@crowdedkingdoms/crowdyjs 7.1.0 → 8.0.0

package/MIGRATION.md

@@ -1,3 +1,49 @@
+# CrowdyJS v8 — Passwordless & federated sign-in (BREAKING)
+
+**Crowded Kingdoms is passwordless.** Email + password login is removed. Update
+your sign-in flow to one of:
+
+- **Magic link (email):**
+  ```ts
+  await client.auth.requestLoginLink({ email, redirectUri }); // emails a one-time link
+  // on the landing page (token from the URL):
+  const { user } = await client.auth.completeLoginLink(tokenFromUrl);
+  ```
+- **Social (federated / OIDC):**
+  ```ts
+  const providers = await client.auth.availableLoginProviders(); // e.g. ['google']
+  const { authorizeUrl, state } = await client.auth.socialLoginStart('google', callbackUrl);
+  location.assign(authorizeUrl);
+  // on the callback page:
+  await client.auth.socialLoginComplete({ provider: 'google', code, state });
+  ```
+- **Dev bypass (development only):** `await client.auth.devLogin(email)` — works only
+  when the server has `DEV_AUTH_BYPASS` enabled.
+
+**Removed:** `client.auth.login`, `register`, `confirmEmail`, `requestPasswordReset`,
+`resetPassword`, `resendConfirmationEmail`, `changePassword` (and the
+`LoginUserInput` / `RegisterUserInput` / `ResetPasswordInput` types).
+
+**New:** `requestLoginLink`, `completeLoginLink`, `socialLoginStart`,
+`socialLoginComplete`, `devLogin`, `availableLoginProviders`, `myIdentities`,
+`linkIdentity`, `unlinkIdentity`. Each sign-in still returns an identity session
+token, stored on the shared session automatically (account is created on first
+sign-in).
+
+**Portal consent + connected apps (new on `client.portal`):** `getConsent(appId)`,
+`authorizeApp(appId)`, `revokeAppAuthorization(appId)`, `myAuthorizedApps()`,
+`setAppClientSettings({ appId, redirectUris, clientType, launchUrl })`.
+`handleAuthorizeRequest` now enforces consent: untrusted apps throw
+`PortalConsentRequiredError` unless you pass `{ grantConsent: true }` (call after
+the user approves on the consent screen). Trusted/first-party apps (the Overworld,
+app 1) skip consent. Browser portal entry now requires the destination app's
+`redirect_uris` to be registered (`setAppClientSettings`).
+
+Everything else from v7 (the two-client pattern, `client.portal` minting/PKCE,
+app-scoped tokens) is unchanged.
+
+---
+
 # CrowdyJS v7 — Overworld portals & app-scoped tokens (BREAKING)
 
 v7 splits the single app-agnostic game token into two credentials and makes

package/README.md

@@ -1,6 +1,6 @@
 # CrowdyJS
 
-The official browser-first TypeScript SDK for **Crowded Kingdoms**. CrowdyJS gives you one typed client that handles auth, the world/replication GraphQL API, and the UDP proxy subscription stream behind a single shared session.
+The official browser-first TypeScript SDK for **Crowded Kingdoms**. CrowdyJS gives you typed clients for auth, the world/replication GraphQL API, and the UDP proxy subscription stream. As of **v7** it follows the Overworld two-token model: an identity **session token** for the Management API, and short-lived **app-scoped tokens** for gameplay via `client.portal` (see [Overworld portals & app-scoped tokens (v7)](#overworld-portals--app-scoped-tokens-v7)).
 
 ## Install
 
@@ -41,12 +41,15 @@ if (!client.session.getToken()) {
   await client.auth.login({ email: 'player@example.com', password: 'secret' });
 }
 
-// Fetch the per-app bootstrap (version requirements, UDP availability, spatial limits).
-const bootstrap = await client.serverStatus.gameClientBootstrap('1');
-console.log(bootstrap.versionInfo.minimumClientVersion);
+// `client.auth.login()` returns an identity SESSION token (Management API only).
+// Identity reads run on it:
+const me = await client.users.me();
+console.log(me.email);
 ```
 
-Both endpoints share a single `AuthState`, so once `client.auth.login()` returns, every subsequent SDK call (against either endpoint) carries the bearer token automatically.
+**Gameplay needs an app-scoped token, not the login token.** Mint one per app and
+drive the Game API world/UDP surface (including `gameClientBootstrap`) from a
+per-game client — see [Overworld portals & app-scoped tokens (v7)](#overworld-portals--app-scoped-tokens-v7).
 
 If `managementUrl` is omitted, the SDK falls back to `httpUrl` for backwards-compat with the single-endpoint deployment.
 
@@ -90,16 +93,17 @@ If `managementUrl` is omitted, the SDK falls back to `httpUrl` for backwards-com
 |---|---|
 | `client.operator` | Control plane: cross-org environments, change orders, secrets, release management, audit. |
 
-Auth, user reads, and the studio-admin / operator surfaces target `managementUrl`; the game-client world/UDP surfaces target `httpUrl` / `wsUrl`. A single shared `AuthState` carries the bearer token to whichever endpoint serves each call.
+Auth, user reads, and the studio-admin / operator surfaces target `managementUrl` and use the **identity session token**; the game-client world/UDP surfaces target `httpUrl` / `wsUrl` and require an **app-scoped token** for that app. Use one identity client plus a per-game client (see [Overworld portals & app-scoped tokens (v7)](#overworld-portals--app-scoped-tokens-v7)); each client's `AuthState` carries its token to its own endpoints, so HTTP and WebSocket auth never drift within a client.
 
 ## Game-loop lifecycle
 
-1. Authenticate with `client.auth.login()` or restore a previous token through `client.session.restore()`.
-2. Subscribe to UDP proxy notifications with `client.udp.subscribe(handlers, appId)` — `appId` is **required** (the SDK opens the realtime socket on demand and scopes it to that app).
-3. Join a chunk by sending an initial actor update.
-4. Send actor, voxel, text, audio, and client-event updates through `client.udp` or the higher-level `client.world(appId)` helpers.
-5. Call `client.udp.disconnect()` when leaving the world.
-6. Call `client.close()` when disposing the SDK instance.
+1. Authenticate on the identity client with `client.auth.login()` (or `client.session.restore()`) — this yields the **session token**.
+2. Mint an **app-scoped token** for the app (`identity.portal.mintAppToken(appId)`, or the PKCE portal flow across origins) and build a per-game client holding it (`game.setToken(token)`). The gameplay steps below run on that **game** client.
+3. Subscribe to UDP proxy notifications with `game.udp.subscribe(handlers, appId)` — `appId` is **required** (the SDK opens the realtime socket on demand and scopes it to that app).
+4. Join a chunk by sending an initial actor update.
+5. Send actor, voxel, text, audio, and client-event updates through `game.udp` or the higher-level `game.world(appId)` helpers.
+6. Call `game.udp.disconnect()` when leaving the world; `game.portal.refresh()` before the token expires to keep playing.
+7. Call `client.close()` (and `game.close()`) when disposing the SDK instances.
 
 ## Per-app routing
 
@@ -118,18 +122,21 @@ query AppForRouting($appId: BigInt!) {
 
 `gameApiUrl` is populated for **both** dedicated (`splitMode`) and shared
 (`deploymentTarget: "shared"`) apps. When it's set, build a **second**
-`CrowdyClient` with `httpUrl: gameApiUrl` (and the matching `wsUrl`) **sharing the
-same `tokenStore` as the first client**, then drive gameplay through that client.
-Apps with no `gameApiUrl` keep working against the default `httpUrl` you
-configured.
+`CrowdyClient` with `httpUrl: gameApiUrl` (and the matching `wsUrl`) holding that
+app's **app-scoped token** (`identity.portal.mintAppToken(appId)` — do **not**
+reuse the identity client's session token store), then drive gameplay through that
+client. In practice `mintAppToken` already returns `gameApiUrl` / `gameApiWsUrl`,
+so you rarely need this separate routing query. Apps with no `gameApiUrl` keep
+working against the default `httpUrl` you configured.
 
 ## Realtime notifications
 
 `subscribe` takes the handlers **and a required `appId`** (second argument). The
 Game API scopes the realtime session to that app and rejects an app-agnostic
-subscription with a `RealtimeConnectionEvent` (`code: 'APP_ID_REQUIRED'`). Run
-one client per app (sharing the same `tokenStore`) when a player is in multiple
-apps at once.
+subscription with a `RealtimeConnectionEvent` (`code: 'APP_ID_REQUIRED'`). It also
+rejects an identity session token (`APP_TOKEN_REQUIRED`) or a token scoped to a
+different app (`APP_SCOPE_MISMATCH`). Run one client per app (each holding that
+app's app-scoped token) when a player is in multiple apps at once.
 
 ```ts
 const appId = '1';
@@ -258,7 +265,7 @@ The key parameter is optional and trailing, so it's safe to omit. Requires a ser
 
 - Use `client.auth.setToken(token)` if you need to seed a token externally (e.g. when restoring auth from a non-default storage).
 - `client.session.restore()` reads from the configured `tokenStore`. `BrowserLocalStorageTokenStore` is provided; bring your own for SSR or Node usage.
-- A single `AuthState` is observed by both the HTTP client and the realtime socket, so HTTP and WebSocket auth can never drift.
+- Each client's `AuthState` is observed by both its HTTP client and its realtime socket, so HTTP and WebSocket auth never drift within a client. Hold the **identity session token** on the management/identity client and an **app-scoped token** on each per-game client (`client.portal` — see the [v7 section](#overworld-portals--app-scoped-tokens-v7)).
 
 ## Overworld portals & app-scoped tokens (v7)
 

package/dist/domains/auth.d.ts

@@ -1,163 +1,100 @@
 import type { GraphQLClient } from '../client.js';
 import type { AuthState } from '../auth-state.js';
-import { type LoginMutation, type LoginUserInput, type RegisterMutation, type RegisterUserInput, type ResetPasswordInput } from '../generated/graphql.js';
 /**
- * Authentication and account-lifecycle flows — exposed as `client.auth`.
+ * Authentication and account lifecycle — exposed as `client.auth`.
  *
- * Targets the **management-api**: every call routes to `managementUrl` (falling
- * back to the game-api endpoint only in legacy single-endpoint mode). The
- * management API owns the `game_tokens` table that backs every login / register
- * / password / email-confirmation flow; the `token` it returns is a
- * `game_tokens` row that game-api validates against the same shared Postgres.
+ * Crowded Kingdoms is **passwordless**. There is no email+password login: a user
+ * authenticates with an emailed magic link, a federated social provider (OIDC),
+ * or — in development only — the dev bypass. Every path returns an identity
+ * SESSION token (management-plane), which is stored on the shared session state
+ * automatically. Gameplay tokens are minted separately via `client.portal`.
  *
- * {@link login} and {@link register} mint that session token **and** store it on
- * the shared session state automatically, so every later call on *either*
- * endpoint (auth, users, apps, actors, chunks, udp, ...) is authenticated
- * without you threading the token through by hand. Use {@link setToken} to
- * rehydrate a saved token and {@link getToken} to read the current one. `BigInt`
- * ids on the returned user (e.g. `userId`, `orgId`) are decimal strings.
+ * Targets the **management-api** (`managementUrl`).
  *
- * **Public — no session required:** {@link login}, {@link register},
- * {@link confirmEmail}, {@link requestPasswordReset}, {@link resetPassword}, and
- * {@link resendConfirmationEmail}. **Require a valid session:** {@link logout},
- * {@link logoutAllDevices}, and {@link changePassword}, which otherwise throw
- * {@link CrowdyGraphQLError} with `UNAUTHENTICATED` when the bearer token is
- * missing, expired, or revoked.
+ * **Public (no session):** {@link requestLoginLink}, {@link completeLoginLink},
+ * {@link socialLoginStart}, {@link socialLoginComplete}, {@link devLogin},
+ * {@link availableLoginProviders}. **Require a session:** {@link logout},
+ * {@link logoutAllDevices}, {@link myIdentities}, {@link linkIdentity},
+ * {@link unlinkIdentity}.
  */
+export interface AuthUser {
+    userId: string;
+    email?: string | null;
+    gamertag?: string | null;
+}
+export interface AuthResponse {
+    /** Identity session token; stored on the session state automatically. */
+    token: string;
+    gameTokenId: string;
+    user: AuthUser;
+}
+export interface UserIdentity {
+    identityId: string;
+    provider: string;
+    subject: string;
+    email: string | null;
+    emailVerified: boolean;
+    createdAt: string;
+    lastLoginAt: string | null;
+}
 export declare class AuthAPI {
     private readonly graphql;
     private readonly session;
     constructor(graphql: GraphQLClient, session: AuthState);
+    /** The federated sign-in providers currently enabled (e.g. `['google']`). */
+    availableLoginProviders(): Promise<string[]>;
     /**
-     * Authenticate with email + password and start a new session. **Public** — no
-     * existing session required.
-     *
-     * On success the returned `token` is minted **and** stored on the shared
-     * session state, so subsequent calls on any sub-client (management-api or
-     * game-api) carry it automatically — no need to call {@link setToken}.
-     *
-     * @param input - Credentials ({@link LoginUserInput}): `email` and `password`
-     *   (min 8 characters).
-     * @returns An {@link AuthResponse}: the opaque session `token` (sent as
-     *   `Authorization: Bearer <token>`), `gameTokenId` (the session row id, a
-     *   string), and the authenticated `user`.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` on invalid credentials, or
-     *   `BAD_USER_INPUT` on malformed input.
-     * @example
-     * ```ts
-     * const { user } = await client.auth.login({ email, password });
-     * // the session token is now stored; later calls are authenticated for you
-     * await client.users.me();
-     * ```
+     * Passwordless: email the address a one-time magic sign-in link (creating the
+     * account on first sign-in). Always resolves `sent: true` (no enumeration). In
+     * development (`DEV_AUTH_BYPASS`) the response also carries `devToken`, the
+     * token to pass straight to {@link completeLoginLink} without an inbox.
      */
-    login(input: LoginUserInput): Promise<LoginMutation['login']>;
+    requestLoginLink(input: {
+        email: string;
+        redirectUri?: string;
+    }): Promise<{
+        sent: boolean;
+        devToken: string | null;
+    }>;
+    /** Complete a magic-link sign-in; stores the session token on success. */
+    completeLoginLink(token: string): Promise<AuthResponse>;
     /**
-     * Create a new (initially unconfirmed) account, send a confirmation email, and
-     * return a session for immediate login. **Public** — no existing session
-     * required. Same token-persistence behaviour as {@link login}: the new `token`
-     * is stored on the shared session state automatically.
-     *
-     * @param input - New-account details ({@link RegisterUserInput}): `email`
-     *   (where the confirmation email is sent), `password` (min 8 characters), and
-     *   an optional initial `gamertag` (min 3 characters; can also be set later via
-     *   `client.users.updateGamertag`).
-     * @returns An {@link AuthResponse} (session `token`, `gameTokenId`, and the new
-     *   `user`).
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the email already exists or
-     *   the input is invalid.
+     * Begin a federated (social) sign-in. Returns an `authorizeUrl` to redirect the
+     * user to and an opaque `state` to round-trip back to {@link socialLoginComplete}.
      */
-    register(input: RegisterUserInput): Promise<RegisterMutation['register']>;
+    socialLoginStart(provider: string, redirectUri: string): Promise<{
+        authorizeUrl: string;
+        state: string;
+    }>;
+    /** Complete a federated sign-in from the provider callback; stores the token. */
+    socialLoginComplete(input: {
+        provider: string;
+        code: string;
+        state: string;
+    }): Promise<AuthResponse>;
     /**
-     * Single-device logout: revoke the `game_tokens` row that authenticated this
-     * request; other devices/tokens are unaffected. After a successful server-side
-     * revoke the in-memory token is cleared from the shared session state so the
-     * other sub-clients stop using it. Requires a valid session.
-     *
-     * @returns `true` if a token was revoked, or `false` if the request carried no
-     *   game token.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
+     * DEV ONLY bypass sign-in (active only when the server has `DEV_AUTH_BYPASS`).
+     * Returns a session for `email` without email/social verification; stores it.
+     * Throws `FORBIDDEN` when the bypass is disabled (e.g. production).
      */
+    devLogin(email: string): Promise<AuthResponse>;
+    /** The signed-in user's linked sign-in identities. Requires a session. */
+    myIdentities(): Promise<UserIdentity[]>;
+    /** Link an additional federated identity (from a social callback). */
+    linkIdentity(input: {
+        provider: string;
+        code: string;
+        state: string;
+    }): Promise<UserIdentity>;
+    /** Unlink a federated identity (cannot remove the last sign-in method). */
+    unlinkIdentity(identityId: string): Promise<boolean>;
+    /** Single-device logout; clears the in-memory token on success. */
     logout(): Promise<boolean>;
-    /**
-     * Revoke **every** active session for the authenticated user (deletes all
-     * their `game_tokens` rows and records revocations). Requires a valid session;
-     * use {@link logout} to end only the current one.
-     *
-     * Note: unlike {@link logout}, this does not clear the SDK's in-memory token —
-     * call {@link setToken}`(null)` afterwards if you also want to drop it locally.
-     *
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
-     */
+    /** Revoke every active session for the user. Requires a session. */
     logoutAllDevices(): Promise<boolean>;
-    /**
-     * Confirm a user's email address using the token from the confirmation email.
-     * **Public** — the token itself authorizes the call.
-     *
-     * @param token - The confirmation token from the emailed link.
-     * @returns `true` on success, or `false` if the token is invalid or expired.
-     * @throws {CrowdyGraphQLError} on transport/validation failures (invalid or
-     *   expired tokens resolve to `false` rather than throwing).
-     */
-    confirmEmail(token: string): Promise<boolean>;
-    /**
-     * Start the password-reset flow by emailing a reset link to the address.
-     * **Public**. Always returns `true` regardless of whether the email exists or
-     * is confirmed, to prevent account enumeration.
-     *
-     * @param email - Email address to send the password-reset link to.
-     * @returns `true` (always, even when no such account exists).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
-     */
-    requestPasswordReset(email: string): Promise<boolean>;
-    /**
-     * Complete a password reset using the reset token and a new password.
-     * **Public** — the reset token authorizes the call. Existing sessions are
-     * **not** revoked.
-     *
-     * @param input - {@link ResetPasswordInput}: the `token` from the emailed reset
-     *   link and the `newPassword` to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the token is invalid or
-     *   expired.
-     */
-    resetPassword(input: ResetPasswordInput): Promise<boolean>;
-    /**
-     * Re-send the email-confirmation link. **Public**. Always returns `true`
-     * regardless of whether the account exists or is already confirmed (prevents
-     * enumeration); the email is only actually sent for existing unconfirmed
-     * accounts.
-     *
-     * @param email - Email address of the account to re-send confirmation to.
-     * @returns `true` (always).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
-     */
-    resendConfirmationEmail(email: string): Promise<boolean>;
-    /**
-     * Change the authenticated user's password after verifying the current one.
-     * Requires a valid session. Existing sessions are **not** revoked.
-     *
-     * @param currentPassword - The user's current password, for verification.
-     * @param newPassword - The new password to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` without a valid session, or
-     *   `BAD_USER_INPUT` if the current password is wrong.
-     */
-    changePassword(currentPassword: string, newPassword: string): Promise<boolean>;
-    /**
-     * Imperatively replace the in-memory bearer token on the shared session state
-     * (e.g. to rehydrate a token persisted to disk). Affects every sub-client.
-     * Local only — performs no network call. Pass `null` to clear it.
-     *
-     * @param token - The bearer token to use, or `null` to clear the session.
-     */
+    /** Imperatively set the in-memory bearer token (e.g. rehydrate). */
     setToken(token: string | null): void;
-    /**
-     * Read the current in-memory bearer token from the shared session state. Local
-     * only — performs no network call.
-     *
-     * @returns The current bearer token, or `null` if none is set.
-     */
+    /** Read the current in-memory bearer token. */
     getToken(): string | null;
 }
 //# sourceMappingURL=auth.d.ts.map

package/dist/domains/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAUL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAQnE;;;;;;;;;;;;;;OAcG;IACG,QAAQ,CACZ,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAQxC;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC;;;;;;;;;;OAUG;IACG,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C;;;;;;;;OAQG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;;;;;OAQG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3D;;;;;;;;;;OAUG;IACG,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOhE;;;;;;;;;OASG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO9D;;;;;;;;;OASG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAQnB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA+DD,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC,6EAA6E;IACvE,uBAAuB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKlD;;;;;OAKG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAKvD,0EAA0E;IACpE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAS7D;;;OAGG;IACG,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAOnD,iFAAiF;IAC3E,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IASzB;;;;OAIG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQpD,0EAA0E;IACpE,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK7C,sEAAsE;IAChE,YAAY,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IAKzB,2EAA2E;IACrE,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D,mEAAmE;IAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC,oEAAoE;IAC9D,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}