@openora/core 0.4.1-canary.12 → 0.4.1-canary.121

package/dist/pam/identity/service/identity.service.d.ts

@@ -1,18 +1,30 @@
-import { ORPCError } from '@orpc/server';
 import { type EventBus, type NodeHeaders, DrizzleService } from '@openora/core/server';
-import type { RateLimiterAdapter, SendEmailPort, LoginInput, RegisterInput, Enable2faInput, Verify2faInput, Disable2faInput, RequestPasswordResetInput, ResetPasswordInput, VerifyEmailInput, UpdateProfileInput, User, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig } from '@openora/core/contracts';
-export declare function createAccountLockedError(lockoutUntil: Date): ORPCError<"UNAUTHORIZED", {
-    code: string;
-    lockoutUntil: string;
-}>;
-export declare const UserNotFoundError: new (id: string) => Error;
+import type { SessionService } from './session.service.js';
+import type { TrustedDeviceService } from './trusted-device.service.js';
+import type { TwoFactorLockoutService } from './two-factor-lockout.service.js';
+import type { CacheAdapter, RateLimiterAdapter, RateLimitKey, SendEmailPort, EmailTemplateRenderer, LoginInput, RegisterInput, Enable2faInput, Verify2faInput, Disable2faInput, RegenerateBackupCodesInput, TrustCurrentDeviceInput, RequestPasswordResetInput, VerifyPasswordResetOtpInput, ResetPasswordInput, ResendEmailVerificationInput, VerifyEmailInput, UpdateProfileInput, User, IdentityReader, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig, ClientMeta, GeoCheckCommands, PlayerProvisioning } from '@openora/core/contracts';
+export declare const UserNotFoundError: new (id: string) => Error & {
+    data?: Record<string, string>;
+};
+export declare const UsernameConflictError: new () => Error & {
+    data?: Record<string, string>;
+};
+export declare const SESSION_DURATION_IN_SECONDS: number;
 export type IdentityServiceDeps = {
     drizzle: DrizzleService;
     events: EventBus;
+    identityReader: IdentityReader;
     email?: SendEmailPort;
+    templateRenderer: EmailTemplateRenderer;
     options?: IdentityServiceOptions;
-    limiter?: RateLimiterAdapter;
+    limiter?: RateLimiterAdapter<RateLimitKey>;
     platformConfig?: PlatformConfig;
+    geoCheck?: GeoCheckCommands;
+    playerProvisioning?: PlayerProvisioning;
+    cache?: CacheAdapter;
+    trustedDevices?: TrustedDeviceService;
+    twoFactorLockout?: TwoFactorLockoutService;
+    sessions?: SessionService;
 };
 /**
  * Thin wrapper over the shared better-auth instance (register/login/2FA/
@@ -27,34 +39,45 @@ export declare class IdentityService {
     private readonly auth;
     private readonly drizzle;
     private readonly events;
+    private readonly identityReader;
     private readonly email?;
+    private readonly templateRenderer;
     private readonly options?;
     private readonly limiter?;
     private readonly platformConfig?;
-    constructor({ drizzle, events, email, options, limiter, platformConfig }: IdentityServiceDeps);
+    private readonly playerProvisioning?;
+    private readonly geoCheck?;
+    private readonly cache?;
+    private readonly existingAccountSignUps;
+    private readonly trustedDevices?;
+    private readonly twoFactorLockout?;
+    private readonly sessions?;
+    constructor({ drizzle, events, identityReader, email, templateRenderer, options, limiter, platformConfig, geoCheck, playerProvisioning, cache, trustedDevices, twoFactorLockout, sessions, }: IdentityServiceDeps);
+    private findUserByEmail;
+    private resolveUserLanguage;
     private get api();
+    private forwardCookies;
     private currentUserId;
-    register(input: RegisterInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            emailVerified: boolean;
-            theme: "light" | "dark" | "system";
-            language: string;
-            createdAt: string;
-            updatedAt: string;
-        } | {
-            image: string | null;
-            id: string;
-            email: string;
-            name: string;
-            emailVerified: boolean;
-            theme: "light" | "dark" | "system";
-            language: string;
-            createdAt: string;
-            updatedAt: string;
-        };
+    private assertAccountNotBlocked;
+    /**
+     * Emitted on every registration attempt that produced no account. The audit trail is
+     * the one place that records what actually happened - the HTTP response deliberately
+     * does not, because a truthful answer on a known address is an enumeration oracle.
+     */
+    private emitRegistrationFailed;
+    register(input: RegisterInput, reqHeaders: NodeHeaders): Promise<{
+        status: "check-email";
+    }>;
+    private findUserIdByUsername;
+    private findUserIdByEmail;
+    /**
+     * Better Auth commits the user inside its own transaction before returning, so a
+     * failure here would otherwise leave an account with no consent record. The user is
+     * deleted instead (sessions and accounts cascade), making registration all-or-nothing.
+     */
+    private recordRegistrationConsent;
+    usernameAvailable(username: string, reqHeaders: NodeHeaders): Promise<{
+        available: boolean;
     }>;
     /**
      * Credentials are verified FIRST; the RG login block is checked only AFTER
@@ -72,14 +95,17 @@ export declare class IdentityService {
         twoFactorRedirect: boolean;
         user?: undefined;
         session?: undefined;
+        security?: undefined;
     } | {
         user: {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         } | {
@@ -87,9 +113,11 @@ export declare class IdentityService {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         };
@@ -97,10 +125,21 @@ export declare class IdentityService {
             token: string;
             expiresAt: string;
         };
+        security: {
+            attemptsRemaining: number;
+            lockoutUntil: string | null;
+        };
         twoFactorRedirect?: undefined;
     }>;
     private clearLockout;
-    unlockUser(userId: User['id'], actorId: User['id']): Promise<{
+    private resetLockoutTier;
+    private loginShadowGet;
+    private loginShadowSet;
+    private adminPasswordResetMarkerKey;
+    adminRequestPasswordReset(userId: User['id'], actorId: User['id'], meta?: ClientMeta): Promise<{
+        success: true;
+    }>;
+    unlockUser(userId: User['id'], actorId: User['id'], meta?: ClientMeta): Promise<{
         success: true;
     }>;
     logout(reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
@@ -110,9 +149,11 @@ export declare class IdentityService {
         id: string;
         email: string;
         name: string;
+        username: string;
         emailVerified: boolean;
         theme: "light" | "dark" | "system";
         language: string;
+        twoFactorEnabled: boolean;
         createdAt: string;
         updatedAt: string;
     } | null>;
@@ -123,23 +164,91 @@ export declare class IdentityService {
     verifyTwoFactor(input: Verify2faInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;
+    /**
+     * Grants this browser its trust window without a sign-out. better-auth issues the
+     * trust cookie only on the sign-in leg of a challenge, so the grant has to replay
+     * that leg: the account proves its password and a fresh second factor, and the
+     * cookies better-auth returns are the ones the browser keeps.
+     */
+    trustCurrentDevice(input: TrustCurrentDeviceInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        success: true;
+    }>;
+    /**
+     * A step-up gate for the self-service routes that change standing 2FA state: the
+     * caller has to clear a live authenticator code, not just the account password.
+     * Routed through TwoFactorLockoutService so a hijacked session plus a reused
+     * password cannot grind the second factor here the way the password-only paths let it.
+     */
+    private assertFreshSecondFactor;
+    regenerateBackupCodes(input: RegenerateBackupCodesInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        backupCodes: string[];
+    }>;
     disableTwoFactor(input: Disable2faInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;
     requestPasswordReset(input: RequestPasswordResetInput): Promise<{
         success: true;
     }>;
+    verifyPasswordResetOtp(input: VerifyPasswordResetOtpInput): Promise<{
+        success: true;
+    }>;
     resetPassword(input: ResetPasswordInput): Promise<{
         success: true;
     }>;
     changePassword(input: ChangePasswordInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;
-    sendEmailVerification(reqHeaders: NodeHeaders): Promise<{
+    /**
+     * Resends the registration code. Unauthenticated by design - the player has no session
+     * until the code is verified - so it answers SUCCESS for every address and only mails a
+     * code to an account that exists and is still unverified. Verified accounts are skipped
+     * deliberately: `verifyEmail` signs the code's bearer in, so resending to a verified
+     * address would turn this into passwordless sign-in for anyone who can read that inbox.
+     */
+    sendEmailVerification(input: ResendEmailVerificationInput, reqHeaders: NodeHeaders): Promise<{
         success: true;
     }>;
-    verifyEmail(input: VerifyEmailInput, reqHeaders: NodeHeaders): Promise<{
-        success: true;
+    /**
+     * Consumes the 6-digit code mailed by `register()` and signs the player in -
+     * better-auth's `autoSignInAfterVerification` mints the session here rather than at
+     * sign-up, which is what lets sign-up stay sessionless and therefore keep its
+     * duplicate-email response indistinguishable. Same post-credential gates as `login`:
+     * a code is proof of address ownership, not a bypass for an RG or backoffice block.
+     */
+    verifyEmail(input: VerifyEmailInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        twoFactorRedirect: true;
+        user?: undefined;
+        session?: undefined;
+    } | {
+        user: {
+            id: string;
+            email: string;
+            name: string;
+            username: string;
+            emailVerified: boolean;
+            theme: "light" | "dark" | "system";
+            language: string;
+            twoFactorEnabled: boolean;
+            createdAt: string;
+            updatedAt: string;
+        } | {
+            image: string | null;
+            id: string;
+            email: string;
+            name: string;
+            username: string;
+            emailVerified: boolean;
+            theme: "light" | "dark" | "system";
+            language: string;
+            twoFactorEnabled: boolean;
+            createdAt: string;
+            updatedAt: string;
+        };
+        session: {
+            token: string;
+            expiresAt: string;
+        };
+        twoFactorRedirect?: undefined;
     }>;
     changeEmail(input: ChangeEmailInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
@@ -149,9 +258,11 @@ export declare class IdentityService {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         } | {
@@ -159,9 +270,11 @@ export declare class IdentityService {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         };

package/dist/pam/identity/service/identity.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAIf,MAAM,sBAAsB,CAAC;AAI9B,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACf,MAAM,yBAAyB,CAAC;AAcjC,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,IAAI;;;GAQ1D;AAiFD,eAAO,MAAM,iBAAiB,2BAA4B,CAAC;AAuE3D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;gBAErC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,mBAAmB;IAc7F,OAAO,KAAK,GAAG,GAId;YAEa,aAAa;IAKrB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;IAmBjF;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiJ3E,OAAO,CAAC,YAAY;IAOd,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC;;;IA8BlD,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAanD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;IAS1B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAmBnF,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnF,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAqBrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAqBrD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAmBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAkBvF,qBAAqB,CAAC,UAAU,EAAE,WAAW;;;IAe7C,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW;;;IAoB5D,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAYjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;CA0B5F"}
+{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAQf,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,UAAU,EAEV,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAwJjC,eAAO,MAAM,iBAAiB;QAnMR,CAAC;CAmMmC,CAAC;AAC3D,eAAO,MAAM,qBAAqB;QApMZ,CAAC;CAoMyE,CAAC;AA+CjG,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAkF7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAG3C,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IAMtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAuB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiB;gBAE/B,EACV,OAAO,EACP,MAAM,EACN,cAAc,EACd,KAAK,EACL,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,gBAAgB,EAChB,QAAQ,GACT,EAAE,mBAAmB;YAkDR,eAAe;YAaf,mBAAmB;IAKjC,OAAO,KAAK,GAAG,GAId;IAED,OAAO,CAAC,cAAc;YAOR,aAAa;IAM3B,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAcxB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;;;YA0G9C,oBAAoB;YASpB,iBAAiB;IAS/B;;;;OAIG;YACW,yBAAyB;IAoCjC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW;;;IAUjE;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwU3E,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAYd,cAAc;IAc5B,OAAO,CAAC,2BAA2B;IAI7B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAwCpF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAiCrE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;;;IAS1B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAmBnF,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA+DzF;;;;;OAKG;IACG,kBAAkB,CACtB,KAAK,EAAE,uBAAuB,EAC9B,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAiErB;;;;;OAKG;YACW,uBAAuB;IAmB/B,qBAAqB,CACzB,KAAK,EAAE,0BAA0B,EACjC,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAqCf,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAqCrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAsBrD,sBAAsB,CAAC,KAAK,EAAE,2BAA2B;;;IAgBzD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAqBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAkB7F;;;;;;OAMG;IACG,qBAAqB,CAAC,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,WAAW;;;IAsBxF;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8EjF,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAYjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC5F"}