@backendfree/core 0.1.0 → 0.1.1

package/dist/webhooks 3.js

@@ -1,207 +0,0 @@
-/**
- * Checking that a webhook really came from the platform.
- *
- * The other direction from the rest of this package: your server receives, and
- * this says whether to believe it. A webhook endpoint is a public URL, so
- * anybody can post to it, and `payment.succeeded` is a message that marks an
- * order paid. Without this, marking it paid is something a stranger can do.
- *
- * It lives in core rather than in the payments package because a delivery
- * carries whatever event it carries: a published page, a confirmed booking, a
- * settled payment. One verifier, whichever modules a project has switched on.
- *
- * Four things decide whether it works.
- *
- * **The raw body, exactly as it arrived.** The signature covers those bytes, so
- * a body that has been parsed and re-serialised computes a different digest and
- * every delivery fails. In Express that means `express.raw({type: '*\/*'})` on
- * this route and not `express.json()`. In a Next.js route handler it means
- * `await request.text()` before anything reads `request.json()`.
- *
- * **The timestamp is signed too.** It is inside the signed material, so it
- * cannot be edited, and it is checked for age separately. A signature on its own
- * proves the message was ours once, not that it is not a recording of one.
- *
- * **The digest is compared in constant time.** A comparison that stops at the
- * first wrong byte tells whoever is guessing how much of the prefix is right,
- * and a valid signature can be built one byte at a time from that.
- *
- * **The secret is the endpoint's own**, shown when the endpoint is created. It
- * is not an API key, it never goes in a header, and one per endpoint means
- * rotating one does not break the rest.
- */
-import { GeorithaminatorError } from './errors.js';
-export const SIGNATURE_HEADER = 'x-georithaminator-signature';
-export const TIMESTAMP_HEADER = 'x-georithaminator-timestamp';
-export const EVENT_HEADER = 'x-georithaminator-event';
-export const DELIVERY_HEADER = 'x-georithaminator-delivery';
-/**
- * How old a delivery may be, in seconds. Five minutes.
- *
- * Long enough for a queue backing up and for clocks that disagree by a little,
- * short enough that a captured request is not a spare key. Pass `0` to accept
- * any age, which is for replaying a stored delivery by hand and not for a live
- * endpoint.
- */
-export const DEFAULT_TOLERANCE = 300;
-/**
- * A delivery that could not be believed.
- *
- * Its own class because the answer is different from an API failure: there is
- * nothing to retry and nothing to fix at your end. Answer 400 and log it.
- * `code` says which check failed, and every one of them means the same thing to
- * a caller, which is do not act on this.
- */
-export class WebhookError extends GeorithaminatorError {
-    constructor(code, message) {
-        super('invalid_request', code, message);
-    }
-}
-/**
- * Verify one delivery and hand back what it says.
- *
- * Throws `WebhookError` when anything is wrong: no signature, no timestamp, too
- * old, a digest that does not match, or a body that is not JSON. Nothing is
- * parsed until the signature has passed, so an unverified body is never
- * anything but bytes.
- *
- *     import { verifyWebhook } from '@georithaminator/core';
- *
- *     const event = await verifyWebhook({
- *       body: await request.text(),
- *       headers: request.headers,
- *       secret: process.env.WEBHOOK_SECRET,
- *     });
- *     if (event.name === 'payment.succeeded') { ... }
- *
- * Answer 2xx quickly and do the work afterwards. The platform retries anything
- * that is not a success, so a slow handler becomes a duplicate delivery.
- * Duplicates happen anyway: a delivery is at least once, never exactly once, so
- * make the handler idempotent on `event.delivery` or on what the payload names.
- */
-export async function verifyWebhook(options) {
-    const { secret, tolerance = DEFAULT_TOLERANCE } = options;
-    if (!secret) {
-        throw new WebhookError('secret_required', 'Pass the endpoint signing secret.');
-    }
-    const headers = readHeaders(options.headers);
-    const signature = headers.get(SIGNATURE_HEADER);
-    const stamp = headers.get(TIMESTAMP_HEADER);
-    if (!signature) {
-        throw new WebhookError('missing_signature', `This request carries no ${SIGNATURE_HEADER} header, so it did not come from the platform.`);
-    }
-    if (!stamp) {
-        throw new WebhookError('missing_timestamp', `This request carries no ${TIMESTAMP_HEADER} header, and the timestamp is part of what is signed.`);
-    }
-    const timestamp = Number.parseInt(stamp, 10);
-    if (!Number.isFinite(timestamp)) {
-        throw new WebhookError('invalid_timestamp', `${TIMESTAMP_HEADER} is not a number of seconds.`);
-    }
-    // Before the digest, because an expired delivery is refused whatever it says
-    // and there is no reason to spend a hash on it.
-    const age = Math.floor((options.now ?? Date.now()) / 1000) - timestamp;
-    if (tolerance > 0 && Math.abs(age) > tolerance) {
-        throw new WebhookError('timestamp_out_of_tolerance', `This delivery is ${age}s old and at most ${tolerance}s is accepted. Either it is a ` +
-            'replay of an old one, or this machine and the platform disagree about the time.');
-    }
-    const body = asBytes(options.body);
-    // `timestamp.body`, as bytes, never as a string that was decoded and encoded
-    // again on the way. The digest is over what arrived.
-    const signed = join(`${stamp}.`, body);
-    const expected = await hmac(secret, signed);
-    if (!constantTimeEqual(expected, parseSignature(signature))) {
-        throw new WebhookError('invalid_signature', 'The signature does not match. Either the secret is the wrong one, or something ' +
-            'parsed the body before this saw it: the digest covers the exact bytes that arrived.');
-    }
-    return {
-        name: headers.get(EVENT_HEADER) ?? '',
-        delivery: headers.get(DELIVERY_HEADER) ?? '',
-        timestamp,
-        data: parse(body),
-    };
-}
-// --- the parts ----------------------------------------------------------------
-/**
- * The digest out of the header value.
- *
- * `sha256=<hex>` is the form sent. The prefix is stripped rather than required,
- * so a second algorithm could be added without this refusing every delivery
- * from the day it ships.
- */
-function parseSignature(header) {
-    const value = header.trim();
-    const marker = value.indexOf('=');
-    return (marker === -1 ? value : value.slice(marker + 1)).trim().toLowerCase();
-}
-async function hmac(secret, message) {
-    const encoder = new TextEncoder();
-    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-    const signature = await crypto.subtle.sign('HMAC', key, message);
-    return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, '0')).join('');
-}
-/**
- * Compare two hex digests without leaking where they differ.
- *
- * Every byte is looked at, whatever the first one says. A `===` on strings can
- * stop at the first difference, and that timing is enough to build a valid
- * signature a character at a time.
- *
- * Lengths are folded in rather than checked first, so a wrong length is not a
- * faster answer than a wrong digest.
- */
-function constantTimeEqual(a, b) {
-    let difference = a.length ^ b.length;
-    for (let index = 0; index < a.length; index += 1) {
-        difference |= a.charCodeAt(index) ^ b.charCodeAt(index % (b.length || 1));
-    }
-    return difference === 0;
-}
-function asBytes(body) {
-    return typeof body === 'string' ? new TextEncoder().encode(body) : body;
-}
-function join(prefix, body) {
-    const head = new TextEncoder().encode(prefix);
-    const out = new Uint8Array(head.length + body.length);
-    out.set(head, 0);
-    out.set(body, head.length);
-    return out;
-}
-function parse(body) {
-    try {
-        return JSON.parse(new TextDecoder().decode(body));
-    }
-    catch (cause) {
-        // Reached only after the signature passed, so this is the platform sending
-        // something unreadable rather than anybody's attempt at anything.
-        throw new WebhookError('malformed_body', `This delivery is signed but its body is not JSON: ${String(cause)}`);
-    }
-}
-/**
- * One lookup that works for a Headers, a Map, or `req.headers`.
- *
- * A Headers is used as it is, since its own lookup already ignores case.
- * Anything else is copied into a lowercased map, because a plain object's keys
- * are whatever the server chose to call them: Node lowercases, other runtimes
- * do not, and a signature header missed on case reads as no signature at all.
- *
- * `append` is what tells a Headers from a Map. Both have `get`, but a Map's is
- * case-sensitive, so treating one as the other would silently miss every header
- * whose key was not already lower case.
- */
-function readHeaders(source) {
-    const candidate = source;
-    if (typeof candidate.get === 'function' && typeof candidate.append === 'function') {
-        return { get: (name) => candidate.get(name) ?? undefined };
-    }
-    const entries = source instanceof Map ? source.entries() : Object.entries(source);
-    const lowered = new Map();
-    for (const [name, value] of entries) {
-        if (value === undefined || value === null)
-            continue;
-        // Node hands back an array when a header arrived more than once. The first
-        // is taken, because two signatures on one request is not a case to guess at.
-        lowered.set(name.toLowerCase(), String(Array.isArray(value) ? value[0] : value));
-    }
-    return { get: (name) => lowered.get(name.toLowerCase()) };
-}
-//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.d 3.ts

@@ -1,115 +0,0 @@
-/**
- * Checking that a webhook really came from the platform.
- *
- * The other direction from the rest of this package: your server receives, and
- * this says whether to believe it. A webhook endpoint is a public URL, so
- * anybody can post to it, and `payment.succeeded` is a message that marks an
- * order paid. Without this, marking it paid is something a stranger can do.
- *
- * It lives in core rather than in the payments package because a delivery
- * carries whatever event it carries: a published page, a confirmed booking, a
- * settled payment. One verifier, whichever modules a project has switched on.
- *
- * Four things decide whether it works.
- *
- * **The raw body, exactly as it arrived.** The signature covers those bytes, so
- * a body that has been parsed and re-serialised computes a different digest and
- * every delivery fails. In Express that means `express.raw({type: '*\/*'})` on
- * this route and not `express.json()`. In a Next.js route handler it means
- * `await request.text()` before anything reads `request.json()`.
- *
- * **The timestamp is signed too.** It is inside the signed material, so it
- * cannot be edited, and it is checked for age separately. A signature on its own
- * proves the message was ours once, not that it is not a recording of one.
- *
- * **The digest is compared in constant time.** A comparison that stops at the
- * first wrong byte tells whoever is guessing how much of the prefix is right,
- * and a valid signature can be built one byte at a time from that.
- *
- * **The secret is the endpoint's own**, shown when the endpoint is created. It
- * is not an API key, it never goes in a header, and one per endpoint means
- * rotating one does not break the rest.
- */
-import { GeorithaminatorError } from './errors.js';
-export declare const SIGNATURE_HEADER = "x-georithaminator-signature";
-export declare const TIMESTAMP_HEADER = "x-georithaminator-timestamp";
-export declare const EVENT_HEADER = "x-georithaminator-event";
-export declare const DELIVERY_HEADER = "x-georithaminator-delivery";
-/**
- * How old a delivery may be, in seconds. Five minutes.
- *
- * Long enough for a queue backing up and for clocks that disagree by a little,
- * short enough that a captured request is not a spare key. Pass `0` to accept
- * any age, which is for replaying a stored delivery by hand and not for a live
- * endpoint.
- */
-export declare const DEFAULT_TOLERANCE = 300;
-/** A delivery that proved to be ours. */
-export interface WebhookEvent<T = Record<string, unknown>> {
-    /** `payment.succeeded`, `booking.confirmed`, `page.published`. */
-    name: string;
-    /** This delivery's id. The same event resent is a new one, so log it. */
-    delivery: string;
-    /** When the platform signed it, in seconds since the epoch. */
-    timestamp: number;
-    /** The event's own payload, parsed. */
-    data: T;
-}
-export interface VerifyOptions {
-    /**
-     * The body exactly as received, as text or as bytes.
-     *
-     * Not an object. By the time it is an object the bytes the signature covers
-     * are gone, and no amount of re-serialising gets them back: key order and
-     * spacing both change the digest.
-     */
-    body: string | Uint8Array;
-    /**
-     * The request's headers. A `Headers`, Node's `req.headers`, or any plain
-     * object. Names are matched without case, since every server presents them
-     * differently.
-     */
-    headers: HeaderSource;
-    /** The endpoint's signing secret, from the dashboard when it was created. */
-    secret: string;
-    /** Seconds of age to allow. Defaults to five minutes; `0` allows any. */
-    tolerance?: number;
-    /** Milliseconds since the epoch, for tests. Defaults to now. */
-    now?: number;
-}
-export type HeaderSource = Headers | Map<string, string> | Record<string, string | string[] | undefined>;
-/**
- * A delivery that could not be believed.
- *
- * Its own class because the answer is different from an API failure: there is
- * nothing to retry and nothing to fix at your end. Answer 400 and log it.
- * `code` says which check failed, and every one of them means the same thing to
- * a caller, which is do not act on this.
- */
-export declare class WebhookError extends GeorithaminatorError {
-    constructor(code: string, message: string);
-}
-/**
- * Verify one delivery and hand back what it says.
- *
- * Throws `WebhookError` when anything is wrong: no signature, no timestamp, too
- * old, a digest that does not match, or a body that is not JSON. Nothing is
- * parsed until the signature has passed, so an unverified body is never
- * anything but bytes.
- *
- *     import { verifyWebhook } from '@georithaminator/core';
- *
- *     const event = await verifyWebhook({
- *       body: await request.text(),
- *       headers: request.headers,
- *       secret: process.env.WEBHOOK_SECRET,
- *     });
- *     if (event.name === 'payment.succeeded') { ... }
- *
- * Answer 2xx quickly and do the work afterwards. The platform retries anything
- * that is not a success, so a slow handler becomes a duplicate delivery.
- * Duplicates happen anyway: a delivery is at least once, never exactly once, so
- * make the handler idempotent on `event.delivery` or on what the payload names.
- */
-export declare function verifyWebhook<T = Record<string, unknown>>(options: VerifyOptions): Promise<WebhookEvent<T>>;
-//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts 3.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAC9D,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAC9D,eAAO,MAAM,YAAY,4BAA4B,CAAC;AACtD,eAAO,MAAM,eAAe,+BAA+B,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC,yCAAyC;AACzC,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACvD,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,IAAI,EAAE,CAAC,CAAC;CACT;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,YAAY,CAAC;IACtB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACnB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAElD;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,oBAAoB;gBACxC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAG1C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,aAAa,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA2D1B"}

package/dist/webhooks.js 3.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAC;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AA0CrC;;;;;;;GAOG;AACH,MAAM,OAAO,YAAa,SAAQ,oBAAoB;IACpD,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAsB;IAEtB,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,iBAAiB,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,mBAAmB,EACnB,2BAA2B,gBAAgB,gDAAgD,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CACpB,mBAAmB,EACnB,2BAA2B,gBAAgB,uDAAuD,CACnG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,GAAG,gBAAgB,8BAA8B,CAAC,CAAC;IACjG,CAAC;IAED,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IACvE,IAAI,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,oBAAoB,GAAG,qBAAqB,SAAS,gCAAgC;YACnF,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,mBAAmB,EACnB,iFAAiF;YAC/E,qFAAqF,CACxF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;QAC5C,SAAS;QACT,IAAI,EAAE,KAAK,CAAI,IAAI,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,OAAmB;IACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAuB,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,UAAU,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACjD,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,OAAO,CAAC,IAAyB;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAgB;IAC5C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAI,IAAgB;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAM,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,qDAAqD,MAAM,CAAC,KAAK,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,MAAoB;IACvC,MAAM,SAAS,GAAG,MAAiB,CAAC;IACpC,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,UAAU,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClF,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GACX,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC;IAE/F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,2EAA2E;QAC3E,6EAA6E;QAC7E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC"}