@effect-auth/core 0.1.0-alpha.2 → 0.1.0-alpha.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +148 -13
- package/dist/ApiKey.d.ts +207 -0
- package/dist/ApiKey.d.ts.map +1 -0
- package/dist/ApiKey.js +275 -0
- package/dist/ApiKey.js.map +1 -0
- package/dist/AuditLog.d.ts +204 -1
- package/dist/AuditLog.d.ts.map +1 -1
- package/dist/AuditLog.js +170 -0
- package/dist/AuditLog.js.map +1 -1
- package/dist/AuthConfig.d.ts +0 -9
- package/dist/AuthConfig.d.ts.map +1 -1
- package/dist/AuthConfig.js +1 -14
- package/dist/AuthConfig.js.map +1 -1
- package/dist/AuthFlow.d.ts +220 -51
- package/dist/AuthFlow.d.ts.map +1 -1
- package/dist/AuthFlow.js +550 -22
- package/dist/AuthFlow.js.map +1 -1
- package/dist/AuthKernel.d.ts +1 -1
- package/dist/Challenge.d.ts +5 -1
- package/dist/Challenge.d.ts.map +1 -1
- package/dist/Challenge.js +58 -48
- package/dist/Challenge.js.map +1 -1
- package/dist/Client.d.ts +242 -1
- package/dist/Client.d.ts.map +1 -1
- package/dist/Client.js +489 -1
- package/dist/Client.js.map +1 -1
- package/dist/D1Kysely.d.ts +1 -1
- package/dist/D1Kysely.d.ts.map +1 -1
- package/dist/EffectQbSqliteStorage.d.ts +156 -41
- package/dist/EffectQbSqliteStorage.d.ts.map +1 -1
- package/dist/EffectQbSqliteStorage.js +336 -33
- package/dist/EffectQbSqliteStorage.js.map +1 -1
- package/dist/EmailOtp.d.ts +5 -2
- package/dist/EmailOtp.d.ts.map +1 -1
- package/dist/EmailOtp.js +11 -4
- package/dist/EmailOtp.js.map +1 -1
- package/dist/EmailVerification.d.ts +2 -2
- package/dist/EmailVerification.d.ts.map +1 -1
- package/dist/EmailVerification.js +2 -3
- package/dist/EmailVerification.js.map +1 -1
- package/dist/HttpApi/Api.d.ts +1161 -19
- package/dist/HttpApi/Api.d.ts.map +1 -1
- package/dist/HttpApi/Api.js +1433 -20
- package/dist/HttpApi/Api.js.map +1 -1
- package/dist/HttpApi/Endpoints.d.ts +611 -0
- package/dist/HttpApi/Endpoints.d.ts.map +1 -1
- package/dist/HttpApi/Endpoints.js +242 -1
- package/dist/HttpApi/Endpoints.js.map +1 -1
- package/dist/HttpApi/Schemas.d.ts +704 -0
- package/dist/HttpApi/Schemas.d.ts.map +1 -1
- package/dist/HttpApi/Schemas.js +435 -1
- package/dist/HttpApi/Schemas.js.map +1 -1
- package/dist/HttpApi/Security.d.ts +13 -1
- package/dist/HttpApi/Security.d.ts.map +1 -1
- package/dist/HttpApi/Security.js +107 -16
- package/dist/HttpApi/Security.js.map +1 -1
- package/dist/HttpApi/Transport.d.ts +36 -2
- package/dist/HttpApi/Transport.d.ts.map +1 -1
- package/dist/HttpApi/Transport.js +151 -9
- package/dist/HttpApi/Transport.js.map +1 -1
- package/dist/Jwt.d.ts +271 -0
- package/dist/Jwt.d.ts.map +1 -0
- package/dist/Jwt.js +512 -0
- package/dist/Jwt.js.map +1 -0
- package/dist/KyselyStorage.d.ts +134 -1
- package/dist/KyselyStorage.d.ts.map +1 -1
- package/dist/KyselyStorage.js +918 -4
- package/dist/KyselyStorage.js.map +1 -1
- package/dist/LoginApproval.d.ts +314 -0
- package/dist/LoginApproval.d.ts.map +1 -0
- package/dist/LoginApproval.js +551 -0
- package/dist/LoginApproval.js.map +1 -0
- package/dist/LoginNotification.d.ts +183 -0
- package/dist/LoginNotification.d.ts.map +1 -0
- package/dist/LoginNotification.js +329 -0
- package/dist/LoginNotification.js.map +1 -0
- package/dist/LoginRisk.d.ts +73 -0
- package/dist/LoginRisk.d.ts.map +1 -0
- package/dist/LoginRisk.js +57 -0
- package/dist/LoginRisk.js.map +1 -0
- package/dist/MagicLink.d.ts +85 -0
- package/dist/MagicLink.d.ts.map +1 -0
- package/dist/MagicLink.js +206 -0
- package/dist/MagicLink.js.map +1 -0
- package/dist/Mailer.d.ts +33 -2
- package/dist/Mailer.d.ts.map +1 -1
- package/dist/Mailer.js +107 -0
- package/dist/Mailer.js.map +1 -1
- package/dist/Passkey.d.ts +334 -0
- package/dist/Passkey.d.ts.map +1 -0
- package/dist/Passkey.js +422 -0
- package/dist/Passkey.js.map +1 -0
- package/dist/Password.d.ts +138 -8
- package/dist/Password.d.ts.map +1 -1
- package/dist/Password.js +397 -8
- package/dist/Password.js.map +1 -1
- package/dist/RecoveryCode.d.ts +169 -0
- package/dist/RecoveryCode.d.ts.map +1 -0
- package/dist/RecoveryCode.js +299 -0
- package/dist/RecoveryCode.js.map +1 -0
- package/dist/RefreshToken.d.ts +222 -0
- package/dist/RefreshToken.d.ts.map +1 -0
- package/dist/RefreshToken.js +342 -0
- package/dist/RefreshToken.js.map +1 -0
- package/dist/Sessions.d.ts +52 -2
- package/dist/Sessions.d.ts.map +1 -1
- package/dist/Sessions.js +123 -1
- package/dist/Sessions.js.map +1 -1
- package/dist/StepUp.d.ts +44 -0
- package/dist/StepUp.d.ts.map +1 -0
- package/dist/StepUp.js +82 -0
- package/dist/StepUp.js.map +1 -0
- package/dist/Storage.d.ts +14 -1
- package/dist/Storage.d.ts.map +1 -1
- package/dist/Storage.js.map +1 -1
- package/dist/StorageMigrations.d.ts +9 -1
- package/dist/StorageMigrations.d.ts.map +1 -1
- package/dist/StorageMigrations.js +159 -0
- package/dist/StorageMigrations.js.map +1 -1
- package/dist/Testing.d.ts +1 -1
- package/dist/Totp.d.ts +220 -0
- package/dist/Totp.d.ts.map +1 -0
- package/dist/Totp.js +477 -0
- package/dist/Totp.js.map +1 -0
- package/dist/TrustedDevice.d.ts +115 -0
- package/dist/TrustedDevice.d.ts.map +1 -0
- package/dist/TrustedDevice.js +222 -0
- package/dist/TrustedDevice.js.map +1 -0
- package/dist/alchemy/cloudflare/Email.d.ts +25 -0
- package/dist/alchemy/cloudflare/Email.d.ts.map +1 -0
- package/dist/alchemy/cloudflare/Email.js +117 -0
- package/dist/alchemy/cloudflare/Email.js.map +1 -0
- package/dist/cloudflare/Email.d.ts +25 -0
- package/dist/cloudflare/Email.d.ts.map +1 -0
- package/dist/cloudflare/Email.js +153 -0
- package/dist/cloudflare/Email.js.map +1 -0
- package/dist/index.d.ts +12 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +12 -0
- package/dist/index.js.map +1 -1
- package/migrations/0003_auth_login_approval_review.sql +22 -0
- package/migrations/0004_auth_trusted_device.sql +12 -0
- package/migrations/0005_auth_passkey.sql +17 -0
- package/migrations/0006_auth_totp_factor.sql +17 -0
- package/migrations/0007_auth_recovery_code.sql +13 -0
- package/migrations/0008_auth_api_key.sql +17 -0
- package/migrations/0009_auth_refresh_token.sql +21 -0
- package/migrations/0010_auth_jwt_revocation.sql +8 -0
- package/package.json +57 -1
|
@@ -0,0 +1,551 @@
|
|
|
1
|
+
import { Context, Data, Duration, Effect, Layer, Option } from "effect";
|
|
2
|
+
import { Challenge } from "./Challenge.js";
|
|
3
|
+
import { UserId as makeUserId } from "./Identifiers.js";
|
|
4
|
+
import { currentUnixMillis } from "./Internal.js";
|
|
5
|
+
import { LoginRiskContext, LoginRiskSignal } from "./LoginRisk.js";
|
|
6
|
+
import { AuthMailer } from "./Mailer.js";
|
|
7
|
+
export const unknownLoginDeviceContext = {
|
|
8
|
+
status: "unknown",
|
|
9
|
+
};
|
|
10
|
+
export class LoginApprovalPolicy extends Context.Service()("auth/LoginApprovalPolicy") {
|
|
11
|
+
}
|
|
12
|
+
(function (LoginApprovalPolicy) {
|
|
13
|
+
LoginApprovalPolicy.make = (service) => LoginApprovalPolicy.of(service);
|
|
14
|
+
LoginApprovalPolicy.custom = (decide) => LoginApprovalPolicy.of({ decide });
|
|
15
|
+
})(LoginApprovalPolicy || (LoginApprovalPolicy = {}));
|
|
16
|
+
const aalRank = {
|
|
17
|
+
aal1: 1,
|
|
18
|
+
aal2: 2,
|
|
19
|
+
aal3: 3,
|
|
20
|
+
};
|
|
21
|
+
const aalAtLeast = (actual, minimum) => aalRank[actual] >= aalRank[minimum];
|
|
22
|
+
const continueDecision = { _tag: "Continue" };
|
|
23
|
+
const sessionBindingFromSameDeviceRequired = (sameDeviceRequired) => sameDeviceRequired ? "originating-device" : "approval-device";
|
|
24
|
+
const sameDeviceRequiredFromSessionBinding = (sessionBinding) => sessionBinding !== "approval-device";
|
|
25
|
+
const resolveSessionBinding = (input) => input.sessionBinding ??
|
|
26
|
+
sessionBindingFromSameDeviceRequired(input.sameDeviceRequired ?? true);
|
|
27
|
+
const isLoginApprovalSessionBinding = (value) => value === "originating-device" ||
|
|
28
|
+
value === "approval-device" ||
|
|
29
|
+
value === "none";
|
|
30
|
+
const metadataString = (metadata, key) => {
|
|
31
|
+
const value = metadata?.[key];
|
|
32
|
+
return typeof value === "string" && value.length > 0 ? value : undefined;
|
|
33
|
+
};
|
|
34
|
+
const metadataSessionBinding = (metadata, key) => {
|
|
35
|
+
const value = metadataString(metadata, key);
|
|
36
|
+
return isLoginApprovalSessionBinding(value) ? value : undefined;
|
|
37
|
+
};
|
|
38
|
+
const approvalDecision = (input) => {
|
|
39
|
+
const sessionBinding = resolveSessionBinding(input);
|
|
40
|
+
return {
|
|
41
|
+
_tag: "RequiresApproval",
|
|
42
|
+
channel: input.channel,
|
|
43
|
+
sessionBinding,
|
|
44
|
+
sameDeviceRequired: sameDeviceRequiredFromSessionBinding(sessionBinding),
|
|
45
|
+
reason: input.reason,
|
|
46
|
+
...(input.markEmailVerified === true ? { markEmailVerified: true } : {}),
|
|
47
|
+
};
|
|
48
|
+
};
|
|
49
|
+
const emailApprovalDecision = (reason, input = {}) => approvalDecision({
|
|
50
|
+
channel: "email",
|
|
51
|
+
reason: input.reason ?? reason,
|
|
52
|
+
sessionBinding: input.sessionBinding ?? "originating-device",
|
|
53
|
+
...(input.markEmailVerified === true ? { markEmailVerified: true } : {}),
|
|
54
|
+
});
|
|
55
|
+
export const LoginApprovalDecision = {
|
|
56
|
+
continue: () => continueDecision,
|
|
57
|
+
requiresApproval: (input) => approvalDecision(input),
|
|
58
|
+
custom: (input) => approvalDecision(input),
|
|
59
|
+
emailCode: (input) => emailApprovalDecision("email-code", input),
|
|
60
|
+
emailLink: (input) => emailApprovalDecision("email-link", input),
|
|
61
|
+
sms: (input = {}) => approvalDecision({
|
|
62
|
+
channel: "sms",
|
|
63
|
+
reason: input.reason ?? "sms",
|
|
64
|
+
sessionBinding: input.sessionBinding ?? "originating-device",
|
|
65
|
+
...(input.markEmailVerified === true ? { markEmailVerified: true } : {}),
|
|
66
|
+
}),
|
|
67
|
+
adminReview: (input = {}) => approvalDecision({
|
|
68
|
+
channel: "admin",
|
|
69
|
+
reason: input.reason ?? "manual-review",
|
|
70
|
+
sessionBinding: input.sessionBinding ?? "none",
|
|
71
|
+
...(input.markEmailVerified === true ? { markEmailVerified: true } : {}),
|
|
72
|
+
}),
|
|
73
|
+
};
|
|
74
|
+
const requiresApproval = (options, reason, markEmailVerified = false) => ({
|
|
75
|
+
...LoginApprovalDecision.requiresApproval({
|
|
76
|
+
channel: options.channel,
|
|
77
|
+
sessionBinding: options.sessionBinding,
|
|
78
|
+
sameDeviceRequired: options.sameDeviceRequired,
|
|
79
|
+
reason,
|
|
80
|
+
markEmailVerified,
|
|
81
|
+
}),
|
|
82
|
+
});
|
|
83
|
+
export const makeLoginApprovalPolicy = (options = {}) => {
|
|
84
|
+
const sessionBinding = options.sessionBinding ??
|
|
85
|
+
sessionBindingFromSameDeviceRequired(options.sameDeviceRequired ?? true);
|
|
86
|
+
const resolved = {
|
|
87
|
+
mode: options.mode ?? "never",
|
|
88
|
+
channel: options.channel ?? "email",
|
|
89
|
+
sessionBinding,
|
|
90
|
+
sameDeviceRequired: sameDeviceRequiredFromSessionBinding(sessionBinding),
|
|
91
|
+
requireForUnverifiedEmail: options.requireForUnverifiedEmail ?? false,
|
|
92
|
+
skipMethods: options.skipMethods ?? [],
|
|
93
|
+
skipWhenAalAtLeast: options.skipWhenAalAtLeast,
|
|
94
|
+
};
|
|
95
|
+
return LoginApprovalPolicy.make({
|
|
96
|
+
decide: Effect.fn("auth.login_approval_policy.decide")(function* (input) {
|
|
97
|
+
if (resolved.skipMethods.includes(input.method)) {
|
|
98
|
+
return continueDecision;
|
|
99
|
+
}
|
|
100
|
+
if (resolved.skipWhenAalAtLeast !== undefined &&
|
|
101
|
+
aalAtLeast(input.aal, resolved.skipWhenAalAtLeast)) {
|
|
102
|
+
return continueDecision;
|
|
103
|
+
}
|
|
104
|
+
if (resolved.requireForUnverifiedEmail && input.emailVerified === false) {
|
|
105
|
+
return requiresApproval(resolved, "unverified-email", true);
|
|
106
|
+
}
|
|
107
|
+
if (resolved.mode === "always") {
|
|
108
|
+
return requiresApproval(resolved, "always");
|
|
109
|
+
}
|
|
110
|
+
if (resolved.mode === "new-device") {
|
|
111
|
+
const { status } = input.device;
|
|
112
|
+
if (status === "known") {
|
|
113
|
+
return continueDecision;
|
|
114
|
+
}
|
|
115
|
+
return requiresApproval(resolved, status === "new" ? "new-device" : "unknown-device");
|
|
116
|
+
}
|
|
117
|
+
return continueDecision;
|
|
118
|
+
}),
|
|
119
|
+
});
|
|
120
|
+
};
|
|
121
|
+
export const LoginApprovalPolicyLive = (options) => Layer.succeed(LoginApprovalPolicy)(makeLoginApprovalPolicy(options));
|
|
122
|
+
export class LoginApprovalIssueError extends Data.TaggedError("LoginApprovalIssueError") {
|
|
123
|
+
}
|
|
124
|
+
export class LoginApprovalVerifyError extends Data.TaggedError("LoginApprovalVerifyError") {
|
|
125
|
+
}
|
|
126
|
+
export class LoginApprovalDeliveryError extends Data.TaggedError("LoginApprovalDeliveryError") {
|
|
127
|
+
}
|
|
128
|
+
export class LoginApprovalDelivery extends Context.Service()("auth/LoginApprovalDelivery") {
|
|
129
|
+
}
|
|
130
|
+
(function (LoginApprovalDelivery) {
|
|
131
|
+
LoginApprovalDelivery.make = (service) => LoginApprovalDelivery.of(service);
|
|
132
|
+
})(LoginApprovalDelivery || (LoginApprovalDelivery = {}));
|
|
133
|
+
export class LoginApproval extends Context.Service()("auth/LoginApproval") {
|
|
134
|
+
}
|
|
135
|
+
(function (LoginApproval) {
|
|
136
|
+
LoginApproval.make = (service) => LoginApproval.of(service);
|
|
137
|
+
})(LoginApproval || (LoginApproval = {}));
|
|
138
|
+
export class LoginApprovalReviewError extends Data.TaggedError("LoginApprovalReviewError") {
|
|
139
|
+
}
|
|
140
|
+
export class LoginApprovalReviewStore extends Context.Service()("auth/LoginApprovalReviewStore") {
|
|
141
|
+
}
|
|
142
|
+
(function (LoginApprovalReviewStore) {
|
|
143
|
+
LoginApprovalReviewStore.make = (service) => LoginApprovalReviewStore.of(service);
|
|
144
|
+
})(LoginApprovalReviewStore || (LoginApprovalReviewStore = {}));
|
|
145
|
+
export class LoginApprovalReview extends Context.Service()("auth/LoginApprovalReview") {
|
|
146
|
+
}
|
|
147
|
+
(function (LoginApprovalReview) {
|
|
148
|
+
LoginApprovalReview.make = (service) => LoginApprovalReview.of(service);
|
|
149
|
+
})(LoginApprovalReview || (LoginApprovalReview = {}));
|
|
150
|
+
export class LoginApprovalFlowStartError extends Data.TaggedError("LoginApprovalFlowStartError") {
|
|
151
|
+
}
|
|
152
|
+
export class LoginApprovalFlow extends Context.Service()("auth/LoginApprovalFlow") {
|
|
153
|
+
}
|
|
154
|
+
(function (LoginApprovalFlow) {
|
|
155
|
+
LoginApprovalFlow.make = (service) => LoginApprovalFlow.of(service);
|
|
156
|
+
})(LoginApprovalFlow || (LoginApprovalFlow = {}));
|
|
157
|
+
export const defaultLoginApprovalTtl = Duration.minutes(10);
|
|
158
|
+
const metadataBoolean = (metadata, key) => {
|
|
159
|
+
const value = metadata?.[key];
|
|
160
|
+
return typeof value === "boolean" ? value : undefined;
|
|
161
|
+
};
|
|
162
|
+
const loginApprovalMetadata = (input, channel, sessionBinding, sameDeviceRequired) => ({
|
|
163
|
+
...input.metadata,
|
|
164
|
+
channel,
|
|
165
|
+
reason: input.reason,
|
|
166
|
+
sessionBinding,
|
|
167
|
+
sameDeviceRequired,
|
|
168
|
+
markEmailVerified: input.markEmailVerified ?? false,
|
|
169
|
+
});
|
|
170
|
+
const verifiedLoginApprovalMetadata = (metadata) => {
|
|
171
|
+
if (metadata === undefined) {
|
|
172
|
+
return undefined;
|
|
173
|
+
}
|
|
174
|
+
const { channel: _channel, reason: _reason, sessionBinding: _sessionBinding, sameDeviceRequired: _sameDeviceRequired, markEmailVerified: _markEmailVerified, ...rest } = metadata;
|
|
175
|
+
return rest;
|
|
176
|
+
};
|
|
177
|
+
const parseLoginApprovalChallenge = (challenge) => Effect.gen(function* () {
|
|
178
|
+
const channel = metadataString(challenge.metadata, "channel");
|
|
179
|
+
const reason = metadataString(challenge.metadata, "reason");
|
|
180
|
+
const sameDeviceRequired = metadataBoolean(challenge.metadata, "sameDeviceRequired");
|
|
181
|
+
const sessionBinding = metadataSessionBinding(challenge.metadata, "sessionBinding") ??
|
|
182
|
+
(sameDeviceRequired === undefined
|
|
183
|
+
? undefined
|
|
184
|
+
: sessionBindingFromSameDeviceRequired(sameDeviceRequired));
|
|
185
|
+
if (channel === undefined) {
|
|
186
|
+
return yield* new LoginApprovalVerifyError({
|
|
187
|
+
message: "Login approval challenge is missing channel metadata",
|
|
188
|
+
});
|
|
189
|
+
}
|
|
190
|
+
if (reason === undefined) {
|
|
191
|
+
return yield* new LoginApprovalVerifyError({
|
|
192
|
+
message: "Login approval challenge is missing reason metadata",
|
|
193
|
+
});
|
|
194
|
+
}
|
|
195
|
+
if (sameDeviceRequired === undefined) {
|
|
196
|
+
return yield* new LoginApprovalVerifyError({
|
|
197
|
+
message: "Login approval challenge is missing same-device metadata",
|
|
198
|
+
});
|
|
199
|
+
}
|
|
200
|
+
if (sessionBinding === undefined) {
|
|
201
|
+
return yield* new LoginApprovalVerifyError({
|
|
202
|
+
message: "Login approval challenge has invalid session binding",
|
|
203
|
+
});
|
|
204
|
+
}
|
|
205
|
+
return {
|
|
206
|
+
challengeId: challenge.id,
|
|
207
|
+
userId: makeUserId(challenge.subject),
|
|
208
|
+
channel,
|
|
209
|
+
reason,
|
|
210
|
+
sessionBinding,
|
|
211
|
+
sameDeviceRequired,
|
|
212
|
+
...(metadataBoolean(challenge.metadata, "markEmailVerified") === true
|
|
213
|
+
? { markEmailVerified: true }
|
|
214
|
+
: {}),
|
|
215
|
+
metadata: verifiedLoginApprovalMetadata(challenge.metadata),
|
|
216
|
+
};
|
|
217
|
+
});
|
|
218
|
+
export const makeLoginApproval = (dependencies) => {
|
|
219
|
+
const ttl = dependencies.ttl ?? defaultLoginApprovalTtl;
|
|
220
|
+
return LoginApproval.make({
|
|
221
|
+
issue: Effect.fn("auth.login_approval.issue")(function* (input) {
|
|
222
|
+
yield* Effect.annotateCurrentSpan("auth.login_approval.operation", "issue");
|
|
223
|
+
const channel = input.channel ?? "email";
|
|
224
|
+
const sessionBinding = resolveSessionBinding(input);
|
|
225
|
+
const sameDeviceRequired = sameDeviceRequiredFromSessionBinding(sessionBinding);
|
|
226
|
+
const issued = yield* dependencies.challenge
|
|
227
|
+
.issue({
|
|
228
|
+
type: "login-approval",
|
|
229
|
+
subject: input.userId,
|
|
230
|
+
ttl: input.ttl ?? ttl,
|
|
231
|
+
secret: input.secret,
|
|
232
|
+
metadata: loginApprovalMetadata(input, channel, sessionBinding, sameDeviceRequired),
|
|
233
|
+
})
|
|
234
|
+
.pipe(Effect.mapError((cause) => new LoginApprovalIssueError({
|
|
235
|
+
message: "Failed to issue login approval challenge",
|
|
236
|
+
cause,
|
|
237
|
+
})));
|
|
238
|
+
return {
|
|
239
|
+
challengeId: issued.id,
|
|
240
|
+
userId: input.userId,
|
|
241
|
+
...(input.email === undefined ? {} : { email: input.email }),
|
|
242
|
+
channel,
|
|
243
|
+
reason: input.reason,
|
|
244
|
+
sessionBinding,
|
|
245
|
+
sameDeviceRequired,
|
|
246
|
+
...(input.markEmailVerified === true
|
|
247
|
+
? { markEmailVerified: true }
|
|
248
|
+
: {}),
|
|
249
|
+
...(input.risk === undefined ? {} : { risk: input.risk }),
|
|
250
|
+
secret: issued.secret,
|
|
251
|
+
expiresAt: issued.expiresAt,
|
|
252
|
+
};
|
|
253
|
+
}),
|
|
254
|
+
inspect: Effect.fn("auth.login_approval.inspect")(function* (input) {
|
|
255
|
+
yield* Effect.annotateCurrentSpan("auth.login_approval.operation", "inspect");
|
|
256
|
+
const inspected = yield* dependencies.challenge
|
|
257
|
+
.inspect({
|
|
258
|
+
challengeId: input.challengeId,
|
|
259
|
+
type: "login-approval",
|
|
260
|
+
secret: input.secret,
|
|
261
|
+
})
|
|
262
|
+
.pipe(Effect.mapError((cause) => new LoginApprovalVerifyError({
|
|
263
|
+
message: "Invalid login approval challenge",
|
|
264
|
+
cause,
|
|
265
|
+
})));
|
|
266
|
+
const approval = yield* parseLoginApprovalChallenge(inspected);
|
|
267
|
+
return {
|
|
268
|
+
...approval,
|
|
269
|
+
expiresAt: inspected.expiresAt,
|
|
270
|
+
};
|
|
271
|
+
}),
|
|
272
|
+
verify: Effect.fn("auth.login_approval.verify")(function* (input) {
|
|
273
|
+
yield* Effect.annotateCurrentSpan("auth.login_approval.operation", "verify");
|
|
274
|
+
const verified = yield* dependencies.challenge
|
|
275
|
+
.verify({
|
|
276
|
+
challengeId: input.challengeId,
|
|
277
|
+
type: "login-approval",
|
|
278
|
+
secret: input.secret,
|
|
279
|
+
})
|
|
280
|
+
.pipe(Effect.mapError((cause) => new LoginApprovalVerifyError({
|
|
281
|
+
message: "Invalid login approval challenge",
|
|
282
|
+
cause,
|
|
283
|
+
})));
|
|
284
|
+
return yield* parseLoginApprovalChallenge(verified);
|
|
285
|
+
}),
|
|
286
|
+
});
|
|
287
|
+
};
|
|
288
|
+
export const LoginApprovalLive = (options) => Layer.effect(LoginApproval)(Effect.gen(function* () {
|
|
289
|
+
const challenge = yield* Challenge;
|
|
290
|
+
return makeLoginApproval({
|
|
291
|
+
...options,
|
|
292
|
+
challenge,
|
|
293
|
+
});
|
|
294
|
+
}));
|
|
295
|
+
const cloneLoginRiskSignal = (signal) => LoginRiskSignal.make({
|
|
296
|
+
type: signal.type,
|
|
297
|
+
...(signal.level === undefined ? {} : { level: signal.level }),
|
|
298
|
+
...(signal.metadata === undefined
|
|
299
|
+
? {}
|
|
300
|
+
: { metadata: structuredClone(signal.metadata) }),
|
|
301
|
+
});
|
|
302
|
+
const cloneLoginRiskContext = (risk) => LoginRiskContext.make({
|
|
303
|
+
level: risk.level,
|
|
304
|
+
signals: risk.signals.map(cloneLoginRiskSignal),
|
|
305
|
+
...(risk.metadata === undefined
|
|
306
|
+
? {}
|
|
307
|
+
: { metadata: structuredClone(risk.metadata) }),
|
|
308
|
+
});
|
|
309
|
+
const cloneReviewRecord = (record) => ({
|
|
310
|
+
...structuredClone(record),
|
|
311
|
+
...(record.risk === undefined
|
|
312
|
+
? {}
|
|
313
|
+
: { risk: cloneLoginRiskContext(record.risk) }),
|
|
314
|
+
});
|
|
315
|
+
export const makeLoginApprovalReviewStoreMemory = () => {
|
|
316
|
+
const records = new Map();
|
|
317
|
+
return LoginApprovalReviewStore.make({
|
|
318
|
+
insertPending: (input) => Effect.gen(function* () {
|
|
319
|
+
if (records.has(input.approvalChallengeId)) {
|
|
320
|
+
return yield* new LoginApprovalReviewError({
|
|
321
|
+
message: "Login approval review already exists",
|
|
322
|
+
});
|
|
323
|
+
}
|
|
324
|
+
const record = cloneReviewRecord(input);
|
|
325
|
+
records.set(input.approvalChallengeId, record);
|
|
326
|
+
return cloneReviewRecord(record);
|
|
327
|
+
}),
|
|
328
|
+
findByApprovalChallengeId: (input) => Effect.sync(() => {
|
|
329
|
+
const record = records.get(input.approvalChallengeId);
|
|
330
|
+
return record === undefined
|
|
331
|
+
? Option.none()
|
|
332
|
+
: Option.some(cloneReviewRecord(record));
|
|
333
|
+
}),
|
|
334
|
+
approve: (input) => Effect.sync(() => {
|
|
335
|
+
const record = records.get(input.approvalChallengeId);
|
|
336
|
+
if (record === undefined || record.status !== "pending") {
|
|
337
|
+
return Option.none();
|
|
338
|
+
}
|
|
339
|
+
const updated = cloneReviewRecord({
|
|
340
|
+
...record,
|
|
341
|
+
status: "approved",
|
|
342
|
+
reviewedAt: input.reviewedAt,
|
|
343
|
+
...(input.reviewedBy === undefined
|
|
344
|
+
? {}
|
|
345
|
+
: { reviewedBy: input.reviewedBy }),
|
|
346
|
+
...(input.metadata === undefined
|
|
347
|
+
? {}
|
|
348
|
+
: { reviewMetadata: input.metadata }),
|
|
349
|
+
});
|
|
350
|
+
records.set(input.approvalChallengeId, updated);
|
|
351
|
+
return Option.some(cloneReviewRecord(updated));
|
|
352
|
+
}),
|
|
353
|
+
deny: (input) => Effect.sync(() => {
|
|
354
|
+
const record = records.get(input.approvalChallengeId);
|
|
355
|
+
if (record === undefined || record.status !== "pending") {
|
|
356
|
+
return Option.none();
|
|
357
|
+
}
|
|
358
|
+
const updated = cloneReviewRecord({
|
|
359
|
+
...record,
|
|
360
|
+
status: "denied",
|
|
361
|
+
reviewedAt: input.reviewedAt,
|
|
362
|
+
...(input.reviewedBy === undefined
|
|
363
|
+
? {}
|
|
364
|
+
: { reviewedBy: input.reviewedBy }),
|
|
365
|
+
...(input.reason === undefined
|
|
366
|
+
? {}
|
|
367
|
+
: { deniedReason: input.reason }),
|
|
368
|
+
...(input.metadata === undefined
|
|
369
|
+
? {}
|
|
370
|
+
: { reviewMetadata: input.metadata }),
|
|
371
|
+
});
|
|
372
|
+
records.set(input.approvalChallengeId, updated);
|
|
373
|
+
return Option.some(cloneReviewRecord(updated));
|
|
374
|
+
}),
|
|
375
|
+
});
|
|
376
|
+
};
|
|
377
|
+
export const LoginApprovalReviewStoreMemoryLive = Layer.sync(LoginApprovalReviewStore, makeLoginApprovalReviewStoreMemory);
|
|
378
|
+
const reviewRecordMatchesApproval = (record, approval) => record.approvalChallengeId === approval.challengeId &&
|
|
379
|
+
record.userId === approval.userId &&
|
|
380
|
+
record.channel === approval.channel &&
|
|
381
|
+
record.reason === approval.reason &&
|
|
382
|
+
record.sessionBinding === approval.sessionBinding;
|
|
383
|
+
const reviewRecordNotFound = () => new LoginApprovalReviewError({
|
|
384
|
+
message: "Login approval review was not found",
|
|
385
|
+
});
|
|
386
|
+
const reviewRecordNotPending = () => new LoginApprovalReviewError({
|
|
387
|
+
message: "Login approval review is not pending",
|
|
388
|
+
});
|
|
389
|
+
const reviewRecordMismatch = () => new LoginApprovalReviewError({
|
|
390
|
+
message: "Login approval review does not match approval challenge",
|
|
391
|
+
});
|
|
392
|
+
export const makeLoginApprovalReview = (dependencies) => LoginApprovalReview.make({
|
|
393
|
+
start: Effect.fn("auth.login_approval_review.start")(function* (input) {
|
|
394
|
+
const now = yield* currentUnixMillis;
|
|
395
|
+
return yield* dependencies.store.insertPending({
|
|
396
|
+
approvalChallengeId: input.approval.challengeId,
|
|
397
|
+
flowId: input.flowId,
|
|
398
|
+
userId: input.approval.userId,
|
|
399
|
+
channel: input.approval.channel,
|
|
400
|
+
reason: input.approval.reason,
|
|
401
|
+
sessionBinding: input.approval.sessionBinding,
|
|
402
|
+
sameDeviceRequired: input.approval.sameDeviceRequired,
|
|
403
|
+
status: "pending",
|
|
404
|
+
createdAt: now,
|
|
405
|
+
expiresAt: input.approval.expiresAt,
|
|
406
|
+
...(input.approval.risk === undefined
|
|
407
|
+
? {}
|
|
408
|
+
: { risk: input.approval.risk }),
|
|
409
|
+
...(input.metadata === undefined ? {} : { metadata: input.metadata }),
|
|
410
|
+
});
|
|
411
|
+
}),
|
|
412
|
+
status: (input) => dependencies.store.findByApprovalChallengeId(input),
|
|
413
|
+
approve: Effect.fn("auth.login_approval_review.approve")(function* (input) {
|
|
414
|
+
const approval = yield* dependencies.loginApproval
|
|
415
|
+
.inspect(input.approval)
|
|
416
|
+
.pipe(Effect.mapError((cause) => new LoginApprovalReviewError({
|
|
417
|
+
message: "Invalid login approval review approval",
|
|
418
|
+
cause,
|
|
419
|
+
})));
|
|
420
|
+
const existing = yield* dependencies.store.findByApprovalChallengeId({
|
|
421
|
+
approvalChallengeId: approval.challengeId,
|
|
422
|
+
});
|
|
423
|
+
if (Option.isNone(existing)) {
|
|
424
|
+
return yield* reviewRecordNotFound();
|
|
425
|
+
}
|
|
426
|
+
if (!reviewRecordMatchesApproval(existing.value, approval)) {
|
|
427
|
+
return yield* reviewRecordMismatch();
|
|
428
|
+
}
|
|
429
|
+
const reviewedAt = yield* currentUnixMillis;
|
|
430
|
+
const approved = yield* dependencies.store.approve({
|
|
431
|
+
approvalChallengeId: approval.challengeId,
|
|
432
|
+
reviewedAt,
|
|
433
|
+
...(input.reviewedBy === undefined
|
|
434
|
+
? {}
|
|
435
|
+
: { reviewedBy: input.reviewedBy }),
|
|
436
|
+
...(input.metadata === undefined ? {} : { metadata: input.metadata }),
|
|
437
|
+
});
|
|
438
|
+
if (Option.isNone(approved)) {
|
|
439
|
+
return yield* reviewRecordNotPending();
|
|
440
|
+
}
|
|
441
|
+
return approved.value;
|
|
442
|
+
}),
|
|
443
|
+
deny: Effect.fn("auth.login_approval_review.deny")(function* (input) {
|
|
444
|
+
const approval = yield* dependencies.loginApproval
|
|
445
|
+
.inspect(input.approval)
|
|
446
|
+
.pipe(Effect.mapError((cause) => new LoginApprovalReviewError({
|
|
447
|
+
message: "Invalid login approval review denial",
|
|
448
|
+
cause,
|
|
449
|
+
})));
|
|
450
|
+
const existing = yield* dependencies.store.findByApprovalChallengeId({
|
|
451
|
+
approvalChallengeId: approval.challengeId,
|
|
452
|
+
});
|
|
453
|
+
if (Option.isNone(existing)) {
|
|
454
|
+
return yield* reviewRecordNotFound();
|
|
455
|
+
}
|
|
456
|
+
if (!reviewRecordMatchesApproval(existing.value, approval)) {
|
|
457
|
+
return yield* reviewRecordMismatch();
|
|
458
|
+
}
|
|
459
|
+
const reviewedAt = yield* currentUnixMillis;
|
|
460
|
+
const denied = yield* dependencies.store.deny({
|
|
461
|
+
approvalChallengeId: approval.challengeId,
|
|
462
|
+
reviewedAt,
|
|
463
|
+
...(input.reviewedBy === undefined
|
|
464
|
+
? {}
|
|
465
|
+
: { reviewedBy: input.reviewedBy }),
|
|
466
|
+
...(input.reason === undefined ? {} : { reason: input.reason }),
|
|
467
|
+
...(input.metadata === undefined ? {} : { metadata: input.metadata }),
|
|
468
|
+
});
|
|
469
|
+
if (Option.isNone(denied)) {
|
|
470
|
+
return yield* reviewRecordNotPending();
|
|
471
|
+
}
|
|
472
|
+
return denied.value;
|
|
473
|
+
}),
|
|
474
|
+
});
|
|
475
|
+
export const LoginApprovalReviewLive = Layer.effect(LoginApprovalReview)(Effect.gen(function* () {
|
|
476
|
+
const loginApproval = yield* LoginApproval;
|
|
477
|
+
const store = yield* LoginApprovalReviewStore;
|
|
478
|
+
return makeLoginApprovalReview({ loginApproval, store });
|
|
479
|
+
}));
|
|
480
|
+
export const makeLoginApprovalFlow = (dependencies) => LoginApprovalFlow.make({
|
|
481
|
+
start: Effect.fn("auth.login_approval_flow.start")(function* (input) {
|
|
482
|
+
yield* Effect.annotateCurrentSpan("auth.login_approval_flow.operation", "start");
|
|
483
|
+
const issued = yield* dependencies.loginApproval.issue(input).pipe(Effect.mapError((cause) => new LoginApprovalFlowStartError({
|
|
484
|
+
message: "Failed to issue login approval challenge",
|
|
485
|
+
cause,
|
|
486
|
+
})));
|
|
487
|
+
yield* dependencies.delivery
|
|
488
|
+
.sendLoginApproval({
|
|
489
|
+
userId: issued.userId,
|
|
490
|
+
...(issued.email === undefined ? {} : { email: issued.email }),
|
|
491
|
+
channel: issued.channel,
|
|
492
|
+
challengeId: issued.challengeId,
|
|
493
|
+
secret: issued.secret,
|
|
494
|
+
expiresAt: issued.expiresAt,
|
|
495
|
+
reason: issued.reason,
|
|
496
|
+
sessionBinding: issued.sessionBinding,
|
|
497
|
+
sameDeviceRequired: issued.sameDeviceRequired,
|
|
498
|
+
...(issued.markEmailVerified === true
|
|
499
|
+
? { markEmailVerified: true }
|
|
500
|
+
: {}),
|
|
501
|
+
...(issued.risk === undefined ? {} : { risk: issued.risk }),
|
|
502
|
+
metadata: input.metadata,
|
|
503
|
+
})
|
|
504
|
+
.pipe(Effect.mapError((cause) => new LoginApprovalFlowStartError({
|
|
505
|
+
message: "Failed to send login approval",
|
|
506
|
+
cause,
|
|
507
|
+
})));
|
|
508
|
+
return issued;
|
|
509
|
+
}),
|
|
510
|
+
});
|
|
511
|
+
export const LoginApprovalFlowLive = Layer.effect(LoginApprovalFlow)(Effect.gen(function* () {
|
|
512
|
+
const loginApproval = yield* LoginApproval;
|
|
513
|
+
const delivery = yield* LoginApprovalDelivery;
|
|
514
|
+
return makeLoginApprovalFlow({ loginApproval, delivery });
|
|
515
|
+
}));
|
|
516
|
+
export const makeLoginApprovalDeliveryFromAuthMailer = (dependencies) => LoginApprovalDelivery.make({
|
|
517
|
+
sendLoginApproval: Effect.fn("auth.login_approval.delivery.auth_mailer")(function* (input) {
|
|
518
|
+
if (input.channel !== "email") {
|
|
519
|
+
return yield* new LoginApprovalDeliveryError({
|
|
520
|
+
message: "Email login approval delivery only supports email channel",
|
|
521
|
+
});
|
|
522
|
+
}
|
|
523
|
+
if (input.email === undefined) {
|
|
524
|
+
return yield* new LoginApprovalDeliveryError({
|
|
525
|
+
message: "Email login approval requires an email address",
|
|
526
|
+
});
|
|
527
|
+
}
|
|
528
|
+
yield* dependencies.authMailer
|
|
529
|
+
.send({
|
|
530
|
+
_tag: "LoginApproval",
|
|
531
|
+
to: input.email,
|
|
532
|
+
userId: input.userId,
|
|
533
|
+
challengeId: input.challengeId,
|
|
534
|
+
secret: input.secret,
|
|
535
|
+
expiresAt: input.expiresAt,
|
|
536
|
+
reason: input.reason,
|
|
537
|
+
sessionBinding: input.sessionBinding,
|
|
538
|
+
sameDeviceRequired: input.sameDeviceRequired,
|
|
539
|
+
metadata: input.metadata,
|
|
540
|
+
})
|
|
541
|
+
.pipe(Effect.mapError((cause) => new LoginApprovalDeliveryError({
|
|
542
|
+
message: "Failed to send login approval",
|
|
543
|
+
cause,
|
|
544
|
+
})));
|
|
545
|
+
}),
|
|
546
|
+
});
|
|
547
|
+
export const LoginApprovalDeliveryFromAuthMailerLive = Layer.effect(LoginApprovalDelivery)(Effect.gen(function* () {
|
|
548
|
+
const authMailer = yield* AuthMailer;
|
|
549
|
+
return makeLoginApprovalDeliveryFromAuthMailer({ authMailer });
|
|
550
|
+
}));
|
|
551
|
+
//# sourceMappingURL=LoginApproval.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"LoginApproval.js","sourceRoot":"","sources":["../src/LoginApproval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGxE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAS3C,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqBzC,MAAM,CAAC,MAAM,yBAAyB,GAAuB;IAC3D,MAAM,EAAE,SAAS;CAClB,CAAC;AA+DF,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,0BAA0B,CAAC;CAAG;AAElC,WAAiB,mBAAmB;IACrB,wBAAI,GAAG,CAClB,OAAmC,EACP,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAEpD,0BAAM,GAAG,CACpB,MAA4C,EAChB,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACtE,CAAC,EARgB,mBAAmB,KAAnB,mBAAmB,QAQnC;AAED,MAAM,OAAO,GAAuC;IAClD,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,MAA0B,EAC1B,OAA2B,EAClB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;AAElD,MAAM,gBAAgB,GAAgC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAE3E,MAAM,oCAAoC,GAAG,CAC3C,kBAA2B,EACE,EAAE,CAC/B,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAEhE,MAAM,oCAAoC,GAAG,CAC3C,cAA2C,EAClC,EAAE,CAAC,cAAc,KAAK,iBAAiB,CAAC;AAEnD,MAAM,qBAAqB,GAAG,CAAC,KAG9B,EAA+B,EAAE,CAChC,KAAK,CAAC,cAAc;IACpB,oCAAoC,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC,CAAC;AAEzE,MAAM,6BAA6B,GAAG,CACpC,KAAyB,EACa,EAAE,CACxC,KAAK,KAAK,oBAAoB;IAC9B,KAAK,KAAK,iBAAiB;IAC3B,KAAK,KAAK,MAAM,CAAC;AAEnB,MAAM,cAAc,GAAG,CACrB,QAAuD,EACvD,GAAW,EACS,EAAE;IACtB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAE9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,QAAuD,EACvD,GAAW,EAC8B,EAAE;IAC3C,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE5C,OAAO,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,KAAyC,EACZ,EAAE;IAC/B,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc;QACd,kBAAkB,EAAE,oCAAoC,CAAC,cAAc,CAAC;QACxE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,MAA2B,EAC3B,QAA4C,EAAE,EACjB,EAAE,CAC/B,gBAAgB,CAAC;IACf,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;IAC9B,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,oBAAoB;IAC5D,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACzE,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,GAAgC,EAAE,CAAC,gBAAgB;IAC7D,gBAAgB,EAAE,CAChB,KAAyC,EACZ,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACzD,MAAM,EAAE,CACN,KAAyC,EACZ,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACzD,SAAS,EAAE,CACT,KAA0C,EACb,EAAE,CAAC,qBAAqB,CAAC,YAAY,EAAE,KAAK,CAAC;IAC5E,SAAS,EAAE,CACT,KAA0C,EACb,EAAE,CAAC,qBAAqB,CAAC,YAAY,EAAE,KAAK,CAAC;IAC5E,GAAG,EAAE,CACH,QAA4C,EAAE,EACjB,EAAE,CAC/B,gBAAgB,CAAC;QACf,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK;QAC7B,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,oBAAoB;QAC5D,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;IACJ,WAAW,EAAE,CACX,QAA4C,EAAE,EACjB,EAAE,CAC/B,gBAAgB,CAAC;QACf,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,eAAe;QACvC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,MAAM;QAC9C,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;CACL,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,OAKC,EACD,MAA2B,EAC3B,iBAAiB,GAAG,KAAK,EACI,EAAE,CAAC,CAAC;IACjC,GAAG,qBAAqB,CAAC,gBAAgB,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,MAAM;QACN,iBAAiB;KAClB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,UAAsC,EAAE,EACZ,EAAE;IAC9B,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,oCAAoC,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;QACnC,cAAc;QACd,kBAAkB,EAAE,oCAAoC,CAAC,cAAc,CAAC;QACxE,yBAAyB,EAAE,OAAO,CAAC,yBAAyB,IAAI,KAAK;QACrE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;QACtC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC;IAEF,OAAO,mBAAmB,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK;YACrE,IAAI,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAED,IACE,QAAQ,CAAC,kBAAkB,KAAK,SAAS;gBACzC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAClD,CAAC;gBACD,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAED,IAAI,QAAQ,CAAC,yBAAyB,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;gBAEhC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;oBACvB,OAAO,gBAAgB,CAAC;gBAC1B,CAAC;gBAED,OAAO,gBAAgB,CACrB,QAAQ,EACR,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CACnD,CAAC;YACJ,CAAC;YAED,OAAO,gBAAgB,CAAC;QAC1B,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAoC,EAAE,EAAE,CAC9E,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;AAkDvE,MAAM,OAAO,uBAAwB,SAAQ,IAAI,CAAC,WAAW,CAC3D,yBAAyB,CAIzB;CAAG;AAEL,MAAM,OAAO,wBAAyB,SAAQ,IAAI,CAAC,WAAW,CAC5D,0BAA0B,CAI1B;CAAG;AAiBL,MAAM,OAAO,0BAA2B,SAAQ,IAAI,CAAC,WAAW,CAC9D,4BAA4B,CAI5B;CAAG;AAQL,MAAM,OAAO,qBAAsB,SAAQ,OAAO,CAAC,OAAO,EAGvD,CAAC,4BAA4B,CAAC;CAAG;AAEpC,WAAiB,qBAAqB;IACvB,0BAAI,GAAG,CAClB,OAAqC,EACP,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACvE,CAAC,EAJgB,qBAAqB,KAArB,qBAAqB,QAIrC;AAcD,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAG/C,CAAC,oBAAoB,CAAC;CAAG;AAE5B,WAAiB,aAAa;IACf,kBAAI,GAAG,CAAC,OAA6B,EAAwB,EAAE,CAC1E,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC,EAHgB,aAAa,KAAb,aAAa,QAG7B;AAgDD,MAAM,OAAO,wBAAyB,SAAQ,IAAI,CAAC,WAAW,CAC5D,0BAA0B,CAI1B;CAAG;AAiCL,MAAM,OAAO,wBAAyB,SAAQ,OAAO,CAAC,OAAO,EAG1D,CAAC,+BAA+B,CAAC;CAAG;AAEvC,WAAiB,wBAAwB;IAC1B,6BAAI,GAAG,CAClB,OAAwC,EACP,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC7E,CAAC,EAJgB,wBAAwB,KAAxB,wBAAwB,QAIxC;AAoBD,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,0BAA0B,CAAC;CAAG;AAElC,WAAiB,mBAAmB;IACrB,wBAAI,GAAG,CAClB,OAAmC,EACP,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC,EAJgB,mBAAmB,KAAnB,mBAAmB,QAInC;AAOD,MAAM,OAAO,2BAA4B,SAAQ,IAAI,CAAC,WAAW,CAC/D,6BAA6B,CAI7B;CAAG;AAQL,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,OAAO,EAGnD,CAAC,wBAAwB,CAAC;CAAG;AAEhC,WAAiB,iBAAiB;IACnB,sBAAI,GAAG,CAClB,OAAiC,EACP,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC,EAJgB,iBAAiB,KAAjB,iBAAiB,QAIjC;AAmBD,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAE5D,MAAM,eAAe,GAAG,CACtB,QAAuD,EACvD,GAAW,EACU,EAAE;IACvB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAE9B,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,KAA8B,EAC9B,OAA6B,EAC7B,cAA2C,EAC3C,kBAA2B,EACQ,EAAE,CAAC,CAAC;IACvC,GAAG,KAAK,CAAC,QAAQ;IACjB,OAAO;IACP,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,cAAc;IACd,kBAAkB;IAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK;CACpD,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CACpC,QAAuD,EACR,EAAE;IACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EACJ,OAAO,EAAE,QAAQ,EACjB,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,eAAe,EAC/B,kBAAkB,EAAE,mBAAmB,EACvC,iBAAiB,EAAE,kBAAkB,EACrC,GAAG,IAAI,EACR,GAAG,QAAQ,CAAC;IAEb,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC,SAIpC,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GAAG,eAAe,CACxC,SAAS,CAAC,QAAQ,EAClB,oBAAoB,CACrB,CAAC;IACF,MAAM,cAAc,GAClB,sBAAsB,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC5D,CAAC,kBAAkB,KAAK,SAAS;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,oCAAoC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAEhE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC;YACzC,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC;YACzC,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC;YACzC,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC;YACzC,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW,EAAE,SAAS,CAAC,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC;QACrC,OAAO;QACP,MAAM;QACN,cAAc;QACd,kBAAkB;QAClB,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,KAAK,IAAI;YACnE,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE;YAC7B,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,EAAE,6BAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC;KAC5B,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,YAAuC,EACjB,EAAE;IACxB,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,IAAI,uBAAuB,CAAC;IAExD,OAAO,aAAa,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EACrD,KAA8B;YAE9B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAC/B,+BAA+B,EAC/B,OAAO,CACR,CAAC;YAEF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;YACzC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACpD,MAAM,kBAAkB,GACtB,oCAAoC,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS;iBACzC,KAAK,CAAC;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG;gBACrB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,qBAAqB,CAC7B,KAAK,EACL,OAAO,EACP,cAAc,EACd,kBAAkB,CACnB;aACF,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,uBAAuB,CAAC;gBAC1B,OAAO,EAAE,0CAA0C;gBACnD,KAAK;aACN,CAAC,CACL,CACF,CAAC;YAEJ,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,EAAE;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC5D,OAAO;gBACP,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,cAAc;gBACd,kBAAkB;gBAClB,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI;oBAClC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACzD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EACzD,KAA+B;YAE/B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAC/B,+BAA+B,EAC/B,SAAS,CACV,CAAC;YAEF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS;iBAC5C,OAAO,CAAC;gBACP,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,wBAAwB,CAAC;gBAC3B,OAAO,EAAE,kCAAkC;gBAC3C,KAAK;aACN,CAAC,CACL,CACF,CAAC;YACJ,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;YAE/D,OAAO;gBACL,GAAG,QAAQ;gBACX,SAAS,EAAE,SAAS,CAAC,SAAS;aACE,CAAC;QACrC,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EACvD,KAA+B;YAE/B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAC/B,+BAA+B,EAC/B,QAAQ,CACT,CAAC;YAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS;iBAC3C,MAAM,CAAC;gBACN,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,wBAAwB,CAAC;gBAC3B,OAAO,EAAE,kCAAkC;gBAC3C,KAAK;aACN,CAAC,CACL,CACF,CAAC;YACJ,OAAO,KAAK,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA8B,EAAE,EAAE,CAClE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAEnC,OAAO,iBAAiB,CAAC;QACvB,GAAG,OAAO;QACV,SAAS;KACV,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,oBAAoB,GAAG,CAAC,MAAuB,EAAmB,EAAE,CACxE,eAAe,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC9D,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;CACpD,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,CAAC,IAAsB,EAAoB,EAAE,CACzE,gBAAgB,CAAC,IAAI,CAAC;IACpB,KAAK,EAAE,IAAI,CAAC,KAAK;IACjB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC/C,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CACxB,MAAiC,EACN,EAAE,CAAC,CAAC;IAC/B,GAAG,eAAe,CAAC,MAAM,CAAC;IAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,GAAoC,EAAE;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;IAElE,OAAO,wBAAwB,CAAC,IAAI,CAAC;QACnC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CACvB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC;oBACzC,OAAO,EAAE,sCAAsC;iBAChD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAE/C,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC;QACJ,yBAAyB,EAAE,CAAC,KAAK,EAAE,EAAE,CACnC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAEtD,OAAO,MAAM,KAAK,SAAS;gBACzB,CAAC,CAAC,MAAM,CAAC,IAAI,EAA6B;gBAC1C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC;QACJ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAEtD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACxD,OAAO,MAAM,CAAC,IAAI,EAA6B,CAAC;YAClD,CAAC;YAED,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,GAAG,MAAM;gBACT,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACrC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;oBAC9B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;YAEhD,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC;QACJ,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CACd,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAEtD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACxD,OAAO,MAAM,CAAC,IAAI,EAA6B,CAAC;YAClD,CAAC;YAED,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,GAAG,MAAM;gBACT,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACrC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;oBAC5B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACnC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;oBAC9B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;YAEhD,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,CAAC,IAAI,CAC1D,wBAAwB,EACxB,kCAAkC,CACnC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAClC,MAAiC,EACjC,QAAgC,EACvB,EAAE,CACX,MAAM,CAAC,mBAAmB,KAAK,QAAQ,CAAC,WAAW;IACnD,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;IACjC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;IACnC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;IACjC,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAAC;AAEpD,MAAM,oBAAoB,GAAG,GAAG,EAAE,CAChC,IAAI,wBAAwB,CAAC;IAC3B,OAAO,EAAE,qCAAqC;CAC/C,CAAC,CAAC;AAEL,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAClC,IAAI,wBAAwB,CAAC;IAC3B,OAAO,EAAE,sCAAsC;CAChD,CAAC,CAAC;AAEL,MAAM,oBAAoB,GAAG,GAAG,EAAE,CAChC,IAAI,wBAAwB,CAAC;IAC3B,OAAO,EAAE,yDAAyD;CACnE,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,YAA6C,EACjB,EAAE,CAC9B,mBAAmB,CAAC,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EAC5D,KAAoC;QAEpC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;QAErC,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC;YAC7C,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;YAC/C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC7B,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC7B,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;YAC7C,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC,kBAAkB;YACrD,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;YACnC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAAC,QAAQ,CAAC,EAChE,KAAsC;QAEtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,aAAa;aAC/C,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;aACvB,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,wBAAwB,CAAC;YAC3B,OAAO,EAAE,wCAAwC;YACjD,KAAK;SACN,CAAC,CACL,CACF,CAAC;QACJ,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,yBAAyB,CAAC;YACnE,mBAAmB,EAAE,QAAQ,CAAC,WAAW;SAC1C,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;YACjD,mBAAmB,EAAE,QAAQ,CAAC,WAAW;YACzC,UAAU;YACV,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACrC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,sBAAsB,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EAC1D,KAAmC;QAEnC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,aAAa;aAC/C,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;aACvB,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,wBAAwB,CAAC;YAC3B,OAAO,EAAE,sCAAsC;YAC/C,KAAK;SACN,CAAC,CACL,CACF,CAAC;QACJ,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,yBAAyB,CAAC;YACnE,mBAAmB,EAAE,QAAQ,CAAC,WAAW;SAC1C,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5C,mBAAmB,EAAE,QAAQ,CAAC,WAAW;YACzC,UAAU;YACV,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACrC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,sBAAsB,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CACtE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAAC;IAE9C,OAAO,uBAAuB,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,YAA2C,EACjB,EAAE,CAC5B,iBAAiB,CAAC,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,EAC1D,KAA8B;QAE9B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAC/B,oCAAoC,EACpC,OAAO,CACR,CAAC;QAEF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,2BAA2B,CAAC;YAC9B,OAAO,EAAE,0CAA0C;YACnD,KAAK;SACN,CAAC,CACL,CACF,CAAC;QAEF,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ;aACzB,iBAAiB,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9D,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,IAAI;gBACnC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE;gBAC7B,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,2BAA2B,CAAC;YAC9B,OAAO,EAAE,+BAA+B;YACxC,KAAK;SACN,CAAC,CACL,CACF,CAAC;QAEJ,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IAE9C,OAAO,qBAAqB,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CACrD,YAA6D,EAC/B,EAAE,CAChC,qBAAqB,CAAC,IAAI,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC,EAAE,CAAC,0CAA0C,CAAC,CACtE,QAAQ,CAAC,EAAE,KAAiC;QAC1C,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;gBAC3C,OAAO,EACL,2DAA2D;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;gBAC3C,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,CAAC,YAAY,CAAC,UAAU;aAC3B,IAAI,CAAC;YACJ,IAAI,EAAE,eAAe;YACrB,EAAE,EAAE,KAAK,CAAC,KAAK;YACf,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,0BAA0B,CAAC;YAC7B,OAAO,EAAE,+BAA+B;YACxC,KAAK;SACN,CAAC,CACL,CACF,CAAC;IACN,CAAC,CACF;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,uCAAuC,GAAG,KAAK,CAAC,MAAM,CACjE,qBAAqB,CACtB,CACC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;IAErC,OAAO,uCAAuC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AACjE,CAAC,CAAC,CACH,CAAC"}
|