@boopkit/cap-users 0.1.0

package/dist/auth-middleware.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * Auth middleware factories for Express.
+ *
+ * Provides three middleware functions:
+ * - `ensureVisitor` — resolves session from auth_id cookie, creates anonymous visitor if missing
+ * - `requireAuth` — gates routes by trust tier, redirects web / 401s API
+ * - `addAuthContext` — populates res.locals.auth for view templates
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthMiddleware = createAuthMiddleware;
+const auth_service_js_1 = require("./auth-service.js");
+// ---------- Constants ----------
+const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1000;
+const TEN_YEARS_MS = 10 * ONE_YEAR_MS;
+// ---------- Factory ----------
+/**
+ * Create auth middleware functions wired to the auth, identity, and user services.
+ */
+function createAuthMiddleware(deps, options) {
+    const { authService, identityService, userService } = deps;
+    const cookieName = options?.cookieName ?? 'auth_id';
+    const cookieMaxAge = options?.cookieMaxAge ?? ONE_YEAR_MS;
+    const visitorCookieName = options?.visitorCookieName ?? 'visitor_id';
+    const visitorCookieMaxAge = options?.visitorCookieMaxAge ?? TEN_YEARS_MS;
+    const loginPath = options?.loginPath ?? '/login';
+    /**
+     * ensureVisitor — two-cookie pattern:
+     * 1. Resolve/create visitor_id cookie (long-lived tracking, never rotated)
+     * 2. Resolve/create auth_id cookie (session authentication, rotated on login)
+     * Sets req.user, req.sessionToken, and req.visitorToken.
+     */
+    function ensureVisitor(req, res, next) {
+        resolveVisitor(req, res).then(() => next()).catch(next);
+    }
+    async function resolveVisitor(req, res) {
+        let user;
+        let sessionToken;
+        let visitorToken;
+        // --- Phase 1: Resolve user from existing cookies ---
+        // Try auth_id first (most authoritative for current session)
+        const rawAuthToken = req.cookies?.[cookieName];
+        if (rawAuthToken) {
+            const identity = await identityService.findByDomainAndKey('cookie', (0, auth_service_js_1.hashToken)(rawAuthToken));
+            if (identity) {
+                const u = await userService.findById(identity.userId);
+                if (u) {
+                    user = u;
+                    sessionToken = rawAuthToken;
+                }
+            }
+        }
+        // Try visitor_id (fallback if auth_id missing/stale)
+        const rawVisitorToken = req.cookies?.[visitorCookieName];
+        if (rawVisitorToken) {
+            const identity = await identityService.findByDomainAndKey('cookie', (0, auth_service_js_1.hashToken)(rawVisitorToken));
+            if (identity) {
+                if (!user) {
+                    user = await userService.findById(identity.userId) ?? undefined;
+                }
+                visitorToken = rawVisitorToken;
+            }
+            // If identity not found, visitor cookie is stale — will be replaced below
+        }
+        // --- Phase 2: Create missing resources ---
+        // Create user if neither cookie resolved one
+        if (!user) {
+            user = await userService.create({ type: 'user' });
+        }
+        // Ensure visitor_id cookie exists
+        if (!visitorToken) {
+            visitorToken = (0, auth_service_js_1.generateToken)();
+            await identityService.create(user.id, 'cookie', (0, auth_service_js_1.hashToken)(visitorToken));
+            res.cookie(visitorCookieName, visitorToken, { maxAge: visitorCookieMaxAge, httpOnly: true });
+        }
+        // Ensure auth_id session cookie exists
+        if (!sessionToken) {
+            sessionToken = await authService.generateSessionToken(user.id);
+            res.cookie(cookieName, sessionToken, { maxAge: cookieMaxAge, httpOnly: true });
+        }
+        req.user = user;
+        req.sessionToken = sessionToken;
+        req.visitorToken = visitorToken;
+    }
+    /**
+     * requireAuth — middleware factory. Checks trust tier for the current session.
+     * Web routes: redirects to /login?next=<current_url>.
+     * API routes: returns 401 JSON.
+     */
+    function requireAuth(requiredTrust = 'authenticated') {
+        return function requireAuthMiddleware(req, res, next) {
+            checkAuth(req, res, next, requiredTrust).catch(next);
+        };
+    }
+    async function checkAuth(req, res, next, requiredTrust) {
+        const user = req.user;
+        const sessionToken = req.sessionToken;
+        if (!user || !sessionToken) {
+            return denyAccess(req, res);
+        }
+        const authorized = await authService.isAuthorized(user.id, sessionToken, requiredTrust);
+        if (!authorized) {
+            return denyAccess(req, res);
+        }
+        next();
+    }
+    function isApiRequest(req) {
+        return req.path.startsWith('/api/') || req.path.startsWith('/api');
+    }
+    function denyAccess(req, res) {
+        if (isApiRequest(req)) {
+            res.status(401).json({ error: 'Unauthorized' });
+        }
+        else {
+            const next = encodeURIComponent(req.originalUrl);
+            res.redirect(`${loginPath}?next=${next}`);
+        }
+    }
+    /**
+     * addAuthContext — populates res.locals.auth with trust tier and user info for views.
+     */
+    function addAuthContext(req, res, next) {
+        populateAuthContext(req, res).then(() => next()).catch(next);
+    }
+    async function populateAuthContext(req, res) {
+        const user = req.user;
+        const sessionToken = req.sessionToken;
+        if (!user || !sessionToken) {
+            res.locals.auth = { trustTier: null, userName: null, userEmail: null, userInitial: null };
+            return;
+        }
+        const trustTier = await authService.getTrustTier(user.id, sessionToken);
+        const name = user.info.name ?? null;
+        const email = user.info.email ?? null;
+        const userInitial = (name ?? email ?? '?')[0].toUpperCase();
+        res.locals.auth = {
+            trustTier,
+            userName: name,
+            userEmail: email,
+            userInitial,
+        };
+    }
+    return {
+        ensureVisitor,
+        requireAuth,
+        addAuthContext,
+    };
+}
+//# sourceMappingURL=auth-middleware.js.map

package/dist/auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../src/auth-middleware.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AA0DH,oDAyJC;AA/MD,uDAA6D;AA4C7D,kCAAkC;AAElC,MAAM,WAAW,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,MAAM,YAAY,GAAG,EAAE,GAAG,WAAW,CAAC;AAEtC,gCAAgC;AAEhC;;GAEG;AACH,SAAgB,oBAAoB,CAClC,IAAwB,EACxB,OAA+B;IAE/B,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,SAAS,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,WAAW,CAAC;IAC1D,MAAM,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,YAAY,CAAC;IACrE,MAAM,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,IAAI,YAAY,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,QAAQ,CAAC;IAEjD;;;;;OAKG;IACH,SAAS,aAAa,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACpE,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa;QACvD,IAAI,IAAoC,CAAC;QACzC,IAAI,YAAgC,CAAC;QACrC,IAAI,YAAgC,CAAC;QAErC,sDAAsD;QAEtD,6DAA6D;QAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAA,2BAAS,EAAC,YAAY,CAAC,CAAC,CAAC;YAC7F,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACtD,IAAI,CAAC,EAAE,CAAC;oBACN,IAAI,GAAG,CAAC,CAAC;oBACT,YAAY,GAAG,YAAY,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAA,2BAAS,EAAC,eAAe,CAAC,CAAC,CAAC;YAChG,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;gBAClE,CAAC;gBACD,YAAY,GAAG,eAAe,CAAC;YACjC,CAAC;YACD,0EAA0E;QAC5E,CAAC;QAED,4CAA4C;QAE5C,6CAA6C;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAkB,CAAC,CAAC;QACpE,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,IAAA,+BAAa,GAAE,CAAC;YAC/B,MAAM,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAA,2BAAS,EAAC,YAAY,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,MAAM,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QAEA,GAAW,CAAC,IAAI,GAAG,IAAI,CAAC;QACxB,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;QACxC,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,SAAS,WAAW,CAAC,gBAA2B,eAAe;QAC7D,OAAO,SAAS,qBAAqB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;YACnF,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,aAAwB;QAChG,MAAM,IAAI,GAAI,GAAW,CAAC,IAAsC,CAAC;QACjE,MAAM,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAErE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;IAED,SAAS,YAAY,CAAC,GAAY;QAChC,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,SAAS,UAAU,CAAC,GAAY,EAAE,GAAa;QAC7C,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACjD,GAAG,CAAC,QAAQ,CAAC,GAAG,SAAS,SAAS,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACrE,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,IAAI,GAAI,GAAW,CAAC,IAAsC,CAAC;QACjE,MAAM,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAErE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAuB,CAAC;YAC/G,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QACtC,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAE5D,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG;YAChB,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,KAAK;YAChB,WAAW;SACS,CAAC;IACzB,CAAC;IAED,OAAO;QACL,aAAa;QACb,WAAW;QACX,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/auth-service.d.ts

@@ -0,0 +1,112 @@
+import type { PropertyRecord } from '@boopkit/cap-services';
+import type { AuthorizationGrant, BaseUserInfo, TrustTier, User, UserAuthentication, UserIdentity } from './types.js';
+import type { UserService } from './user-service.js';
+import type { IdentityService } from './identity-service.js';
+import type { UserPropertyService } from './user-property-service.js';
+/** Thrown when signup/login input validation fails. */
+export declare class AuthValidationError extends Error {
+    readonly field: string;
+    constructor(field: string, message: string);
+}
+/** Thrown on login failure — generic message to prevent user enumeration. */
+export declare class AuthError extends Error {
+    constructor(message?: string);
+}
+/** Input shape for signup. */
+export interface SignupInput {
+    email: string;
+    password: string;
+    passwordConfirmation: string;
+    name?: string;
+}
+/** Result of a successful signup. */
+export interface SignupResult {
+    user: User<BaseUserInfo>;
+    sessionToken: string;
+}
+/** Result of a successful login. */
+export interface LoginResult {
+    user: User<BaseUserInfo>;
+    sessionToken: string;
+}
+/** Dependencies injected into createAuthService. */
+export interface AuthServiceDeps {
+    userService: UserService<BaseUserInfo>;
+    identityService: IdentityService;
+    userPropertyService: UserPropertyService;
+}
+/** Result of a successful email verification. */
+export interface VerifyEmailResult {
+    userId: number;
+    email: string;
+}
+/** Options for createAuthService. */
+export interface AuthServiceOptions {
+    onSignup?(result: SignupResult): void | Promise<void>;
+    onLogin?(result: LoginResult): void | Promise<void>;
+    defaultSessionDuration?: number;
+    hashRounds?: number;
+    verificationTokenTtl?: number;
+}
+/** Options for addAuthenticationMethod (OAuth tokens, etc.). */
+export interface AddAuthMethodOptions {
+    refresh_token?: string;
+    access_token?: string;
+    access_token_expires_at?: number;
+    oauth_profile?: unknown;
+}
+/** The service object returned by createAuthService. */
+export interface AuthService {
+    validateSignup(input: SignupInput): void;
+    createUser(input: Partial<BaseUserInfo> & {
+        name?: string;
+    }): Promise<User<BaseUserInfo>>;
+    createIdentity(userId: number, domain: string, key: string): Promise<UserIdentity>;
+    setProfile(userId: number, profileData: unknown): Promise<PropertyRecord>;
+    setCredentials(userId: number, strategy: string, secret: string): Promise<PropertyRecord>;
+    addAuthenticationMethod(userId: number, strategy: string, opts?: AddAuthMethodOptions): Promise<PropertyRecord>;
+    disableAuthenticationMethod(userId: number, strategy: string): Promise<PropertyRecord>;
+    setAuthorization(userId: number, identityKey: string, strategy: string, trust: TrustTier, expiresIn?: number): Promise<PropertyRecord>;
+    generateSessionToken(userId: number): Promise<string>;
+    validateCredentials(email: string, password: string): Promise<User<BaseUserInfo>>;
+    login(email: string, password: string, currentSessionToken?: string): Promise<LoginResult>;
+    rotateSession(userId: number, currentSessionToken?: string): Promise<string>;
+    getAuthenticationMethods(userId: number): Promise<UserAuthentication | null>;
+    getAuthorizationStatus(userId: number, identityKey: string): Promise<AuthorizationGrant | null>;
+    getTrustTier(userId: number, identityKey: string): Promise<TrustTier | null>;
+    isMethodAccepted(userId: number, strategy: string): Promise<boolean>;
+    isAuthorized(userId: number, identityKey: string, requiredTrust?: TrustTier): Promise<boolean>;
+    logout(userId: number, sessionToken: string): Promise<void>;
+    logoutAll(userId: number): Promise<void>;
+    forgetDevice(userId: number, sessionToken: string): Promise<void>;
+    forgetAllDevices(userId: number): Promise<void>;
+    setTrust(userId: number, identityKey: string, tier: TrustTier): Promise<PropertyRecord>;
+    createApiKey(userId: number): Promise<{
+        apiKey: string;
+    }>;
+    validateApiKey(apiKey: string): Promise<User<BaseUserInfo>>;
+    revokeApiKey(userId: number, apiKey: string): Promise<void>;
+    rotateApiKey(userId: number, currentApiKey: string): Promise<{
+        apiKey: string;
+    }>;
+    generateVerificationToken(userId: number): Promise<string>;
+    verifyEmail(token: string): Promise<VerifyEmailResult>;
+    signup(input: SignupInput): Promise<SignupResult>;
+}
+/**
+ * Generate a partitioned token with 128 bits of cryptographic randomness.
+ * Format: `XXXXXXXX-PP-YYYYYYYYYYYYYYYYY` (base36 uppercase).
+ * The partition segment is a data-routing hint (default '01').
+ */
+export declare function generateToken(partition?: string): string;
+/**
+ * SHA-256 hash a token for storage. Input already has high entropy
+ * so a fast hash is sufficient (no need for bcrypt).
+ */
+export declare function hashToken(token: string): string;
+/**
+ * Create an auth business service orchestrating signup, login, and
+ * session management on top of user data services.
+ */
+export declare function createAuthService(deps: AuthServiceDeps, options?: AuthServiceOptions): AuthService;
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAEV,kBAAkB,EAClB,YAAY,EAEZ,SAAS,EACT,IAAI,EACJ,kBAAkB,EAGlB,YAAY,EAEb,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAItE,uDAAuD;AACvD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK3C;AAED,6EAA6E;AAC7E,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,GAAE,MAAoC;CAI1D;AAID,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAE1B,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAGzC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1F,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1F,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChH,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvI,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAGtD,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAG3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC7E,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAChG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7E,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAG/F,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGhD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAGxF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAGjF,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAGvD,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACnD;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,SAAO,GAAG,MAAM,CAItD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AA2DD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,WAAW,CAiiBb"}