@bitbaum/accountkit 0.0.0-stage → 0.6.3

package/dist/identity.js

@@ -0,0 +1,76 @@
+/**
+ * Who is signed in, as the menu shows it — pure, so every rule is testable
+ * without a browser.
+ *
+ * Two apps had already learned two different halves of this, and each was
+ * missing the other's half:
+ *
+ *  - Loki: initials come from the NAME only. Built from an email local-part,
+ *    "butaeff" becomes "B" and tells the person nothing they didn't know.
+ *  - OrangeCat: a display name is NEVER reconstructed from the email address.
+ *    Its old chain ended in the local-part titlecased, so
+ *    `firstname.lastname@…` came out as "Firstname Lastname" — a real name
+ *    nobody typed, rebuilt from an address the person never chose to display,
+ *    on an account that may have chosen a pseudonym on purpose.
+ *
+ * Loki itself still fell back to the email local-part for its name. This
+ * module takes OrangeCat's rule, so adopting it fixes that too.
+ */
+/** Shown when the person has no name and no handle. Not their email. */
+export const PLACEHOLDER_NAME = "Account";
+/**
+ * The name the menu shows: name, else @handle, else a placeholder.
+ * Never the email, never anything derived from it.
+ */
+export function displayNameFor(user) {
+    const name = user.name?.trim();
+    if (name)
+        return name;
+    const handle = user.handle?.trim().replace(/^@/, "");
+    if (handle)
+        return `@${handle}`;
+    return PLACEHOLDER_NAME;
+}
+/**
+ * Up to two initials from the person's NAME, or null — in which case the
+ * trigger draws a person glyph rather than a letter that means nothing.
+ */
+export function initialsFor(user) {
+    const name = user.name?.trim();
+    if (!name)
+        return null;
+    const letters = name
+        .split(/\s+/)
+        .slice(0, 2)
+        .map((part) => Array.from(part)[0]?.toUpperCase() ?? "")
+        .join("");
+    return letters || null;
+}
+/** The identity line under the name: @handle when the name is shown, else the email. */
+export function secondaryLineFor(user) {
+    const name = user.name?.trim();
+    const handle = user.handle?.trim().replace(/^@/, "");
+    if (name && handle)
+        return `@${handle}`;
+    return user.email?.trim() || null;
+}
+/**
+ * Where keyboard focus goes next among `count` menu items. Arrows wrap;
+ * Home and End jump. Pure so the wrap-around is pinned by a test — an
+ * off-by-one here strands the keyboard on the last row.
+ */
+export function nextMenuIndex(current, key, count) {
+    if (count <= 0)
+        return -1;
+    switch (key) {
+        case "Home":
+            return 0;
+        case "End":
+            return count - 1;
+        case "ArrowDown":
+            return current < 0 ? 0 : (current + 1) % count;
+        case "ArrowUp":
+            return current < 0 ? count - 1 : (current - 1 + count) % count;
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAcH,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAiB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,MAAM;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IAChC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI;SACjB,KAAK,CAAC,KAAK,CAAC;SACZ,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;SACvD,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,IAAI,IAAI,MAAM;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,GAA6C,EAC7C,KAAa;IAEb,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAC1B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM;YACT,OAAO,CAAC,CAAC;QACX,KAAK,KAAK;YACR,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,KAAK,WAAW;YACd,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QACjD,KAAK,SAAS;YACZ,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { displayNameFor, initialsFor, nextMenuIndex, secondaryLineFor, PLACEHOLDER_NAME, type AccountUser, } from "./identity.js";
+export { AccountMenu, type AccountActionItem, type AccountGroup, type AccountItem, type AccountLinkItem, type AccountMenuLabels, type AccountMenuProps, type RenderLinkProps, } from "./AccountMenu.js";
+export { SignInError, signInErrorKind, type SignInErrorKind, type SignInErrorLabels, type SignInErrorProps, } from "./SignInError.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { displayNameFor, initialsFor, nextMenuIndex, secondaryLineFor, PLACEHOLDER_NAME, } from "./identity.js";
+export { AccountMenu, } from "./AccountMenu.js";
+export { SignInError, signInErrorKind, } from "./SignInError.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,GAQZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,eAAe,GAIhB,MAAM,kBAAkB,CAAC"}

package/dist/orangecat.d.ts

@@ -0,0 +1,333 @@
+export declare const ORANGECAT_PROVIDER_ID = "orangecat";
+export declare const ORANGECAT_DEFAULT_ISSUER = "https://orangecat.ch";
+/** Identity only. An app that acts on OrangeCat's behalf passes its own. */
+export declare const ORANGECAT_IDENTITY_SCOPES = "openid profile email";
+type Env = Record<string, string | undefined>;
+/**
+ * The issuer every OrangeCat token's `iss` carries. Not normalised: OIDC
+ * compares `iss` byte for byte, so a trailing slash in the env is a
+ * different issuer, exactly as discovery would treat it.
+ */
+export declare function orangecatIssuer(env?: Env): string;
+export interface OrangecatClient {
+    clientId: string;
+    clientSecret: string;
+    issuer: string;
+}
+/**
+ * The client pair from the env names every app already uses, or null. Null
+ * means the provider is ABSENT — an app hides the button rather than mount a
+ * half-configured provider that fails opaquely at the code exchange.
+ */
+export declare function orangecatClient(env?: Env): OrangecatClient | null;
+/** The id_token / userinfo claims OrangeCat sends. `sub` is the actor id. */
+export interface OrangecatClaims {
+    sub?: string | null;
+    name?: string | null;
+    preferred_username?: string | null;
+    email?: string | null;
+    picture?: string | null;
+    [claim: string]: unknown;
+}
+/** What the provider hands Auth.js as "the user". */
+export interface OrangecatProfileUser {
+    id: string;
+    name: string | null;
+    image: string | null;
+    /** The actor id again, under a name an adapter can key on. */
+    orangecatSub: string;
+    /** OrangeCat handle, without the @. */
+    username: string | null;
+    /** The OrangeCat address as CONTACT data, lower-cased. Never an identity. */
+    contactEmail: string | null;
+}
+/**
+ * Deliberately has NO `email` key. For an account it has not seen, Auth.js
+ * calls `getUserByEmail(user.email)` and then either links the two (account
+ * takeover, since the address is unverified) or refuses the sign-in
+ * (OAuthAccountNotLinked). Without the key that lookup never runs, so a new
+ * `sub` always becomes a new person. The address rides along as
+ * `contactEmail`, for an app that wants to store it — see `contactEmailFor`.
+ */
+export declare function orangecatProfile(claims: OrangecatClaims): OrangecatProfileUser;
+export interface OrangecatProviderOptions {
+    clientId: string;
+    clientSecret: string;
+    issuer?: string;
+    /** Space-separated. Defaults to identity only; must not exceed what
+     *  OrangeCat registered for the client, or the consent screen refuses. */
+    scopes?: string;
+}
+/** Auth.js v5 (`next-auth@5`). Spread into `providers: [...]`. */
+export declare function orangecatProvider(options: OrangecatProviderOptions): {
+    id: string;
+    name: string;
+    type: "oidc";
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    client: {
+        token_endpoint_auth_method: "client_secret_post";
+    };
+    checks: ("pkce" | "state")[];
+    authorization: {
+        params: {
+            scope: string;
+        };
+    };
+    profile: typeof orangecatProfile;
+    allowDangerousEmailAccountLinking: boolean;
+};
+/** next-auth v4 (`next-auth@4`): an "oauth" provider with OIDC discovery. */
+export declare function orangecatProviderV4(options: OrangecatProviderOptions): {
+    id: string;
+    name: string;
+    type: "oauth";
+    wellKnown: string;
+    issuer: string;
+    idToken: boolean;
+    clientId: string;
+    clientSecret: string;
+    client: {
+        token_endpoint_auth_method: "client_secret_post";
+    };
+    checks: ("pkce" | "state")[];
+    authorization: {
+        params: {
+            scope: string;
+        };
+    };
+    profile: typeof orangecatProfile;
+    allowDangerousEmailAccountLinking: boolean;
+};
+export type EntryMode = "sign-in" | "sign-up";
+/** The providers OrangeCat has switched on that an app may offer a button for. */
+export declare const SOCIAL_PROVIDERS: readonly ["google", "github"];
+export type SocialProvider = (typeof SOCIAL_PROVIDERS)[number];
+export declare function isSocialProvider(value: unknown): value is SocialProvider;
+/**
+ * The third argument to `signIn("orangecat", options, params)`. OrangeCat's
+ * screen opens already in the state the person chose:
+ *
+ *   prompt=create   on "Create account" (OIDC Prompt Create 1.0)
+ *   login_hint      the email they typed, pre-filled
+ *   idp_hint        straight to Google or GitHub
+ *
+ * Auth.js merges these into the authorization URL verbatim, including over
+ * its own parameters, so only these three keys are ever produced and every
+ * value is checked first.
+ */
+export declare function authorizationParams(input: {
+    mode?: EntryMode;
+    email?: string | null;
+    provider?: string | null;
+}): Record<string, string>;
+/**
+ * Where to land after signing in: `from`, if it is a path on this site.
+ * `from` arrives in a URL anyone can write, so `//evil.example` and
+ * `/\evil.example` (which browsers read as protocol-relative) are refused.
+ */
+export { returnPath } from "./paths.js";
+export interface OcSessionClaims extends Record<string, unknown> {
+    /** OrangeCat actor id (id_token.sub). Absent = not signed in. */
+    actorId?: string;
+    ocRefreshToken?: string;
+    /** Access-token expiry, seconds since the epoch. */
+    ocExpiresAt?: number;
+    /** Earliest time (seconds) to retry after a transient refresh failure. */
+    ocRetryAt?: number;
+}
+export interface OcTokenGrant {
+    refresh_token?: string | null;
+    expires_at?: number | null;
+}
+/** On sign-in: remember what OrangeCat handed over. */
+export declare function bindOcTokens<T extends OcSessionClaims>(token: T, account: OcTokenGrant): T;
+/** True when the access token has (nearly) expired and a retry is not on hold. */
+export declare function ocRefreshDue(token: OcSessionClaims, nowSeconds: number): boolean;
+export type OcRefreshResult = {
+    ok: true;
+    refreshToken: string;
+    expiresAt: number;
+} | {
+    ok: false;
+    revoked: true;
+} | {
+    ok: false;
+    revoked: false;
+    reason: string;
+};
+export interface OcRefreshDeps {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    fetch: typeof fetch;
+    nowSeconds: number;
+}
+/** One refresh_token grant against OrangeCat's token endpoint. */
+export declare function refreshOcTokens(refreshToken: string, deps: OcRefreshDeps): Promise<OcRefreshResult>;
+/**
+ * Apply a refresh outcome. Revoked → the identity is dropped, which is how
+ * an app reads "signed out" (read `token.actorId`, never `token.sub`).
+ * Transient → hold the retry for a minute.
+ */
+export declare function applyOcRefresh<T extends OcSessionClaims>(token: T, result: OcRefreshResult, nowSeconds: number): T;
+/**
+ * The whole of an app's `jwt()` callback for OrangeCat, in one call:
+ *
+ *   async jwt({ token, account, profile }) {
+ *     return syncOcSession({ token, account, profile }, orangecat);
+ *   }
+ *
+ * Sign-in: records the actor id and the tokens. Afterwards: refreshes when
+ * due, and drops `actorId` when OrangeCat revoked the grant.
+ */
+export declare function syncOcSession<T extends OcSessionClaims>(input: {
+    token: T;
+    account?: (OcTokenGrant & {
+        provider?: string;
+    }) | null;
+    profile?: {
+        sub?: string | null;
+    } | null;
+}, client: OrangecatClient | null, deps?: {
+    fetch?: typeof fetch;
+    nowSeconds?: number;
+}): Promise<T>;
+/**
+ * The address stored when the OrangeCat email already belongs to another
+ * local user (or there is none). `.invalid` is reserved (RFC 2606): it can
+ * never be delivered to, registered, or sent a reset link.
+ */
+export declare function placeholderEmail(sub: string): string;
+export declare function isPlaceholderEmail(email: string | null | undefined): boolean;
+/** The contact address to store for a new OrangeCat user: theirs when free. */
+export declare function contactEmailFor(sub: string, wanted: string | null | undefined, taken: boolean): string;
+/**
+ * Whether a sign-in's email may earn ADMIN_EMAILS (or any email-list)
+ * promotion. Never for OrangeCat: promoting on an unverified address makes
+ * admin a matter of typing one into OrangeCat.
+ */
+export declare function emailEarnsPromotion(provider: string | null | undefined): boolean;
+/**
+ * Whether "forgot password" may email this account a reset link.
+ *
+ * A user OrangeCat created has no local password, and its address came from
+ * OrangeCat unverified: a reset link would hand whoever really owns that
+ * address a password on the OrangeCat person's account. A placeholder can
+ * never receive mail. Anyone with a password of their own may reset it.
+ */
+export declare function mayReceivePasswordReset(user: {
+    email: string | null | undefined;
+    hasPassword: boolean;
+    orangecatLinked: boolean;
+}): boolean;
+export type OrangecatRefusal = "already-linked" | "no-email" | "email-taken";
+export type OrangecatDecision = {
+    kind: "existing";
+    userId: string;
+} | {
+    kind: "link";
+    userId: string;
+} | {
+    kind: "create";
+    email: string;
+} | {
+    kind: "refuse";
+    reason: OrangecatRefusal;
+};
+export interface OrangecatPolicy {
+    /** Another local account has this address. Default: a placeholder. evig
+     *  refuses instead and sends the person to connect from their profile. */
+    whenEmailTaken?: "placeholder" | "refuse";
+    /** OrangeCat sent no address (an anonymous account). Default: placeholder. */
+    whenNoEmail?: "placeholder" | "refuse";
+}
+/**
+ * What an OrangeCat sign-in means for a local account. Pure; the adapter
+ * wrapper and the JWT-only apps (evig) both decide through it.
+ *
+ *  - An explicit connect from a signed-in account wins: the person's own
+ *    decision, made from inside their session.
+ *  - A known `sub` signs in as its user.
+ *  - Anything else creates a new user — never a match on email.
+ */
+export declare function decideOrangecatSignIn(input: {
+    sub: string;
+    contactEmail: string | null | undefined;
+    /** The local user already carrying this sub. */
+    byActor: {
+        id: string;
+    } | null;
+    /** The signed-in user who asked to connect (link token / session). */
+    linkFor: {
+        id: string;
+        orangecatSub: string | null;
+    } | null;
+    /** Whether another local user holds `contactEmail` (case-insensitive). */
+    emailTaken: boolean;
+}, policy?: OrangecatPolicy): OrangecatDecision;
+/** The few database operations the OrangeCat identity rule needs. */
+export interface OrangecatUserStore<U> {
+    findBySub(sub: string): Promise<U | null>;
+    /** Case-insensitive. */
+    emailTaken(email: string): Promise<boolean>;
+    insert(user: {
+        orangecatSub: string;
+        email: string;
+        name: string | null;
+        image: string | null;
+    }): Promise<U>;
+    /** Attach a sub to an existing user. False when they already hold a different one. */
+    attachSub(userId: string, sub: string): Promise<boolean>;
+}
+/**
+ * Find or create the local user for an OrangeCat identity — for apps that
+ * resolve in a callback rather than through an adapter (datacat). Survives
+ * the insert race datacat found: a concurrent sign-in of the same sub returns
+ * that row; an address claimed between check and insert falls back to the
+ * placeholder.
+ */
+export declare function resolveOrangecatUser<U>(store: OrangecatUserStore<U>, identity: {
+    sub: string;
+    contactEmail?: string | null;
+    name?: string | null;
+    image?: string | null;
+}): Promise<U>;
+export interface AdapterSlice {
+    getUserByAccount?(ref: never): unknown;
+    createUser?(user: never): unknown;
+    linkAccount?(account: never): unknown;
+}
+/**
+ * Wrap an Auth.js adapter so an OrangeCat sign-in resolves its user by
+ * `sub` alone. Every other provider passes straight through.
+ *
+ * `keepTokens: false` (default) stores no OrangeCat tokens — identity only,
+ * and the sub column is the single source of truth for the link. An app that
+ * calls OrangeCat on the person's behalf (loki) passes `true`, and the base
+ * adapter also writes the accounts row.
+ *
+ * Linking an existing account is Auth.js's own path: sign in to the app,
+ * then sign in with OrangeCat — `linkAccount` runs for the signed-in user,
+ * never on the strength of an email match.
+ */
+export declare function withOrangecatIdentity<A extends AdapterSlice, U>(base: A, store: OrangecatUserStore<U>, options?: {
+    keepTokens?: boolean;
+}): A;
+/**
+ * For an app without an adapter, proof that THIS signed-in user asked to
+ * connect OrangeCat: a cookie set by a POST from inside their session,
+ * read back by the sign-in callback, good for ten minutes. The OrangeCat
+ * identity that comes back attaches to that account and no other.
+ *
+ *   POST /api/user/orangecat      → set cookie mintLinkToken(user.id, AUTH_SECRET)
+ *   signIn("orangecat")           → OrangeCat → callback
+ *   signIn/jwt callback           → readLinkToken(cookie) → decideOrangecatSignIn({ linkFor })
+ */
+export declare const ORANGECAT_LINK_TTL_SECONDS: number;
+/** `userId.expiresAt.signature`, minted for one signed-in user. */
+export declare function mintLinkToken(userId: string, secret: string, nowMs?: number): string;
+/** The user id the token was minted for, or null if forged, altered or expired. */
+export declare function readLinkToken(token: string | null | undefined, secret: string, nowMs?: number): string | null;
+//# sourceMappingURL=orangecat.d.ts.map

package/dist/orangecat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orangecat.d.ts","sourceRoot":"","sources":["../src/orangecat.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CAE9D;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,GAAiB,GACrB,eAAe,GAAG,IAAI,CAKxB;AAID,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,GACtB,oBAAoB,CActB;AAID,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8EAC0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAmBD,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB;;;;;;;;;;;;;;;;;;EAiBlE;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,wBAAwB;;;;;;;;;;;;;;;;;;;;EAmBpE;AAID,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,+BAAgC,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAI/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAKxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOzB;AAED;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAuBxC,MAAM,WAAW,eAAgB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9D,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,uDAAuD;AACvD,wBAAgB,YAAY,CAAC,CAAC,SAAS,eAAe,EACpD,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,YAAY,GACpB,CAAC,CAMH;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAWT;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,CAAC,CA8C1B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,KAAK,EAAE,CAAC,EACR,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,MAAM,GACjB,CAAC,CAgBH;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,eAAe,EAC3D,KAAK,EAAE;IACL,KAAK,EAAE,CAAC,CAAC;IACT,OAAO,CAAC,EAAE,CAAC,YAAY,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1C,EACD,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACvD,OAAO,CAAC,CAAC,CAAC,CAeZ;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAK5E;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,KAAK,EAAE,OAAO,UAIf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAIV;AAED,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,UAAU,GAAG,aAAa,CAAC;AAE7E,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,eAAe;IAC9B;8EAC0E;IAC1E,cAAc,CAAC,EAAE,aAAa,GAAG,QAAQ,CAAC;IAC1C,8EAA8E;IAC9E,WAAW,CAAC,EAAE,aAAa,GAAG,QAAQ,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC,gDAAgD;IAChD,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/B,sEAAsE;IACtE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5D,0EAA0E;IAC1E,UAAU,EAAE,OAAO,CAAC;CACrB,EACD,MAAM,GAAE,eAAoB,GAC3B,iBAAiB,CAqBnB;AAED,qEAAqE;AACrE,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1C,wBAAwB;IACxB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACf,sFAAsF;IACtF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAC5B,QAAQ,EAAE;IACR,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GACA,OAAO,CAAC,CAAC,CAAC,CAqBZ;AAeD,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,CAAC,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC;IACvC,UAAU,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC;IAClC,WAAW,CAAC,CAAC,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC;CACvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,EAC7D,IAAI,EAAE,CAAC,EACP,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAC5B,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,CAAC,CA0CH;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,QAAU,CAAC;AAMlD,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,SAAa,GACjB,MAAM,CAMR;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,MAAM,EACd,KAAK,SAAa,GACjB,MAAM,GAAG,IAAI,CAUf"}