@frontmcp/auth 1.8.2 → 1.8.4

package/authorities/authorities.engine.d.ts

@@ -5,7 +5,7 @@
  * built-in evaluators, custom evaluators, and combinators.
  */
 import type { AuthoritiesEvaluatorRegistry, AuthoritiesProfileRegistry } from './authorities.registry';
-import type { AuthoritiesEvaluationContext, AuthoritiesMetadata, AuthoritiesResult } from './authorities.types';
+import type { AuthoritiesEvaluationContext, AuthoritiesMetadata, AuthoritiesPolicyMetadata, AuthoritiesResult } from './authorities.types';
 /**
  * The main evaluation engine.
  *
@@ -19,15 +19,32 @@ import type { AuthoritiesEvaluationContext, AuthoritiesMetadata, AuthoritiesResu
 export declare class AuthoritiesEngine {
     private readonly profiles;
     private readonly evaluators;
+    /** Problems found per rule object, so a rule is validated once however often it is evaluated. */
+    private readonly ruleProblems;
     constructor(profiles: AuthoritiesProfileRegistry, evaluators: AuthoritiesEvaluatorRegistry);
+    /**
+     * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
+     * and each profile name it uses that no registered profile has. The server reports them when it
+     * starts; {@link evaluate} denies such a value (an unknown profile as `profile '…' is not registered`).
+     */
+    findRuleProblems(authorities: unknown): string[];
+    /**
+     * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}).
+     * The server reports them when it starts.
+     */
+    findProfileProblems(): string[];
     /**
      * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
+     *
+     * A value that is malformed or checks nothing (see {@link findAuthoritiesRuleProblems}) is denied.
      */
     evaluate(authorities: AuthoritiesMetadata, ctx: AuthoritiesEvaluationContext): Promise<AuthoritiesResult>;
     /**
      * Resolve and evaluate a single named profile.
      */
     private evaluateProfile;
+    /** Validate a rule, reusing the result for a rule object seen before. */
+    private problemsOf;
     /**
      * Evaluate an array of profile names (AND semantics).
      */
@@ -46,7 +63,8 @@ export declare class AuthoritiesEngine {
     private evaluateCustom;
     /**
      * Evaluate async guard functions in sequence.
-     * Each guard returns true (granted) or a string (denial message).
+     * Only `true` grants. A string is the denial message; anything else (`false`, but also
+     * `undefined` from a guard that forgot to return, `null`, `0` or an object) denies.
      */
     private evaluateGuards;
     /**
@@ -61,5 +79,10 @@ export declare class AuthoritiesEngine {
      * not combinator — inverts the nested policy result.
      */
     private evaluateNot;
+    /**
+     * The policy a profile name stands for when `evaluate()` is given that name, or `undefined`
+     * when no such profile is registered. Lets callers inspect a named rule without evaluating it.
+     */
+    resolveProfile(name: string): AuthoritiesPolicyMetadata | undefined;
 }
 //# sourceMappingURL=authorities.engine.d.ts.map

package/authorities/authorities.engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EAEnB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AAoB7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;OAEG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAe/G;;OAEG;YACW,eAAe;IAsB7B;;OAEG;YACW,oBAAoB;IAclC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;YACW,cAAc;IA2B5B;;;OAGG;YACW,cAAc;IAoB5B;;OAEG;YACW,aAAa;IAiB3B;;OAEG;YACW,aAAa;IAwB3B;;OAEG;YACW,WAAW;CAa1B"}
+{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AA0B7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;gBAG7C,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;;;OAIG;IACH,gBAAgB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE;IAShD;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAM/B;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB/G;;OAEG;YACW,eAAe;IAyB7B,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,oBAAoB;IAclC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;YACW,cAAc;IA2B5B;;;;OAIG;YACW,cAAc;IAyB5B;;OAEG;YACW,aAAa;IAiB3B;;OAEG;YACW,aAAa;IAwB3B;;OAEG;YACW,WAAW;IAczB;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;CAGpE"}

package/authorities/authorities.validation.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Structural validation for authorities rules.
+ *
+ * The engine evaluates only the fields it knows, so a rule that names no known check
+ * (`{}`, `{ roles: {} }`, `allOf: []`, a misspelled `role:`) used to grant everyone.
+ * These helpers find such rules so the server can refuse them when it starts, and the
+ * engine can deny them when they are evaluated anyway.
+ */
+/**
+ * Find what is wrong with an `authorities` value: a profile name, a list of profile names,
+ * or a rule object. Returns an empty list when the value checks something everywhere.
+ *
+ * A rule object must name at least one check (roles, permissions, attributes, relationships,
+ * custom, guards, allOf, anyOf or not), use only known fields, and leave no check empty;
+ * combinators hold rule objects, not profile names.
+ *
+ * @example
+ * findAuthoritiesRuleProblems({ role: { any: ['admin'] } });
+ * // ['has an unknown field "role"', 'checks nothing']
+ */
+export declare function findAuthoritiesRuleProblems(authorities: unknown): string[];
+/**
+ * Same as {@link findAuthoritiesRuleProblems}, for a named profile's rule. Problems read
+ * `profile "<name>": <problem>`.
+ */
+export declare function findAuthoritiesProfileProblems(name: string, policy: unknown): string[];
+//# sourceMappingURL=authorities.validation.d.ts.map

package/authorities/authorities.validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.validation.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgPH;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE,CAY1E;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAEtF"}

package/authorities/index.d.ts

@@ -10,6 +10,7 @@ export type { AuthoritiesClaimsMapping, AuthoritiesConfig, AuthoritiesScopeMappi
 export { resolveRequiredScopes } from './authorities.scope-mapping';
 export { rbacRolesPolicySchema, rbacPermissionsPolicySchema, abacOperatorSchema, abacConditionSchema, abacPolicySchema, resourceIdRefSchema, rebacPolicySchema, authoritiesPolicySchema, authoritiesMetadataSchema, authoritiesClaimsMappingSchema, authoritiesConfigSchema, } from './authorities.schema';
 export { AuthoritiesEngine } from './authorities.engine';
+export { findAuthoritiesRuleProblems, findAuthoritiesProfileProblems } from './authorities.validation';
 export { AuthoritiesContextBuilder, isAnonymousSubject } from './authorities.context';
 export type { ClaimsResolverFn } from './authorities.context';
 export { AuthoritiesEvaluatorRegistry, AuthoritiesProfileRegistry } from './authorities.registry';

package/authorities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorities/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,gCAAgC,CAAC;AAGxC,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACtF,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAGlG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorities/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,gCAAgC,CAAC;AAGxC,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAGvG,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACtF,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAGlG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}

package/authorization/dcr-client.registry.d.ts

@@ -49,6 +49,19 @@ export interface DcrRegistryConfig {
      */
     maxDynamicClients?: number;
 }
+/**
+ * Match `input` against a simple glob where `*` = any run of characters and
+ * every other character is matched literally (so a plain string with no `*` is
+ * an exact match). Full-string match. Used per-URI-COMPONENT by
+ * {@link globMatchRedirectUri} — on its own a `*` here still crosses any
+ * character, so it must only ever be applied within a single component.
+ *
+ * Implemented as a linear two-pointer scan (the classic wildcard-match
+ * algorithm) rather than compiling to a RegExp — this avoids the regex engine's
+ * backtracking entirely (no `.*.*` ReDoS surface) on the attacker-supplied
+ * `redirect_uri` we test allowlist patterns against.
+ */
+export declare function globMatch(pattern: string, input: string): boolean;
 /**
  * Local-AS DCR client registry. Seeded from `dcr.clients` at construction and
  * mutated by `POST /oauth/register` at runtime.

package/authorization/dcr-client.registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dcr-client.registry.d.ts","sourceRoot":"","sources":["../../src/authorization/dcr-client.registry.ts"],"names":[],"mappings":"AAgBA,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,EACtB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,GAAG,EAAE,OAAO,CAAC;IACb,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;IAChF,UAAU,CAAC,EAAE,KAAK,CAAC,oBAAoB,GAAG,eAAe,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAoHD;;;GAGG;AACH,qBAAa,iBAAiB;IAKhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAExB,MAAM,GAAE,iBAAsB;IAK3D,+EAA+E;IAC/E,OAAO,CAAC,wBAAwB;IAoBhC,yEAAyE;IACzE,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAInD;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS;IAcvG,oDAAoD;IACpD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO;IAY3C,+EAA+E;IAC/E,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,mBAAmB;IAM3B,sDAAsD;IACtD,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAOlD,mDAAmD;IACnD,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQ5C,wEAAwE;IACxE,0BAA0B,IAAI,OAAO;IAIrC;;;;OAIG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;CAajE"}
+{"version":3,"file":"dcr-client.registry.d.ts","sourceRoot":"","sources":["../../src/authorization/dcr-client.registry.ts"],"names":[],"mappings":"AAgBA,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,EACtB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,GAAG,EAAE,OAAO,CAAC;IACb,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;IAChF,UAAU,CAAC,EAAE,KAAK,CAAC,oBAAoB,GAAG,eAAe,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAyBjE;AA0ED;;;GAGG;AACH,qBAAa,iBAAiB;IAKhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAExB,MAAM,GAAE,iBAAsB;IAK3D,+EAA+E;IAC/E,OAAO,CAAC,wBAAwB;IAoBhC,yEAAyE;IACzE,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAInD;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS;IAcvG,oDAAoD;IACpD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO;IAY3C,+EAA+E;IAC/E,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,mBAAmB;IAM3B,sDAAsD;IACtD,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAOlD,mDAAmD;IACnD,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQ5C,wEAAwE;IACxE,0BAA0B,IAAI,OAAO;IAIrC;;;;OAIG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;CAajE"}