@ghuri/socialauth 0.0.0-stage → 0.1.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ghuri contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,189 @@
-# Temporary Holding Version
+# @ghuri/socialauth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+"Log in with GitHub / Google / Facebook…" for [Ghuri](https://github.com/ghurijs/ghuri), like **django-allauth**'s
+`socialaccount`: configure providers in settings and include the URLs. Accounts are linked to users with the same
+tables as allauth, new users sign up automatically, existing users connect more providers, and SPAs and mobile apps get
+JSON endpoints. Built on [`@ghuri/oauth`](https://github.com/ghurijs/oauth); runs on Cloudflare Workers and Node.
+
+> Status: alpha (ARCHITECTURE.md §18). Needs `@ghuri/auth` 0.1.0-alpha.2 and `@ghuri/oauth`.
+
+```sh
+npm install @ghuri/socialauth @ghuri/oauth
+```
+
+## Setup
+
+```ts
+// src/settings.ts
+import { AuthConfig, ContentTypesConfig, SessionsConfig } from '@ghuri/auth'
+import { SocialAuthConfig } from '@ghuri/socialauth'
+
+INSTALLED_APPS: [ContentTypesConfig, AuthConfig, SessionsConfig, SocialAuthConfig, /* your apps */],
+SOCIALACCOUNT: {
+  PROVIDERS: {
+    github: { APP: { clientId: env.GITHUB_CLIENT_ID, secret: env.GITHUB_SECRET } },
+    google: { APP: { clientId: env.GOOGLE_CLIENT_ID, secret: env.GOOGLE_SECRET } },
+  },
+},
+```
+
+```ts
+// src/urls.ts
+import { authUrls } from '@ghuri/auth'
+import { socialUrls } from '@ghuri/socialauth'
+
+export const urlpatterns = [
+  path('accounts/', include(authUrls)),
+  path('accounts/', include(socialUrls)),
+]
+```
+
+```sh
+npx ghuri migrate
+```
+
+Register `https://<your host>/accounts/<provider>/login/callback/` as the redirect URI in each provider's console.
+
+A login button is a POST form (CSRF-protected, so other sites can't log your visitors in to their own account):
+
+```html
+<form method="post" action="/accounts/github/login/?next=/dashboard/">
+  <input type="hidden" name="csrfmiddlewaretoken" value="{csrfToken}">
+  <button>Continue with GitHub</button>
+</form>
+```
+
+A GET to the same URL shows a one-button confirmation page instead (or starts right away with `LOGIN_ON_GET: true`).
+
+## Providers
+
+| id | Notes |
+|---|---|
+| `github` | Profile from `/user`; the email is the primary **verified** one from `/user/emails`. `settings.webUrl` / `apiUrl` for GitHub Enterprise. |
+| `google` | OpenID Connect. |
+| `facebook` | Graph API (`VERSION`, default `v21.0`). Emails are treated as unverified unless `VERIFIED_EMAIL: true`. |
+| `microsoft` | Entra ID, OpenID Connect. `settings.tenant` (default `common`). Emails are never trusted by default (tenants can claim any address). |
+| `discord` | `verified` flag from `/users/@me`. |
+| `gitlab` | OpenID Connect; `settings.url` for self-hosted GitLab. |
+| `openid_connect` | Any OIDC issuer (Auth0, Okta, Keycloak, Cognito, Zitadel…), several apps at once: |
+
+```ts
+openid_connect: {
+  APPS: [
+    { providerId: 'okta', name: 'Okta', clientId: env.OKTA_ID, secret: env.OKTA_SECRET, settings: { serverUrl: 'https://acme.okta.com' } },
+  ],
+},
+// → /accounts/okta/login/
+```
+
+Per provider: `SCOPE` (replaces the defaults), `AUTH_PARAMS` (extra authorization parameters), `VERIFIED_EMAIL`.
+Credentials can also live in the database as `SocialApp` rows (managed in the admin); settings win.
+
+Your own provider: subclass `Provider`, return an `OAuth2Strategy` / `OIDCStrategy` from `createStrategy()`, and call
+`registerProvider(new MyProvider())`.
+
+## What happens on the callback
+
+1. **A linked account** (`SocialAccount` with this provider and uid) → its user logs in.
+2. **Connecting** (`?process=connect`, user logged in) → the account is linked to them. An account linked to someone
+   else is refused.
+3. **`EMAIL_AUTHENTICATION`** (off by default) and the provider says the email is **verified** and exactly one user has
+   it → link and log in. Unverified emails never link to existing users.
+4. **Sign up**: with `AUTO_SIGNUP` (default) the user is created from the profile (a free username, the email unless
+   another user has it, first/last name) with an unusable password. When something is missing or taken, the visitor
+   goes to `signup/` to fill it in.
+
+Then: redirect to a safe `next` or `LOGIN_REDIRECT_URL`. Errors redirect to `LOGIN_ERROR_URL` (default `LOGIN_URL`)
+with `?error=`.
+
+## URLs
+
+| | |
+|---|---|
+| `providers/` | JSON list of configured providers with their login URLs. |
+| `<provider>/login/` | POST starts the login (`?next=`, `?process=connect`). |
+| `<provider>/login/callback/` | The OAuth callback. |
+| `<provider>/token/` | Native apps: POST JSON `{ id_token }` (OIDC providers) or `{ access_token }` (GitHub, Facebook). The token is checked against your client id (`settings.audiences` adds iOS/Android client ids). |
+| `token/` | SPAs: POST JSON `{ code }` → `{ access, refresh, user }`. |
+| `signup/` | Finish a signup (HTML form or JSON). |
+| `connections/` | The user's linked accounts (GET); POST `{ account }` disconnects one. The last login method of a user without a password can't be removed. |
+
+## SPAs and mobile apps
+
+With `LOGIN_RESPONSE: 'jwt'` and `FRONTEND_URL`, the callback redirects to `FRONTEND_URL#code=<one-time code>`; the SPA
+posts the code to `token/` for a JWT pair. Tokens never appear in URLs; codes expire after 60 seconds and are refused on
+reuse while the cache remembers them. Native apps that sign in with the provider's SDK post the token to
+`<provider>/token/` instead and get a session (or the JWT pair with `LOGIN_RESPONSE: 'jwt'`).
+
+## Adapter and signals
+
+```ts
+import { ImmediateResponse, SocialAccountAdapter } from '@ghuri/socialauth'
+
+class Adapter extends SocialAccountAdapter {
+  isOpenForSignup(c, login) {
+    return login.profile.email?.endsWith('@acme.com') ?? false
+  }
+  async preSocialLogin(c, login) {
+    if (login.provider.id === 'facebook') throw new ImmediateResponse(c.text('Not here', 403))
+  }
+}
+
+SOCIALACCOUNT: { ADAPTER: Adapter }
+```
+
+Also: `isAutoSignupAllowed`, `newUser`, `populateUser`, `saveUser`, `generateUsername`, `getConnectRedirectUrl`,
+`authenticationError`. Signals: `preSocialLogin`, `socialAccountAdded`, `socialAccountUpdated`, `socialAccountRemoved`.
+
+## Provider tokens
+
+With `STORE_TOKENS: true`, access and refresh tokens are kept in `SocialToken`, encrypted with a key derived from
+`SECRET_KEY`. `await getAccessToken(account)` returns a usable token, refreshing it when it expired.
+
+## Admin
+
+```ts
+// src/admin.ts
+import '@ghuri/socialauth/admin'   // SocialApp, SocialAccount, SocialToken (tokens are never shown)
+```
+
+## Settings
+
+```ts
+SOCIALACCOUNT: {
+  PROVIDERS: {},
+  ADAPTER: SocialAccountAdapter,
+  AUTO_SIGNUP: true,
+  EMAIL_AUTHENTICATION: false,
+  EMAIL_REQUIRED: false,
+  LOGIN_ON_GET: false,
+  STORE_TOKENS: false,
+  LOGIN_RESPONSE: 'session',     // or 'jwt' (needs FRONTEND_URL)
+  FRONTEND_URL: undefined,
+  LOGIN_ERROR_URL: undefined,    // default LOGIN_URL
+}
+```
+
+## Testing
+
+```ts
+import { socialLogin } from '@ghuri/socialauth/testing'
+
+const res = await socialLogin(client, 'github', { id: '1', username: 'ann', email: 'ann@example.com', emailVerified: true })
+// the client is now logged in (or res redirects to signup/)
+```
+
+`socialLogin` runs the real views with a stand-in for the provider. To test a provider's own requests, use
+`mockOAuthProvider` from `@ghuri/oauth/testing`.
+
+## For django-allauth users
+
+| allauth | Ghuri |
+|---|---|
+| `INSTALLED_APPS += ['allauth.socialaccount', 'allauth.socialaccount.providers.github']` | `SocialAuthConfig` (all providers built in) |
+| `SOCIALACCOUNT_PROVIDERS = {'github': {'APP': {...}}}` | `SOCIALACCOUNT: { PROVIDERS: { github: { APP: { clientId, secret } } } }` |
+| `{% provider_login_url 'github' %}` | `reverse('socialaccount_login', { provider: 'github' })` |
+| `SOCIALACCOUNT_AUTO_SIGNUP`, `SOCIALACCOUNT_EMAIL_AUTHENTICATION`, `SOCIALACCOUNT_LOGIN_ON_GET`, `SOCIALACCOUNT_STORE_TOKENS` | `AUTO_SIGNUP`, `EMAIL_AUTHENTICATION`, `LOGIN_ON_GET`, `STORE_TOKENS` |
+| `DefaultSocialAccountAdapter` | `SocialAccountAdapter` |
+| `SocialAccount`, `SocialApp`, `SocialToken` (same tables) | same |
+| allauth headless `provider/token` | `<provider>/token/` |

package/dist/admin.d.ts

@@ -0,0 +1,22 @@
+import { ModelAdmin } from '@ghuri/admin';
+import { S as SocialAccount, a as SocialApp, b as SocialToken } from './models-Cepu1xG8.js';
+import '@ghuri/orm';
+
+declare class SocialAppAdmin extends ModelAdmin<SocialApp> {
+    listDisplay: string[];
+    listFilter: string[];
+    searchFields: string[];
+}
+declare class SocialAccountAdmin extends ModelAdmin<SocialAccount> {
+    listDisplay: string[];
+    listFilter: string[];
+    searchFields: string[];
+    readonlyFields: string[];
+}
+declare class SocialTokenAdmin extends ModelAdmin<SocialToken> {
+    listDisplay: string[];
+    exclude: string[];
+    readonlyFields: string[];
+}
+
+export { SocialAccountAdmin, SocialAppAdmin, SocialTokenAdmin };

package/dist/admin.js

@@ -0,0 +1,35 @@
+import {
+  SocialAccount,
+  SocialApp,
+  SocialToken
+} from "./chunk-ZNZG4OU3.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/admin.ts
+import { ModelAdmin, site } from "@ghuri/admin";
+var SocialAppAdmin = class extends ModelAdmin {
+  listDisplay = ["name", "provider", "providerId", "clientId"];
+  listFilter = ["provider"];
+  searchFields = ["name", "clientId", "providerId"];
+};
+var SocialAccountAdmin = class extends ModelAdmin {
+  listDisplay = ["user", "provider", "uid", "lastLogin", "dateJoined"];
+  listFilter = ["provider"];
+  searchFields = ["uid", "provider"];
+  readonlyFields = ["extraData", "lastLogin", "dateJoined"];
+};
+var SocialTokenAdmin = class extends ModelAdmin {
+  listDisplay = ["account", "app", "expiresAt"];
+  // Tokens are encrypted; never show or edit them in the admin.
+  exclude = ["token", "tokenSecret"];
+  readonlyFields = ["account", "app", "expiresAt"];
+};
+site.register(SocialApp, SocialAppAdmin);
+site.register(SocialAccount, SocialAccountAdmin);
+site.register(SocialToken, SocialTokenAdmin);
+export {
+  SocialAccountAdmin,
+  SocialAppAdmin,
+  SocialTokenAdmin
+};
+//# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/admin.ts"],"sourcesContent":["// @ghuri/socialauth/admin — import from your project's admin module to manage social apps and accounts:\n//   import '@ghuri/socialauth/admin'\nimport { ModelAdmin, site } from '@ghuri/admin'\nimport { SocialAccount, SocialApp, SocialToken } from './models'\n\nexport class SocialAppAdmin extends ModelAdmin<SocialApp> {\n  override listDisplay = ['name', 'provider', 'providerId', 'clientId']\n  override listFilter = ['provider']\n  override searchFields = ['name', 'clientId', 'providerId']\n}\n\nexport class SocialAccountAdmin extends ModelAdmin<SocialAccount> {\n  override listDisplay = ['user', 'provider', 'uid', 'lastLogin', 'dateJoined']\n  override listFilter = ['provider']\n  override searchFields = ['uid', 'provider']\n  override readonlyFields = ['extraData', 'lastLogin', 'dateJoined']\n}\n\nexport class SocialTokenAdmin extends ModelAdmin<SocialToken> {\n  override listDisplay = ['account', 'app', 'expiresAt']\n  // Tokens are encrypted; never show or edit them in the admin.\n  override exclude = ['token', 'tokenSecret']\n  override readonlyFields = ['account', 'app', 'expiresAt']\n}\n\nsite.register(SocialApp, SocialAppAdmin)\nsite.register(SocialAccount, SocialAccountAdmin)\nsite.register(SocialToken, SocialTokenAdmin)\n"],"mappings":";;;;;;;;AAEA,SAAS,YAAY,YAAY;AAG1B,IAAM,iBAAN,cAA6B,WAAsB;AAAA,EAC/C,cAAc,CAAC,QAAQ,YAAY,cAAc,UAAU;AAAA,EAC3D,aAAa,CAAC,UAAU;AAAA,EACxB,eAAe,CAAC,QAAQ,YAAY,YAAY;AAC3D;AAEO,IAAM,qBAAN,cAAiC,WAA0B;AAAA,EACvD,cAAc,CAAC,QAAQ,YAAY,OAAO,aAAa,YAAY;AAAA,EACnE,aAAa,CAAC,UAAU;AAAA,EACxB,eAAe,CAAC,OAAO,UAAU;AAAA,EACjC,iBAAiB,CAAC,aAAa,aAAa,YAAY;AACnE;AAEO,IAAM,mBAAN,cAA+B,WAAwB;AAAA,EACnD,cAAc,CAAC,WAAW,OAAO,WAAW;AAAA;AAAA,EAE5C,UAAU,CAAC,SAAS,aAAa;AAAA,EACjC,iBAAiB,CAAC,WAAW,OAAO,WAAW;AAC1D;AAEA,KAAK,SAAS,WAAW,cAAc;AACvC,KAAK,SAAS,eAAe,kBAAkB;AAC/C,KAAK,SAAS,aAAa,gBAAgB;","names":[]}

package/dist/chunk-PZ5AY32C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/chunk-PZ5AY32C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-ZNZG4OU3.js

@@ -0,0 +1,77 @@
+// src/models.ts
+import { getUserModel } from "@ghuri/auth";
+import {
+  CASCADE,
+  CharField,
+  DateTimeField,
+  ForeignKey,
+  JSONField,
+  Model,
+  TextField
+} from "@ghuri/orm";
+var userModel = () => getUserModel();
+function emptyDict() {
+  return {};
+}
+var SocialApp = class extends Model({
+  provider: new CharField({ maxLength: 30, verboseName: "provider" }),
+  /** For providers with several apps (`openid_connect`): the id used in URLs. */
+  providerId: new CharField({ maxLength: 200, blank: true, verboseName: "provider ID" }),
+  name: new CharField({ maxLength: 40, verboseName: "name" }),
+  clientId: new CharField({ maxLength: 191, verboseName: "client id" }),
+  secret: new CharField({ maxLength: 191, blank: true, verboseName: "secret key" }),
+  key: new CharField({ maxLength: 191, blank: true, verboseName: "key" }),
+  settings: new JSONField({ default: emptyDict, blank: true, verboseName: "settings" })
+}) {
+  static Meta = {
+    dbTable: "socialaccount_socialapp",
+    verboseName: "social application",
+    verboseNamePlural: "social applications"
+  };
+  toString() {
+    return this.name;
+  }
+};
+var SocialAccount = class extends Model({
+  user: new ForeignKey(userModel, { onDelete: CASCADE, relatedName: "socialAccounts", verboseName: "user" }),
+  /** The provider id (`github`, or the `providerId` of an OpenID Connect app). */
+  provider: new CharField({ maxLength: 200, verboseName: "provider" }),
+  uid: new CharField({ maxLength: 191, verboseName: "uid" }),
+  lastLogin: new DateTimeField({ autoNow: true, verboseName: "last login" }),
+  dateJoined: new DateTimeField({ autoNowAdd: true, verboseName: "date joined" }),
+  /** The provider's raw profile. */
+  extraData: new JSONField({ default: emptyDict, verboseName: "extra data" })
+}) {
+  static Meta = {
+    dbTable: "socialaccount_socialaccount",
+    uniqueTogether: [["provider", "uid"]],
+    verboseName: "social account",
+    verboseNamePlural: "social accounts"
+  };
+  toString() {
+    return `${this.provider}:${this.uid}`;
+  }
+};
+var SocialToken = class extends Model({
+  app: new ForeignKey(() => SocialApp, { onDelete: CASCADE, null: true, blank: true }),
+  account: new ForeignKey(() => SocialAccount, { onDelete: CASCADE, relatedName: "tokens" }),
+  token: new TextField({ verboseName: "token" }),
+  /** The refresh token (allauth's name). */
+  tokenSecret: new TextField({ blank: true, verboseName: "token secret" }),
+  expiresAt: new DateTimeField({ null: true, blank: true, verboseName: "expires at" })
+}) {
+  static Meta = {
+    dbTable: "socialaccount_socialtoken",
+    uniqueTogether: [["app", "account"]],
+    verboseName: "social application token",
+    verboseNamePlural: "social application tokens"
+  };
+};
+
+export {
+  emptyDict,
+  SocialApp,
+  SocialAccount,
+  SocialToken
+};
+//# sourceMappingURL=chunk-ZNZG4OU3.js.map

package/dist/chunk-ZNZG4OU3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/models.ts"],"sourcesContent":["// django-allauth's socialaccount models (same table names): apps, linked accounts, provider tokens.\nimport { getUserModel } from '@ghuri/auth'\nimport {\n  CASCADE,\n  CharField,\n  DateTimeField,\n  ForeignKey,\n  JSONField,\n  type Manager,\n  Model,\n  type ModelClass,\n  TextField,\n} from '@ghuri/orm'\n\nconst userModel = () => getUserModel() as unknown as ModelClass\n\n/** Default of the JSON fields (a named function, so migrations can reference it). */\nexport function emptyDict(): Record<string, unknown> {\n  return {}\n}\n\n/** Provider credentials kept in the database (alternative to `SOCIALACCOUNT.PROVIDERS.<id>.APP`). */\nexport class SocialApp extends Model({\n  provider: new CharField({ maxLength: 30, verboseName: 'provider' }),\n  /** For providers with several apps (`openid_connect`): the id used in URLs. */\n  providerId: new CharField({ maxLength: 200, blank: true, verboseName: 'provider ID' }),\n  name: new CharField({ maxLength: 40, verboseName: 'name' }),\n  clientId: new CharField({ maxLength: 191, verboseName: 'client id' }),\n  secret: new CharField({ maxLength: 191, blank: true, verboseName: 'secret key' }),\n  key: new CharField({ maxLength: 191, blank: true, verboseName: 'key' }),\n  settings: new JSONField({ default: emptyDict, blank: true, verboseName: 'settings' }),\n}) {\n  static Meta = {\n    dbTable: 'socialaccount_socialapp',\n    verboseName: 'social application',\n    verboseNamePlural: 'social applications',\n  }\n  declare static objects: Manager<SocialApp>\n\n  override toString(): string {\n    return this.name\n  }\n}\n\n/** A provider account linked to a user. */\nexport class SocialAccount extends Model({\n  user: new ForeignKey(userModel, { onDelete: CASCADE, relatedName: 'socialAccounts', verboseName: 'user' }),\n  /** The provider id (`github`, or the `providerId` of an OpenID Connect app). */\n  provider: new CharField({ maxLength: 200, verboseName: 'provider' }),\n  uid: new CharField({ maxLength: 191, verboseName: 'uid' }),\n  lastLogin: new DateTimeField({ autoNow: true, verboseName: 'last login' }),\n  dateJoined: new DateTimeField({ autoNowAdd: true, verboseName: 'date joined' }),\n  /** The provider's raw profile. */\n  extraData: new JSONField({ default: emptyDict, verboseName: 'extra data' }),\n}) {\n  static Meta = {\n    dbTable: 'socialaccount_socialaccount',\n    uniqueTogether: [['provider', 'uid']],\n    verboseName: 'social account',\n    verboseNamePlural: 'social accounts',\n  }\n  declare static objects: Manager<SocialAccount>\n\n  override toString(): string {\n    return `${this.provider}:${this.uid}`\n  }\n}\n\n/** Provider tokens (only with `STORE_TOKENS`), encrypted at rest. Read them with `getAccessToken()`. */\nexport class SocialToken extends Model({\n  app: new ForeignKey(() => SocialApp, { onDelete: CASCADE, null: true, blank: true }),\n  account: new ForeignKey(() => SocialAccount, { onDelete: CASCADE, relatedName: 'tokens' }),\n  token: new TextField({ verboseName: 'token' }),\n  /** The refresh token (allauth's name). */\n  tokenSecret: new TextField({ blank: true, verboseName: 'token secret' }),\n  expiresAt: new DateTimeField({ null: true, blank: true, verboseName: 'expires at' }),\n}) {\n  static Meta = {\n    dbTable: 'socialaccount_socialtoken',\n    uniqueTogether: [['app', 'account']],\n    verboseName: 'social application token',\n    verboseNamePlural: 'social application tokens',\n  }\n  declare static objects: Manager<SocialToken>\n}\n"],"mappings":";AACA,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAEA;AAAA,OACK;AAEP,IAAM,YAAY,MAAM,aAAa;AAG9B,SAAS,YAAqC;AACnD,SAAO,CAAC;AACV;AAGO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,UAAU,IAAI,UAAU,EAAE,WAAW,IAAI,aAAa,WAAW,CAAC;AAAA;AAAA,EAElE,YAAY,IAAI,UAAU,EAAE,WAAW,KAAK,OAAO,MAAM,aAAa,cAAc,CAAC;AAAA,EACrF,MAAM,IAAI,UAAU,EAAE,WAAW,IAAI,aAAa,OAAO,CAAC;AAAA,EAC1D,UAAU,IAAI,UAAU,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;AAAA,EACpE,QAAQ,IAAI,UAAU,EAAE,WAAW,KAAK,OAAO,MAAM,aAAa,aAAa,CAAC;AAAA,EAChF,KAAK,IAAI,UAAU,EAAE,WAAW,KAAK,OAAO,MAAM,aAAa,MAAM,CAAC;AAAA,EACtE,UAAU,IAAI,UAAU,EAAE,SAAS,WAAW,OAAO,MAAM,aAAa,WAAW,CAAC;AACtF,CAAC,EAAE;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,SAAS;AAAA,IACT,aAAa;AAAA,IACb,mBAAmB;AAAA,EACrB;AAAA,EAGS,WAAmB;AAC1B,WAAO,KAAK;AAAA,EACd;AACF;AAGO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,MAAM,IAAI,WAAW,WAAW,EAAE,UAAU,SAAS,aAAa,kBAAkB,aAAa,OAAO,CAAC;AAAA;AAAA,EAEzG,UAAU,IAAI,UAAU,EAAE,WAAW,KAAK,aAAa,WAAW,CAAC;AAAA,EACnE,KAAK,IAAI,UAAU,EAAE,WAAW,KAAK,aAAa,MAAM,CAAC;AAAA,EACzD,WAAW,IAAI,cAAc,EAAE,SAAS,MAAM,aAAa,aAAa,CAAC;AAAA,EACzE,YAAY,IAAI,cAAc,EAAE,YAAY,MAAM,aAAa,cAAc,CAAC;AAAA;AAAA,EAE9E,WAAW,IAAI,UAAU,EAAE,SAAS,WAAW,aAAa,aAAa,CAAC;AAC5E,CAAC,EAAE;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,SAAS;AAAA,IACT,gBAAgB,CAAC,CAAC,YAAY,KAAK,CAAC;AAAA,IACpC,aAAa;AAAA,IACb,mBAAmB;AAAA,EACrB;AAAA,EAGS,WAAmB;AAC1B,WAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,GAAG;AAAA,EACrC;AACF;AAGO,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,KAAK,IAAI,WAAW,MAAM,WAAW,EAAE,UAAU,SAAS,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,EACnF,SAAS,IAAI,WAAW,MAAM,eAAe,EAAE,UAAU,SAAS,aAAa,SAAS,CAAC;AAAA,EACzF,OAAO,IAAI,UAAU,EAAE,aAAa,QAAQ,CAAC;AAAA;AAAA,EAE7C,aAAa,IAAI,UAAU,EAAE,OAAO,MAAM,aAAa,eAAe,CAAC;AAAA,EACvE,WAAW,IAAI,cAAc,EAAE,MAAM,MAAM,OAAO,MAAM,aAAa,aAAa,CAAC;AACrF,CAAC,EAAE;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,SAAS;AAAA,IACT,gBAAgB,CAAC,CAAC,OAAO,SAAS,CAAC;AAAA,IACnC,aAAa;AAAA,IACb,mBAAmB;AAAA,EACrB;AAEF;","names":[]}