@fluixi/oauth2 1.0.0-alpha.1

package/dist/server.cjs

@@ -0,0 +1,470 @@
+/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  oauthRoutes: () => oauthRoutes,
+  sessionLocals: () => sessionLocals
+});
+module.exports = __toCommonJS(server_exports);
+var import_server = require("@fluixi/session/server");
+
+// src/return-to.ts
+function safeReturnTo(candidate, options = {}) {
+  const fallback = options.fallback ?? "/";
+  if (!candidate || typeof candidate !== "string") return fallback;
+  const value = candidate.trim();
+  if (!value) return fallback;
+  if (/[\u0000-\u001f\u007f]/.test(value)) return fallback;
+  if (/^[/\\]{2}/.test(value)) return fallback;
+  if (value.startsWith("/")) return value;
+  const here = options.origin ?? (typeof location === "undefined" ? void 0 : location.origin);
+  const allowed = [here, ...options.allowedOrigins ?? []].filter(Boolean);
+  if (!allowed.length) return fallback;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return fallback;
+  }
+  if (!allowed.includes(url.origin)) return fallback;
+  if (url.protocol !== "http:" && url.protocol !== "https:") return fallback;
+  return url.toString();
+}
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/client-auth.ts
+var CANONICAL = {
+  basic: "client_secret_basic",
+  body: "client_secret_post",
+  client_secret_basic: "client_secret_basic",
+  client_secret_post: "client_secret_post",
+  private_key_jwt: "private_key_jwt",
+  none: "none"
+};
+function resolveMethod(auth) {
+  if (auth.method) return CANONICAL[auth.method] ?? "client_secret_basic";
+  if (auth.privateKey) return "private_key_jwt";
+  return auth.clientSecret ? "client_secret_basic" : "none";
+}
+async function loadJose() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function signAssertion(auth, endpoint) {
+  const jose = await loadJose();
+  const alg = auth.assertionAlgorithm ?? "RS256";
+  const key = await jose.importJWK(auth.privateKey, alg);
+  const kid = auth.keyId ?? auth.privateKey.kid;
+  return new jose.SignJWT({}).setProtectedHeader(kid ? { alg, kid } : { alg }).setIssuer(auth.clientId).setSubject(auth.clientId).setAudience(endpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("1m").sign(key);
+}
+async function applyClientAuth(auth, endpoint, headers, form) {
+  switch (resolveMethod(auth)) {
+    case "client_secret_basic": {
+      const pair = `${encodeURIComponent(auth.clientId)}:${encodeURIComponent(auth.clientSecret)}`;
+      headers.authorization = `Basic ${btoa(pair)}`;
+      break;
+    }
+    case "client_secret_post":
+      form.set("client_id", auth.clientId);
+      form.set("client_secret", auth.clientSecret);
+      break;
+    case "private_key_jwt":
+      form.set("client_id", auth.clientId);
+      form.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+      form.set("client_assertion", await signAssertion(auth, endpoint));
+      break;
+    case "none":
+      form.set("client_id", auth.clientId);
+      break;
+  }
+}
+
+// src/discovery.ts
+var cache = /* @__PURE__ */ new Map();
+function documentUrl(issuer) {
+  return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+async function discover(issuer, fetcher = fetch) {
+  const cached = cache.get(issuer);
+  if (cached) return cached;
+  const pending = (async () => {
+    let response;
+    try {
+      response = await fetcher(documentUrl(issuer));
+    } catch (cause) {
+      throw new OAuthError(
+        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        "discovery_unreachable"
+      );
+    }
+    if (!response.ok) {
+      throw new OAuthError(
+        `Discovery failed for ${issuer}: ${response.status}`,
+        "discovery_failed"
+      );
+    }
+    const doc = await response.json();
+    if (!doc.authorization_endpoint || !doc.token_endpoint) {
+      throw new OAuthError(
+        `${issuer} published a discovery document with no authorization or token endpoint.`,
+        "discovery_incomplete"
+      );
+    }
+    return {
+      authorization: doc.authorization_endpoint,
+      token: doc.token_endpoint,
+      userinfo: doc.userinfo_endpoint,
+      endSession: doc.end_session_endpoint,
+      jwks: doc.jwks_uri,
+      introspection: doc.introspection_endpoint,
+      revocation: doc.revocation_endpoint,
+      issuer: doc.issuer ?? issuer
+    };
+  })();
+  cache.set(issuer, pending);
+  pending.catch(() => cache.delete(issuer));
+  return pending;
+}
+
+// src/pkce.ts
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  crypto.getRandomValues(bytes);
+  return bytes;
+}
+function createVerifier() {
+  return base64url(randomBytes(32));
+}
+function createStateValue() {
+  return base64url(randomBytes(16));
+}
+async function createChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url(new Uint8Array(digest));
+}
+async function createPkcePair() {
+  const verifier = createVerifier();
+  return { verifier, challenge: await createChallenge(verifier) };
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function expiryFrom(expiresIn, now = Date.now()) {
+  const seconds = typeof expiresIn === "number" ? expiresIn : Number(expiresIn);
+  return Number.isFinite(seconds) && seconds > 0 ? now + seconds * 1e3 : void 0;
+}
+
+// src/server.ts
+function oauthRoutes(config) {
+  const base = (config.basePath ?? "/auth").replace(/\/$/, "");
+  const scopes = config.scopes ?? ["openid", "profile", "email"];
+  const cookie = (0, import_server.createSessionCookie)({
+    secret: config.cookieSecret,
+    name: config.cookieName,
+    secure: config.secureCookie
+  });
+  let endpoints = config.endpoints ?? null;
+  const resolve = async () => {
+    if (endpoints) return endpoints;
+    if (!config.issuer) {
+      throw new OAuthError("Give oauthRoutes an issuer or endpoints.", "missing_issuer");
+    }
+    endpoints = await discover(config.issuer);
+    return endpoints;
+  };
+  const json = (body, status = 200, headers = {}) => new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", ...headers }
+  });
+  const clientAuth = {
+    clientId: config.clientId,
+    // `client_secret_post` by default here, which is what this half has always sent, so
+    // an existing deployment keeps working.
+    method: config.tokenAuthMethod ?? (config.clientSecret ? "body" : "none"),
+    clientSecret: config.clientSecret,
+    privateKey: config.privateKey,
+    keyId: config.keyId,
+    assertionAlgorithm: config.assertionAlgorithm
+  };
+  async function tokenRequest(body) {
+    const { token } = await resolve();
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded"
+    };
+    const form = new URLSearchParams(body);
+    await applyClientAuth(clientAuth, token, headers, form);
+    const response = await fetch(token, { method: "POST", headers, body: form.toString() });
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      throw new OAuthError(
+        String(payload.error ?? "token_request_failed"),
+        String(payload.error ?? "token_request_failed")
+      );
+    }
+    return payload;
+  }
+  return async function middleware(request, next) {
+    const url = new URL(request.url);
+    if (!url.pathname.startsWith(`${base}/`)) return next();
+    const route = url.pathname.slice(base.length);
+    const session = async () => {
+      return cookie.read(request);
+    };
+    if (route === "/login") {
+      const { authorization } = await resolve();
+      const { verifier, challenge } = await createPkcePair();
+      const state = createStateValue();
+      const target = new URL(authorization);
+      target.searchParams.set("response_type", "code");
+      target.searchParams.set("client_id", config.clientId);
+      target.searchParams.set("redirect_uri", config.redirectUri);
+      target.searchParams.set("scope", scopes.join(" "));
+      target.searchParams.set("state", state);
+      target.searchParams.set("code_challenge", challenge);
+      target.searchParams.set("code_challenge_method", "S256");
+      const pendingCookie = await cookie.write(
+        {
+          accessToken: "",
+          pending: {
+            verifier,
+            state,
+            // Checked here rather than only at the callback, so a refused destination
+            // never reaches the cookie and cannot be read back out of it later.
+            returnTo: safeReturnTo(url.searchParams.get("returnTo"), {
+              fallback: "",
+              origin: url.origin,
+              allowedOrigins: config.allowedReturnOrigins
+            }) || void 0
+          }
+        },
+        // Ten minutes: long enough to sign in, short enough that an abandoned attempt
+        // does not sit in the browser.
+        { maxAge: 600 }
+      );
+      return new Response(null, {
+        status: 302,
+        headers: {
+          location: target.toString(),
+          "set-cookie": pendingCookie
+        }
+      });
+    }
+    if (route === "/callback") {
+      const current = await session();
+      const pending = current?.pending;
+      const error = url.searchParams.get("error");
+      if (error) return json({ error }, 400);
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (!code) return json({ error: "no_code" }, 400);
+      if (!pending || !state || !timingSafeEqual(pending.state, state)) {
+        return json({ error: "state_mismatch" }, 400);
+      }
+      const payload = await tokenRequest({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: config.redirectUri,
+        code_verifier: pending.verifier
+      });
+      const signedIn = await cookie.write({
+        accessToken: String(payload.access_token ?? ""),
+        refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : void 0,
+        idToken: typeof payload.id_token === "string" ? payload.id_token : void 0,
+        expiresAt: expiryFrom(payload.expires_in)
+      });
+      return new Response(null, {
+        status: 302,
+        headers: {
+          // Checked again on the way out. The cookie cannot be forged, but a value that
+          // was acceptable when the flow started should still be one when it finishes,
+          // and this is the line that actually performs the redirect.
+          location: safeReturnTo(pending.returnTo ?? config.defaultReturnTo, {
+            fallback: "/",
+            origin: url.origin,
+            allowedOrigins: config.allowedReturnOrigins
+          }),
+          "set-cookie": signedIn
+        }
+      });
+    }
+    if (route === "/refresh") {
+      const current = await session();
+      if (!current?.refreshToken) return json({ error: "no_session" }, 401);
+      const payload = await tokenRequest({
+        grant_type: "refresh_token",
+        refresh_token: current.refreshToken
+      });
+      const refreshed = await cookie.write({
+        accessToken: String(payload.access_token ?? ""),
+        // A provider that rotates refresh tokens sends a new one; one that does not
+        // expects the old one to keep working.
+        refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : current.refreshToken,
+        idToken: current.idToken,
+        expiresAt: expiryFrom(payload.expires_in)
+      });
+      return json({ ok: true }, 200, { "set-cookie": refreshed });
+    }
+    if (route === "/me") {
+      const current = await session();
+      if (!current?.accessToken) return json({ error: "no_session" }, 401);
+      const { userinfo } = await resolve();
+      if (!userinfo) return json({ error: "no_userinfo" }, 501);
+      const response = await fetch(userinfo, {
+        headers: { authorization: `Bearer ${current.accessToken}` }
+      });
+      if (!response.ok) return json({ error: "userinfo_failed" }, response.status);
+      const claims = await response.json();
+      return json(config.mapUser ? config.mapUser(claims, current.accessToken) : claims);
+    }
+    if (route === "/revoke") {
+      const current = await session();
+      const hint = url.searchParams.get("hint") === "access_token" ? "access_token" : "refresh_token";
+      const target = hint === "access_token" ? current?.accessToken : current?.refreshToken;
+      if (!target) return json({ error: "no_session" }, 401);
+      const { revocation } = await resolve().catch(() => ({ revocation: void 0 }));
+      if (!revocation) return json({ error: "no_revocation_endpoint" }, 501);
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded"
+      };
+      const form = new URLSearchParams({ token: target, token_type_hint: hint });
+      await applyClientAuth(clientAuth, revocation, headers, form);
+      await fetch(revocation, { method: "POST", headers, body: form.toString() }).catch(
+        () => void 0
+      );
+      return json({ ok: true, revoked: hint });
+    }
+    if (route === "/logout") {
+      const current = await session();
+      const { endSession } = await resolve().catch(() => ({ endSession: void 0 }));
+      const { revocation } = await resolve().catch(() => ({ revocation: void 0 }));
+      if (revocation && current?.refreshToken) {
+        const headers = {
+          "content-type": "application/x-www-form-urlencoded"
+        };
+        const form = new URLSearchParams({
+          token: current.refreshToken,
+          token_type_hint: "refresh_token"
+        });
+        await applyClientAuth(clientAuth, revocation, headers, form);
+        await fetch(revocation, { method: "POST", headers, body: form.toString() }).catch(
+          () => void 0
+        );
+      }
+      const cleared = cookie.clear();
+      if (endSession && current?.idToken) {
+        const target = new URL(endSession);
+        target.searchParams.set("id_token_hint", current.idToken);
+        if (config.defaultReturnTo) {
+          target.searchParams.set("post_logout_redirect_uri", config.defaultReturnTo);
+        }
+        return new Response(null, {
+          status: 302,
+          headers: { location: target.toString(), "set-cookie": cleared }
+        });
+      }
+      return json({ ok: true }, 200, { "set-cookie": cleared });
+    }
+    return next();
+  };
+}
+function sessionLocals(config) {
+  const cookie = (0, import_server.createSessionCookie)({
+    secret: config.cookieSecret,
+    name: config.cookieName,
+    secure: config.secureCookie
+  });
+  const ttl = config.userCacheMs ?? 3e4;
+  const cache2 = /* @__PURE__ */ new Map();
+  const remember = (token, user) => {
+    if (ttl <= 0) return;
+    if (cache2.size > 500) {
+      const now = Date.now();
+      for (const [key, entry] of cache2) if (entry.until <= now) cache2.delete(key);
+      if (cache2.size > 500) cache2.delete(cache2.keys().next().value);
+    }
+    cache2.set(token, { user, until: Date.now() + ttl });
+  };
+  return async function middleware(request, next) {
+    const { getRequestLocals } = await import("@fluixi/server");
+    const locals = getRequestLocals(request);
+    const session = await cookie.read(request);
+    if (!session?.accessToken) {
+      locals.auth = { user: null, session: null };
+      return next();
+    }
+    const cached = cache2.get(session.accessToken);
+    if (cached && cached.until > Date.now()) {
+      locals.auth = { user: cached.user, session: { expiresAt: session.expiresAt } };
+      return next();
+    }
+    let user = null;
+    try {
+      const endpoints = config.endpoints ?? (config.issuer ? await discover(config.issuer) : null);
+      if (endpoints?.userinfo) {
+        const response = await fetch(endpoints.userinfo, {
+          headers: { authorization: `Bearer ${session.accessToken}` }
+        });
+        if (response.ok) {
+          const claims = await response.json();
+          user = config.mapUser ? config.mapUser(claims, session.accessToken) : claims;
+          remember(session.accessToken, user);
+        }
+      }
+    } catch {
+    }
+    locals.auth = { user, session: user ? { expiresAt: session.expiresAt } : null };
+    return next();
+  };
+}

package/dist/server.d.ts

@@ -0,0 +1,89 @@
+import { type ClientAuthMethodInput } from './client-auth.js';
+import { type Endpoints } from './types.js';
+export interface OAuthRoutesConfig {
+    issuer?: string;
+    endpoints?: Endpoints;
+    clientId: string;
+    /** A server-held client can keep one, which is what makes it confidential. */
+    clientSecret?: string;
+    redirectUri: string;
+    scopes?: string[];
+    /** Where the routes are mounted. Must agree with the browser client. Default `/auth`. */
+    basePath?: string;
+    /** At least 32 bytes. The cookie is encrypted with a key derived from it. */
+    cookieSecret: string;
+    cookieName?: string;
+    /** Default: true in production. Set false only for plain-http local work. */
+    secureCookie?: boolean;
+    /** Where to send the browser after a login with no recorded destination. */
+    defaultReturnTo?: string;
+    /**
+     * Origins a login may return to besides this server's own.
+     *
+     * A destination arrives on the query string, so it is attacker controlled. Anything
+     * that is not a path on this origin is refused unless it is named here. Adding an
+     * origin here makes it a valid landing place for an authenticated visitor, so add only
+     * ones you control.
+     */
+    allowedReturnOrigins?: string[];
+    /**
+     * How this server authenticates to the token endpoint.
+     *
+     * `private_key_jwt` needs `privateKey` and sends no secret at all, which some providers
+     * require: Okta's org authorization server refuses anything else.
+     */
+    tokenAuthMethod?: ClientAuthMethodInput;
+    /** The signing key for `private_key_jwt`, as a JWK. */
+    privateKey?: Record<string, unknown>;
+    /** Names which key, for a provider holding more than one. */
+    keyId?: string;
+    /** Default `RS256`. */
+    assertionAlgorithm?: string;
+    /**
+     * How long `sessionLocals` may reuse a userinfo response, in milliseconds.
+     *
+     * Without this every server render calls the provider, which is a round trip per page
+     * and makes the provider being up a condition of rendering at all.
+     *
+     * The cost is freshness: a session disabled at the provider keeps rendering as signed
+     * in until the entry expires. Short by default for that reason, and worth leaving
+     * short. `0` disables it and asks every time.
+     */
+    userCacheMs?: number;
+    /** Map the provider's userinfo onto the app's own shape. */
+    mapUser?: (claims: Record<string, unknown>, accessToken: string) => unknown;
+}
+/**
+ * The middleware.
+ *
+ * Handles `<basePath>/login`, `/callback`, `/refresh`, `/me` and `/logout`, and passes
+ * anything else along untouched.
+ */
+export declare function oauthRoutes(config: OAuthRoutesConfig): (request: Request, next: () => Promise<Response>) => Promise<Response>;
+/**
+ * Put the signed-in user on the request, so a server render knows who is looking.
+ *
+ * This is the piece that makes `tokens: 'server'` able to render authenticated pages. The
+ * cookie is the credential and the server can read it, so the user is resolved before
+ * the render and written where `@fluixi/auth`'s hooks already look: request locals,
+ * under the key they read. `useUser()` then answers during SSR instead of returning null
+ * and filling in after hydration.
+ *
+ * Dependency injection does not solve this and is not meant to. DI decides which
+ * instance a component gets; locals carry what the middleware learned about this
+ * request. They are different questions, and the user is the second one.
+ *
+ * There is no browser-mode equivalent, and that is not an omission. In that mode the
+ * token lives in the browser and is never sent on a document request, so the server has
+ * no credential to resolve and cannot know who is signed in. An app built that way
+ * renders the signed-out shell and fills it in on the client.
+ *
+ * ```ts
+ * export default defineMiddleware([auth, sessionLocals(config), ...]);
+ * ```
+ *
+ * Mount it after `oauthRoutes`, so a request to `/auth/login` is answered rather than
+ * having its session resolved first.
+ */
+export declare function sessionLocals(config: OAuthRoutesConfig): (request: Request, next: () => Promise<Response>) => Promise<Response>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAgCA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7E;AAYD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,IAwDjD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAwMrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,IA8BnD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CA0CrB"}