@honua/react 0.0.20-alpha.0 → 0.1.0-beta.0

package/core/auth/oauth2-provider.js

@@ -0,0 +1,408 @@
+/**
+ * OAuth2 authorization-code + PKCE provider.
+ *
+ * Implements {@link HonuaAuthProvider} (so it drops straight into
+ * `new HonuaClient({ auth })` and is attached/refreshed on every fetch and
+ * gRPC-web call) *and* exposes the interactive surface a browser app drives:
+ * `signIn()` (redirect or popup), `handleRedirectCallback()`, `signOut()`.
+ *
+ * Design highlights:
+ * - S256 PKCE + unguessable `state` (CSRF), validated on the redirect.
+ * - Silent refresh via `refresh_token` with a documented fallback
+ *   (`interaction_required`) when no refresh token is available.
+ * - Clock-skew-tolerant expiry so a refresh happens *before* requests 401.
+ * - **Single-flight refresh**: N concurrent `getCredentials()` calls that all
+ *   observe an expiring token share exactly one token-endpoint round-trip.
+ *
+ * @packageDocumentation
+ */
+import { HonuaAuthError } from "../errors.js";
+import { InMemoryCredentialStore } from "./credential-store.js";
+import { createPkcePair, createStateToken } from "./pkce.js";
+import { DEFAULT_CLOCK_SKEW_MS, isCredentialExpiring, requestToken, resolveServiceKey, toHonuaCredentials, } from "./token-endpoint.js";
+const TRANSACTION_NAMESPACE = "honua.auth.txn";
+/**
+ * OAuth2 authorization-code + PKCE provider. Construct via {@link oauth2}.
+ */
+export class OAuth2Provider {
+    config;
+    store;
+    serviceKey;
+    clockSkewMs;
+    mode;
+    fetchFn;
+    listeners = new Set();
+    /** Single-flight guard: one in-flight refresh shared by all callers. */
+    refreshInFlight;
+    /** In-memory transaction fallback when no Web Storage is available. */
+    memoryTransaction;
+    constructor(config) {
+        this.config = config;
+        this.store = config.store ?? new InMemoryCredentialStore();
+        this.serviceKey = resolveServiceKey(config.serviceKey, config.clientId, config.tokenEndpoint);
+        this.clockSkewMs = config.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS;
+        this.mode = config.mode ?? "redirect";
+        this.fetchFn = (config.fetchFn ?? fetch).bind(globalThis);
+        if (config.onEvent) {
+            this.listeners.add(config.onEvent);
+        }
+    }
+    // ── HonuaAuthProvider surface ────────────────────────────────
+    /**
+     * Resolve credentials for an outgoing request. Returns the current access
+     * token, silently refreshing it first when it is expiring (or when
+     * `context.forceRefresh` is set, e.g. after a 401). Throws
+     * {@link HonuaAuthError} `interaction_required` when there is no token and no
+     * refresh token — the app must call {@link OAuth2Provider.signIn}.
+     */
+    async getCredentials(context = { reason: "manual", forceRefresh: false }) {
+        const current = await this.store.get(this.serviceKey);
+        const needsRefresh = context.forceRefresh || isCredentialExpiring(current, this.clockSkewMs);
+        if (!needsRefresh && current) {
+            return toHonuaCredentials(current);
+        }
+        if (current?.refreshToken) {
+            const refreshed = await this.refreshSingleFlight(current);
+            return toHonuaCredentials(refreshed);
+        }
+        throw new HonuaAuthError("interaction_required", current
+            ? "Access token expired and no refresh token is available; call signIn() to re-authenticate."
+            : "No credential available; call signIn() to start the OAuth2 authorization-code flow.");
+    }
+    /** {@link HonuaAuthProvider.revokeCredentials} — clears + optionally revokes. */
+    async revokeCredentials(_credentials, _context) {
+        await this.signOut();
+    }
+    // ── Interactive flow ─────────────────────────────────────────
+    /**
+     * Start interactive sign-in. In `redirect` mode this navigates the current
+     * window to the authorization endpoint and returns a promise that never
+     * resolves (the page unloads); complete the flow by calling
+     * {@link OAuth2Provider.handleRedirectCallback} when the app reloads at the
+     * redirect URI. In `popup` mode it opens a popup, waits for the redirect back,
+     * exchanges the code, and resolves with the stored credential.
+     */
+    async signIn() {
+        const pkce = await createPkcePair();
+        const state = createStateToken();
+        const transaction = {
+            codeVerifier: pkce.codeVerifier,
+            state,
+            redirectUri: this.config.redirectUri,
+            createdAt: Date.now(),
+        };
+        const authorizeUrl = this.buildAuthorizeUrl(pkce, state);
+        if (this.mode === "popup") {
+            return this.signInPopup(authorizeUrl, transaction);
+        }
+        this.saveTransaction(transaction);
+        const win = this.requireWindow();
+        win.location.assign(authorizeUrl);
+        // The redirect unloads the page; never resolves.
+        return new Promise(() => { });
+    }
+    /**
+     * Whether `url` (or the current window location) looks like an OAuth2 redirect
+     * callback (carries `code`+`state` or an `error`). Call this on app load to
+     * decide whether to invoke {@link OAuth2Provider.handleRedirectCallback}.
+     */
+    isRedirectCallback(url) {
+        const target = this.parseUrl(url);
+        if (!target) {
+            return false;
+        }
+        return target.searchParams.has("error") || (target.searchParams.has("code") && target.searchParams.has("state"));
+    }
+    /**
+     * Complete the redirect leg: validate `state`, exchange the authorization
+     * `code` (+ PKCE verifier) for tokens, persist them, and emit `signed-in`.
+     */
+    async handleRedirectCallback(url) {
+        const target = this.parseUrl(url);
+        if (!target) {
+            throw new HonuaAuthError("interaction_required", "No redirect callback URL is available to process.");
+        }
+        const params = target.searchParams;
+        const authError = params.get("error");
+        if (authError) {
+            const description = params.get("error_description");
+            this.clearTransaction();
+            throw new HonuaAuthError("invalid_grant", `Authorization server returned an error: ${authError}${description ? ` (${description})` : ""}`);
+        }
+        const code = params.get("code");
+        const state = params.get("state");
+        if (!code) {
+            throw new HonuaAuthError("interaction_required", "Redirect callback is missing the authorization code.");
+        }
+        const transaction = this.loadTransaction();
+        if (!transaction) {
+            throw new HonuaAuthError("interaction_required", "No PKCE transaction is in progress; start sign-in with signIn() first.");
+        }
+        if (!state || state !== transaction.state) {
+            this.clearTransaction();
+            throw new HonuaAuthError("invalid_grant", "OAuth2 state mismatch on redirect callback (possible CSRF).");
+        }
+        const credential = await this.exchangeCode(code, transaction);
+        await this.store.set(this.serviceKey, credential);
+        this.clearTransaction();
+        this.emit({ type: "signed-in", credential });
+        return credential;
+    }
+    /** Whether a (non-expired) credential is currently stored. */
+    async isSignedIn() {
+        const current = await this.store.get(this.serviceKey);
+        return current !== undefined && !isCredentialExpiring(current, 0);
+    }
+    /** Read the raw stored credential, if any. */
+    getStoredCredential() {
+        return this.store.get(this.serviceKey);
+    }
+    /** Clear stored credentials, optionally revoke them, and emit `signed-out`. */
+    async signOut() {
+        const current = await this.store.get(this.serviceKey);
+        await this.store.delete(this.serviceKey);
+        this.clearTransaction();
+        this.refreshInFlight = undefined;
+        if (current && this.config.revocationEndpoint) {
+            await this.revokeAtEndpoint(current).catch(() => {
+                // Best-effort revocation; local sign-out already succeeded.
+            });
+        }
+        this.emit({ type: "signed-out" });
+    }
+    /** Register an auth lifecycle listener. */
+    on(listener) {
+        this.listeners.add(listener);
+        return {
+            remove: () => {
+                this.listeners.delete(listener);
+            },
+        };
+    }
+    // ── internals ────────────────────────────────────────────────
+    refreshSingleFlight(current) {
+        if (this.refreshInFlight) {
+            return this.refreshInFlight;
+        }
+        const inFlight = this.doRefresh(current).finally(() => {
+            if (this.refreshInFlight === inFlight) {
+                this.refreshInFlight = undefined;
+            }
+        });
+        this.refreshInFlight = inFlight;
+        return inFlight;
+    }
+    async doRefresh(current) {
+        const refreshToken = current.refreshToken;
+        if (!refreshToken) {
+            throw new HonuaAuthError("interaction_required", "No refresh token is available; call signIn().");
+        }
+        try {
+            const refreshed = await requestToken({
+                fetchFn: this.fetchFn,
+                tokenEndpoint: this.config.tokenEndpoint,
+                params: {
+                    grant_type: "refresh_token",
+                    refresh_token: refreshToken,
+                    client_id: this.config.clientId,
+                    ...(this.config.scopes && this.config.scopes.length > 0 ? { scope: this.config.scopes.join(" ") } : {}),
+                    ...this.config.extraTokenParams,
+                },
+                previous: current,
+            });
+            await this.store.set(this.serviceKey, refreshed);
+            this.emit({ type: "token-refreshed", credential: refreshed });
+            return refreshed;
+        }
+        catch (error) {
+            if (error instanceof HonuaAuthError) {
+                this.emit({ type: "refresh-failed", error });
+                if (error.code === "invalid_grant") {
+                    // The refresh token is dead; drop it so the next call surfaces
+                    // interaction_required instead of looping on a doomed refresh.
+                    await this.store.delete(this.serviceKey);
+                    this.emit({ type: "signed-out" });
+                }
+            }
+            throw error;
+        }
+    }
+    async exchangeCode(code, transaction) {
+        return requestToken({
+            fetchFn: this.fetchFn,
+            tokenEndpoint: this.config.tokenEndpoint,
+            params: {
+                grant_type: "authorization_code",
+                code,
+                redirect_uri: transaction.redirectUri,
+                client_id: this.config.clientId,
+                code_verifier: transaction.codeVerifier,
+                ...this.config.extraTokenParams,
+            },
+        });
+    }
+    async revokeAtEndpoint(credential) {
+        const endpoint = this.config.revocationEndpoint;
+        if (!endpoint) {
+            return;
+        }
+        const token = credential.refreshToken ?? credential.accessToken;
+        await this.fetchFn(endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ token, client_id: this.config.clientId }).toString(),
+        });
+    }
+    buildAuthorizeUrl(pkce, state) {
+        const url = new URL(this.config.authorizationEndpoint);
+        const params = url.searchParams;
+        params.set("response_type", "code");
+        params.set("client_id", this.config.clientId);
+        params.set("redirect_uri", this.config.redirectUri);
+        params.set("state", state);
+        params.set("code_challenge", pkce.codeChallenge);
+        params.set("code_challenge_method", pkce.codeChallengeMethod);
+        if (this.config.scopes && this.config.scopes.length > 0) {
+            params.set("scope", this.config.scopes.join(" "));
+        }
+        for (const [key, value] of Object.entries(this.config.extraAuthorizationParams ?? {})) {
+            params.set(key, value);
+        }
+        return url.toString();
+    }
+    async signInPopup(authorizeUrl, transaction) {
+        const win = this.requireWindow();
+        const popup = win.open(authorizeUrl, "honua-oauth", this.config.popupFeatures ?? "width=480,height=680");
+        if (!popup) {
+            throw new HonuaAuthError("interaction_required", "The sign-in popup was blocked by the browser.");
+        }
+        const redirectOrigin = new URL(transaction.redirectUri, win.location?.href ?? transaction.redirectUri).origin;
+        const callback = await new Promise((resolve, reject) => {
+            const timer = setInterval(() => {
+                try {
+                    if (popup.closed) {
+                        clearInterval(timer);
+                        reject(new HonuaAuthError("interaction_required", "The sign-in popup was closed before completing sign-in."));
+                        return;
+                    }
+                    let popupUrl;
+                    try {
+                        popupUrl = new URL(popup.location.href);
+                    }
+                    catch {
+                        // Cross-origin while on the authorization server — not readable yet.
+                        return;
+                    }
+                    if (popupUrl.origin === redirectOrigin && popupUrl.searchParams.has("code")) {
+                        clearInterval(timer);
+                        const code = popupUrl.searchParams.get("code") ?? "";
+                        const state = popupUrl.searchParams.get("state") ?? "";
+                        popup.close();
+                        resolve({ code, state });
+                    }
+                }
+                catch {
+                    // Ignore transient cross-origin access errors during the auth leg.
+                }
+            }, 200);
+        });
+        if (!callback.state || callback.state !== transaction.state) {
+            throw new HonuaAuthError("invalid_grant", "OAuth2 state mismatch on popup callback (possible CSRF).");
+        }
+        const credential = await this.exchangeCode(callback.code, transaction);
+        await this.store.set(this.serviceKey, credential);
+        this.emit({ type: "signed-in", credential });
+        return credential;
+    }
+    parseUrl(url) {
+        const href = url ?? this.getWindow()?.location?.href;
+        if (!href) {
+            return undefined;
+        }
+        try {
+            return new URL(href);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    getWindow() {
+        return this.config.windowRef ?? globalThis.window;
+    }
+    requireWindow() {
+        const win = this.getWindow();
+        if (!win) {
+            throw new HonuaAuthError("interaction_required", "Interactive OAuth2 sign-in requires a browser window; none is available in this environment.");
+        }
+        return win;
+    }
+    transactionKey() {
+        return `${TRANSACTION_NAMESPACE}:${this.serviceKey}`;
+    }
+    sessionStorage() {
+        return this.getWindow()?.sessionStorage;
+    }
+    saveTransaction(transaction) {
+        const storage = this.sessionStorage();
+        if (storage) {
+            storage.setItem(this.transactionKey(), JSON.stringify(transaction));
+            return;
+        }
+        this.memoryTransaction = transaction;
+    }
+    loadTransaction() {
+        const storage = this.sessionStorage();
+        if (storage) {
+            const raw = storage.getItem(this.transactionKey());
+            if (!raw) {
+                return undefined;
+            }
+            try {
+                return JSON.parse(raw);
+            }
+            catch {
+                return undefined;
+            }
+        }
+        return this.memoryTransaction;
+    }
+    clearTransaction() {
+        this.sessionStorage()?.removeItem(this.transactionKey());
+        this.memoryTransaction = undefined;
+    }
+    emit(event) {
+        for (const listener of this.listeners) {
+            try {
+                listener(event);
+            }
+            catch {
+                // Listener errors must not break the auth flow.
+            }
+        }
+    }
+}
+/**
+ * Create an OAuth2 authorization-code + PKCE {@link HonuaAuthProvider}.
+ *
+ * @example
+ * ```ts
+ * import { HonuaClient } from "@honua/sdk-js/honua";
+ * import { oauth2 } from "@honua/sdk-js/auth";
+ *
+ * const auth = oauth2({
+ *   authorizationEndpoint: "https://idp.example/authorize",
+ *   tokenEndpoint: "https://idp.example/token",
+ *   clientId: "my-app",
+ *   redirectUri: `${location.origin}/callback`,
+ *   scopes: ["openid", "profile"],
+ * });
+ * const client = new HonuaClient({ baseUrl: "https://api.example", auth });
+ *
+ * // On the callback page:
+ * if (auth.isRedirectCallback()) await auth.handleRedirectCallback();
+ * else if (!(await auth.isSignedIn())) await auth.signIn();
+ * ```
+ */
+export function oauth2(config) {
+    return new OAuth2Provider(config);
+}

package/core/auth/pkce.d.ts

@@ -0,0 +1,25 @@
+/**
+ * PKCE (RFC 7636) primitives built exclusively on WebCrypto.
+ *
+ * `globalThis.crypto` (the WebCrypto API) is available in browsers and in
+ * Node ≥20, so no `node:crypto` import — and therefore no bundler/runtime
+ * branch — is needed. This keeps the auth flow dependency-free and identical
+ * across environments.
+ *
+ * @packageDocumentation
+ */
+/**
+ * A PKCE code verifier + its S256 challenge. The verifier is high-entropy
+ * (32 random bytes → 43-char base64url string, within the RFC's 43–128 range);
+ * the challenge is `BASE64URL(SHA-256(verifier))`.
+ */
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+}
+/** Create a fresh PKCE verifier/challenge pair using SHA-256 (S256). */
+export declare function createPkcePair(): Promise<PkcePair>;
+/** Random, unguessable `state` value for CSRF protection on the redirect. */
+export declare function createStateToken(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/core/auth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA6BH;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,wEAAwE;AACxE,wBAAsB,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,CAQxD;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC"}

package/core/auth/pkce.js

@@ -0,0 +1,46 @@
+/**
+ * PKCE (RFC 7636) primitives built exclusively on WebCrypto.
+ *
+ * `globalThis.crypto` (the WebCrypto API) is available in browsers and in
+ * Node ≥20, so no `node:crypto` import — and therefore no bundler/runtime
+ * branch — is needed. This keeps the auth flow dependency-free and identical
+ * across environments.
+ *
+ * @packageDocumentation
+ */
+function requireWebCrypto() {
+    const cryptoRef = globalThis.crypto;
+    if (!cryptoRef?.subtle) {
+        throw new Error("WebCrypto (globalThis.crypto.subtle) is unavailable. OAuth2 PKCE requires a browser or Node.js >= 20.");
+    }
+    return cryptoRef;
+}
+/** Base64url-encode raw bytes (no padding), per RFC 7636 §A. */
+function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    const base64 = typeof btoa === "function" ? btoa(binary) : Buffer.from(bytes).toString("base64");
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** Cryptographically-random base64url string derived from `byteLength` bytes. */
+function randomBase64Url(byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    requireWebCrypto().getRandomValues(bytes);
+    return base64UrlEncode(bytes);
+}
+/** Create a fresh PKCE verifier/challenge pair using SHA-256 (S256). */
+export async function createPkcePair() {
+    const codeVerifier = randomBase64Url(32);
+    const digest = await requireWebCrypto().subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+    return {
+        codeVerifier,
+        codeChallenge: base64UrlEncode(new Uint8Array(digest)),
+        codeChallengeMethod: "S256",
+    };
+}
+/** Random, unguessable `state` value for CSRF protection on the redirect. */
+export function createStateToken() {
+    return randomBase64Url(16);
+}

package/core/auth/static-providers.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Static (non-interactive) {@link HonuaAuthProvider} built-ins for callers that
+ * already hold a long-lived credential.
+ *
+ * @packageDocumentation
+ */
+import type { HonuaAuthProvider } from "../types.js";
+/**
+ * Provider that attaches a static API key as `X-API-Key` on every request.
+ * Equivalent to `new HonuaClient({ apiKey })` but composable as an
+ * {@link HonuaAuthProvider}.
+ */
+export declare function apiKeyAuth(apiKey: string): HonuaAuthProvider;
+/**
+ * Provider that attaches a static bearer token as `Authorization: Bearer …`.
+ * Equivalent to `new HonuaClient({ bearerToken })` but composable as an
+ * {@link HonuaAuthProvider}.
+ */
+export declare function bearerTokenAuth(token: string): HonuaAuthProvider;
+//# sourceMappingURL=static-providers.d.ts.map

package/core/auth/static-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-providers.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/static-providers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAI5D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAIhE"}

package/core/auth/static-providers.js

@@ -0,0 +1,26 @@
+/**
+ * Static (non-interactive) {@link HonuaAuthProvider} built-ins for callers that
+ * already hold a long-lived credential.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Provider that attaches a static API key as `X-API-Key` on every request.
+ * Equivalent to `new HonuaClient({ apiKey })` but composable as an
+ * {@link HonuaAuthProvider}.
+ */
+export function apiKeyAuth(apiKey) {
+    return {
+        getCredentials: () => ({ apiKey }),
+    };
+}
+/**
+ * Provider that attaches a static bearer token as `Authorization: Bearer …`.
+ * Equivalent to `new HonuaClient({ bearerToken })` but composable as an
+ * {@link HonuaAuthProvider}.
+ */
+export function bearerTokenAuth(token) {
+    return {
+        getCredentials: () => ({ bearerToken: token }),
+    };
+}

package/core/auth/token-endpoint.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Shared helpers for talking to an OAuth2 token endpoint and turning responses
+ * into {@link StoredCredential}s. Used by both the PKCE and client-credentials
+ * providers.
+ *
+ * @packageDocumentation
+ */
+import type { HonuaAuthCredentials } from "../types.js";
+import type { OAuth2TokenResponse, StoredCredential } from "./types.js";
+/**
+ * Project a {@link StoredCredential} into the {@link HonuaAuthCredentials} shape
+ * the client attaches to requests. Non-`Bearer` token types are emitted as a
+ * full `Authorization` value; the expiry drives the client's own refresh skew.
+ */
+export declare function toHonuaCredentials(credential: StoredCredential): HonuaAuthCredentials;
+/** Resolve `serviceKey`, defaulting to `${clientId}@${endpoint origin}`. */
+export declare function resolveServiceKey(serviceKey: string | undefined, clientId: string, endpoint: string): string;
+/** Default clock-skew tolerance (ms) applied to credential expiry checks. */
+export declare const DEFAULT_CLOCK_SKEW_MS = 60000;
+/** True when a credential is missing or within `skewMs` of (or past) expiry. */
+export declare function isCredentialExpiring(credential: StoredCredential | undefined, skewMs: number): boolean;
+/** Map a token response into a {@link StoredCredential} (clock-skew tolerant). */
+export declare function credentialFromTokenResponse(response: OAuth2TokenResponse, previous?: StoredCredential): StoredCredential;
+/**
+ * POST an `application/x-www-form-urlencoded` grant to the token endpoint and
+ * return the parsed {@link StoredCredential}.
+ *
+ * Errors are normalized to {@link HonuaAuthError}: an `invalid_grant` OAuth
+ * error (expired/revoked/invalid grant → re-auth needed) maps to code
+ * `invalid_grant`; every other transport/HTTP/parse failure maps to
+ * `refresh_failed` (transient, retry may succeed).
+ */
+export declare function requestToken(options: {
+    fetchFn: typeof fetch;
+    tokenEndpoint: string;
+    params: Record<string, string>;
+    previous?: StoredCredential;
+    signal?: AbortSignal;
+}): Promise<StoredCredential>;
+//# sourceMappingURL=token-endpoint.d.ts.map

package/core/auth/token-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-endpoint.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/token-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,GAAG,oBAAoB,CAWrF;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW5G;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAE5C,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAQtG;AAED,kFAAkF;AAClF,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,gBAAgB,CAwBlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,OAAO,EAAE,OAAO,KAAK,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmD5B"}