@hawcx/oauth-client 0.2.0 → 4.0.1

package/dist/stepup/client.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StepUpClient = void 0;
+const factory_1 = require("../delegation/factory");
+const exceptions_1 = require("../delegation/exceptions");
+class StepUpClient {
+    constructor(options) {
+        this.transport = options.transport;
+        this.options = options.clientOptions;
+        this.apiKey = options.apiKey;
+    }
+    static fromSecretKey(options) {
+        const { apiKey } = options;
+        const transport = (0, factory_1.buildTransportFromSecretKey)(options);
+        return new StepUpClient({ transport, clientOptions: options, apiKey });
+    }
+    static fromKeys(options) {
+        const { apiKey } = options;
+        const transport = (0, factory_1.buildTransportFromKeys)(options);
+        return new StepUpClient({ transport, clientOptions: options, apiKey });
+    }
+    buildExtraHeaders() {
+        const headers = {
+            'X-Hawcx-Protocol-Version': '1',
+            ...(this.options.extraHeaders || {}),
+        };
+        if (this.apiKey) {
+            headers['apikey'] = this.apiKey;
+        }
+        if (this.options.relyingParty) {
+            headers['X-Relying-Party'] = this.options.relyingParty;
+        }
+        if (this.options.tenantHeaderName && this.options.tenantHeaderValue) {
+            headers[this.options.tenantHeaderName] = this.options.tenantHeaderValue;
+        }
+        return headers;
+    }
+    async startToken(options) {
+        try {
+            const apiPrefix = this.options.apiPrefix ?? '/v1';
+            const payload = {
+                subject_userid: options.userId,
+                purpose: options.purpose,
+            };
+            if (options.newMfaMethod) {
+                payload.new_mfa_method = options.newMfaMethod;
+            }
+            if (options.newPhoneNumber) {
+                payload.new_phone_number = options.newPhoneNumber;
+            }
+            return (await this.transport.send({
+                endpoint: `${apiPrefix}/management/stepup/start-token`,
+                payload,
+                headers: this.buildExtraHeaders(),
+            }));
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationError) {
+                throw error;
+            }
+            throw new exceptions_1.DelegationRequestError('stepup.start-token failed', { cause: error });
+        }
+    }
+    async consumeReceipt(options) {
+        try {
+            const apiPrefix = this.options.apiPrefix ?? '/v1';
+            return (await this.transport.send({
+                endpoint: `${apiPrefix}/management/stepup/consume`,
+                payload: {
+                    step_up_receipt: options.receipt,
+                },
+                headers: this.buildExtraHeaders(),
+            }));
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationError) {
+                throw error;
+            }
+            throw new exceptions_1.DelegationRequestError('stepup.consume failed', { cause: error });
+        }
+    }
+}
+exports.StepUpClient = StepUpClient;
+//# sourceMappingURL=client.js.map

package/dist/stepup/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/stepup/client.ts"],"names":[],"mappings":";;;AACA,mDAAmH;AACnH,yDAAmF;AAgBnF,MAAa,YAAY;IAKvB,YAAY,OAIX;QACC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAqC;QACxD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAA+B;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAEO,iBAAiB;QACvB,MAAM,OAAO,GAA2B;YACtC,0BAA0B,EAAE,GAAG;YAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;SACrC,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAA2B;QAC1C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;YAClD,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,OAAO,CAAC,MAAM;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC;YACF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC;YAChD,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,OAAO,CAAC,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;YACpD,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAG/B;gBACA,QAAQ,EAAE,GAAG,SAAS,gCAAgC;gBACtD,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAClC,CAAC,CAA6B,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAA6B;QAChD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;YAClD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAG/B;gBACA,QAAQ,EAAE,GAAG,SAAS,4BAA4B;gBAClD,OAAO,EAAE;oBACP,eAAe,EAAE,OAAO,CAAC,OAAO;iBACjC;gBACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAClC,CAAC,CAA0B,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;CACF;AA/FD,oCA+FC"}

package/dist/stepup/index.d.ts

@@ -0,0 +1,3 @@
+export * from './client';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/stepup/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/stepup/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC"}

package/dist/stepup/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./client"), exports);
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/stepup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/stepup/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,0CAAwB"}

package/dist/stepup/types.d.ts

@@ -0,0 +1,36 @@
+export type StepUpPurpose = 'change_mfa_method' | 'change_phone_number';
+export type HxAuthMfaMethod = 'sms_otp' | 'email_otp' | 'totp';
+export interface StepUpStartTokenResponse {
+    start_token: string;
+    expires_in: number;
+}
+export interface StepUpConsumeResponse {
+    ok: boolean;
+}
+export interface StepUpStartOptions {
+    userId: string;
+    purpose: StepUpPurpose;
+    newMfaMethod?: HxAuthMfaMethod;
+    newPhoneNumber?: string;
+}
+export interface StepUpConsumeOptions {
+    receipt: string;
+}
+export interface StepUpClientBaseOptions {
+    /** Base URL to hx_auth, e.g. http://localhost:8000 */
+    baseUrl: string;
+    /** API version prefix (default: /v1) */
+    apiPrefix?: string;
+    /** Required by hx_auth for tenant routing in most deployments (forwarded via headers). */
+    tenantHeaderName?: string;
+    tenantHeaderValue?: string;
+    /** Required by hx_auth relying party validation. */
+    relyingParty?: string;
+    /** Optional additional headers (e.g., apikey) */
+    extraHeaders?: Record<string, string>;
+    /** Request timeout in seconds (default: 15) */
+    timeoutSeconds?: number;
+    /** Allowed response timestamp skew in seconds (default: 300) */
+    clockSkewSeconds?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/stepup/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/stepup/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,mBAAmB,GAAG,qBAAqB,CAAC;AAExE,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAE/D,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/stepup/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/stepup/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/stepup/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@hawcx/oauth-client",
-  "version": "0.2.0",
-  "description": "Lightweight OAuth client for exchanging authorization codes and verifying JWT claims with Hawcx delegation support",
+  "version": "4.0.1",
+  "description": "Simple OAuth client for Hawcx authentication with delegation support",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
     "build": "tsc",
     "test": "jest",
-    "test:coverage": "jest --coverage",
     "lint": "eslint 'src/**/*.ts'",
     "format": "prettier --write 'src/**/*.ts'",
     "prepublishOnly": "npm run build"
@@ -16,25 +15,27 @@
     "oauth",
     "jwt",
     "authentication",
-    "oauth2",
-    "verification",
     "hawcx",
+    "pkce",
     "mfa",
-    "delegation",
-    "pkce"
+    "delegation"
   ],
   "author": "Hawcx Team",
-  "license": "MIT",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/hawcx/hawcx_node_oauth_client.git"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
   "dependencies": {
-    "jsonwebtoken": "^9.0.2",
-    "axios": "^1.6.0",
-    "uuid": "^9.0.0"
+    "jose": "^5.10.0"
   },
   "devDependencies": {
     "@types/jest": "^29.5.0",
-    "@types/jsonwebtoken": "^9.0.5",
     "@types/node": "^20.10.0",
-    "@types/uuid": "^9.0.0",
     "@typescript-eslint/eslint-plugin": "^6.0.0",
     "@typescript-eslint/parser": "^6.0.0",
     "eslint": "^8.50.0",
@@ -44,12 +45,10 @@
     "typescript": "^5.3.0"
   },
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=18.0.0"
   },
   "files": [
     "dist",
-    "README.md",
-    "LICENSE"
+    "README.md"
   ]
 }
-

package/LICENSE

@@ -1,22 +0,0 @@
-MIT License
-
-Copyright (c) 2024 Hawcx
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-

package/dist/client.d.ts

@@ -1,134 +0,0 @@
-/**
- * Core OAuth client implementation
- */
-/**
- * Options for exchanging authorization code for claims
- */
-export interface ExchangeCodeOptions {
-    /** Authorization code from OAuth flow */
-    code: string;
-    /** Token endpoint URL */
-    oauthTokenUrl: string;
-    /** OAuth client identifier */
-    clientId: string;
-    /** Ed25519 public key (PEM string or file path) - optional if jwksUrl provided */
-    publicKey?: string;
-    /** JWKS URL for dynamic key fetching (alternative to publicKey) */
-    jwksUrl?: string;
-    /** API key for OAuth provider (required for Hawcx) */
-    apiKey: string;
-    /** PKCE code verifier (optional, recommended for security) */
-    codeVerifier?: string;
-    /** OAuth redirect URI (optional, required by some providers) */
-    redirectUri?: string;
-    /** Request timeout in seconds (default: 20) */
-    timeout?: number;
-    /** Expected 'aud' claim (optional but recommended) */
-    audience?: string;
-    /** Expected 'iss' claim (optional but recommended) */
-    issuer?: string;
-    /** Verify token expiration (default: true) */
-    verifyExp?: boolean;
-    /** Clock skew tolerance in seconds (default: 0) */
-    leeway?: number;
-    /** List of allowed signing algorithms (default: RS256, ES256/384/512, EdDSA) */
-    algorithms?: string[];
-}
-/**
- * Options for verifying JWT tokens
- */
-export interface VerifyJwtOptions {
-    /** JWT token to verify */
-    token: string;
-    /** Public key for JWT verification (PEM string or file path) - optional if jwksUrl provided */
-    publicKey?: string;
-    /** JWKS URL for dynamic key fetching (alternative to publicKey) */
-    jwksUrl?: string;
-    /** Expected 'aud' claim (optional but recommended) */
-    audience?: string;
-    /** Expected 'iss' claim (optional but recommended) */
-    issuer?: string;
-    /** Verify token expiration (default: true) */
-    verifyExp?: boolean;
-    /** Clock skew tolerance in seconds (default: 0) */
-    leeway?: number;
-    /** List of allowed signing algorithms (default: RS256, ES256/384/512, EdDSA) */
-    algorithms?: string[];
-}
-/**
- * Exchange OAuth authorization code for verified JWT claims.
- *
- * Supports PKCE (Proof Key for Code Exchange) per RFC 7636 for enhanced security.
- *
- * @param options - Configuration options for code exchange
- * @returns Dictionary containing the verified JWT claims
- * @throws OAuthExchangeError - Code exchange failed
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- *
- * @example
- * ```typescript
- * // Basic usage
- * const claims = await exchangeCodeForClaims({
- *   code: req.body.code,
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: '/path/to/public.pem'
- * });
- *
- * // With PKCE (recommended)
- * const claims = await exchangeCodeForClaims({
- *   code: req.body.code,
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: process.env.OAUTH_PUBLIC_KEY!,
- *   codeVerifier: session.pkceVerifier,
- *   redirectUri: 'https://myapp.com/callback',
- *   audience: 'my-app',
- *   issuer: 'https://oauth.example.com'
- * });
- * ```
- */
-export declare function exchangeCodeForClaims(options: ExchangeCodeOptions): Promise<Record<string, any>>;
-/**
- * Exchange OAuth authorization code for verified JWT claims and the raw id_token.
- *
- * @param options - Configuration options for code exchange
- * @returns Tuple containing [claims, idToken]
- * @throws OAuthExchangeError - Code exchange failed
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- */
-export declare function exchangeCodeForTokenAndClaims(options: ExchangeCodeOptions): Promise<[Record<string, any>, string]>;
-/**
- * Verify a JWT and return its claims.
- *
- * This function verifies the JWT signature using the provided public key
- * and validates claims (audience, issuer, expiration).
- *
- * @param options - Configuration options for JWT verification
- * @returns Dictionary containing the verified JWT claims
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- *
- * @example
- * ```typescript
- * // Basic usage
- * const claims = verifyJwt({
- *   token: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...',
- *   publicKey: 'keys/public.pem'
- * });
- * console.log(`User: ${claims.sub}`);
- *
- * // With validation
- * const claims = verifyJwt({
- *   token: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...',
- *   publicKey: process.env.OAUTH_PUBLIC_KEY!,
- *   audience: 'my-app',
- *   issuer: 'https://oauth.example.com',
- *   leeway: 10  // Allow 10 seconds clock skew
- * });
- * ```
- */
-export declare function verifyJwt(options: VerifyJwtOptions): Promise<Record<string, any>>;
-//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAgED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAwE9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAiDxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAkHvF"}