@nacre.work/api 0.17.5 → 0.19.0

package/dist/errors.d.ts

@@ -58,5 +58,24 @@ export declare function forbidden(instance: string, requestId: string, detail: s
  */
 export declare function notAdministeredHere(instance: string, requestId: string): Problem;
 export declare function badRequest(instance: string, requestId: string, detail: string): Problem;
+/**
+ * The password gate is full.
+ *
+ * `core/passwords.ts` bounds how many scrypt calls run at once — the pool is
+ * libuv's and is shared with DNS and file I/O, so an unbounded one stops the
+ * rest of the API on a name lookup — and past its queue bound it raises rather
+ * than queueing further. Its own header says the caller answers 503, "the
+ * honest response to 'this process cannot verify a password right now'".
+ *
+ * **503 and never 401.** Nothing was decided about the credential, and
+ * answering "not valid" to a request that was never checked is a lie the client
+ * will act on — a person told their password is wrong changes it. It is not an
+ * oracle either: it depends on how loaded the process is and not at all on
+ * whether the account exists.
+ *
+ * One builder because four routes hash and each would otherwise have its own
+ * wording, and the wording is what a client matches on.
+ */
+export declare function tooBusy(instance: string, requestId: string): Problem;
 export declare function internal(instance: string, requestId: string): Problem;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,qBAAa,OAAQ,SAAQ,KAAK;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;gBAEd,IAAI,EAAE,WAAW;IAW7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAUlC;AAID;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CASrE;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CASzF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAStF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQhF;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CASvF;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAWrE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,qBAAa,OAAQ,SAAQ,KAAK;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;gBAEd,IAAI,EAAE,WAAW;IAW7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAUlC;AAID;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CASrE;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CASzF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAStF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQhF;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CASvF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CASpE;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAWrE"}

package/dist/errors.js

@@ -109,6 +109,34 @@ export function badRequest(instance, requestId, detail) {
         requestId,
     });
 }
+/**
+ * The password gate is full.
+ *
+ * `core/passwords.ts` bounds how many scrypt calls run at once — the pool is
+ * libuv's and is shared with DNS and file I/O, so an unbounded one stops the
+ * rest of the API on a name lookup — and past its queue bound it raises rather
+ * than queueing further. Its own header says the caller answers 503, "the
+ * honest response to 'this process cannot verify a password right now'".
+ *
+ * **503 and never 401.** Nothing was decided about the credential, and
+ * answering "not valid" to a request that was never checked is a lie the client
+ * will act on — a person told their password is wrong changes it. It is not an
+ * oracle either: it depends on how loaded the process is and not at all on
+ * whether the account exists.
+ *
+ * One builder because four routes hash and each would otherwise have its own
+ * wording, and the wording is what a client matches on.
+ */
+export function tooBusy(instance, requestId) {
+    return new Problem({
+        type: uri('unavailable'),
+        title: 'Service unavailable',
+        status: 503,
+        detail: 'Too many passwords are being verified at once. Try again shortly.',
+        instance,
+        requestId,
+    });
+}
 export function internal(instance, requestId) {
     return new Problem({
         type: uri('internal'),

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,MAAM,OAAO,OAAQ,SAAQ,KAAK;IACvB,IAAI,CAAQ;IACZ,KAAK,CAAQ;IACb,MAAM,CAAQ;IACd,MAAM,CAAQ;IACd,QAAQ,CAAQ;IAChB,SAAS,CAAQ;IAE1B,YAAY,IAAiB;QAC3B,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IACjC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAA;IACH,CAAC;CACF;AAED,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,6BAA6B,IAAI,EAAE,CAAA;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IAC1D,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,6DAA6D;QACrE,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC9E,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC;QACzB,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC3E,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,SAAiB;IACrE,OAAO,SAAS,CACd,QAAQ,EACR,SAAS,EACT,sFAAsF;QACpF,yFAAyF;QACzF,sCAAsC,CACzC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC5E,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC;QACxB,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IAC1D,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;QACrB,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,GAAG;QACX,0EAA0E;QAC1E,qCAAqC;QACrC,MAAM,EAAE,qCAAqC;QAC7C,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,MAAM,OAAO,OAAQ,SAAQ,KAAK;IACvB,IAAI,CAAQ;IACZ,KAAK,CAAQ;IACb,MAAM,CAAQ;IACd,MAAM,CAAQ;IACd,QAAQ,CAAQ;IAChB,SAAS,CAAQ;IAE1B,YAAY,IAAiB;QAC3B,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IACjC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAA;IACH,CAAC;CACF;AAED,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,6BAA6B,IAAI,EAAE,CAAA;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IAC1D,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,6DAA6D;QACrE,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC9E,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC;QACzB,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC3E,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,SAAiB;IACrE,OAAO,SAAS,CACd,QAAQ,EACR,SAAS,EACT,sFAAsF;QACpF,yFAAyF;QACzF,sCAAsC,CACzC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC5E,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC;QACxB,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,SAAiB;IACzD,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC;QACxB,KAAK,EAAE,qBAAqB;QAC5B,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,mEAAmE;QAC3E,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IAC1D,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;QACrB,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,GAAG;QACX,0EAA0E;QAC1E,qCAAqC;QACrC,MAAM,EAAE,qCAAqC;QAC7C,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC"}

package/dist/login.d.ts

@@ -1,5 +1,6 @@
 import type { KeyObject } from 'node:crypto';
 import type { Pool } from 'pg';
+import type { WebAuthnAssertionOptions } from './second-factor.js';
 export interface LoginRequest {
     readonly email: string;
     readonly password: string;
@@ -41,9 +42,84 @@ export interface LoginDeps {
     readonly accessTokenTtl: number;
     readonly refreshTokenTtl: number;
     readonly role?: string;
+    /**
+     * The second factor, when the deployment has a key to seal one with.
+     *
+     * Absent, `login` issues tokens as it always did — which is what every
+     * existing installation gets, and why this is optional rather than a
+     * constructor argument every caller had to learn about.
+     */
+    readonly secondFactors?: SecondFactorGate;
     /** Injected so tests are not asked to wait for wall-clock expiry. */
     readonly now?: () => Date;
 }
+/**
+ * What `login` needs from the second factor, and no more.
+ *
+ * A narrow port rather than the class: this file is the sign-in path and has no
+ * business being able to enrol anything. It also keeps the cycle out — the
+ * store imports nothing from here.
+ */
+export interface SecondFactorGate {
+    required(orgId: string, userId: string): Promise<boolean>;
+    verify(orgId: string, userId: string, code: string): Promise<boolean>;
+    beginWebAuthnAssertion(orgId: string, userId: string): Promise<WebAuthnAssertionOptions | undefined>;
+    verifyWebAuthnAssertion(orgId: string, userId: string, response: WebAuthnProof): Promise<boolean>;
+}
+/** What a browser hands back from `navigator.credentials.get`. */
+export interface WebAuthnProof {
+    readonly credentialId: string;
+    readonly authenticatorData: Uint8Array;
+    readonly clientDataJSON: Uint8Array;
+    readonly signature: Uint8Array;
+    readonly challenge: string;
+}
+/**
+ * The proof the second half of a sign-in takes, and it is a union on purpose.
+ *
+ * A six-digit code and an assertion are not two spellings of one argument: the
+ * first is a string a person read off a screen and the second is a signature
+ * over an origin. Making the parameter a union means a caller has to say which
+ * it holds, and a handler that forgot the new kind is a compile error rather
+ * than a route that silently only ever accepts the old one.
+ */
+export type SecondFactorProof = {
+    readonly kind: 'code';
+    readonly code: string;
+} | {
+    readonly kind: 'webauthn';
+    readonly response: WebAuthnProof;
+};
+/**
+ * Sign-in has three outcomes now, and a union rather than a nullable pair.
+ *
+ * Making it a union turns every existing call site into a compile error until
+ * it says which one it means — the alternative is a second optional field that
+ * a caller can ignore, and ignoring it here means issuing a session to somebody
+ * who has not produced their second factor.
+ */
+export type LoginOutcome = {
+    readonly kind: 'tokens';
+    readonly tokens: Tokens;
+} | {
+    readonly kind: 'second-factor';
+    /** Short-lived, single-purpose, and useless as an access token. */
+    readonly challenge: string;
+    readonly expiresIn: number;
+};
+/**
+ * What `changePassword` answers.
+ *
+ * A union rather than a boolean for the same reason `LoginOutcome` is one: a
+ * caller that cannot tell "the current password was wrong" from "there is no
+ * such account" answers both the same way, and only one of those is something
+ * a person can act on.
+ */
+export type ChangePasswordOutcome = {
+    readonly kind: 'changed';
+    readonly tokens: Tokens;
+    readonly email: string;
+} | 'wrong-password' | 'no-user';
 export declare class Login {
     private readonly deps;
     constructor(deps: LoginDeps);
@@ -55,7 +131,96 @@ export declare class Login {
      * `undefined` for every reason it can fail. The caller turns it into one
      * `401` with one message.
      */
-    login(request: LoginRequest): Promise<Tokens | undefined>;
+    login(request: LoginRequest): Promise<LoginOutcome | undefined>;
+    /**
+     * The token that says "this password was correct", and nothing else.
+     *
+     * Its audience is not the API's, so it is refused everywhere an access token
+     * is accepted — a challenge that could be presented as a bearer token would
+     * be a way past the factor it exists to demand. Five minutes, which is longer
+     * than reading a phone and shorter than walking away from one.
+     *
+     * Not stored, and it does not need to be: replaying it needs the *code* as
+     * well, the code is single-use through `last_step`, and a person holding both
+     * has finished signing in anyway.
+     */
+    private challenge;
+    /**
+     * The second half of a sign-in: a challenge and a code, for a session.
+     *
+     * `undefined` for every reason it can fail — an expired challenge, one signed
+     * for something else, a wrong code, a disabled account — and the caller turns
+     * all of them into one refusal. Which of the four it was is not something a
+     * client needs and is something an attacker would use.
+     */
+    completeSecondFactor(challenge: string, proof: SecondFactorProof): Promise<Tokens | undefined>;
+    /**
+     * The options a browser needs for the assertion half of a sign-in.
+     *
+     * It takes the same challenge `login` handed back, and that is the whole
+     * reason this method is here rather than on the store: the JWT is what says
+     * who is signing in, and it is signed by a key the store does not have. An
+     * endpoint that took a user id instead would answer "which authenticators
+     * does this person hold" to anybody who asked.
+     *
+     * `undefined` where the challenge is not one of ours, where it has expired,
+     * and where the person has no key enrolled — one refusal, for the reason
+     * every refusal on this path is one.
+     */
+    beginSecondFactorWebAuthn(challenge: string): Promise<WebAuthnAssertionOptions | undefined>;
+    /**
+     * Who a sign-in challenge names, or nothing.
+     *
+     * One reader for the two halves that consult it, because a challenge whose
+     * audience is checked on one path and not the other is an access token
+     * accepted as a challenge — which is exactly what `challengeAudience` exists
+     * to stop.
+     */
+    private readChallenge;
+    /**
+     * A person changes their own password, having proved the current one.
+     *
+     * ## Why this is not `POST /v1/users/{id}/password`
+     *
+     * That one is an **administrator** setting somebody else's, and it returns
+     * the plaintext because a generated password has to be shown once. This is
+     * the person themselves choosing one, so nothing is returned and nothing is
+     * generated — and it needs no administrator at all, which on a
+     * single-administrator installation is the whole point. Recovery closed the
+     * case where the password is *forgotten*; this closes the ordinary one, where
+     * it is merely known to somebody else.
+     *
+     * ## What it costs to get in
+     *
+     * The current password, always, and that is the only proof this takes. A
+     * session is not enough: changing the password is the first thing somebody
+     * with a stolen session does, and it is what locks the owner out. It is the
+     * same reasoning that makes removing a second factor take a current code.
+     *
+     * A second factor is deliberately *not* asked for here. It bounds sign-in,
+     * and this caller has already signed in and just produced the password
+     * besides; demanding a code would mean somebody whose phone is lost cannot
+     * change a password they know is compromised.
+     *
+     * ## Every other session ends, and this one is replaced
+     *
+     * The reason to change a password is usually that somebody else knows it, and
+     * leaving their refresh token alive would leave them signed in. So all of them
+     * are revoked — including this caller's, since there is no way to tell one
+     * refresh token from another with only an access token in hand — and a fresh
+     * pair comes back with the answer. Signing the person out of the browser they
+     * did it in would read as a failure.
+     */
+    changePassword(orgId: string, userId: string, current: string, next: string): Promise<ChangePasswordOutcome>;
+    private userById;
+    /**
+     * What verifies the challenge this same object signed.
+     *
+     * With a shared secret the key is its own verifier; with Ed25519 the public
+     * half comes out of the private one, so nothing new has to be configured for
+     * a round trip that never leaves this process.
+     */
+    private get verificationKey();
     /**
      * Find the one user this login is about, without saying how many nearly were.
      *

package/dist/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAG5C,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAyC1C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAAA;IACpC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IACtC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAeD,qBAAa,KAAK;IACJ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAE5C,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAiC/D;;;;;;;;OAQG;YACW,IAAI;YAuBJ,YAAY;YAaZ,SAAS;YAYT,MAAM;IAgBpB;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA+FzD,sDAAsD;IAChD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7C;;;;;;;;;;;OAWG;YACW,YAAY;IAe1B;;;;;;OAMG;YACW,KAAK;CAoDpB"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAG5C,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAI1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAqDlE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAAA;IACpC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IACtC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrE,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACpG,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAClG;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAA;AAEnE;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAEL;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7E,gBAAgB,GAChB,SAAS,CAAA;AAeb,qBAAa,KAAK;IACJ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAE5C,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA8CrE;;;;;;;;;;;OAWG;YACW,SAAS;IAevB;;;;;;;OAOG;IACG,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAuBpG;;;;;;;;;;;;OAYG;IACG,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAQjG;;;;;;;OAOG;YACW,aAAa;IAmB3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC;YAoDnB,QAAQ;IAgBtB;;;;;;OAMG;IACH,OAAO,KAAK,eAAe,GAG1B;IAED;;;;;;;;OAQG;YACW,IAAI;YAuBJ,YAAY;YAaZ,SAAS;YAYT,MAAM;IAgBpB;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA+FzD,sDAAsD;IAChD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7C;;;;;;;;;;;OAWG;YACW,YAAY;IAe1B;;;;;;OAMG;YACW,KAAK;CAoDpB"}

package/dist/login.js

@@ -1,6 +1,6 @@
-import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createHash, createPublicKey, randomBytes, timingSafeEqual } from 'node:crypto';
 import { hashPassword, needsRehash, spendVerificationTime, verifyPassword, whileAuthenticating, withOrg, } from '@nacre.work/core';
-import { SignJWT } from 'jose';
+import { jwtVerify, SignJWT } from 'jose';
 /**
  * Email and password sign-in.
  *
@@ -38,6 +38,16 @@ import { SignJWT } from 'jose';
  * exists.
  */
 const ACCESS_MIN_SECONDS = 60;
+/** Long enough to read a phone, short enough not to survive walking away. */
+const CHALLENGE_SECONDS = 300;
+/**
+ * The challenge's audience, which is deliberately not the API's.
+ *
+ * An access token and a challenge are both JWTs signed by the same key, so the
+ * only thing keeping one from being presented as the other is what they claim
+ * to be for.
+ */
+const challengeAudience = (audience) => `${audience}/second-factor`;
 const digest = (token) => createHash('sha256').update(token).digest('hex');
 /** 32 bytes from the CSPRNG. Opaque — it is looked up, never parsed. */
 const mint = () => randomBytes(32).toString('base64url');
@@ -79,7 +89,204 @@ export class Login {
             const rehashed = await hashPassword(request.password);
             await withOrg(this.deps.pool, candidate.org_id, (client) => client.query('UPDATE users SET password_hash = $1 WHERE id = $2', [rehashed, candidate.id]), this.scope).catch(() => undefined);
         }
-        return this.issue(candidate, undefined);
+        /*
+         * The password was right. Whether that is a session depends on the factor.
+         *
+         * The check is here rather than in the handler because there is exactly one
+         * path from a correct password to a token, and a check beside it is a check
+         * the next path forgets. `required` answers false for an installation with
+         * no key configured, so nothing changes for a deployment that has not asked
+         * for this.
+         */
+        if (this.deps.secondFactors !== undefined && (await this.deps.secondFactors.required(candidate.org_id, candidate.id))) {
+            return { kind: 'second-factor', challenge: await this.challenge(candidate), expiresIn: CHALLENGE_SECONDS };
+        }
+        return { kind: 'tokens', tokens: await this.issue(candidate, undefined) };
+    }
+    /**
+     * The token that says "this password was correct", and nothing else.
+     *
+     * Its audience is not the API's, so it is refused everywhere an access token
+     * is accepted — a challenge that could be presented as a bearer token would
+     * be a way past the factor it exists to demand. Five minutes, which is longer
+     * than reading a phone and shorter than walking away from one.
+     *
+     * Not stored, and it does not need to be: replaying it needs the *code* as
+     * well, the code is single-use through `last_step`, and a person holding both
+     * has finished signing in anyway.
+     */
+    async challenge(user) {
+        const now = this.clock;
+        return new SignJWT({ org: user.org_id, purpose: 'second-factor' })
+            .setProtectedHeader({
+            alg: this.deps.algorithm ?? 'HS256',
+            ...(this.deps.keyId === undefined ? {} : { kid: this.deps.keyId }),
+        })
+            .setSubject(user.id)
+            .setIssuer(this.deps.issuer)
+            .setAudience(challengeAudience(this.deps.audience))
+            .setIssuedAt(Math.floor(now.getTime() / 1000))
+            .setExpirationTime(Math.floor(now.getTime() / 1000) + CHALLENGE_SECONDS)
+            .sign(this.deps.key);
+    }
+    /**
+     * The second half of a sign-in: a challenge and a code, for a session.
+     *
+     * `undefined` for every reason it can fail — an expired challenge, one signed
+     * for something else, a wrong code, a disabled account — and the caller turns
+     * all of them into one refusal. Which of the four it was is not something a
+     * client needs and is something an attacker would use.
+     */
+    async completeSecondFactor(challenge, proof) {
+        const gate = this.deps.secondFactors;
+        if (gate === undefined)
+            return undefined;
+        const who = await this.readChallenge(challenge);
+        if (who === undefined)
+            return undefined;
+        const { orgId, userId } = who;
+        const proved = proof.kind === 'code'
+            ? await gate.verify(orgId, userId, proof.code)
+            : await gate.verifyWebAuthnAssertion(orgId, userId, proof.response);
+        if (!proved)
+            return undefined;
+        // Re-read the row rather than trusting the challenge for anything but
+        // identity: five minutes is long enough to be disabled, and the role in the
+        // token has to be the one the database holds now.
+        const user = await this.userById(orgId, userId);
+        if (user === undefined || user.disabled_at !== null)
+            return undefined;
+        return this.issue(user, undefined);
+    }
+    /**
+     * The options a browser needs for the assertion half of a sign-in.
+     *
+     * It takes the same challenge `login` handed back, and that is the whole
+     * reason this method is here rather than on the store: the JWT is what says
+     * who is signing in, and it is signed by a key the store does not have. An
+     * endpoint that took a user id instead would answer "which authenticators
+     * does this person hold" to anybody who asked.
+     *
+     * `undefined` where the challenge is not one of ours, where it has expired,
+     * and where the person has no key enrolled — one refusal, for the reason
+     * every refusal on this path is one.
+     */
+    async beginSecondFactorWebAuthn(challenge) {
+        const gate = this.deps.secondFactors;
+        if (gate === undefined)
+            return undefined;
+        const who = await this.readChallenge(challenge);
+        if (who === undefined)
+            return undefined;
+        return gate.beginWebAuthnAssertion(who.orgId, who.userId);
+    }
+    /**
+     * Who a sign-in challenge names, or nothing.
+     *
+     * One reader for the two halves that consult it, because a challenge whose
+     * audience is checked on one path and not the other is an access token
+     * accepted as a challenge — which is exactly what `challengeAudience` exists
+     * to stop.
+     */
+    async readChallenge(challenge) {
+        try {
+            const { payload } = await jwtVerify(challenge, this.verificationKey, {
+                issuer: this.deps.issuer,
+                audience: challengeAudience(this.deps.audience),
+                algorithms: [this.deps.algorithm ?? 'HS256'],
+                currentDate: this.clock,
+            });
+            if (payload.purpose !== 'second-factor' || typeof payload.sub !== 'string' || typeof payload.org !== 'string') {
+                return undefined;
+            }
+            return { orgId: payload.org, userId: payload.sub };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * A person changes their own password, having proved the current one.
+     *
+     * ## Why this is not `POST /v1/users/{id}/password`
+     *
+     * That one is an **administrator** setting somebody else's, and it returns
+     * the plaintext because a generated password has to be shown once. This is
+     * the person themselves choosing one, so nothing is returned and nothing is
+     * generated — and it needs no administrator at all, which on a
+     * single-administrator installation is the whole point. Recovery closed the
+     * case where the password is *forgotten*; this closes the ordinary one, where
+     * it is merely known to somebody else.
+     *
+     * ## What it costs to get in
+     *
+     * The current password, always, and that is the only proof this takes. A
+     * session is not enough: changing the password is the first thing somebody
+     * with a stolen session does, and it is what locks the owner out. It is the
+     * same reasoning that makes removing a second factor take a current code.
+     *
+     * A second factor is deliberately *not* asked for here. It bounds sign-in,
+     * and this caller has already signed in and just produced the password
+     * besides; demanding a code would mean somebody whose phone is lost cannot
+     * change a password they know is compromised.
+     *
+     * ## Every other session ends, and this one is replaced
+     *
+     * The reason to change a password is usually that somebody else knows it, and
+     * leaving their refresh token alive would leave them signed in. So all of them
+     * are revoked — including this caller's, since there is no way to tell one
+     * refresh token from another with only an access token in hand — and a fresh
+     * pair comes back with the answer. Signing the person out of the browser they
+     * did it in would read as a failure.
+     */
+    async changePassword(orgId, userId, current, next) {
+        const row = await withOrg(this.deps.pool, orgId, async (client) => {
+            const { rows } = await client.query(`SELECT id, org_id, role, email, password_hash, disabled_at
+             FROM users WHERE org_id = $1 AND id = $2`, [orgId, userId]);
+            return rows[0];
+        }, this.scope);
+        // A disabled account and one with no password set are the same answer as an
+        // account that is not there. Nobody reaching here is any of the three —
+        // they hold a token this row issued — so this is a guard rather than a
+        // branch anybody sees.
+        if (row === undefined || row.disabled_at !== null || row.password_hash === null)
+            return 'no-user';
+        // Outside the transaction on purpose: scrypt at OWASP's minimum takes long
+        // enough that holding a row lock across it is a lock held on arithmetic.
+        if (!(await verifyPassword(current, row.password_hash)))
+            return 'wrong-password';
+        const hash = await hashPassword(next);
+        const tokens = await withOrg(this.deps.pool, orgId, async (client) => {
+            await client.query('UPDATE users SET password_hash = $3 WHERE org_id = $1 AND id = $2', [orgId, userId, hash]);
+            // Every one, and before the new pair is inserted so the pair this
+            // returns is not revoked by the statement that ends the old sessions.
+            await client.query(`UPDATE refresh_tokens SET revoked_at = now()
+            WHERE org_id = $1 AND user_id = $2 AND revoked_at IS NULL`, [orgId, userId]);
+            // A new family. Carrying the old one would put the session that
+            // replaces every other one in the same chain as the tokens just
+            // revoked.
+            return this.issue(row, undefined, client);
+        }, this.scope);
+        return { kind: 'changed', tokens, email: row.email };
+    }
+    async userById(orgId, userId) {
+        return withOrg(this.deps.pool, orgId, async (client) => {
+            const { rows } = await client.query(`SELECT id, org_id, role, password_hash, disabled_at
+             FROM users WHERE org_id = $1 AND id = $2`, [orgId, userId]);
+            return rows[0];
+        }, this.scope);
+    }
+    /**
+     * What verifies the challenge this same object signed.
+     *
+     * With a shared secret the key is its own verifier; with Ed25519 the public
+     * half comes out of the private one, so nothing new has to be configured for
+     * a round trip that never leaves this process.
+     */
+    get verificationKey() {
+        if (this.deps.key instanceof Uint8Array)
+            return this.deps.key;
+        return createPublicKey(this.deps.key);
     }
     /**
      * Find the one user this login is about, without saying how many nearly were.

package/dist/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,OAAO,GACR,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAG9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAyD7B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE1F,wEAAwE;AACxE,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEhE,MAAM,OAAO,KAAK;IACa;IAA7B,YAA6B,IAAe;QAAf,SAAI,GAAJ,IAAI,CAAW;IAAG,CAAC;IAEhD,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACrE,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAChD,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClG,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAExF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACrD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,SAAS,CAAC,MAAM,EAChB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAC7F,IAAI,CAAC,KAAK,CACX,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACzC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAgC;QAChE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;YACxE,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,MAAM,KAAK,GAAc,EAAE,CAAA;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAC3C,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtC,wEAAwE;YACxE,uEAAuE;YACvE,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;QACxC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,qEAAqE,EACrE,CAAC,IAAI,CAAC,CACP,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,uDAAuD,CACxD,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QAC/C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;yDAC+C,EAC/C,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAUjC;uDAC6C,EAC7C,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEvC,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAClD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAE/F,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAE7C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAAE,OAAO,SAAS,CAAA;QAEtE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,8DAA8D;QAC9D,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,MAAM,EAAqC,EAAE;YAClD,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAEjF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;yBAEe,EACf,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAA;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAA;YAEhD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAC1B,CAAA;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAA;YAElE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAChD,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,qEAAqE;YACrE,yEAAyE;YACzE,+CAA+C;YAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,2FAA2F,EAC3F,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACnC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACxD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC5E,MAAM,MAAM,CAAC,KAAK,CAChB,0FAA0F,EAC1F,CAAC,QAAQ,CAAC,CACX,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,KAAK,CACjB,IAAa,EACb,MAA0B,EAC1B,MAAmB;QAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;YACpC,uEAAuE;YACvE,8BAA8B;YAC9B,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;aACC,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,qEAAqE;YACrE,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC/B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEtB,MAAM,YAAY,GAAG,IAAI,EAAE,CAAA;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;QAE5E,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAoB,EAAE,CACtD,MAAM,CAAC,KAAK,CACV;wEACgE,EAChE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,CAAC,CACxE,CAAA;QAEH,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;;YACzC,MAAM,OAAO,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,IAAI,CAAC,MAAM,EACX,MAAM,EACN,IAAI,CAAC,KAAK,CACX,CAAA;QAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;IAC3F,CAAC;CACF"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,OAAO,GACR,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAOzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,QAAQ,gBAAgB,CAAA;AAmInF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE1F,wEAAwE;AACxE,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEhE,MAAM,OAAO,KAAK;IACa;IAA7B,YAA6B,IAAe;QAAf,SAAI,GAAJ,IAAI,CAAW;IAAG,CAAC;IAEhD,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACrE,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAChD,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClG,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAExF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACrD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,SAAS,CAAC,MAAM,EAChB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAC7F,IAAI,CAAC,KAAK,CACX,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC1B,CAAC;QAED;;;;;;;;WAQG;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACtH,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;QAC5G,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAA;IAC3E,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,SAAS,CAAC,IAAa;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QACtB,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;aAC/D,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,iBAAiB,CAAC;aACvE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,KAAwB;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAExC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;QAE7B,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,MAAM;YACnB,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;YAC9C,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACvE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAE7B,sEAAsE;QACtE,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAErE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,yBAAyB,CAAC,SAAiB;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvC,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;gBACnE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gBACxB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/C,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;gBAC5C,WAAW,EAAE,IAAI,CAAC,KAAK;aACxB,CAAC,CAAA;YACF,IAAI,OAAO,CAAC,OAAO,KAAK,eAAe,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC9G,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAc,EACd,OAAe,EACf,IAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,4EAA4E;QAC5E,wEAAwE;QACxE,uEAAuE;QACvE,uBAAuB;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAEjG,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,gBAAgB,CAAA;QAChF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QAErC,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAChB,mEAAmE,EACnE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CACtB,CAAA;YACD,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,MAAM,CAAC,KAAK,CAChB;sEAC4D,EAC5D,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,gEAAgE;YAChE,gEAAgE;YAChE,WAAW;YACX,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QAC3C,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;IACtD,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,IAAY,eAAe;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,UAAU;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QAC7D,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAgC;QAChE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;YACxE,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,MAAM,KAAK,GAAc,EAAE,CAAA;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAC3C,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtC,wEAAwE;YACxE,uEAAuE;YACvE,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;QACxC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,qEAAqE,EACrE,CAAC,IAAI,CAAC,CACP,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,uDAAuD,CACxD,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QAC/C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;yDAC+C,EAC/C,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAUjC;uDAC6C,EAC7C,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEvC,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAClD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAE/F,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAE7C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAAE,OAAO,SAAS,CAAA;QAEtE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,8DAA8D;QAC9D,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,MAAM,EAAqC,EAAE;YAClD,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAEjF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;yBAEe,EACf,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAA;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAA;YAEhD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAC1B,CAAA;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAA;YAElE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAChD,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,qEAAqE;YACrE,yEAAyE;YACzE,+CAA+C;YAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,2FAA2F,EAC3F,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACnC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACxD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC5E,MAAM,MAAM,CAAC,KAAK,CAChB,0FAA0F,EAC1F,CAAC,QAAQ,CAAC,CACX,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,KAAK,CACjB,IAAa,EACb,MAA0B,EAC1B,MAAmB;QAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;YACpC,uEAAuE;YACvE,8BAA8B;YAC9B,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;aACC,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,qEAAqE;YACrE,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC/B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEtB,MAAM,YAAY,GAAG,IAAI,EAAE,CAAA;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;QAE5E,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAoB,EAAE,CACtD,MAAM,CAAC,KAAK,CACV;wEACgE,EAChE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,CAAC,CACxE,CAAA;QAEH,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;;YACzC,MAAM,OAAO,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,IAAI,CAAC,MAAM,EACX,MAAM,EACN,IAAI,CAAC,KAAK,CACX,CAAA;QAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;IAC3F,CAAC;CACF"}