@mx-space/cli 0.1.0

package/dist/auth-DIFZzoMm.mjs

@@ -0,0 +1,211 @@
+import { s as MxsError } from "./output-BM7aBFwt.mjs";
+import { c as readCredentials, d as writeCredentials } from "./config-store-DIu7x0ao.mjs";
+//#region src/core/auth.ts
+const SUPPORTED_API_VERSIONS = [2];
+function defaultHttp() {
+	return { fetch: globalThis.fetch.bind(globalThis) };
+}
+async function probeAuthEndpoint(apiUrl, http = defaultHttp()) {
+	const candidates = [...SUPPORTED_API_VERSIONS.map((v) => ({
+		prefix: `/api/v${v}/auth`,
+		version: v
+	})), {
+		prefix: "/auth",
+		version: null
+	}];
+	for (const cand of candidates) {
+		const probeUrl = `${apiUrl}${cand.prefix}/ok`;
+		let res;
+		try {
+			res = await http.fetch(probeUrl, { method: "GET" });
+		} catch {
+			continue;
+		}
+		if (res.ok) {
+			const apiVersion = cand.version ?? SUPPORTED_API_VERSIONS[0];
+			return {
+				apiUrl,
+				apiBase: cand.prefix === "/auth" ? apiUrl : `${apiUrl}/api/v${apiVersion}`,
+				authBase: `${apiUrl}${cand.prefix}`,
+				apiVersion
+			};
+		}
+	}
+	throw new MxsError({
+		code: "auth.probe",
+		message: "cannot detect auth endpoint",
+		hint: "verify the URL points at a running mx-core server"
+	});
+}
+async function requestDeviceCode(authBase, clientId, scope = "openid profile email", http = defaultHttp()) {
+	const res = await http.fetch(`${authBase}/device/code`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			client_id: clientId,
+			scope
+		})
+	});
+	if (!res.ok) {
+		let body;
+		try {
+			body = await res.json();
+		} catch {
+			body = await res.text();
+		}
+		throw new MxsError({
+			code: "auth.denied",
+			message: `device code request failed (${res.status})`,
+			details: body
+		});
+	}
+	return await res.json();
+}
+async function pollDeviceToken(authBase, clientId, deviceCode, opts) {
+	const http = opts.http ?? defaultHttp();
+	const deadline = Date.now() + opts.expiresInSec * 1e3;
+	let intervalMs = Math.max(1, opts.intervalSec) * 1e3;
+	while (Date.now() < deadline) {
+		if (opts.signal?.aborted) throw new MxsError({
+			code: "auth.denied",
+			message: "aborted by user"
+		});
+		await sleep(intervalMs, opts.signal);
+		const res = await http.fetch(`${authBase}/device/token`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				device_code: deviceCode,
+				client_id: clientId
+			})
+		});
+		let body;
+		try {
+			body = await res.json();
+		} catch {
+			body = null;
+		}
+		if (res.ok && body?.access_token) return body;
+		const err = body?.error;
+		if (err === "authorization_pending") {
+			opts.onTick?.("pending");
+			continue;
+		}
+		if (err === "slow_down") {
+			intervalMs += 5e3;
+			opts.onTick?.("slow_down");
+			continue;
+		}
+		if (err === "access_denied") throw new MxsError({
+			code: "auth.denied",
+			message: "user denied the authorization request"
+		});
+		if (err === "expired_token") throw new MxsError({
+			code: "auth.expired",
+			message: "device code expired before authorization completed",
+			hint: "run `mxs auth login` again"
+		});
+		throw new MxsError({
+			code: "auth.denied",
+			message: `device token request failed (${res.status})`,
+			details: body
+		});
+	}
+	throw new MxsError({
+		code: "auth.expired",
+		message: "device authorization timed out",
+		hint: "run `mxs auth login` again"
+	});
+}
+function sleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) return reject(/* @__PURE__ */ new Error("aborted"));
+		const timer = setTimeout(() => {
+			if (signal) signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(/* @__PURE__ */ new Error("aborted"));
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+function toCredentials(resp) {
+	return {
+		access_token: resp.access_token,
+		refresh_token: resp.refresh_token,
+		expires_at: Date.now() + resp.expires_in * 1e3,
+		user: resp.user
+	};
+}
+function isExpiringSoon(cred, bufferMs = 6e4) {
+	return cred.expires_at < Date.now() + bufferMs;
+}
+async function refreshAccessToken(authBase, clientId, cred, http = defaultHttp()) {
+	if (!cred.refresh_token) return refreshSessionToken(authBase, cred, http);
+	const res = await http.fetch(`${authBase}/token`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			grant_type: "refresh_token",
+			refresh_token: cred.refresh_token,
+			client_id: clientId
+		})
+	});
+	if (!res.ok) return null;
+	const body = await res.json();
+	if (!body?.access_token) return null;
+	return {
+		access_token: body.access_token,
+		refresh_token: body.refresh_token ?? cred.refresh_token,
+		expires_at: Date.now() + body.expires_in * 1e3,
+		user: body.user ?? cred.user
+	};
+}
+async function refreshSessionToken(authBase, cred, http) {
+	const res = await http.fetch(`${authBase}/get-session`, {
+		method: "GET",
+		headers: {
+			accept: "application/json",
+			authorization: `Bearer ${cred.access_token}`
+		}
+	});
+	if (!res.ok) return null;
+	const body = await res.json().catch(() => null);
+	const expiresAt = normalizeExpiresAt(body?.session?.expiresAt);
+	if (!expiresAt || expiresAt <= cred.expires_at) return null;
+	return {
+		access_token: res.headers.get("set-auth-token") ?? cred.access_token,
+		refresh_token: cred.refresh_token,
+		expires_at: expiresAt,
+		user: body?.user ?? cred.user
+	};
+}
+function normalizeExpiresAt(value) {
+	if (value === void 0) return null;
+	const time = value instanceof Date ? value.getTime() : typeof value === "number" ? value : new Date(value).getTime();
+	return Number.isFinite(time) ? time : null;
+}
+async function loadCredentialsOrThrow() {
+	const cred = await readCredentials();
+	if (!cred) throw new MxsError({
+		code: "auth.missing",
+		message: "not authenticated",
+		hint: "run `mxs auth login`"
+	});
+	return cred;
+}
+async function ensureFreshToken(authBase, clientId, http = defaultHttp()) {
+	const cred = await loadCredentialsOrThrow();
+	if (!isExpiringSoon(cred)) return cred;
+	const refreshed = await refreshAccessToken(authBase, clientId, cred, http);
+	if (!refreshed) return cred;
+	await writeCredentials(refreshed);
+	return refreshed;
+}
+//#endregion
+export { loadCredentialsOrThrow as a, refreshAccessToken as c, isExpiringSoon as i, requestDeviceCode as l, defaultHttp as n, pollDeviceToken as o, ensureFreshToken as r, probeAuthEndpoint as s, SUPPORTED_API_VERSIONS as t, toCredentials as u };
+
+//# sourceMappingURL=auth-DIFZzoMm.mjs.map

package/dist/auth-DIFZzoMm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-DIFZzoMm.mjs","names":[],"sources":["../src/core/auth.ts"],"sourcesContent":["import {\n  type CredentialsShape,\n  readCredentials,\n  writeCredentials,\n} from './config-store'\nimport { MxsError } from './errors'\n\nexport const SUPPORTED_API_VERSIONS = [2] as const\n\nexport interface DeviceCodeResponse {\n  device_code: string\n  user_code: string\n  verification_uri: string\n  verification_uri_complete?: string\n  expires_in: number\n  interval: number\n}\n\nexport interface DeviceTokenResponse {\n  access_token: string\n  token_type: string\n  expires_in: number\n  refresh_token?: string\n  scope?: string\n  user?: {\n    id?: string\n    email?: string\n    name?: string\n  }\n}\n\nexport interface ProbeResult {\n  apiUrl: string\n  apiBase: string\n  authBase: string\n  apiVersion: number\n}\n\nexport interface AuthHttp {\n  fetch: typeof fetch\n}\n\nexport function defaultHttp(): AuthHttp {\n  return { fetch: globalThis.fetch.bind(globalThis) }\n}\n\nexport async function probeAuthEndpoint(\n  apiUrl: string,\n  http: AuthHttp = defaultHttp(),\n): Promise<ProbeResult> {\n  const candidates: { prefix: string; version: number | null }[] = [\n    ...SUPPORTED_API_VERSIONS.map((v) => ({\n      prefix: `/api/v${v}/auth`,\n      version: v,\n    })),\n    { prefix: '/auth', version: null },\n  ]\n  for (const cand of candidates) {\n    const probeUrl = `${apiUrl}${cand.prefix}/ok`\n    let res: Response\n    try {\n      res = await http.fetch(probeUrl, { method: 'GET' })\n    } catch {\n      continue\n    }\n    if (res.ok) {\n      const apiVersion = cand.version ?? SUPPORTED_API_VERSIONS[0]\n      const apiBase =\n        cand.prefix === '/auth' ? apiUrl : `${apiUrl}/api/v${apiVersion}`\n      const authBase = `${apiUrl}${cand.prefix}`\n      return { apiUrl, apiBase, authBase, apiVersion }\n    }\n  }\n  throw new MxsError({\n    code: 'auth.probe',\n    message: 'cannot detect auth endpoint',\n    hint: 'verify the URL points at a running mx-core server',\n  })\n}\n\nexport async function requestDeviceCode(\n  authBase: string,\n  clientId: string,\n  scope = 'openid profile email',\n  http: AuthHttp = defaultHttp(),\n): Promise<DeviceCodeResponse> {\n  const res = await http.fetch(`${authBase}/device/code`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({ client_id: clientId, scope }),\n  })\n  if (!res.ok) {\n    let body: unknown\n    try {\n      body = await res.json()\n    } catch {\n      body = await res.text()\n    }\n    throw new MxsError({\n      code: 'auth.denied',\n      message: `device code request failed (${res.status})`,\n      details: body,\n    })\n  }\n  return (await res.json()) as DeviceCodeResponse\n}\n\nexport interface PollOptions {\n  intervalSec: number\n  expiresInSec: number\n  signal?: AbortSignal\n  onTick?: (state: 'pending' | 'slow_down') => void\n  http?: AuthHttp\n}\n\nexport async function pollDeviceToken(\n  authBase: string,\n  clientId: string,\n  deviceCode: string,\n  opts: PollOptions,\n): Promise<DeviceTokenResponse> {\n  const http = opts.http ?? defaultHttp()\n  const deadline = Date.now() + opts.expiresInSec * 1000\n  let intervalMs = Math.max(1, opts.intervalSec) * 1000\n  while (Date.now() < deadline) {\n    if (opts.signal?.aborted) {\n      throw new MxsError({ code: 'auth.denied', message: 'aborted by user' })\n    }\n    await sleep(intervalMs, opts.signal)\n    const res = await http.fetch(`${authBase}/device/token`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n        device_code: deviceCode,\n        client_id: clientId,\n      }),\n    })\n    let body: any\n    try {\n      body = await res.json()\n    } catch {\n      body = null\n    }\n    if (res.ok && body?.access_token) {\n      return body as DeviceTokenResponse\n    }\n    const err = body?.error as string | undefined\n    if (err === 'authorization_pending') {\n      opts.onTick?.('pending')\n      continue\n    }\n    if (err === 'slow_down') {\n      intervalMs += 5000\n      opts.onTick?.('slow_down')\n      continue\n    }\n    if (err === 'access_denied') {\n      throw new MxsError({\n        code: 'auth.denied',\n        message: 'user denied the authorization request',\n      })\n    }\n    if (err === 'expired_token') {\n      throw new MxsError({\n        code: 'auth.expired',\n        message: 'device code expired before authorization completed',\n        hint: 'run `mxs auth login` again',\n      })\n    }\n    throw new MxsError({\n      code: 'auth.denied',\n      message: `device token request failed (${res.status})`,\n      details: body,\n    })\n  }\n  throw new MxsError({\n    code: 'auth.expired',\n    message: 'device authorization timed out',\n    hint: 'run `mxs auth login` again',\n  })\n}\n\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) return reject(new Error('aborted'))\n    const timer = setTimeout(() => {\n      if (signal) signal.removeEventListener('abort', onAbort)\n      resolve()\n    }, ms)\n    const onAbort = () => {\n      clearTimeout(timer)\n      reject(new Error('aborted'))\n    }\n    signal?.addEventListener('abort', onAbort, { once: true })\n  })\n}\n\nexport function toCredentials(resp: DeviceTokenResponse): CredentialsShape {\n  return {\n    access_token: resp.access_token,\n    refresh_token: resp.refresh_token,\n    expires_at: Date.now() + resp.expires_in * 1000,\n    user: resp.user,\n  }\n}\n\nexport function isExpiringSoon(\n  cred: CredentialsShape,\n  bufferMs = 60_000,\n): boolean {\n  return cred.expires_at < Date.now() + bufferMs\n}\n\nexport async function refreshAccessToken(\n  authBase: string,\n  clientId: string,\n  cred: CredentialsShape,\n  http: AuthHttp = defaultHttp(),\n): Promise<CredentialsShape | null> {\n  if (!cred.refresh_token) {\n    return refreshSessionToken(authBase, cred, http)\n  }\n  const res = await http.fetch(`${authBase}/token`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      refresh_token: cred.refresh_token,\n      client_id: clientId,\n    }),\n  })\n  if (!res.ok) return null\n  const body = (await res.json()) as DeviceTokenResponse\n  if (!body?.access_token) return null\n  return {\n    access_token: body.access_token,\n    refresh_token: body.refresh_token ?? cred.refresh_token,\n    expires_at: Date.now() + body.expires_in * 1000,\n    user: body.user ?? cred.user,\n  }\n}\n\nasync function refreshSessionToken(\n  authBase: string,\n  cred: CredentialsShape,\n  http: AuthHttp,\n): Promise<CredentialsShape | null> {\n  const res = await http.fetch(`${authBase}/get-session`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${cred.access_token}`,\n    },\n  })\n  if (!res.ok) return null\n  const body = (await res.json().catch(() => null)) as\n    | {\n        session?: { expiresAt?: string | Date | number }\n        user?: CredentialsShape['user']\n      }\n    | null\n  const expiresAt = normalizeExpiresAt(body?.session?.expiresAt)\n  if (!expiresAt || expiresAt <= cred.expires_at) return null\n  return {\n    access_token: res.headers.get('set-auth-token') ?? cred.access_token,\n    refresh_token: cred.refresh_token,\n    expires_at: expiresAt,\n    user: body?.user ?? cred.user,\n  }\n}\n\nfunction normalizeExpiresAt(value: string | Date | number | undefined) {\n  if (value === undefined) return null\n  const time =\n    value instanceof Date\n      ? value.getTime()\n      : typeof value === 'number'\n        ? value\n        : new Date(value).getTime()\n  return Number.isFinite(time) ? time : null\n}\n\nexport async function loadCredentialsOrThrow(): Promise<CredentialsShape> {\n  const cred = await readCredentials()\n  if (!cred) {\n    throw new MxsError({\n      code: 'auth.missing',\n      message: 'not authenticated',\n      hint: 'run `mxs auth login`',\n    })\n  }\n  return cred\n}\n\nexport async function ensureFreshToken(\n  authBase: string,\n  clientId: string,\n  http: AuthHttp = defaultHttp(),\n): Promise<CredentialsShape> {\n  const cred = await loadCredentialsOrThrow()\n  if (!isExpiringSoon(cred)) return cred\n  const refreshed = await refreshAccessToken(authBase, clientId, cred, http)\n  if (!refreshed) return cred\n  await writeCredentials(refreshed)\n  return refreshed\n}\n"],"mappings":";;;AAOA,MAAa,yBAAyB,CAAC,CAAC;AAmCxC,SAAgB,cAAwB;CACtC,OAAO,EAAE,OAAO,WAAW,MAAM,KAAK,UAAU,EAAE;AACpD;AAEA,eAAsB,kBACpB,QACA,OAAiB,YAAY,GACP;CACtB,MAAM,aAA2D,CAC/D,GAAG,uBAAuB,KAAK,OAAO;EACpC,QAAQ,SAAS,EAAE;EACnB,SAAS;CACX,EAAE,GACF;EAAE,QAAQ;EAAS,SAAS;CAAK,CACnC;CACA,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,WAAW,GAAG,SAAS,KAAK,OAAO;EACzC,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,KAAK,MAAM,UAAU,EAAE,QAAQ,MAAM,CAAC;EACpD,QAAQ;GACN;EACF;EACA,IAAI,IAAI,IAAI;GACV,MAAM,aAAa,KAAK,WAAW,uBAAuB;GAI1D,OAAO;IAAE;IAAQ,SAFf,KAAK,WAAW,UAAU,SAAS,GAAG,OAAO,QAAQ;IAE7B,UAAA,GADN,SAAS,KAAK;IACE;GAAW;EACjD;CACF;CACA,MAAM,IAAI,SAAS;EACjB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH;AAEA,eAAsB,kBACpB,UACA,UACA,QAAQ,wBACR,OAAiB,YAAY,GACA;CAC7B,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,eAAe;EACtD,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GAAE,WAAW;GAAU;EAAM,CAAC;CACrD,CAAC;CACD,IAAI,CAAC,IAAI,IAAI;EACX,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,IAAI,KAAK;EACxB,QAAQ;GACN,OAAO,MAAM,IAAI,KAAK;EACxB;EACA,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS,+BAA+B,IAAI,OAAO;GACnD,SAAS;EACX,CAAC;CACH;CACA,OAAQ,MAAM,IAAI,KAAK;AACzB;AAUA,eAAsB,gBACpB,UACA,UACA,YACA,MAC8B;CAC9B,MAAM,OAAO,KAAK,QAAQ,YAAY;CACtC,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,eAAe;CAClD,IAAI,aAAa,KAAK,IAAI,GAAG,KAAK,WAAW,IAAI;CACjD,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,IAAI,KAAK,QAAQ,SACf,MAAM,IAAI,SAAS;GAAE,MAAM;GAAe,SAAS;EAAkB,CAAC;EAExE,MAAM,MAAM,YAAY,KAAK,MAAM;EACnC,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,gBAAgB;GACvD,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;GACb,CAAC;EACH,CAAC;EACD,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,IAAI,KAAK;EACxB,QAAQ;GACN,OAAO;EACT;EACA,IAAI,IAAI,MAAM,MAAM,cAClB,OAAO;EAET,MAAM,MAAM,MAAM;EAClB,IAAI,QAAQ,yBAAyB;GACnC,KAAK,SAAS,SAAS;GACvB;EACF;EACA,IAAI,QAAQ,aAAa;GACvB,cAAc;GACd,KAAK,SAAS,WAAW;GACzB;EACF;EACA,IAAI,QAAQ,iBACV,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS;EACX,CAAC;EAEH,IAAI,QAAQ,iBACV,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS;GACT,MAAM;EACR,CAAC;EAEH,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS,gCAAgC,IAAI,OAAO;GACpD,SAAS;EACX,CAAC;CACH;CACA,MAAM,IAAI,SAAS;EACjB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH;AAEA,SAAS,MAAM,IAAY,QAAqC;CAC9D,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,QAAQ,SAAS,OAAO,uBAAO,IAAI,MAAM,SAAS,CAAC;EACvD,MAAM,QAAQ,iBAAiB;GAC7B,IAAI,QAAQ,OAAO,oBAAoB,SAAS,OAAO;GACvD,QAAQ;EACV,GAAG,EAAE;EACL,MAAM,gBAAgB;GACpB,aAAa,KAAK;GAClB,uBAAO,IAAI,MAAM,SAAS,CAAC;EAC7B;EACA,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC3D,CAAC;AACH;AAEA,SAAgB,cAAc,MAA6C;CACzE,OAAO;EACL,cAAc,KAAK;EACnB,eAAe,KAAK;EACpB,YAAY,KAAK,IAAI,IAAI,KAAK,aAAa;EAC3C,MAAM,KAAK;CACb;AACF;AAEA,SAAgB,eACd,MACA,WAAW,KACF;CACT,OAAO,KAAK,aAAa,KAAK,IAAI,IAAI;AACxC;AAEA,eAAsB,mBACpB,UACA,UACA,MACA,OAAiB,YAAY,GACK;CAClC,IAAI,CAAC,KAAK,eACR,OAAO,oBAAoB,UAAU,MAAM,IAAI;CAEjD,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,SAAS;EAChD,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,YAAY;GACZ,eAAe,KAAK;GACpB,WAAW;EACb,CAAC;CACH,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,MAAM,cAAc,OAAO;CAChC,OAAO;EACL,cAAc,KAAK;EACnB,eAAe,KAAK,iBAAiB,KAAK;EAC1C,YAAY,KAAK,IAAI,IAAI,KAAK,aAAa;EAC3C,MAAM,KAAK,QAAQ,KAAK;CAC1B;AACF;AAEA,eAAe,oBACb,UACA,MACA,MACkC;CAClC,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,eAAe;EACtD,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,eAAe,UAAU,KAAK;EAChC;CACF,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,MAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,YAAY,IAAI;CAM/C,MAAM,YAAY,mBAAmB,MAAM,SAAS,SAAS;CAC7D,IAAI,CAAC,aAAa,aAAa,KAAK,YAAY,OAAO;CACvD,OAAO;EACL,cAAc,IAAI,QAAQ,IAAI,gBAAgB,KAAK,KAAK;EACxD,eAAe,KAAK;EACpB,YAAY;EACZ,MAAM,MAAM,QAAQ,KAAK;CAC3B;AACF;AAEA,SAAS,mBAAmB,OAA2C;CACrE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,OACJ,iBAAiB,OACb,MAAM,QAAQ,IACd,OAAO,UAAU,WACf,QACA,IAAI,KAAK,KAAK,EAAE,QAAQ;CAChC,OAAO,OAAO,SAAS,IAAI,IAAI,OAAO;AACxC;AAEA,eAAsB,yBAAoD;CACxE,MAAM,OAAO,MAAM,gBAAgB;CACnC,IAAI,CAAC,MACH,MAAM,IAAI,SAAS;EACjB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CAEH,OAAO;AACT;AAEA,eAAsB,iBACpB,UACA,UACA,OAAiB,YAAY,GACF;CAC3B,MAAM,OAAO,MAAM,uBAAuB;CAC1C,IAAI,CAAC,eAAe,IAAI,GAAG,OAAO;CAClC,MAAM,YAAY,MAAM,mBAAmB,UAAU,UAAU,MAAM,IAAI;CACzE,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,iBAAiB,SAAS;CAChC,OAAO;AACT"}