","authMethod","NONE","tokenBindingMethod","builtIn","active","grantTypes","scope","redirectUri","postLogoutRedirectUri","WebClientProvisioner","clientRepository","scopeRepository","clientScopeRepository","logger","ctx","ensureForRealm","client","ensureClient","ensureScopes","attributes","existing","findOneBy","isDirty","Object","keys","some","key","target","warn","findOneWithSecret","secret","secretHashed","secretEncrypted","merged","merge","save","entity","create","clientId","scopeId","clientRealmId","scopeRealmId"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_WEB_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientScopeRepository } from '../client-scope/types.ts';\nimport type { IScopeRepository } from '../scope/types.ts';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    scopeRepository: IScopeRepository;\n    clientScopeRepository: IClientScopeRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * The scopes a realm's public `web` client is granted.\n *\n * `global` lets the issued token drive the management API (parity with the\n * legacy password-grant admin login); `openid` yields the id-token.\n */\nexport const WEB_CLIENT_SCOPE_NAMES: string[] = [\n    ScopeName.GLOBAL,\n    ScopeName.OPEN_ID,\n];\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `builtIn` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard.\n *\n * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirectUri` and\n * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch).\n *\n * The `scope` column is descriptive only. Scope authorization resolves\n * through the `auth_client_scopes` junction, which\n * `WebClientProvisioner.ensureForRealm` fills from\n * {@see WEB_CLIENT_SCOPE_NAMES}.\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: CLIENT_WEB_NAME,\n        realmId: realm.id,\n        authMethod: ClientAuthMethod.NONE,\n        tokenBindingMethod: ClientTokenBindingMethod.NONE,\n        builtIn: true,\n        active: true,\n        grantTypes: 'authorization_code refresh_token',\n        scope: WEB_CLIENT_SCOPE_NAMES.join(' '),\n        redirectUri: originPatterns,\n        postLogoutRedirectUri: originPatterns,\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected scopeRepository: IScopeRepository;\n\n    protected clientScopeRepository: IClientScopeRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n        this.clientScopeRepository = ctx.clientScopeRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const client = await this.ensureClient(realm);\n\n        // Always run, even when the attributes were already up to date: an\n        // instance provisioned before the junction rows existed carries a\n        // steady-state client with no scopes at all.\n        await this.ensureScopes(client);\n    }\n\n    /**\n     * Upsert the client row itself.\n     *\n     * `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row\n     * belongs to the system whatever state it is in. A non-built-in one\n     * predates the reservation and is taken over rather than left to shadow\n     * the realm's login client.\n     */\n    protected async ensureClient(realm: Realm | { id: string }): Promise<Client> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realmId: realm.id,\n        });\n\n        if (existing) {\n            // MERGE: refresh attributes (e.g. redirectUri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updatedAt) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return existing;\n            }\n\n            let target = existing;\n\n            if (!existing.builtIn) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Taking over the non-built-in client named '${CLIENT_WEB_NAME}' in realm ${realm.id}: the name is reserved for the built-in web client.`,\n                    );\n                }\n\n                // The takeover makes the client public, so a secret it carried\n                // as a confidential client can never authenticate it again.\n                // Drop it instead of leaving the material at rest.\n                //\n                // The row has to be re-read WITH the secret for that: `secret`\n                // is a `select: false` column, so the loaded entity carries no\n                // value for it and typeorm's changed-column diff would not\n                // emit the null. Re-reading is confined to this branch, and\n                // the secret stays out of `buildWebClientAttributes` for the\n                // same reason (an undefined-vs-null compare would read as\n                // dirty on every boot).\n                target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;\n                target.secret = null;\n                target.secretHashed = false;\n                target.secretEncrypted = false;\n            }\n\n            const merged = this.clientRepository.merge(target, attributes);\n\n            return this.clientRepository.save(merged);\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        return this.clientRepository.save(entity);\n    }\n\n    /**\n     * Bind the built-in global scopes through `auth_client_scopes`. That\n     * junction is the only source the /authorize code-request verifier reads\n     * scopes from.\n     *\n     * Additive like the attribute MERGE above: an extra scope an admin bound\n     * by hand is left in place.\n     */\n    protected async ensureScopes(client: Client): Promise<void> {\n        for (const name of WEB_CLIENT_SCOPE_NAMES) {\n            const scope = await this.scopeRepository.findOneBy({\n                name,\n                realmId: null,\n            });\n\n            if (!scope) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping scope '${name}' for the web client of realm ${client.realmId}: the scope is not provisioned.`,\n                    );\n                }\n                continue;\n            }\n\n            const existing = await this.clientScopeRepository.findOneBy({\n                clientId: client.id,\n                scopeId: scope.id,\n            });\n\n            if (existing) {\n                continue;\n            }\n\n            await this.clientScopeRepository.save(this.clientScopeRepository.create({\n                clientId: client.id,\n                clientRealmId: client.realmId,\n                scopeId: scope.id,\n                scopeRealmId: scope.realmId,\n            }));\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAiCA,MAAaI,yBAAmC,CAC5CD,UAAUE,QACVF,UAAUG,OACb;;;;;;;;;;;;;;;;;;GAoBD,SAAgBC,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMd;EACNe,SAASP,MAAMQ;EACfC,YAAYhB,iBAAiBiB;EAC7BC,oBAAoBjB,yBAAyBgB;EAC7CE,SAAS;EACTC,QAAQ;EACRC,YAAY;EACZC,OAAOnB,uBAAuBS,KAAK,GAAA;EACnCW,aAAad;EACbe,uBAAuBf;CAC3B;AACJ;AAEA,IAAagB,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEApB;CAEAqB;CAEV,YAAYC,KAAkC;EAC1C,KAAKJ,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKpB,aAAasB,IAAItB;EACtB,KAAKqB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAexB,OAA8C;EAC/D,MAAMyB,SAAS,MAAM,KAAKC,aAAa1B,KAAAA;EAKvC,MAAM,KAAK2B,aAAaF,MAAAA;CAC5B;;;;;;;;IAUA,MAAgBC,aAAa1B,OAAgD;EACzE,MAAM4B,aAAa7B,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAM4B,WAAW,MAAM,KAAKV,iBAAiBW,UAAU;GACnDxB,MAAMd;GACNe,SAASP,MAAMQ;EACnB,CAAA;EAEA,IAAIqB,UAAU;GAOV,IAAI,CAFY,OAAQI,KAAKL,UAAAA,CAAAA,CACxBM,MAAMC,QAAQN,SAASM,SAASP,WAAWO,IAC3CJ,GACD,OAAOF;GAGX,IAAIO,SAASP;GAEb,IAAI,CAACA,SAASjB,SAAS;IACnB,IAAI,KAAKU,QACL,KAAKA,OAAOe,KACR,8CAA8C7C,gBAAgB,aAAaQ,MAAMQ,GAAG,oDAAoD;IAehJ4B,SAAS,MAAM,KAAKjB,iBAAiBmB,kBAAkB,EAAE9B,IAAIqB,SAASrB,GAAG,CAAA,KAAMqB;IAC/EO,OAAOG,SAAS;IAChBH,OAAOI,eAAe;IACtBJ,OAAOK,kBAAkB;GAC7B;GAEA,MAAMC,SAAS,KAAKvB,iBAAiBwB,MAAMP,QAAQR,UAAAA;GAEnD,OAAO,KAAKT,iBAAiByB,KAAKF,MAAAA;EACtC;EAEA,MAAMG,SAAS,KAAK1B,iBAAiB2B,OAAOlB,UAAAA;EAC5C,OAAO,KAAKT,iBAAiByB,KAAKC,MAAAA;CACtC;;;;;;;;IAUA,MAAgBlB,aAAaF,QAA+B;EACxD,KAAK,MAAMnB,QAAQV,wBAAwB;GACvC,MAAMmB,QAAQ,MAAM,KAAKK,gBAAgBU,UAAU;IAC/CxB;IACAC,SAAS;GACb,CAAA;GAEA,IAAI,CAACQ,OAAO;IACR,IAAI,KAAKO,QACL,KAAKA,OAAOe,KACR,mBAAmB/B,KAAK,gCAAgCmB,OAAOlB,QAAQ,gCAAgC;IAG/G;GACJ;GAOA,IAAIsB,MALmB,KAAKR,sBAAsBS,UAAU;IACxDiB,UAAUtB,OAAOjB;IACjBwC,SAASjC,MAAMP;GACnB,CAAA,GAGI;GAGJ,MAAM,KAAKa,sBAAsBuB,KAAK,KAAKvB,sBAAsByB,OAAO;IACpEC,UAAUtB,OAAOjB;IACjByC,eAAexB,OAAOlB;IACtByC,SAASjC,MAAMP;IACf0C,cAAcnC,MAAMR;GACxB,CAAA,CAAA;EACJ;CACJ;AACJ"}