@noresponse/node 6.0.1 → 7.0.0

package/dist/esm/late-results.d.ts

@@ -1,161 +1,107 @@
+/**
+ * Late enforcement. Generated by tools/generate_overlays.py from
+ * tools/late_results/actions.json; do not edit.
+ *
+ * account.risk_changed only wakes the handler. handleRiskChange verifies the
+ * delivery, reads the account's current risk (GET /v1/accounts/{account_id}),
+ * asks your getAccountState where the account is in your own flow, and takes
+ * the actions the table names for that state and the decision of its flow:
+ *
+ *   onboarding   account_creation review/block  fail_onboarding, revoke_sessions
+ *   provisional  account_creation review/block  reject_activation, revoke_sessions
+ *   active       login review                   revoke_sessions
+ *   active       login block                    restrict, revoke_sessions
+ *   restricted   login allow                    unrestrict, when flows.login.reinstate
+ *
+ * Every action, or none, is recorded with accounts.recordEnforcement at the
+ * riskVersion read, and a refused action is recorded as failed and thrown.
+ * No action deletes a user. The same table and vectors
+ * (tests/fixtures/late-results-vectors.json) run in every SDK.
+ */
+import type { NoResponse } from "./client.js";
+import type { Account } from "./models/account.js";
 import type { WebhookEvent } from "./models/webhook-event.js";
 import { type ConstructEventOptions, type HeaderInput, type WebhookSecrets } from "./webhooks.js";
-/** What to do to the user. "ban" also ends every session. */
-export type LateResultAction = "none" | "revoke_sessions" | "ban";
-/** The action for each account decision (account.risk.decision). A decision you leave out does nothing. */
-export type LateResultPolicy = Readonly<Partial<Record<"allow" | "step_up" | "review" | "block", LateResultAction>>>;
-/** Revoke sessions on review and block; do nothing on allow or step_up. Banning is opt-in. */
-export declare const DEFAULT_LATE_RESULT_POLICY: LateResultPolicy;
-/** The two admin actions, for one auth provider. Build one with clerkActions, workosActions or auth0Actions. */
-export interface LateResultProvider {
-    readonly name: string;
-    /** End every active session of the user. */
-    revokeSessions(userId: string): Promise<void>;
-    /** Stop the user signing in again and end their sessions. */
-    ban(userId: string): Promise<void>;
-    /**
-     * Optional. Take `action` and return the action that ran. A provider that
-     * has to do more than it was asked implements this: auth0Actions answers
-     * "ban" when the tenant's plan has no sessions API and it blocked the user
-     * to end their sessions. When absent, handleLateResult calls ban or
-     * revokeSessions and reports the action asked for.
-     */
-    act?(action: "revoke_sessions" | "ban", userId: string): Promise<LateResultAction>;
-}
-/** A provider that reports the action that ran, as auth0Actions does. */
-export interface LateResultActor extends LateResultProvider {
-    act(action: "revoke_sessions" | "ban", userId: string): Promise<LateResultAction>;
+type Flow = "account_creation" | "login" | "purchase";
+export type AccountState = "onboarding" | "provisional" | "active" | "restricted" | "rejected";
+type EnforcementAction = "revoke_sessions" | "restrict" | "unrestrict" | "fail_onboarding" | "reject_activation" | "none";
+/** An action a provider runs: every EnforcementAction but none. */
+export type ProviderAction = Exclude<EnforcementAction, "none">;
+/** Where the account is in your flow, from getAccountState. */
+export type AccountStateAnswer = {
+    state: AccountState;
+    /** The provider's user id. Defaults to the account id, as when you assess with the provider's user id. */
+    userId?: string;
+    /** The riskVersion you last enforced (a result's riskVersion that you stored). An account at or below it is skipped. */
+    enforcedRiskVersion?: number;
+};
+/** Runs one action in an identity provider. Build one with identityProvider or customProvider. */
+export interface ActionProvider {
+    readonly name: "clerk" | "workos" | "auth0" | "custom";
+    /** Take the action and return any other action that had to run with it (Auth0 restricts to end a session). */
+    run(action: ProviderAction, userId: string): Promise<ProviderAction[]>;
 }
-export type LateResultOptions = ConstructEventOptions & {
-    /** Account decision to action. Defaults to DEFAULT_LATE_RESULT_POLICY. */
-    policy?: LateResultPolicy;
-    /**
-     * The provider user id for the assessment's detail.account_id. Defaults to the
-     * account_id itself, as when you assess with the provider's user id.
-     * Return null or undefined to take no action.
-     */
-    userId?: (accountId: string, event: WebhookEvent) => string | null | undefined | Promise<string | null | undefined>;
+export type FlowPolicy = {
+    /** Lift a restriction once the flow's decision is allow again. Off by default. */
+    reinstate?: boolean;
 };
-export type LateResult = {
-    /** The verified event. Answer an endpoint.verification with a WebhookVerificationResponse echoing its challenge. */
-    event: WebhookEvent;
-    /**
-     * The action that ran. "none" when the policy, the event or the user id
-     * called for nothing. It can be stronger than the policy's action when the
-     * provider had to fall back: auth0Actions reports "ban" when it blocked the
-     * user because the tenant's plan cannot end sessions.
-     */
-    action: LateResultAction;
-    /** The provider user id acted on, when an action was taken. */
-    userId?: string;
+export type EnforcementOptions = ConstructEventOptions & {
+    provider: ActionProvider;
+    /** The account's state in your flow; null or undefined for an account you do not hold. */
+    getAccountState: (account: Account) => AccountStateAnswer | null | undefined | Promise<AccountStateAnswer | null | undefined>;
+    flows?: Partial<Record<Flow, FlowPolicy>>;
 };
-/**
- * Thrown when the provider's admin API refuses a call. Answer the webhook with a 5xx so NoResponse retries it.
- * A 404 is never thrown: the user or session is already gone, so the action is done.
- */
+/** Why nothing was done: not account.risk_changed (or a test event), the account was erased, getAccountState knows no such account, or its riskVersion is already enforced. */
+export type EnforcementSkip = "not_actionable" | "account_gone" | "unknown_user" | "already_enforced";
+export type Enforced = {
+    flow: Flow;
+    action: EnforcementAction;
+    status: "applied" | "failed";
+    errorCode?: string;
+};
+export type EnforcementResult = {
+    /** The verified event, from handleRiskChange. Answer an endpoint.verification with its challenge. */
+    event?: WebhookEvent;
+    account?: Account;
+    state?: AccountState;
+    /** The riskVersion acted on. Store it and return it as enforcedRiskVersion. */
+    riskVersion?: number;
+    skipped?: EnforcementSkip;
+    /** What was recorded, in order. */
+    enforcements: Enforced[];
+};
+/** The provider refused an action or could not be reached (status 0). Answer the webhook with a 5xx so it is delivered again. */
 export declare class ProviderActionError extends Error {
     readonly provider: string;
     readonly status: number;
-    /** The provider's error code from the response body, such as Auth0's errorCode "insufficient_scope", when it sent one. */
+    /** The provider's error code, such as Auth0's errorCode "insufficient_scope", when it sent one. */
     readonly code: string | undefined;
     constructor(provider: string, status: number, message: string, code?: string);
 }
 /**
- * The action your policy names for a verified event's account.risk.decision. Only a complete or partial
- * assessment whose account has a decision can act; a pending one and a test event from
- * webhookEndpoints.sendTestEvent never do.
+ * Verify an account.risk_changed delivery and enforce the account's current
+ * risk. A delivery that fails verification throws WebhookVerificationError
+ * before anything is read; any other event, and a test event, does nothing.
  */
-export declare function lateResultAction(event: WebhookEvent, policy?: LateResultPolicy): LateResultAction;
+export declare function handleRiskChange(client: NoResponse, payload: Uint8Array | string, headers: HeaderInput, secrets: WebhookSecrets, options: EnforcementOptions): Promise<EnforcementResult>;
 /**
- * Verify a webhook delivery and apply your policy to it.
- *
- * `payload`, `headers`, `secrets` and the tolerance options are exactly what
- * constructEvent takes; a delivery that fails verification throws
- * WebhookVerificationError before any provider call. A test event acts on
- * nothing. Revoke and ban are safe to repeat, but deduplicate on
- * `result.event.id` and ignore versions older than one you have acted on.
+ * Enforce one account as read: the account a handler fetched, or one from
+ * accounts.listChanged({ unenforced: true }) when catching up.
  */
-export declare function handleLateResult(payload: Uint8Array | string, headers: HeaderInput, secrets: WebhookSecrets, provider: LateResultProvider, options?: LateResultOptions): Promise<LateResult>;
+export declare function enforceAccount(client: NoResponse, account: Account, options: EnforcementOptions): Promise<EnforcementResult>;
 type Fetch = typeof fetch;
-export type ClerkActionsOptions = {
-    /** Clerk secret key (sk_...). */
-    secretKey: string;
-    /** Default https://api.clerk.com/v1. */
-    baseUrl?: string;
-    fetch?: Fetch;
-};
-/**
- * Clerk Backend API. revokeSessions lists the user's active sessions
- * (GET /sessions?user_id&status=active) and revokes each
- * (POST /sessions/{id}/revoke). ban is POST /users/{id}/ban, which revokes
- * every session and blocks sign-in.
- */
-export declare function clerkActions(options: ClerkActionsOptions): LateResultProvider;
-export type WorkOSActionsOptions = {
-    /** WorkOS API key (sk_...). */
-    apiKey: string;
-    /** Default https://api.workos.com. */
-    baseUrl?: string;
-    fetch?: Fetch;
-};
-/**
- * WorkOS User Management. revokeSessions pages through
- * GET /user_management/users/{id}/sessions and revokes each active one with
- * POST /user_management/sessions/revoke. WorkOS has no block or ban, so ban
- * revokes the sessions and then deletes the user
- * (DELETE /user_management/users/{id}); deletion is permanent.
- */
-export declare function workosActions(options: WorkOSActionsOptions): LateResultProvider;
-export type Auth0ActionsOptions = {
-    /** Your Auth0 tenant domain, such as example.eu.auth0.com. The Management API is https://{domain}/api/v2. */
+export type IdentityProviderOptions = {
+    /** Clerk secret key, WorkOS API key or Auth0 Management API token. */
+    token: string;
+    /** Auth0 tenant domain, such as example.eu.auth0.com. */
     domain?: string;
-    /** The Management API base URL in place of domain. */
+    /** The admin API's base URL, in place of the table's (or of domain). */
     baseUrl?: string;
-    /**
-     * A Management API access token with update:users, delete:sessions,
-     * delete:refresh_tokens, read:device_credentials and delete:device_credentials.
-     */
-    token: string;
     fetch?: Fetch;
 };
-/**
- * Auth0 Management API.
- *
- * revokeSessions deletes every session (DELETE /users/{id}/sessions) and
- * every refresh token (DELETE /users/{id}/refresh-tokens). ban first sets
- * blocked: true (PATCH /users/{id}), then does the same.
- *
- * Auth0 offers the sessions and refresh-token endpoints on Enterprise plans
- * only; on other plans they answer 403 feature_not_enabled. Then:
- * - refresh tokens are deleted one by one through
- *   /device-credentials (types refresh_token and rotating_refresh_token),
- *   which every plan has;
- * - a login session cannot be ended, so revokeSessions blocks the user
- *   (PATCH blocked: true) before deleting the refresh tokens, and act
- *   reports "ban". Unblock the user in the dashboard to undo it.
- * Any other refusal, such as 403 insufficient_scope, throws.
- *
- * A 429 from the Management API is waited out and retried: Retry-After, else
- * X-RateLimit-Reset, else 250 ms doubling, at most 4 retries a call and 3 s of
- * waiting a revoke or ban. Past that the 429 throws as ProviderActionError.
- */
-export declare function auth0Actions(options: Auth0ActionsOptions): LateResultActor;
-export type LogOnlyActionsOptions = {
-    /**
-     * Receives one line per action the handler would take, with the action and
-     * the user id. Defaults to console.info.
-     */
-    log?: (message: string, details: {
-        action: Exclude<LateResultAction, "none">;
-        userId: string;
-    }) => void;
-};
-/**
- * A provider for an app with its own login, or for trying the handler before
- * you wire up a real one. revokeSessions and ban each log what they would do
- * and call nothing: no request leaves your process. Replace it with your own
- * LateResultProvider once you know what revoking and banning mean in your app.
- */
-export declare function logOnlyActions(options?: LogOnlyActionsOptions): LateResultProvider;
+/** Clerk, WorkOS or Auth0, run from the shared action table. */
+export declare function identityProvider(name: "clerk" | "workos" | "auth0", options: IdentityProviderOptions): ActionProvider;
+/** Your own user store: one function per action you support. An action without one fails. */
+export declare function customProvider(handlers: Partial<Record<ProviderAction, (userId: string) => Promise<void | ProviderAction[]>>>): ActionProvider;
 export {};
 //# sourceMappingURL=late-results.d.ts.map

package/dist/esm/late-results.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"late-results.d.ts","sourceRoot":"","sources":["../../src/late-results.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAkB,KAAK,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAElH,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAElE,2GAA2G;AAC3G,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAErH,8FAA8F;AAC9F,eAAO,MAAM,0BAA0B,EAAE,gBAKvC,CAAC;AAEH,gHAAgH;AAChH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,6DAA6D;IAC7D,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpF;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,GAAG,CAAC,MAAM,EAAE,iBAAiB,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACnF;AAED,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG;IACtD,0EAA0E;IAC1E,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CACrH,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,oHAAoH;IACpH,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;OAKG;IACH,MAAM,EAAE,gBAAgB,CAAC;IACzB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0HAA0H;IAC1H,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAM3E;CACF;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,GAAE,gBAA6C,GAAG,gBAAgB,CAqB7H;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAerB;AAED,KAAK,KAAK,GAAG,OAAO,KAAK,CAAC;AA6F1B,MAAM,MAAM,mBAAmB,GAAG;IAChC,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,CAsB7E;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,kBAAkB,CA0B/E;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAKF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,eAAe,CAoE1E;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;OAGG;IACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACzG,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,kBAAkB,CAatF"}
+{"version":3,"file":"late-results.d.ts","sourceRoot":"","sources":["../../src/late-results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAkB,KAAK,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAElH,KAAK,IAAI,GAAG,kBAAkB,GAAG,OAAO,GAAG,UAAU,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,aAAa,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAC;AAC/F,KAAK,iBAAiB,GAAG,iBAAiB,GAAG,UAAU,GAAG,YAAY,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,MAAM,CAAC;AAC1H,mEAAmE;AACnE,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAqBhE,+DAA+D;AAC/D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,YAAY,CAAC;IACpB,0GAA0G;IAC1G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wHAAwH;IACxH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACvD,8GAA8G;IAC9G,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACxE;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GAAG;IACvD,QAAQ,EAAE,cAAc,CAAC;IACzB,0FAA0F;IAC1F,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,kBAAkB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC9H,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;CAC3C,CAAC;AAEF,+KAA+K;AAC/K,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,cAAc,GAAG,cAAc,GAAG,kBAAkB,CAAC;AAEtG,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,qGAAqG;IACrG,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,mCAAmC;IACnC,YAAY,EAAE,QAAQ,EAAE,CAAC;CAC1B,CAAC;AAEF,iIAAiI;AACjI,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAM3E;CACF;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAID;;;GAGG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyClI;AAcD,KAAK,KAAK,GAAG,OAAO,KAAK,CAAC;AAE1B,MAAM,MAAM,uBAAuB,GAAG;IACpC,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,cAAc,CAmBrH;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC,GAAG,cAAc,CAW9I"}