@dupecom/botcha-cloudflare 0.3.2 → 0.9.0

package/dist/auth.js

@@ -1,44 +1,286 @@
 /**
  * BOTCHA Authentication & JWT Token Management
  *
- * Token-based auth flow for production API access
+ * Token-based auth flow with security features:
+ * - JTI (JWT ID) for revocation
+ * - Audience claims for API scoping
+ * - Client IP binding for additional security
+ * - Short-lived access tokens (5 min) with refresh tokens (1 hour)
+ * - Token revocation via KV storage
  */
 import { SignJWT, jwtVerify } from 'jose';
 /**
- * Generate a JWT token after successful challenge verification
+ * Generate JWT tokens (access + refresh) after successful challenge verification
+ *
+ * Access token: 5 minutes, used for API access
+ * Refresh token: 1 hour, used to get new access tokens
  */
-export async function generateToken(challengeId, solveTimeMs, secret) {
+export async function generateToken(challengeId, solveTimeMs, secret, env, options) {
     const encoder = new TextEncoder();
     const secretKey = encoder.encode(secret);
-    const token = await new SignJWT({
+    // Generate unique JTIs for both tokens
+    const accessJti = crypto.randomUUID();
+    const refreshJti = crypto.randomUUID();
+    // Access token: 5 minutes
+    const accessTokenPayload = {
         type: 'botcha-verified',
         solveTime: solveTimeMs,
-    })
+        jti: accessJti,
+    };
+    // Add optional claims
+    if (options?.aud) {
+        accessTokenPayload.aud = options.aud;
+    }
+    if (options?.clientIp) {
+        accessTokenPayload.client_ip = options.clientIp;
+    }
+    if (options?.app_id) {
+        accessTokenPayload.app_id = options.app_id;
+    }
+    const accessToken = await new SignJWT(accessTokenPayload)
+        .setProtectedHeader({ alg: 'HS256' })
+        .setSubject(challengeId)
+        .setIssuedAt()
+        .setExpirationTime('5m') // 5 minutes
+        .sign(secretKey);
+    // Refresh token: 1 hour
+    const refreshTokenPayload = {
+        type: 'botcha-refresh',
+        solveTime: solveTimeMs,
+        jti: refreshJti,
+    };
+    // Include app_id in refresh token if provided
+    if (options?.app_id) {
+        refreshTokenPayload.app_id = options.app_id;
+    }
+    const refreshToken = await new SignJWT(refreshTokenPayload)
         .setProtectedHeader({ alg: 'HS256' })
         .setSubject(challengeId)
         .setIssuedAt()
-        .setExpirationTime('1h') // 1 hour expiry
+        .setExpirationTime('1h') // 1 hour
         .sign(secretKey);
-    return token;
+    // Store refresh token JTI in KV if env provided (for revocation tracking)
+    // Also store aud, client_ip, and app_id so they carry over on refresh
+    if (env?.CHALLENGES) {
+        try {
+            const refreshData = { sub: challengeId, iat: Date.now() };
+            if (options?.aud) {
+                refreshData.aud = options.aud;
+            }
+            if (options?.clientIp) {
+                refreshData.client_ip = options.clientIp;
+            }
+            if (options?.app_id) {
+                refreshData.app_id = options.app_id;
+            }
+            await env.CHALLENGES.put(`refresh:${refreshJti}`, JSON.stringify(refreshData), { expirationTtl: 3600 } // 1 hour TTL
+            );
+        }
+        catch (error) {
+            // Fail-open: continue even if KV storage fails
+            console.error('Failed to store refresh token in KV:', error);
+        }
+    }
+    return {
+        access_token: accessToken,
+        expires_in: 300, // 5 minutes in seconds
+        refresh_token: refreshToken,
+        refresh_expires_in: 3600, // 1 hour in seconds
+    };
+}
+/**
+ * Revoke a token by its JTI
+ *
+ * Stores the JTI in the revocation list (KV) with 1 hour TTL
+ */
+export async function revokeToken(jti, env) {
+    try {
+        await env.CHALLENGES.put(`revoked:${jti}`, JSON.stringify({ revokedAt: Date.now() }), { expirationTtl: 3600 } // 1 hour TTL (matches max token lifetime)
+        );
+    }
+    catch (error) {
+        throw new Error(`Failed to revoke token: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
 }
 /**
- * Verify a JWT token
+ * Refresh an access token using a valid refresh token
+ *
+ * Verifies the refresh token, checks revocation, and issues a new access token
+ */
+export async function refreshAccessToken(refreshToken, env, secret, options) {
+    try {
+        const encoder = new TextEncoder();
+        const secretKey = encoder.encode(secret);
+        // Verify refresh token
+        const { payload } = await jwtVerify(refreshToken, secretKey, {
+            algorithms: ['HS256'],
+        });
+        // Check token type
+        if (payload.type !== 'botcha-refresh') {
+            return {
+                success: false,
+                error: 'Invalid token type. Expected refresh token.',
+            };
+        }
+        const jti = payload.jti;
+        // Check if token is revoked
+        if (jti) {
+            try {
+                const revoked = await env.CHALLENGES.get(`revoked:${jti}`);
+                if (revoked) {
+                    return {
+                        success: false,
+                        error: 'Refresh token has been revoked',
+                    };
+                }
+            }
+            catch (error) {
+                // Fail-open: if KV check fails, allow token to proceed
+                console.error('Failed to check revocation status:', error);
+            }
+        }
+        // Check if refresh token exists in KV and retrieve stored claims (aud, client_ip, app_id)
+        let storedAud;
+        let storedClientIp;
+        let storedAppId;
+        if (jti) {
+            try {
+                const storedToken = await env.CHALLENGES.get(`refresh:${jti}`);
+                if (!storedToken) {
+                    return {
+                        success: false,
+                        error: 'Refresh token not found or expired',
+                    };
+                }
+                // Extract stored claims to carry over to new access token
+                try {
+                    const storedData = JSON.parse(storedToken);
+                    storedAud = storedData.aud;
+                    storedClientIp = storedData.client_ip;
+                    storedAppId = storedData.app_id;
+                }
+                catch {
+                    // Ignore parse errors on legacy KV entries
+                }
+            }
+            catch (error) {
+                // Fail-open: if KV check fails, allow token to proceed
+                console.error('Failed to verify refresh token in KV:', error);
+            }
+        }
+        // Generate new access token
+        const newAccessJti = crypto.randomUUID();
+        const accessTokenPayload = {
+            type: 'botcha-verified',
+            solveTime: payload.solveTime,
+            jti: newAccessJti,
+        };
+        // Carry over claims: prefer explicit options, fall back to stored KV values
+        const effectiveAud = options?.aud || storedAud;
+        const effectiveClientIp = options?.clientIp || storedClientIp;
+        const effectiveAppId = options?.app_id || storedAppId || payload.app_id;
+        if (effectiveAud) {
+            accessTokenPayload.aud = effectiveAud;
+        }
+        if (effectiveClientIp) {
+            accessTokenPayload.client_ip = effectiveClientIp;
+        }
+        if (effectiveAppId) {
+            accessTokenPayload.app_id = effectiveAppId;
+        }
+        const accessToken = await new SignJWT(accessTokenPayload)
+            .setProtectedHeader({ alg: 'HS256' })
+            .setSubject(payload.sub || '')
+            .setIssuedAt()
+            .setExpirationTime('5m') // 5 minutes
+            .sign(secretKey);
+        return {
+            success: true,
+            tokens: {
+                access_token: accessToken,
+                expires_in: 300, // 5 minutes in seconds
+            },
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'Invalid refresh token',
+        };
+    }
+}
+/**
+ * Verify a JWT token with security checks
+ *
+ * Checks:
+ * - Token signature and expiry
+ * - Revocation status (via JTI)
+ * - Audience claim (if provided)
+ * - Client IP binding (if provided)
  */
-export async function verifyToken(token, secret) {
+export async function verifyToken(token, secret, env, options) {
     try {
         const encoder = new TextEncoder();
         const secretKey = encoder.encode(secret);
         const { payload } = await jwtVerify(token, secretKey, {
             algorithms: ['HS256'],
         });
+        // Check token type (must be access token, not refresh token)
+        if (payload.type !== 'botcha-verified') {
+            return {
+                valid: false,
+                error: 'Invalid token type',
+            };
+        }
+        const jti = payload.jti;
+        // Check revocation status (fail-open if KV unavailable)
+        if (jti && env?.CHALLENGES) {
+            try {
+                const revoked = await env.CHALLENGES.get(`revoked:${jti}`);
+                if (revoked) {
+                    return {
+                        valid: false,
+                        error: 'Token has been revoked',
+                    };
+                }
+            }
+            catch (error) {
+                // Fail-open: if KV check fails, allow token to proceed
+                console.error('Failed to check revocation status:', error);
+            }
+        }
+        // Validate audience claim (if required)
+        if (options?.requiredAud) {
+            const tokenAud = payload.aud;
+            if (!tokenAud || tokenAud !== options.requiredAud) {
+                return {
+                    valid: false,
+                    error: 'Invalid audience claim',
+                };
+            }
+        }
+        // Validate client IP binding (if required)
+        if (options?.clientIp) {
+            const tokenIp = payload.client_ip;
+            if (!tokenIp || tokenIp !== options.clientIp) {
+                return {
+                    valid: false,
+                    error: 'Client IP mismatch',
+                };
+            }
+        }
         return {
             valid: true,
             payload: {
                 sub: payload.sub || '',
                 iat: payload.iat || 0,
                 exp: payload.exp || 0,
+                jti: jti || '',
                 type: payload.type,
                 solveTime: payload.solveTime,
+                aud: payload.aud,
+                client_ip: payload.client_ip,
+                app_id: payload.app_id,
             },
         };
     }

package/dist/challenges.d.ts

@@ -20,6 +20,10 @@ export interface SpeedChallenge {
     expectedAnswers: string[];
     issuedAt: number;
     expiresAt: number;
+    baseTimeLimit: number;
+    adjustedTimeLimit: number;
+    rttMs?: number;
+    app_id?: string;
 }
 export interface StandardChallenge {
     id: string;
@@ -27,6 +31,7 @@ export interface StandardChallenge {
     expectedAnswer: string;
     expiresAt: number;
     difficulty: 'easy' | 'medium' | 'hard';
+    app_id?: string;
 }
 export interface ReasoningQuestion {
     id: string;
@@ -44,6 +49,7 @@ export interface ReasoningChallenge {
     expectedAnswers: Record<string, string[]>;
     issuedAt: number;
     expiresAt: number;
+    app_id?: string;
 }
 export interface ChallengeResult {
     valid: boolean;
@@ -51,6 +57,7 @@ export interface ChallengeResult {
     solveTimeMs?: number;
     correctCount?: number;
     totalCount?: number;
+    app_id?: string;
 }
 export interface HybridChallenge {
     id: string;
@@ -58,12 +65,13 @@ export interface HybridChallenge {
     reasoningChallengeId: string;
     issuedAt: number;
     expiresAt: number;
+    app_id?: string;
 }
 /**
- * Generate a speed challenge: 5 SHA256 problems, 500ms to solve ALL
+ * Generate a speed challenge: 5 SHA256 problems, RTT-aware timeout
  * Trivial for AI, impossible for humans to copy-paste fast enough
  */
-export declare function generateSpeedChallenge(kv?: KVNamespace): Promise<{
+export declare function generateSpeedChallenge(kv?: KVNamespace, clientTimestamp?: number, app_id?: string): Promise<{
     id: string;
     problems: {
         num: number;
@@ -71,15 +79,26 @@ export declare function generateSpeedChallenge(kv?: KVNamespace): Promise<{
     }[];
     timeLimit: number;
     instructions: string;
+    rttInfo?: {
+        measuredRtt: number;
+        adjustedTimeout: number;
+        explanation: string;
+    };
 }>;
 /**
- * Verify a speed challenge response
+ * Verify a speed challenge response with RTT-aware timeout
  */
-export declare function verifySpeedChallenge(id: string, answers: string[], kv?: KVNamespace): Promise<ChallengeResult>;
+export declare function verifySpeedChallenge(id: string, answers: string[], kv?: KVNamespace): Promise<ChallengeResult & {
+    rttInfo?: {
+        measuredRtt: number;
+        adjustedTimeout: number;
+        actualTime: number;
+    };
+}>;
 /**
  * Generate a standard challenge: compute SHA256 of concatenated primes
  */
-export declare function generateStandardChallenge(difficulty?: 'easy' | 'medium' | 'hard', kv?: KVNamespace): Promise<{
+export declare function generateStandardChallenge(difficulty?: 'easy' | 'medium' | 'hard', kv?: KVNamespace, app_id?: string): Promise<{
     id: string;
     puzzle: string;
     timeLimit: number;
@@ -111,7 +130,7 @@ export declare function solveSpeedChallenge(problems: number[]): Promise<string[
 /**
  * Generate a reasoning challenge: 3 random questions requiring LLM capabilities
  */
-export declare function generateReasoningChallenge(kv?: KVNamespace): Promise<{
+export declare function generateReasoningChallenge(kv?: KVNamespace, app_id?: string): Promise<{
     id: string;
     questions: {
         id: string;
@@ -128,7 +147,7 @@ export declare function verifyReasoningChallenge(id: string, answers: Record<str
 /**
  * Generate a hybrid challenge: speed + reasoning combined
  */
-export declare function generateHybridChallenge(kv?: KVNamespace): Promise<{
+export declare function generateHybridChallenge(kv?: KVNamespace, clientTimestamp?: number, app_id?: string): Promise<{
     id: string;
     speed: {
         problems: {
@@ -146,6 +165,11 @@ export declare function generateHybridChallenge(kv?: KVNamespace): Promise<{
         timeLimit: number;
     };
     instructions: string;
+    rttInfo?: {
+        measuredRtt: number;
+        adjustedTimeout: number;
+        explanation: string;
+    };
 }>;
 /**
  * Verify a hybrid challenge response

package/dist/challenges.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"challenges.d.ts","sourceRoot":"","sources":["../src/challenges.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,GAAG,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAGF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,cAAc,CAAC;IAC9E,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AA4ED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA+BD;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EAAE,EACjB,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC,eAAe,CAAC,CA4B1B;AASD;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,GAAE,MAAM,GAAG,QAAQ,GAAG,MAAiB,EACjD,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CA4BD;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAKD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAuCD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa5F;AAGD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE/E;AA8ID;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAwDD;AA6BD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC,eAAe,CAAC,CAqE1B;AAKD;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QACL,QAAQ,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,SAAS,EAAE;QACT,SAAS,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAoCD;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,EAAE,EACtB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACxC,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,SAAS,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC,CAyED"}
+{"version":3,"file":"challenges.d.ts","sourceRoot":"","sources":["../src/challenges.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,GAAG,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAGF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,cAAc,CAAC;IAC9E,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA4ED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,CAAC,EAAE,WAAW,EAChB,eAAe,CAAC,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC,CAoED;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EAAE,EACjB,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC,eAAe,GAAG;IAC3B,OAAO,CAAC,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAA;CACF,CAAC,CAmDD;AASD;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,GAAE,MAAM,GAAG,QAAQ,GAAG,MAAiB,EACjD,EAAE,CAAC,EAAE,WAAW,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAgCD;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAKD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAyCD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa5F;AAGD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE/E;AA0fD;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3F,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA0DD;AA6BD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC,eAAe,CAAC,CAqE1B;AAKD;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,CAAC,EAAE,WAAW,EAChB,eAAe,CAAC,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QACL,QAAQ,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,SAAS,EAAE;QACT,SAAS,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC,CA0CD;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,EAAE,EACtB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACxC,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,SAAS,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC,CAyED"}