@enterprisestandard/react 0.0.5-beta.20260115.1 → 0.0.5-beta.20260115.3

package/dist/types/workload-schema.js

@@ -0,0 +1,208 @@
+/**
+ * Creates a StandardSchemaV1 for validating JWT Assertion Claims.
+ * @param vendor - The name of the vendor creating this schema
+ * @returns A StandardSchemaV1 instance for JWT Assertion Claims validation
+ */
+export function jwtAssertionClaimsSchema(vendor) {
+    return {
+        '~standard': {
+            version: 1,
+            vendor,
+            validate: (value) => {
+                if (typeof value !== 'object' || value === null) {
+                    return {
+                        issues: [
+                            {
+                                message: 'Expected an object',
+                            },
+                        ],
+                    };
+                }
+                const claims = value;
+                const issues = [];
+                const result = { ...claims };
+                // Validate required string fields
+                const requiredStringFields = ['iss', 'sub'];
+                for (const field of requiredStringFields) {
+                    if (field in claims) {
+                        if (typeof claims[field] !== 'string') {
+                            issues.push({
+                                message: `${field} must be a string`,
+                                path: [field],
+                            });
+                        }
+                    }
+                    else {
+                        issues.push({
+                            message: `${field} is required`,
+                            path: [field],
+                        });
+                    }
+                }
+                // Validate optional aud field (can be string or array of strings)
+                if ('aud' in claims && claims.aud !== undefined) {
+                    const aud = claims.aud;
+                    if (typeof aud !== 'string' && !Array.isArray(aud)) {
+                        issues.push({
+                            message: 'aud must be a string or array of strings',
+                            path: ['aud'],
+                        });
+                    }
+                    else if (Array.isArray(aud) && !aud.every((a) => typeof a === 'string')) {
+                        issues.push({
+                            message: 'aud array must contain only strings',
+                            path: ['aud'],
+                        });
+                    }
+                }
+                // Validate optional string fields
+                const optionalStringFields = ['jti', 'scope'];
+                for (const field of optionalStringFields) {
+                    if (field in claims && claims[field] !== undefined) {
+                        if (typeof claims[field] !== 'string') {
+                            issues.push({
+                                message: `${field} must be a string`,
+                                path: [field],
+                            });
+                        }
+                    }
+                }
+                // Validate required number fields
+                const requiredNumberFields = ['exp', 'iat'];
+                for (const field of requiredNumberFields) {
+                    if (field in claims) {
+                        if (typeof claims[field] !== 'number') {
+                            issues.push({
+                                message: `${field} must be a number`,
+                                path: [field],
+                            });
+                        }
+                    }
+                    else {
+                        issues.push({
+                            message: `${field} is required`,
+                            path: [field],
+                        });
+                    }
+                }
+                if (issues.length > 0) {
+                    return { issues };
+                }
+                return { value: result };
+            },
+        },
+    };
+}
+/**
+ * Creates a StandardSchemaV1 for validating Workload Token Responses.
+ * @param vendor - The name of the vendor creating this schema
+ * @returns A StandardSchemaV1 instance for Workload Token Response validation
+ */
+export function workloadTokenResponseSchema(vendor) {
+    return {
+        '~standard': {
+            version: 1,
+            vendor,
+            validate: (value) => {
+                if (typeof value !== 'object' || value === null) {
+                    return {
+                        issues: [
+                            {
+                                message: 'Expected an object',
+                            },
+                        ],
+                    };
+                }
+                const response = value;
+                const issues = [];
+                const result = {};
+                // Check required 'access_token' parameter
+                if ('access_token' in response) {
+                    if (typeof response.access_token === 'string') {
+                        result.access_token = response.access_token;
+                    }
+                    else {
+                        issues.push({
+                            message: 'access_token must be a string',
+                            path: ['access_token'],
+                        });
+                    }
+                }
+                else {
+                    issues.push({
+                        message: 'access_token is required',
+                        path: ['access_token'],
+                    });
+                }
+                // Check required 'token_type' parameter
+                if ('token_type' in response) {
+                    if (typeof response.token_type === 'string') {
+                        result.token_type = response.token_type;
+                    }
+                    else {
+                        issues.push({
+                            message: 'token_type must be a string',
+                            path: ['token_type'],
+                        });
+                    }
+                }
+                else {
+                    issues.push({
+                        message: 'token_type is required',
+                        path: ['token_type'],
+                    });
+                }
+                // Optional string fields
+                if ('scope' in response) {
+                    if (typeof response.scope === 'string' || response.scope === undefined) {
+                        result.scope = response.scope;
+                    }
+                    else {
+                        issues.push({
+                            message: 'scope must be a string',
+                            path: ['scope'],
+                        });
+                    }
+                }
+                if ('refresh_token' in response) {
+                    if (typeof response.refresh_token === 'string' || response.refresh_token === undefined) {
+                        result.refresh_token = response.refresh_token;
+                    }
+                    else {
+                        issues.push({
+                            message: 'refresh_token must be a string',
+                            path: ['refresh_token'],
+                        });
+                    }
+                }
+                if ('expires' in response) {
+                    if (typeof response.expires === 'string' || response.expires === undefined) {
+                        result.expires = response.expires;
+                    }
+                    else {
+                        issues.push({
+                            message: 'expires must be a string',
+                            path: ['expires'],
+                        });
+                    }
+                }
+                // Optional number field
+                if ('expires_in' in response) {
+                    if (typeof response.expires_in === 'number' || response.expires_in === undefined) {
+                        result.expires_in = response.expires_in;
+                    }
+                    else {
+                        issues.push({
+                            message: 'expires_in must be a number',
+                            path: ['expires_in'],
+                        });
+                    }
+                }
+                if (issues.length > 0) {
+                    return { issues };
+                }
+                return { value: result };
+            },
+        },
+    };
+}

package/dist/ui/sign-in-loading.js

@@ -0,0 +1,8 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { useUser } from '..';
+export function SignInLoading({ complete = false, children }) {
+    const { isLoading } = useUser();
+    if (isLoading && !complete)
+        return _jsx(_Fragment, { children: children });
+    return null;
+}

package/dist/ui/signed-in.js

@@ -0,0 +1,8 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { useUser } from '..';
+export function SignedIn({ children }) {
+    const { user } = useUser();
+    if (user)
+        return _jsx(_Fragment, { children: children });
+    return null;
+}

package/dist/ui/signed-out.js

@@ -0,0 +1,8 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { useUser } from '..';
+export function SignedOut({ children }) {
+    const { user, isLoading } = useUser();
+    if (user || isLoading)
+        return null;
+    return _jsx(_Fragment, { children: children });
+}

package/dist/ui/sso-provider.js

@@ -0,0 +1,275 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useCallback, useContext, useEffect, useState } from 'react';
+const CTX = createContext(undefined);
+const generateStorageKey = (tenantId) => {
+    return `es-sso-user-${tenantId
+        .replace(/[^a-zA-Z0-9]/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '')}`;
+};
+export function SSOProvider({ tenantId, storage = 'memory', storageKey, userUrl, tokenUrl, refreshUrl, disableListener = false, children, }) {
+    const [user, setUserState] = useState(null);
+    const [isLoading, setIsLoading] = useState(!!userUrl);
+    const actualStorageKey = storageKey || (tenantId ? generateStorageKey(tenantId) : 'es-sso-user');
+    const isValidUser = useCallback((user) => {
+        if (!user || !tenantId)
+            return true;
+        return user.sso?.tenant?.id === tenantId;
+    }, [tenantId]);
+    const loadUserFromStorage = useCallback(() => {
+        if (storage === 'memory' || typeof window === 'undefined')
+            return null;
+        try {
+            const storageObject = storage === 'local' ? localStorage : sessionStorage;
+            const userData = storageObject.getItem(actualStorageKey);
+            if (!userData)
+                return null;
+            const parsedUser = JSON.parse(userData);
+            if (parsedUser.sso?.expires) {
+                parsedUser.sso.expires = new Date(parsedUser.sso.expires);
+            }
+            return isValidUser(parsedUser) ? parsedUser : null;
+        }
+        catch (error) {
+            console.error('Error loading user from storage:', error);
+            return null;
+        }
+    }, [storage, actualStorageKey, isValidUser]);
+    const saveUserToStorage = useCallback((user) => {
+        if (storage === 'memory' || typeof window === 'undefined')
+            return;
+        try {
+            const storageObject = storage === 'local' ? localStorage : sessionStorage;
+            if (user === null) {
+                storageObject.removeItem(actualStorageKey);
+            }
+            else {
+                storageObject.setItem(actualStorageKey, JSON.stringify(user));
+            }
+        }
+        catch (error) {
+            console.error('Error saving user to storage:', error);
+        }
+    }, [storage, actualStorageKey]);
+    const setUser = useCallback((newUser) => {
+        if (newUser && !isValidUser(newUser))
+            return;
+        setUserState(newUser);
+        saveUserToStorage(newUser);
+    }, [isValidUser, saveUserToStorage]);
+    const fetchUserFromUrl = useCallback(async () => {
+        if (!userUrl)
+            return;
+        setIsLoading(true);
+        try {
+            const response = await fetch(userUrl);
+            if (response.status === 401) {
+                setUserState(null);
+                saveUserToStorage(null);
+                setIsLoading(false);
+                return;
+            }
+            if (!response.ok) {
+                throw new Error(`Failed to fetch user: ${response.status} ${response.statusText}`);
+            }
+            const userData = (await response.json());
+            if (userData.sso?.expires && typeof userData.sso.expires === 'string') {
+                userData.sso.expires = new Date(userData.sso.expires);
+            }
+            if (isValidUser(userData)) {
+                setUserState(userData);
+                saveUserToStorage(userData);
+            }
+        }
+        catch (error) {
+            console.error('Error fetching user from URL:', error);
+        }
+        finally {
+            setIsLoading(false);
+        }
+    }, [userUrl, isValidUser, saveUserToStorage]);
+    useEffect(() => {
+        const storedUser = loadUserFromStorage();
+        if (storedUser) {
+            setUserState(storedUser);
+        }
+        if (userUrl) {
+            fetchUserFromUrl();
+        }
+        else {
+            setIsLoading(false);
+        }
+    }, [loadUserFromStorage, userUrl, fetchUserFromUrl]);
+    useEffect(() => {
+        if (disableListener || storage === 'memory')
+            return;
+        const handleStorageChange = (event) => {
+            if (event.key !== actualStorageKey)
+                return;
+            if (event.newValue === null) {
+                setUserState(null);
+            }
+            else {
+                try {
+                    const parsedUser = JSON.parse(event.newValue);
+                    if (parsedUser.sso?.expires) {
+                        parsedUser.sso.expires = new Date(parsedUser.sso.expires);
+                    }
+                    if (isValidUser(parsedUser)) {
+                        setUserState(parsedUser);
+                    }
+                }
+                catch (error) {
+                    console.error('Error parsing user from storage event:', error);
+                }
+            }
+        };
+        const handleLogout = () => {
+            setUserState(null);
+        };
+        window.addEventListener('storage', handleStorageChange);
+        window.addEventListener('es-sso-logout', handleLogout);
+        return () => {
+            window.removeEventListener('storage', handleStorageChange);
+            window.removeEventListener('es-sso-logout', handleLogout);
+        };
+    }, [disableListener, storage, actualStorageKey, isValidUser]);
+    const contextValue = {
+        user,
+        setUser,
+        isLoading,
+        tokenUrl,
+        refreshUrl,
+    };
+    return _jsx(CTX.Provider, { value: contextValue, children: children });
+}
+export function useUser() {
+    const context = useContext(CTX);
+    if (context === undefined) {
+        throw new Error('useUser must be used within a SSOProvider');
+    }
+    return context;
+}
+export function useToken() {
+    const context = useContext(CTX);
+    if (context === undefined) {
+        throw new Error('useToken must be used within a SSOProvider');
+    }
+    const { tokenUrl, refreshUrl } = context;
+    if (!tokenUrl || !refreshUrl) {
+        throw new Error('useToken requires that a "tokenUrl" and "refreshUrl" be set in the SSOProvider');
+    }
+    const [token, setToken] = useState(null);
+    const [expires, setExpires] = useState(null);
+    const [isLoading, setIsLoading] = useState(!!tokenUrl);
+    const [error, setError] = useState(null);
+    const fetchJwt = useCallback(async (url) => {
+        setIsLoading(true);
+        setError(null);
+        try {
+            const response = await fetch(url);
+            if (response.status === 401) {
+                context.setUser(null);
+                setToken(null);
+                setExpires(null);
+                setIsLoading(false);
+                return;
+            }
+            if (!response.ok) {
+                throw new Error(`Failed to fetch JWT: ${response.status} ${response.statusText}`);
+            }
+            const data = (await response.json());
+            setToken(data.token);
+            setExpires(new Date(data.expires));
+        }
+        catch (err) {
+            const error = err instanceof Error ? err : new Error(String(err));
+            setError(error);
+            setToken(null);
+            setExpires(null);
+            console.error('Error fetching JWT:', error);
+        }
+        finally {
+            setIsLoading(false);
+        }
+    }, [context]);
+    const refresh = useCallback(async () => {
+        const url = refreshUrl || tokenUrl;
+        if (!url) {
+            console.warn('No tokenUrl or refreshUrl provided');
+            return;
+        }
+        await fetchJwt(url);
+    }, [refreshUrl, tokenUrl, fetchJwt]);
+    useEffect(() => {
+        if (!tokenUrl) {
+            setIsLoading(false);
+            return;
+        }
+        fetchJwt(tokenUrl);
+    }, [tokenUrl, fetchJwt]);
+    useEffect(() => {
+        if (!expires || !refreshUrl)
+            return;
+        const checkExpiration = () => {
+            const now = new Date();
+            const timeUntilExpiry = expires.getTime() - now.getTime();
+            // Refresh 1 minute before expiration
+            if (timeUntilExpiry <= 60000 && timeUntilExpiry > 0) {
+                refresh();
+            }
+        };
+        // Check immediately
+        checkExpiration();
+        // Check every 30 seconds
+        const interval = setInterval(checkExpiration, 30000);
+        return () => clearInterval(interval);
+    }, [expires, refreshUrl, refresh]);
+    return {
+        token,
+        isLoading,
+        error,
+        refresh,
+    };
+}
+export async function logout(logoutUrl) {
+    try {
+        // Make AJAX logout call
+        const response = await fetch(logoutUrl, {
+            headers: { Accept: 'application/json' },
+        });
+        if (!response.ok) {
+            return { success: false, error: `HTTP ${response.status}` };
+        }
+        const data = await response.json();
+        if (!data.success) {
+            return { success: false, error: data.message || 'Logout failed' };
+        }
+        // Clear managed storage keys (all es-sso-user-* keys)
+        if (typeof window !== 'undefined') {
+            // Clear localStorage
+            for (let i = localStorage.length - 1; i >= 0; i--) {
+                const key = localStorage.key(i);
+                if (key?.startsWith('es-sso-user')) {
+                    localStorage.removeItem(key);
+                }
+            }
+            // Clear sessionStorage
+            for (let i = sessionStorage.length - 1; i >= 0; i--) {
+                const key = sessionStorage.key(i);
+                if (key?.startsWith('es-sso-user')) {
+                    sessionStorage.removeItem(key);
+                }
+            }
+            // Dispatch custom event for same-tab state updates
+            window.dispatchEvent(new CustomEvent('es-sso-logout'));
+        }
+        return { success: true };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'Network error',
+        };
+    }
+}

package/dist/user-store.js

@@ -0,0 +1,114 @@
+/**
+ * User storage for persisting user profiles from SSO authentication.
+ *
+ * User stores are optional - the package works with JWT cookies alone.
+ * User stores are useful when you want to:
+ * - Cache user profiles for fast lookup
+ * - Store users close to your application (in-memory, Redis, etc.)
+ * - Avoid custom IAM/SCIM integration for simple use cases
+ *
+ * ## When to Use UserStore vs IAM
+ *
+ * **Use UserStore when:**
+ * - You just need fast user lookups without external systems
+ * - Users are managed by an external IdP and you just cache them locally
+ * - You want simple in-memory or Redis storage
+ *
+ * **Use IAM (SCIM) when:**
+ * - You need to provision users to an external identity provider
+ * - You need custom user attributes beyond what SSO provides
+ * - You need to sync users with enterprise directories
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import { sso, InMemoryUserStore } from '@enterprisestandard/react/server';
+ *
+ * const userStore = new InMemoryUserStore();
+ *
+ * const auth = sso({
+ *   // ... other config
+ *   user_store: userStore,
+ * });
+ *
+ * // Later, look up users
+ * const user = await userStore.get('user-sub-id');
+ * const userByEmail = await userStore.getByEmail('user@example.com');
+ * ```
+ */
+/**
+ * In-memory user store implementation using Maps.
+ *
+ * Suitable for:
+ * - Development and testing
+ * - Single-server deployments
+ * - Applications without high availability requirements
+ *
+ * NOT suitable for:
+ * - Multi-server deployments (users not shared)
+ * - High availability scenarios (users lost on restart)
+ * - Production applications with distributed architecture
+ *
+ * For production, implement UserStore with Redis or a database.
+ *
+ * @template TExtended - Type-safe custom data that consumers can add to users
+ */
+export class InMemoryUserStore {
+    constructor() {
+        /** Primary storage: sub -> user */
+        this.users = new Map();
+        /** Secondary index: email -> sub */
+        this.emailIndex = new Map();
+        /** Secondary index: userName -> sub */
+        this.userNameIndex = new Map();
+    }
+    async get(sub) {
+        return this.users.get(sub) ?? null;
+    }
+    async getByEmail(email) {
+        const sub = this.emailIndex.get(email.toLowerCase());
+        if (!sub)
+            return null;
+        return this.users.get(sub) ?? null;
+    }
+    async getByUserName(userName) {
+        const sub = this.userNameIndex.get(userName.toLowerCase());
+        if (!sub)
+            return null;
+        return this.users.get(sub) ?? null;
+    }
+    async upsert(user) {
+        const existing = this.users.get(user.id);
+        // Clean up old indexes if email or userName changed
+        if (existing) {
+            if (existing.email && existing.email.toLowerCase() !== user.email?.toLowerCase()) {
+                this.emailIndex.delete(existing.email.toLowerCase());
+            }
+            if (existing.userName && existing.userName.toLowerCase() !== user.userName?.toLowerCase()) {
+                this.userNameIndex.delete(existing.userName.toLowerCase());
+            }
+        }
+        // Store the user
+        this.users.set(user.id, user);
+        // Update indexes
+        if (user.email) {
+            this.emailIndex.set(user.email.toLowerCase(), user.id);
+        }
+        if (user.userName) {
+            this.userNameIndex.set(user.userName.toLowerCase(), user.id);
+        }
+    }
+    async delete(sub) {
+        const user = this.users.get(sub);
+        if (user) {
+            // Clean up indexes
+            if (user.email) {
+                this.emailIndex.delete(user.email.toLowerCase());
+            }
+            if (user.userName) {
+                this.userNameIndex.delete(user.userName.toLowerCase());
+            }
+        }
+        this.users.delete(sub);
+    }
+}

package/dist/utils.js

@@ -0,0 +1,23 @@
+let defaultInstance;
+export function must(value, message = 'Assertion failed. Required value is null or undefined.') {
+    if (value === undefined || value === null) {
+        throw new Error(message);
+    }
+    return value;
+}
+export function setDefaultInstance(es) {
+    defaultInstance = es;
+}
+export function getDefaultInstance() {
+    return defaultInstance;
+}
+/**
+ * If an es is defined, then return it, otherwise return the defaultEnterpriseStandard
+ */
+export function getES(es) {
+    if (es)
+        return es;
+    if (defaultInstance)
+        return defaultInstance;
+    throw new Error(`TODO standardize the error message when there isn't a default EntepriseStandard`);
+}

package/dist/vault.js

@@ -0,0 +1,22 @@
+export function vault(url) {
+    async function getFullSecret(path, token) {
+        const resp = await fetch(`${url}/${path}`, { headers: { 'X-Vault-Token': token } });
+        if (resp.status !== 200) {
+            throw new Error(`Vault returned invalid status, ${resp.status}: '${resp.statusText}' from URL: ${url}`);
+        }
+        try {
+            const secret = await resp.json();
+            return secret.data;
+        }
+        catch (cause) {
+            throw new Error('Error retrieving secret', { cause });
+        }
+    }
+    return {
+        url,
+        getFullSecret,
+        getSecret: async (path, token) => {
+            return (await getFullSecret(path, token)).data;
+        },
+    };
+}

package/dist/workload-server.d.ts

@@ -1,4 +1,4 @@
-import { EnterpriseStandard } from '.';
+import type { EnterpriseStandard } from '.';
 import type { TokenValidationResult } from './types/workload-schema';
 import type { WorkloadIdentity } from './workload';
 /**

package/dist/workload-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workload-server.d.ts","sourceRoot":"","sources":["../src/workload-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,GAAG,CAAC;AAEvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAc7D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAMlH;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAarH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAIlG"}
+{"version":3,"file":"workload-server.d.ts","sourceRoot":"","sources":["../src/workload-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,GAAG,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAcnD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAMlH;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAarH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAIlG"}