@heyo-sh/heyo-cms 0.0.0-stage → 0.2.0

package/dist/types/auth.d.ts

@@ -0,0 +1,310 @@
+import type { Actor } from "./actor";
+import type { Duration } from "./config";
+import type { JsonObject } from "./json";
+/**
+ * The editor-facing side of authentication.
+ *
+ * The CMS authenticates editors and nothing else: there is no identity for
+ * the users of the application being built (section 0). Everything here is
+ * therefore about a small, known set of people — which is why invitations
+ * exist and open sign-up does not.
+ */
+export type CmsUserStatus = "active" | "invited" | "disabled";
+export interface CmsUser {
+    id: string;
+    email: string;
+    name: string | null;
+    status: CmsUserStatus;
+    roles: string[];
+    avatarUrl: string | null;
+    locale: string | null;
+    twoFactorEnabled: boolean;
+    lastLoginAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CmsSession {
+    id: string;
+    userId: string;
+    expiresAt: string;
+    createdAt: string;
+    ip: string | null;
+    userAgent: string | null;
+}
+/** Who is asking, as far as the transport could tell. */
+export interface RequestMeta {
+    ip?: string | null;
+    userAgent?: string | null;
+}
+/**
+ * A completed sign-in.
+ *
+ * `token` is the only moment the session secret exists in plaintext; the
+ * database holds its hash. The caller — a route in stage 7, a CLI, a test —
+ * decides whether it becomes a cookie or a bearer token.
+ */
+export interface SignedIn {
+    status: "signed-in";
+    token: string;
+    expiresAt: string;
+    session: CmsSession;
+    user: CmsUser;
+    actor: Actor;
+}
+/**
+ * A password that was correct, on an account that wants a second factor.
+ *
+ * Returning a session here and "upgrading" it later is the common shortcut
+ * and the common vulnerability: the challenge is a separate, short-lived
+ * secret that is worth nothing without the code.
+ */
+export interface TwoFactorRequired {
+    status: "two-factor-required";
+    challenge: string;
+    expiresAt: string;
+    userId: string;
+}
+export type SignInResult = SignedIn | TwoFactorRequired;
+/**
+ * A single-use secret handed back to the caller.
+ *
+ * The CMS never sends email. It mints the token and returns it; delivering it
+ * is the application's job, which is also why the matching event carries the
+ * user and not the secret — a webhook subscriber must not be able to sign in
+ * as somebody else.
+ */
+export interface IssuedToken {
+    token: string;
+    expiresAt: string;
+    userId: string;
+    email: string;
+}
+export interface ApiKeyRecord {
+    id: string;
+    name: string;
+    /** The visible head of the key, so a panel can tell two keys apart. */
+    prefix: string;
+    userId: string | null;
+    scopes: string[];
+    lastUsedAt: string | null;
+    expiresAt: string | null;
+    revokedAt: string | null;
+    createdAt: string;
+}
+export interface IssuedApiKey extends ApiKeyRecord {
+    /** Shown once and never recoverable. */
+    key: string;
+}
+export interface RoleRecord {
+    name: string;
+    label: string | null;
+    permissions: string[];
+    /** `config` roles are code; `database` roles are managed in the panel. */
+    source: "config" | "database";
+}
+export interface InviteResult extends IssuedToken {
+    user: CmsUser;
+}
+export interface TwoFactorSetup {
+    secret: string;
+    /** `otpauth://` — what the QR code in the panel encodes. */
+    uri: string;
+}
+export interface OAuthStart {
+    url: string;
+    state: string;
+}
+export interface UserListArgs {
+    limit?: number;
+    offset?: number;
+    status?: CmsUserStatus;
+    search?: string;
+}
+export interface CreateUserArgs {
+    email: string;
+    password?: string;
+    name?: string;
+    roles?: string[];
+    status?: CmsUserStatus;
+    locale?: string;
+}
+export interface UpdateUserArgs {
+    name?: string | null;
+    roles?: string[];
+    status?: CmsUserStatus;
+    locale?: string | null;
+    avatarUrl?: string | null;
+}
+export interface AuthUsersApi {
+    list(args?: UserListArgs): Promise<CmsUser[]>;
+    get(id: string): Promise<CmsUser | null>;
+    byEmail(email: string): Promise<CmsUser | null>;
+    count(): Promise<number>;
+    create(args: CreateUserArgs & {
+        actor?: Actor | null;
+    }): Promise<CmsUser>;
+    update(id: string, args: UpdateUserArgs & {
+        actor?: Actor | null;
+    }): Promise<CmsUser>;
+    remove(id: string, args?: {
+        actor?: Actor | null;
+    }): Promise<void>;
+    setPassword(id: string, password: string): Promise<void>;
+    /** Creates the account in `invited` state and mints a single-use token. */
+    invite(args: {
+        email: string;
+        roles?: string[];
+        name?: string;
+        actor?: Actor | null;
+    }): Promise<InviteResult>;
+    acceptInvite(args: {
+        token: string;
+        password?: string;
+        name?: string;
+    } & RequestMeta): Promise<SignedIn>;
+}
+/**
+ * The first account, before there is anybody to authorise it.
+ *
+ * The only unauthenticated write in the whole API, and it is safe for one
+ * reason: it is refused the moment a single account exists. `required()` is
+ * what the sign-in screen asks before it decides whether to draw a sign-in
+ * form or a "claim this deployment" form.
+ */
+export interface AuthSetupApi {
+    /** `true` while `cms_users` is empty and `admin.auth.firstUser` allows it. */
+    required(): Promise<boolean>;
+    /**
+     * Creates the first account and signs it in.
+     *
+     * Throws a 409 if an account already exists, including when it was created
+     * by another request a millisecond earlier: the count is taken inside the
+     * transaction that does the insert.
+     */
+    claim(args: {
+        email: string;
+        password: string;
+        name?: string;
+    } & RequestMeta): Promise<SignedIn>;
+}
+export interface AuthSessionsApi {
+    verify(token: string): Promise<SignedIn | null>;
+    list(userId: string): Promise<CmsSession[]>;
+    revoke(token: string): Promise<boolean>;
+    revokeById(id: string): Promise<boolean>;
+    revokeAll(userId: string): Promise<number>;
+    /** Deletes expired rows. Called by the session job in stage 9. */
+    cleanup(): Promise<number>;
+}
+export interface AuthPasswordApi {
+    signIn(args: {
+        email: string;
+        password: string;
+    } & RequestMeta): Promise<SignInResult>;
+    /** `null` for an unknown address: the response must not confirm accounts. */
+    requestReset(args: {
+        email: string;
+    }): Promise<IssuedToken | null>;
+    reset(args: {
+        token: string;
+        password: string;
+    }): Promise<CmsUser>;
+}
+export interface AuthMagicLinkApi {
+    request(args: {
+        email: string;
+    }): Promise<IssuedToken | null>;
+    verify(args: {
+        token: string;
+    } & RequestMeta): Promise<SignInResult>;
+}
+export interface AuthOAuthApi {
+    /** The provider URL plus the state that has to come back with the code. */
+    authorize(args: {
+        provider: string;
+        redirectUri: string;
+        redirectTo?: string;
+    }): Promise<OAuthStart>;
+    callback(args: {
+        provider: string;
+        code: string;
+        state: string;
+        redirectUri: string;
+    } & RequestMeta): Promise<SignInResult & {
+        redirectTo: string | null;
+    }>;
+}
+export interface AuthTwoFactorApi {
+    /** Mints a secret and returns the URI; the factor is not enabled yet. */
+    begin(userId: string): Promise<TwoFactorSetup>;
+    enable(args: {
+        userId: string;
+        code: string;
+    }): Promise<CmsUser>;
+    disable(userId: string): Promise<CmsUser>;
+    /** Exchanges a challenge plus a code for a session. */
+    complete(args: {
+        challenge: string;
+        code: string;
+    } & RequestMeta): Promise<SignedIn>;
+}
+export interface AuthApiKeysApi {
+    create(args: {
+        name: string;
+        userId?: string | null;
+        scopes?: string[];
+        expiresIn?: Duration;
+        actor?: Actor | null;
+    }): Promise<IssuedApiKey>;
+    list(args?: {
+        userId?: string;
+    }): Promise<ApiKeyRecord[]>;
+    revoke(id: string, args?: {
+        actor?: Actor | null;
+    }): Promise<boolean>;
+    /** Resolves a key to an actor and stamps `last_used_at`. */
+    verify(key: string): Promise<Actor | null>;
+}
+export interface AuthRolesApi {
+    list(): Promise<RoleRecord[]>;
+    create(args: {
+        name: string;
+        permissions: string[];
+        label?: string;
+    }): Promise<RoleRecord>;
+    update(name: string, args: {
+        permissions?: string[];
+        label?: string | null;
+    }): Promise<RoleRecord>;
+    remove(name: string): Promise<boolean>;
+    /** Flattened permissions for a set of role names, config and database. */
+    permissionsFor(roles: string[]): Promise<string[]>;
+}
+/**
+ * `cms.auth`.
+ *
+ * Everything an editor-facing route in stage 7 will call, available today
+ * without HTTP: the local API and the REST API have to share one
+ * implementation for the same reason `cms.api` and the document routes do.
+ */
+export interface CmsAuth {
+    /** Session cookie or `Authorization` header, whichever is present. */
+    actorFromRequest(request: Request): Promise<Actor | null>;
+    /** Session token or API key, by prefix. */
+    actorFromToken(token: string): Promise<Actor | null>;
+    /** The actor a user would have right now, with roles expanded. */
+    actorForUser(user: CmsUser): Promise<Actor>;
+    users: AuthUsersApi;
+    /** The first account, claimed from the sign-in screen. */
+    setup: AuthSetupApi;
+    sessions: AuthSessionsApi;
+    password: AuthPasswordApi;
+    magicLink: AuthMagicLinkApi;
+    oauth: AuthOAuthApi;
+    twoFactor: AuthTwoFactorApi;
+    apiKeys: AuthApiKeysApi;
+    roles: AuthRolesApi;
+}
+/** Claims an OIDC provider returned, before `mapRoles` sees them. */
+export type OidcClaims = JsonObject;
+//# sourceMappingURL=auth.d.ts.map

package/dist/types/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/types/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC;;;;;;;GAOG;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0EAA0E;IAC1E,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;CAC/B;AAED,MAAM,WAAW,YAAa,SAAQ,WAAW;IAC/C,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAChD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,GAC9C,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,2EAA2E;IAC3E,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1B,YAAY,CACV,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,GACtE,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B;;;;;;OAMG;IACH,KAAK,CACH,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,GACrE,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,kEAAkE;IAClE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvF,6EAA6E;IAC7E,YAAY,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,SAAS,CAAC,IAAI,EAAE;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,QAAQ,CACN,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,WAAW,GACd,OAAO,CAAC,YAAY,GAAG;QAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,QAAQ,CAAC;QACrB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,4DAA4D;IAC5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACtD,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,0EAA0E;IAC1E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACpD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,sEAAsE;IACtE,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC1D,2CAA2C;IAC3C,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,KAAK,EAAE,YAAY,CAAC;IACpB,0DAA0D;IAC1D,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC"}