@draftlab/auth 0.15.0 → 0.16.0

package/dist/types/client.d.ts

@@ -0,0 +1,462 @@
+import type { StandardSchemaV1 } from "@standard-schema/spec";
+import { InvalidAccessTokenError, InvalidAuthorizationCodeError, InvalidRefreshTokenError, InvalidSubjectError } from "./error";
+import type { SubjectSchema } from "./subject";
+/**
+ * Result type for operations that can succeed or fail.
+ *
+ * @template T - The success data type
+ * @template E - The error type
+ *
+ * @example
+ * ```ts
+ * const result = await client.exchange(code, redirectUri)
+ * if (result.success) {
+ *   // Access token available: result.data.access
+ * } else {
+ *   // Handle error: result.error.message
+ * }
+ * ```
+ */
+export type Result<T, E = Error> = {
+    success: true;
+    data: T;
+} | {
+    success: false;
+    error: E;
+};
+interface FetchResponse {
+    ok: boolean;
+    text(): Promise<string>;
+    json(): Promise<unknown>;
+}
+type FetchLike = (url: string, init?: RequestInit) => Promise<FetchResponse>;
+/**
+ * Authorization server metadata from well-known endpoints.
+ */
+export interface WellKnown {
+    /**
+     * URI to the JWKS endpoint for token verification.
+     */
+    jwks_uri: string;
+    /**
+     * URI to the token endpoint for authorization code exchange.
+     */
+    token_endpoint: string;
+    /**
+     * URI to the authorization endpoint for starting flows.
+     */
+    authorization_endpoint: string;
+}
+/**
+ * Tokens returned by the authorization server.
+ */
+export interface Tokens {
+    /**
+     * Access token for making authenticated API requests.
+     */
+    access: string;
+    /**
+     * Refresh token for obtaining new access tokens.
+     */
+    refresh: string;
+    /**
+     * Number of seconds until the access token expires.
+     */
+    expiresIn: number;
+}
+/**
+ * Challenge data for PKCE flows.
+ */
+export type Challenge = {
+    /**
+     * State parameter for CSRF protection.
+     */
+    state: string;
+    /**
+     * PKCE code verifier for token exchange.
+     */
+    verifier?: string;
+};
+/**
+ * Client configuration options.
+ */
+export interface ClientInput {
+    /**
+     * Client ID that identifies your application.
+     *
+     * @example
+     * ```ts
+     * {
+     *   clientID: "my-web-app"
+     * }
+     * ```
+     */
+    clientID: string;
+    /**
+     * Base URL of your Draft Auth server.
+     *
+     * @example
+     * ```ts
+     * {
+     *   issuer: "https://auth.myserver.com"
+     * }
+     * ```
+     */
+    issuer: string;
+    /**
+     * Optionally, override the internally used fetch function.
+     *
+     * @example
+     * ```ts
+     * {
+     *   fetch: customFetch
+     * }
+     * ```
+     */
+    fetch?: FetchLike;
+}
+/**
+ * Options for starting an authorization flow.
+ */
+export interface AuthorizeOptions {
+    /**
+     * Enable PKCE flow for enhanced security.
+     *
+     * Recommended for single-page applications and mobile apps.
+     *
+     * @default false
+     * @example
+     * ```ts
+     * {
+     *   pkce: true
+     * }
+     * ```
+     */
+    pkce?: boolean;
+    /**
+     * Specific authentication provider to use.
+     *
+     * If not specified, users see a provider selection screen
+     * or are redirected to the single configured provider.
+     *
+     * @example
+     * ```ts
+     * {
+     *   provider: "google"
+     * }
+     * ```
+     */
+    provider?: string;
+}
+/**
+ * Result of starting an authorization flow.
+ */
+export interface AuthorizeResult {
+    /**
+     * Challenge data needed for PKCE flows.
+     *
+     * Store this securely and use when exchanging the code.
+     *
+     * @example
+     * ```ts
+     * sessionStorage.setItem("challenge", JSON.stringify(challenge))
+     * ```
+     */
+    challenge: Challenge;
+    /**
+     * Authorization URL to redirect the user to.
+     *
+     * @example
+     * ```ts
+     * window.location.href = url
+     * ```
+     */
+    url: string;
+}
+/**
+ * Options for token refresh operations.
+ */
+export interface RefreshOptions {
+    /**
+     * Current access token to check before refreshing.
+     *
+     * Helps avoid unnecessary refresh requests.
+     *
+     * @example
+     * ```ts
+     * {
+     *   access: currentAccessToken
+     * }
+     * ```
+     */
+    access?: string;
+}
+/**
+ * Options for token verification.
+ */
+export interface VerifyOptions {
+    /**
+     * Refresh token for automatic refresh if access token is expired.
+     *
+     * If passed in, this will automatically refresh the access token if it has expired.
+     *
+     * @example
+     * ```ts
+     * {
+     *   refresh: refreshToken
+     * }
+     * ```
+     */
+    refresh?: string;
+    /**
+     * Expected issuer for validation.
+     * @internal
+     */
+    issuer?: string;
+    /**
+     * Expected audience for validation.
+     * Defaults to clientID for security. Override only if you know what you're doing.
+     * @internal
+     */
+    audience?: string;
+    /**
+     * Custom fetch for HTTP requests.
+     *
+     * Optionally, override the internally used fetch function.
+     */
+    fetch?: FetchLike;
+}
+/**
+ * Result of successful token verification.
+ */
+export interface VerifyResult<T extends SubjectSchema> {
+    /**
+     * New tokens if access token was refreshed during verification.
+     */
+    tokens?: Tokens;
+    /**
+     * Audience (client ID) the token was issued for.
+     * @internal
+     */
+    aud: string;
+    /**
+     * Unique subject identifier.
+     *
+     * This is a stable, consistent identifier derived from the subject type and properties.
+     * Format: `{type}:{hash}` (e.g., `user:30e16a2659c8bbb2`)
+     */
+    sub: string;
+    /**
+     * Decoded subject information from the access token.
+     *
+     * Contains user data that was encoded when the token was issued.
+     */
+    subject: {
+        [K in keyof T]: {
+            type: K;
+            properties: StandardSchemaV1.InferOutput<T[K]>;
+        };
+    }[keyof T];
+}
+/**
+ * Options for token revocation.
+ */
+export interface RevokeOptions {
+    /**
+     * Optional hint about the token type.
+     * Can be "access_token" or "refresh_token".
+     *
+     * Helps the server optimize token lookup.
+     *
+     * @example
+     * ```ts
+     * {
+     *   tokenTypeHint: "refresh_token"
+     * }
+     * ```
+     */
+    tokenTypeHint?: "access_token" | "refresh_token";
+}
+/**
+ * Draft Auth client with OAuth 2.0 operations.
+ */
+export interface Client {
+    /**
+     * Start an OAuth authorization flow.
+     *
+     * @param redirectURI - Where users will be sent after authorization
+     * @param response - Response type ("code" or "token")
+     * @param opts - Additional authorization options
+     * @returns Authorization URL and challenge data
+     *
+     * @example Basic flow
+     * ```ts
+     * const result = await client.authorize(
+     *   "https://myapp.com/callback",
+     *   "code"
+     * )
+     * if (result.success) {
+     *   window.location.href = result.data.url
+     * }
+     * ```
+     *
+     * @example PKCE flow
+     * ```ts
+     * const result = await client.authorize(
+     *   "https://spa.example.com/callback",
+     *   "code",
+     *   { pkce: true, scopes: ["read", "write"] }
+     * )
+     * if (result.success) {
+     *   sessionStorage.setItem("challenge", JSON.stringify(result.data.challenge))
+     *   window.location.href = result.data.url
+     * }
+     * ```
+     */
+    authorize(redirectURI: string, response: "code" | "token", opts?: AuthorizeOptions): Promise<Result<AuthorizeResult>>;
+    /**
+     * Exchange authorization code for tokens.
+     *
+     * @param code - Authorization code from the callback
+     * @param redirectURI - Same redirect URI used in authorization
+     * @param verifier - PKCE code verifier (required for PKCE flows)
+     * @returns Access tokens and metadata
+     *
+     * @example Basic exchange
+     * ```ts
+     * const urlParams = new URLSearchParams(window.location.search)
+     * const code = urlParams.get('code')
+     *
+     * if (code) {
+     *   const result = await client.exchange(code, "https://myapp.com/callback")
+     *   if (result.success) {
+     *     const { access, refresh } = result.data
+     *     // Store tokens securely
+     *   }
+     * }
+     * ```
+     *
+     * @example PKCE exchange
+     * ```ts
+     * const challenge = JSON.parse(sessionStorage.getItem("challenge") || "{}")
+     * const code = new URLSearchParams(window.location.search).get('code')
+     *
+     * if (code && challenge.verifier) {
+     *   const result = await client.exchange(
+     *     code,
+     *     "https://spa.example.com/callback",
+     *     challenge.verifier
+     *   )
+     *   if (result.success) {
+     *     sessionStorage.removeItem("challenge")
+     *     // Handle tokens
+     *   }
+     * }
+     * ```
+     */
+    exchange(code: string, redirectURI: string, verifier?: string): Promise<Result<Tokens, InvalidAuthorizationCodeError>>;
+    /**
+     * Refresh an access token using a refresh token.
+     *
+     * @param refresh - Refresh token to use
+     * @param opts - Additional refresh options
+     * @returns New tokens if refresh was needed
+     *
+     * @example Basic refresh
+     * ```ts
+     * const result = await client.refresh(storedRefreshToken)
+     *
+     * if (result.success && result.data.tokens) {
+     *   const { access, refresh: newRefresh } = result.data.tokens
+     *   updateStoredTokens(access, newRefresh)
+     * } else if (result.success) {
+     *   // Token still valid
+     * } else {
+     *   redirectToLogin()
+     * }
+     * ```
+     */
+    refresh(refresh: string, opts?: RefreshOptions): Promise<Result<{
+        tokens?: Tokens;
+    }, InvalidRefreshTokenError | InvalidAccessTokenError>>;
+    /**
+     * Verify and decode an access token.
+     *
+     * @param subjects - Subject schema used when creating the issuer
+     * @param token - Access token to verify
+     * @param options - Additional verification options
+     * @returns Decoded token data and user information
+     *
+     * @example Basic verification
+     * ```ts
+     * const result = await client.verify(subjects, accessToken)
+     *
+     * if (result.success) {
+     *   const { subject, scopes } = result.data
+     *   // Access user ID: subject.properties.userID
+     *   // Access scopes: scopes?.join(', ')
+     * }
+     * ```
+     *
+     * @example With automatic refresh
+     * ```ts
+     * const result = await client.verify(subjects, accessToken, {
+     *   refresh: refreshToken
+     * })
+     *
+     * if (result.success) {
+     *   if (result.data.tokens) {
+     *     // Tokens were refreshed
+     *     updateStoredTokens(result.data.tokens.access, result.data.tokens.refresh)
+     *   }
+     *   // Use verified subject data
+     *   const user = result.data.subject.properties
+     * }
+     * ```
+     */
+    verify<T extends SubjectSchema>(subjects: T, token: string, options?: VerifyOptions): Promise<Result<VerifyResult<T>, InvalidRefreshTokenError | InvalidAccessTokenError | InvalidSubjectError>>;
+    /**
+     * Revoke a token (access or refresh token).
+     *
+     * Once revoked, the token cannot be used to access resources or refresh.
+     * Useful for implementing logout functionality.
+     *
+     * @param token - The token to revoke
+     * @param opts - Additional revocation options
+     * @returns Empty result on success
+     *
+     * @example Logout with refresh token revocation
+     * ```ts
+     * const result = await client.revoke(refreshToken, {
+     *   tokenTypeHint: "refresh_token"
+     * })
+     *
+     * if (result.success) {
+     *   // Token revoked successfully, user is logged out
+     *   clearStoredTokens()
+     *   redirectToHome()
+     * } else {
+     *   // Revocation failed, but still clear tokens on client
+     *   clearStoredTokens()
+     * }
+     * ```
+     */
+    revoke(token: string, opts?: RevokeOptions): Promise<Result<void>>;
+}
+/**
+ * Create a Draft Auth client.
+ *
+ * @param input - Client configuration
+ * @returns Configured client instance
+ *
+ * @example Basic setup
+ * ```ts
+ * const client = createClient({
+ *   clientID: "my-web-app",
+ *   issuer: "https://auth.mycompany.com"
+ * })
+ * ```
+ */
+export declare const createClient: (input: ClientInput) => Client;
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/types/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAmD7D,OAAO,EACN,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE9C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAA;AAQ5F,UAAU,aAAa;IACtB,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACvB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CACxB;AAED,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;AAE5E;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAA;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACtB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACvB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;;;;;OASG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC7B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa;IACpD;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,OAAO,EAAE;SACP,CAAC,IAAI,MAAM,CAAC,GAAG;YACf,IAAI,EAAE,CAAC,CAAA;YACP,UAAU,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;SAC9C;KACD,CAAC,MAAM,CAAC,CAAC,CAAA;CACV;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC7B;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAA;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,SAAS,CACR,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GAAG,OAAO,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAA;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACH,QAAQ,CACP,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CACN,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,wBAAwB,GAAG,uBAAuB,CAAC,CAAC,CAAA;IAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,MAAM,CAAC,CAAC,SAAS,aAAa,EAC7B,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACrB,OAAO,CACT,MAAM,CACL,YAAY,CAAC,CAAC,CAAC,EACf,wBAAwB,GAAG,uBAAuB,GAAG,mBAAmB,CACxE,CACD,CAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAClE;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,WAAW,KAAG,MAuRjD,CAAA"}

package/dist/types/core.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Core issuer implementation using Hono.
+ */
+import { Hono } from "hono";
+import { type AllowCheckInput } from "./allow";
+import { UnknownStateError } from "./error";
+import type { Provider } from "./provider/provider";
+import { type StorageAdapter } from "./storage/storage";
+import type { SubjectPayload, SubjectSchema } from "./subject";
+import { type Theme } from "./themes/theme";
+import type { AuthorizationState } from "./types";
+import { type Prettify } from "./util";
+/**
+ * Sets the subject payload in the JWT token and returns the response.
+ */
+export interface OnSuccessResponder<T extends {
+    type: string;
+    properties: unknown;
+}> {
+    subject<Type extends T["type"]>(type: Type, properties: Extract<T, {
+        type: Type;
+    }>["properties"], opts?: {
+        ttl?: {
+            access?: number;
+            refresh?: number;
+        };
+        subject?: string;
+    }): Promise<Response>;
+}
+/**
+ * Main issuer input configuration interface.
+ */
+interface IssuerInput<Providers extends Record<string, Provider<unknown>>, Subjects extends SubjectSchema, Result = {
+    [Key in keyof Providers]: Prettify<{
+        provider: Key;
+    } & (Providers[Key] extends Provider<infer T> ? T : Record<string, unknown>)>;
+}[keyof Providers]> {
+    /** The storage adapter for persisting tokens and sessions */
+    storage: StorageAdapter;
+    /** Auth providers configuration */
+    providers: Providers;
+    /** Subject schemas for token validation */
+    subjects: Subjects;
+    /** Base path for embedded scenarios (e.g., "/auth" or "/api/auth") */
+    basePath?: string;
+    /** Success callback for completed authentication */
+    success(response: OnSuccessResponder<SubjectPayload<Subjects>>, input: Result, req: Request, clientID: string): Promise<Response>;
+    /** Theme configuration for UI */
+    theme?: Theme;
+    /** TTL configuration for tokens and sessions */
+    ttl?: {
+        access?: number;
+        refresh?: number;
+        reuse?: number;
+        retention?: number;
+    };
+    /** Provider selection UI function */
+    select?(providers: Record<string, string>, req: Request): Promise<Response>;
+    /** Optional start callback */
+    start?(req: Request): Promise<void>;
+    /** Error handling callback */
+    error?(error: UnknownStateError, req: Request): Promise<Response>;
+    /** Client authorization check function */
+    allow?(input: AllowCheckInput, req: Request): Promise<boolean>;
+    /**
+     * Refresh callback for updating user claims.
+     *
+     * @example
+     * ```typescript
+     * refresh: async (payload, req) => {
+     *   const user = await getUserBySubject(payload.subject)
+     *   if (!user || !user.active) {
+     *     return undefined // Revoke the token
+     *   }
+     *
+     *   return {
+     *     type: payload.type,
+     *     properties: {
+     *       userID: user.id,
+     *       role: user.role,
+     *       permissions: user.permissions,
+     *       lastLogin: new Date().toISOString()
+     *     }
+     *   }
+     * }
+     * ```
+     */
+    refresh?(payload: {
+        type: SubjectPayload<Subjects>["type"];
+        properties: SubjectPayload<Subjects>["properties"];
+        subject: string;
+        clientID: string;
+        scopes?: string[];
+    }, req: Request): Promise<{
+        type: SubjectPayload<Subjects>["type"];
+        properties: SubjectPayload<Subjects>["properties"];
+        subject?: string;
+        scopes?: string[];
+    } | undefined>;
+}
+/**
+ * Create a Draft Auth server, a Hono app that handles OAuth 2.0 flows.
+ */
+export declare const issuer: <Providers extends Record<string, Provider<unknown>>, Subjects extends SubjectSchema, Result = { [key in keyof Providers]: {
+    provider: key;
+} & (Providers[key] extends Provider<infer T> ? T : Record<string, unknown>); }[keyof Providers]>(input: IssuerInput<Providers, Subjects, Result>) => Hono<{
+    Variables: {
+        authorization: AuthorizationState;
+        provider: string;
+    };
+}>;
+export {};
+//# sourceMappingURL=core.d.ts.map

package/dist/types/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/core.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,KAAK,eAAe,EAAqB,MAAM,SAAS,CAAA;AACjE,OAAO,EAIN,iBAAiB,EACjB,MAAM,SAAS,CAAA;AAGhB,OAAO,KAAK,EAAE,QAAQ,EAAmB,MAAM,qBAAqB,CAAA;AAGpE,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAY,KAAK,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EACX,kBAAkB,EAIlB,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAwB,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAqC5D;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE;IAClF,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC,MAAM,CAAC,EAC7B,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,OAAO,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,EACpD,IAAI,CAAC,EAAE;QACN,GAAG,CAAC,EAAE;YACL,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,OAAO,CAAC,EAAE,MAAM,CAAA;SAChB,CAAA;QACD,OAAO,CAAC,EAAE,MAAM,CAAA;KAChB,GACC,OAAO,CAAC,QAAQ,CAAC,CAAA;CACpB;AAED;;GAEG;AACH,UAAU,WAAW,CACpB,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,EACnD,QAAQ,SAAS,aAAa,EAC9B,MAAM,GAAG;KACP,GAAG,IAAI,MAAM,SAAS,GAAG,QAAQ,CACjC;QACC,QAAQ,EAAE,GAAG,CAAA;KACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC5E;CACD,CAAC,MAAM,SAAS,CAAC;IAElB,6DAA6D;IAC7D,OAAO,EAAE,cAAc,CAAA;IACvB,mCAAmC;IACnC,SAAS,EAAE,SAAS,CAAA;IACpB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oDAAoD;IACpD,OAAO,CACN,QAAQ,EAAE,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACtD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB,iCAAiC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,gDAAgD;IAChD,GAAG,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,SAAS,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,qCAAqC;IACrC,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3E,8BAA8B;IAC9B,KAAK,CAAC,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,8BAA8B;IAC9B,KAAK,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjE,0CAA0C;IAC1C,KAAK,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9D;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,CACP,OAAO,EAAE;QACR,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;QACtC,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;QAClD,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,EACD,GAAG,EAAE,OAAO,GACV,OAAO,CACP;QACA,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;QACtC,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GACD,SAAS,CACX,CAAA;CACD;AAcD;;GAEG;AACH,eAAO,MAAM,MAAM,GAClB,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,EACnD,QAAQ,SAAS,aAAa,EAC9B,MAAM,GAAG,GACP,GAAG,IAAI,MAAM,SAAS,GAAG;IACzB,QAAQ,EAAE,GAAG,CAAA;CACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC5E,CAAC,MAAM,SAAS,CAAC,EAElB,OAAO,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,KAC7C,IAAI,CAAC;IAAE,SAAS,EAAE;QAAE,aAAa,EAAE,kBAAkB,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAuyB7E,CAAA"}