@pattern-js/mod-identity 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @pattern-js/mod-identity — public surface.
+ *
+ * `identityMod(options)` is the brick; everything else is the toolbox for
+ * provider mods (magic-link, oidc…) and apps that script identity directly.
+ */
+export { identityMod } from "./mod.js";
+export { default } from "./mod.js";
+export { resolveOptions, type IdentityOptions, type ResolvedIdentityOptions } from "./options.js";
+export { DefaultIdentityService, type FindOrCreateInput, type IdentityService, type IssuedToken, type LoginMethod, type MintedSession, type ResolvedSession, } from "./service.js";
+export { identityService, IDENTITY_SERVICE } from "./service-key.js";
+export { sessionAuthProvider, SESSION_PROVIDER_NAME } from "./auth-provider.js";
+export { deliverToken, absoluteUrl, DELIVER_TOKEN_HOOK, type DeliverInput, type DeliverResult } from "./deliver.js";
+export { parseCookies, serializeSessionCookie, clearSessionCookie } from "./cookies.js";
+export { isCrossSiteWrite, isStateChanging } from "./csrf.js";
+export { randomToken, sha256hex, normalizeEmail, looksLikeEmail } from "./tokens.js";
+export { renderLoginPage, renderSentPage } from "./pages/login.js";
+export { layout, escapeHtml, safeNextPath } from "./pages/html.js";
+export { memoryIdentityStores } from "./store/memory.js";
+export { sqliteIdentityStores } from "./store/sqlite.js";
+export { KeyedMutex } from "./store/mutex.js";
+export { UniqueViolationError, type IdentityStores, type SessionRow, type SessionStore, type TokenPurpose, type TokenRow, type TokenStore, type UserRow, type UserStore, } from "./store/types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,EAAE,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACpH,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,SAAS,GACf,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,23 @@
+/**
+ * @pattern-js/mod-identity — public surface.
+ *
+ * `identityMod(options)` is the brick; everything else is the toolbox for
+ * provider mods (magic-link, oidc…) and apps that script identity directly.
+ */
+export { identityMod } from "./mod.js";
+export { default } from "./mod.js";
+export { resolveOptions } from "./options.js";
+export { DefaultIdentityService, } from "./service.js";
+export { identityService, IDENTITY_SERVICE } from "./service-key.js";
+export { sessionAuthProvider, SESSION_PROVIDER_NAME } from "./auth-provider.js";
+export { deliverToken, absoluteUrl, DELIVER_TOKEN_HOOK } from "./deliver.js";
+export { parseCookies, serializeSessionCookie, clearSessionCookie } from "./cookies.js";
+export { isCrossSiteWrite, isStateChanging } from "./csrf.js";
+export { randomToken, sha256hex, normalizeEmail, looksLikeEmail } from "./tokens.js";
+export { renderLoginPage, renderSentPage } from "./pages/login.js";
+export { layout, escapeHtml, safeNextPath } from "./pages/html.js";
+export { memoryIdentityStores } from "./store/memory.js";
+export { sqliteIdentityStores } from "./store/sqlite.js";
+export { KeyedMutex } from "./store/mutex.js";
+export { UniqueViolationError, } from "./store/types.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,EAAE,cAAc,EAAsD,MAAM,cAAc,CAAC;AAClG,OAAO,EACL,sBAAsB,GAOvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAyC,MAAM,cAAc,CAAC;AACpH,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,oBAAoB,GASrB,MAAM,kBAAkB,CAAC"}

package/dist/mod.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @pattern-js/mod-identity — the mod (§9).
+ *
+ * `setup` opens the stores (sqlite at `./.pattern-data/identity.db` by
+ * default — gitignored, never `.pattern/`), builds the service and registers
+ * it under core's IDENTITY_SERVICE key plus the login URL under
+ * AUTH_LOGIN_URL (hosts redirect unauthenticated HTML there). The session
+ * AuthProvider and the `identity.deliverToken` hook ride the PatternMod
+ * fields; routes are ordinary endpoint workflows.
+ *
+ * `ready` runs after the whole mod batch: if the user store is empty, it
+ * mints a one-time bootstrap token and prints the setup URL to the console —
+ * the same single-use-token primitive as login and invites.
+ */
+import { type PatternMod } from "@pattern-js/core";
+import { type IdentityOptions } from "./options.js";
+export declare function identityMod(options?: IdentityOptions): PatternMod;
+/** A ready-to-use identity mod with defaults (for `loadMods`/`engine.use`). */
+declare const _default: PatternMod;
+export default _default;
+//# sourceMappingURL=mod.d.ts.map

package/dist/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAA+D,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAChH,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAuBpE,wBAAgB,WAAW,CAAC,OAAO,GAAE,eAAoB,GAAG,UAAU,CAwDrE;AAED,+EAA+E;;AAC/E,wBAA6B"}

package/dist/mod.js

@@ -0,0 +1,97 @@
+/**
+ * @pattern-js/mod-identity — the mod (§9).
+ *
+ * `setup` opens the stores (sqlite at `./.pattern-data/identity.db` by
+ * default — gitignored, never `.pattern/`), builds the service and registers
+ * it under core's IDENTITY_SERVICE key plus the login URL under
+ * AUTH_LOGIN_URL (hosts redirect unauthenticated HTML there). The session
+ * AuthProvider and the `identity.deliverToken` hook ride the PatternMod
+ * fields; routes are ordinary endpoint workflows.
+ *
+ * `ready` runs after the whole mod batch: if the user store is empty, it
+ * mints a one-time bootstrap token and prints the setup URL to the console —
+ * the same single-use-token primitive as login and invites.
+ */
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { localFs, provideFilesystem } from "@pattern-js/runtime-node";
+import { AUTH_LOGIN_URL, IDENTITY_SERVICE, defineMod, z } from "@pattern-js/core";
+import { resolveOptions } from "./options.js";
+import { DefaultIdentityService } from "./service.js";
+import { sessionAuthProvider } from "./auth-provider.js";
+import { identityOps } from "./ops.js";
+import { endpointWorkflows } from "./workflows.js";
+import { identityAdminRoutes } from "./admin-routes.js";
+import { identityFrontend } from "./frontend.js";
+import { memoryIdentityStores } from "./store/memory.js";
+import { sqliteIdentityStores } from "./store/sqlite.js";
+import { DELIVER_TOKEN_HOOK } from "./deliver.js";
+/** Create the identity mod (a configured `PatternMod`). */
+/** The packaged docs/ chapter (the `docs` contribution points at "identity-docs"). */
+function packagedDocs(engine) {
+    try {
+        const dir = fileURLToPath(new URL("../docs", import.meta.url));
+        if (existsSync(dir))
+            provideFilesystem(engine, "identity-docs", localFs(dir));
+    }
+    catch {
+        /* packaged without docs — the contribution is simply skipped */
+    }
+}
+export function identityMod(options = {}) {
+    const opts = resolveOptions(options);
+    // Created in `setup`; the auth provider closes over it via the thunk so the
+    // provider can be declared on the mod before the stores are open.
+    let service;
+    return defineMod({
+        name: "@pattern-js/mod-identity",
+        docs: { filesystem: "identity-docs", title: "Identity", order: 40 },
+        ops: identityOps,
+        // Auth-page routes + the admin Access screens' dedicated routes (one
+        // purposeful endpoint per screen and action, replacing the invoke path).
+        workflows: [...endpointWorkflows(opts.mount), ...identityAdminRoutes()],
+        authProviders: [sessionAuthProvider(() => service)],
+        hooks: [
+            {
+                name: DELIVER_TOKEN_HOOK,
+                payload: z
+                    .object({
+                    email: z.string(),
+                    url: z.string(),
+                    purpose: z.string(),
+                    delivered: z.boolean(),
+                })
+                    .loose(),
+            },
+        ],
+        frontend: identityFrontend(),
+        setup: async (engine) => {
+            packagedDocs(engine);
+            const stores = opts.storage === "memory" ? memoryIdentityStores() : await sqliteIdentityStores(opts.storage);
+            service = new DefaultIdentityService(stores, opts, engine.connections);
+            engine.provideService(IDENTITY_SERVICE, service);
+            engine.provideService(AUTH_LOGIN_URL, `${opts.mount}/login`);
+        },
+        ready: async () => {
+            if (!service)
+                return;
+            // Bootstrap-on-empty: the first admin signs up through a one-time link.
+            const count = await service.listUsers().then((u) => u.length);
+            if (count > 0)
+                return;
+            const issued = await service.issueToken({
+                purpose: "bootstrap",
+                ttlMs: 24 * 60 * 60 * 1000,
+                data: { roles: opts.bootstrapRoles },
+            });
+            const path = `${opts.mount}/bootstrap?t=${issued.token}`;
+            const guess = `http://localhost:${process.env.PORT ?? 3000}${path}`;
+            console.log(`\n[pattern] ◆ No users yet — create the first admin with this one-time link (valid 24h):\n` +
+                `[pattern]   ${guess}\n` +
+                `[pattern]   (path: ${path} — adjust host/port if your app serves elsewhere)\n`);
+        },
+    });
+}
+/** A ready-to-use identity mod with defaults (for `loadMods`/`engine.use`). */
+export default identityMod();
+//# sourceMappingURL=mod.js.map

package/dist/mod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.js","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,EAAgC,MAAM,kBAAkB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAwB,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,2DAA2D;AAE3D,sFAAsF;AACtF,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAA2B,EAAE;IACvD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAErC,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,OAA2C,CAAC;IAEhD,OAAO,SAAS,CAAC;QACf,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE;QACnE,GAAG,EAAE,WAAW;QAChB,qEAAqE;QACrE,yEAAyE;QACzE,SAAS,EAAE,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,mBAAmB,EAAE,CAAC;QACvE,aAAa,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;QACnD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,CAAC;qBACP,MAAM,CAAC;oBACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;oBACjB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;oBACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;oBACnB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;iBACvB,CAAC;qBACD,KAAK,EAAE;aACX;SACF;QACD,QAAQ,EAAE,gBAAgB,EAAE;QAC5B,KAAK,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE;YAC9B,YAAY,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM,MAAM,GACV,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChG,OAAO,GAAG,IAAI,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACvE,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,wEAAwE;YACxE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO;YACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACtC,OAAO,EAAE,WAAW;gBACpB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;gBAC1B,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,gBAAgB,MAAM,CAAC,KAAK,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,oBAAoB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YACpE,OAAO,CAAC,GAAG,CACT,4FAA4F;gBAC1F,eAAe,KAAK,IAAI;gBACxB,sBAAsB,IAAI,qDAAqD,CAClF,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,eAAe,WAAW,EAAE,CAAC"}

package/dist/ops.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @pattern-js/mod-identity — the `identity.*` op catalog.
+ *
+ * Two authoring shapes:
+ *  - **json ops** (single `out`) — whoami + the admin-screen surface
+ *    (users/sessions). The privileged ones are PURE: they never check scopes
+ *    in-op. Authorization is the trigger's job — their admin routes stamp
+ *    `requireAuth: { scopes: ["admin"] }` — and a `sensitivity: "privileged"`
+ *    tag lets the validator warn if a route ever forgets the gate.
+ *  - **http ops** ({ status, headers, body }) — the auth pages and redirects
+ *    (login page, token callback, logout, bootstrap), where Set-Cookie and
+ *    Location ARE the result.
+ *
+ * The security kernel stays in code on purpose: token consumption and session
+ * minting are not editable in the admin; the *delivery* of tokens is the
+ * customizable part (the `identity.deliverToken` hook).
+ */
+import { type OpDefinition } from "@pattern-js/core";
+/** Per-op route I/O for the auth pages — which request fields each reads. */
+export declare const authOpRoutes: Record<string, {
+    query: string[];
+    body: string[];
+    userAgent: boolean;
+}>;
+export declare const identityOps: OpDefinition[];
+//# sourceMappingURL=ops.d.ts.map

package/dist/ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.d.ts","sourceRoot":"","sources":["../src/ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAuE9F,6EAA6E;AAC7E,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAM,CAAC;AA2bxG,eAAO,MAAM,WAAW,EAAE,YAAY,EAoBrC,CAAC"}

package/dist/ops.js

@@ -0,0 +1,379 @@
+/**
+ * @pattern-js/mod-identity — the `identity.*` op catalog.
+ *
+ * Two authoring shapes:
+ *  - **json ops** (single `out`) — whoami + the admin-screen surface
+ *    (users/sessions). The privileged ones are PURE: they never check scopes
+ *    in-op. Authorization is the trigger's job — their admin routes stamp
+ *    `requireAuth: { scopes: ["admin"] }` — and a `sensitivity: "privileged"`
+ *    tag lets the validator warn if a route ever forgets the gate.
+ *  - **http ops** ({ status, headers, body }) — the auth pages and redirects
+ *    (login page, token callback, logout, bootstrap), where Set-Cookie and
+ *    Location ARE the result.
+ *
+ * The security kernel stays in code on purpose: token consumption and session
+ * minting are not editable in the admin; the *delivery* of tokens is the
+ * customizable part (the `identity.deliverToken` hook).
+ */
+import { AUTH_HOME_URL, value, z } from "@pattern-js/core";
+import { identityService } from "./service-key.js";
+import { deliverToken } from "./deliver.js";
+import { looksLikeEmail } from "./tokens.js";
+import { renderLoginPage, renderSentPage } from "./pages/login.js";
+import { renderBootstrapPage } from "./pages/bootstrap.js";
+import { renderWelcomePage } from "./pages/welcome.js";
+import { safeNextPath } from "./pages/html.js";
+/**
+ * A JSON op: discrete named inputs in, a single `out` value out — a PURE domain
+ * function. Each is fronted by its own dedicated admin route (see
+ * `./admin-routes.ts`) that decomposes the request onto these ports and carries
+ * the auth; workflows may also wire them (an automation listing users, or a CLI
+ * trigger with no session at all — which is exactly why the op stays scope-free).
+ */
+function jsonOp(type, description, io, handler, opts = {}) {
+    const inSpec = io.in ?? {};
+    return {
+        type,
+        title: type,
+        inputs: Object.fromEntries(Object.entries(inSpec).map(([k, s]) => [k, value(s)])),
+        outputs: { [io.out]: value() },
+        description,
+        // Pure: no scope check in-op. Authorization is the trigger's job (the admin
+        // routes stamp `requireAuth: { scopes: ["admin"] }`); `privileged` only flags
+        // the data so the validator catches a route that forgets the gate.
+        ...(opts.sensitivity ? { sensitivity: opts.sensitivity } : {}),
+        execute: async (ctx) => {
+            const args = {};
+            await Promise.all(Object.keys(inSpec).map(async (k) => void (args[k] = ctx.input.has(k) ? await ctx.input.value(k) : undefined)));
+            return { [io.out]: await handler(args, identityService(ctx), ctx) };
+        },
+    };
+}
+/** Per-op route I/O for the auth pages — which request fields each reads. */
+export const authOpRoutes = {};
+/**
+ * An auth-page / redirect op as a PURE function: discrete inputs (the query/body
+ * fields it reads + the user-agent for session minting — all decomposed by the
+ * workflow), and discrete outputs { body, redirect, cookies, status } the route
+ * wires onto boundary.http.response. The op reads the resolved principal +
+ * advertised home from ctx — never HTTP shape.
+ */
+function authOp(type, description, io, handler) {
+    const query = io.query ?? [];
+    const body = io.body ?? [];
+    authOpRoutes[type] = { query, body, userAgent: Boolean(io.userAgent) };
+    const inputs = {};
+    for (const k of [...query, ...body])
+        inputs[k] = value(z.string().optional());
+    if (io.userAgent)
+        inputs.userAgent = value(z.string().optional());
+    return {
+        type,
+        title: type,
+        description,
+        reusable: false,
+        inputs,
+        outputs: {
+            body: value(),
+            redirect: value(z.string()),
+            cookies: value(z.record(z.string(), z.unknown())),
+            status: value(z.number()),
+        },
+        execute: async (ctx) => {
+            const args = {};
+            for (const k of [...query, ...body, ...(io.userAgent ? ["userAgent"] : [])]) {
+                args[k] = ctx.input.has(k) ? await ctx.input.value(k) : undefined;
+            }
+            const svc = identityService(ctx);
+            const advertisedHome = ctx.services[AUTH_HOME_URL];
+            const req = {
+                principal: ctx.principal,
+                home: typeof advertisedHome === "string" ? advertisedHome : `${svc.options.mount}/welcome`,
+                ctx,
+            };
+            const r = await handler(args, svc, req);
+            return { body: r.body ?? null, redirect: r.redirect ?? null, cookies: r.cookies ?? null, status: r.status ?? null };
+        },
+    };
+}
+/** The session cookie as a structured value the out-gate serializes (HttpOnly + SameSite=Lax by default). */
+const sessionCookie = (svc, token) => ({
+    [svc.options.cookieName]: { value: token, maxAge: Math.floor(svc.options.sessionTtlMs / 1000), secure: svc.options.cookieSecure },
+});
+const clearCookie = (svc) => ({
+    [svc.options.cookieName]: { value: "", maxAge: 0, secure: svc.options.cookieSecure },
+});
+const page = (body, status) => (status !== undefined ? { body, status } : { body });
+const redirectTo = (location, cookies) => cookies ? { redirect: location, cookies } : { redirect: location };
+const publicUser = (u) => ({
+    id: u.id,
+    email: u.email,
+    name: u.name,
+    roles: u.roles.join(", "),
+    disabled: u.disabled,
+    created: new Date(u.createdAt).toISOString(),
+});
+/* ── whoami ────────────────────────────────────────────────────────────── */
+const whoami = jsonOp("identity.whoami", "The current principal: kind, id, email, roles, scopes.", { out: "whoami" }, (_args, _svc, ctx) => {
+    const p = ctx.principal;
+    if (p.kind !== "user")
+        return { kind: "anonymous" };
+    return {
+        kind: "user",
+        id: p.id,
+        email: p.claims?.email,
+        name: p.claims?.name,
+        roles: p.claims?.roles ?? [],
+        scopes: p.scopes ?? [],
+        sessionId: p.claims?.sessionId,
+    };
+});
+/* ── admin-surface ops (pure; gated by their routes, tagged `privileged`) ── */
+const usersList = jsonOp("identity.users.list", "List users (admin). Roles flattened for table rendering.", { out: "users" }, async (_args, svc) => (await svc.listUsers()).map(publicUser), { sensitivity: "privileged" });
+const usersInvite = jsonOp("identity.users.invite", 'Invite a user by email (admin): mints an invite token and delivers it via the "identity.deliverToken" hook (console fallback). Args { email, roles? (array or comma string) }.', { in: { email: z.string(), roles: z.unknown().optional() }, out: "result" }, async (args, svc, ctx) => {
+    const email = String(args.email ?? "").trim();
+    if (!looksLikeEmail(email))
+        throw new Error("invalid email");
+    const roles = Array.isArray(args.roles)
+        ? args.roles
+        : String(args.roles ?? "")
+            .split(",")
+            .map((r) => r.trim())
+            .filter(Boolean);
+    const issued = await svc.issueToken({
+        purpose: "invite",
+        email,
+        ttlMs: 7 * 24 * 60 * 60 * 1000, // invites get a week, not 15 minutes
+        data: { roles },
+    });
+    const { delivered, url } = await deliverToken(ctx, { email, path: issued.path, purpose: "invite" });
+    // Undelivered (no email channel): hand the link to the inviting admin —
+    // `copy` renders as a copyable field in the admin's result view.
+    return { ok: true, email, roles, delivered, ...(delivered ? {} : { copy: url }) };
+}, { sensitivity: "privileged" });
+const usersSetRoles = jsonOp("identity.users.setRoles", "Set a user's roles (admin). Ends the user's sessions — privilege changes re-login. Args { userId, roles }.", { in: { userId: z.string(), roles: z.unknown().optional() }, out: "user" }, async (args, svc) => {
+    const roles = Array.isArray(args.roles)
+        ? args.roles
+        : String(args.roles ?? "")
+            .split(",")
+            .map((r) => r.trim())
+            .filter(Boolean);
+    return publicUser(await svc.setRoles(String(args.userId), roles));
+}, { sensitivity: "privileged" });
+const usersToggleDisabled = jsonOp("identity.users.toggleDisabled", "Disable / re-enable a user (admin). Disabling revokes all sessions. Args { userId }.", { in: { userId: z.string() }, out: "user" }, async (args, svc) => {
+    const user = await svc.getUser(String(args.userId));
+    if (!user)
+        throw new Error("user not found");
+    return publicUser(await svc.setDisabled(user.id, !user.disabled));
+}, { sensitivity: "privileged" });
+const usersRevokeSessions = jsonOp("identity.users.revokeSessions", "Revoke every session of a user (admin) — logs them out everywhere, closes their sockets. Args { userId }.", { in: { userId: z.string() }, out: "result" }, async (args, svc) => {
+    await svc.revokeAllForUser(String(args.userId));
+    return { ok: true };
+}, { sensitivity: "privileged" });
+const canReadRuns = (s) => typeof s?.list === "function";
+const usersGet = jsonOp("identity.users.get", "One user's profile for the details page (admin). Args { userId }.", { in: { userId: z.string() }, out: "user" }, async (args, svc) => {
+    const user = await svc.getUser(String(args.userId));
+    if (!user)
+        throw new Error("user not found");
+    const sessions = await svc.listSessions(user.id);
+    const active = sessions.filter((s) => s.revokedAt == null && s.expiresAt > Date.now());
+    return {
+        email: user.email,
+        name: user.name ?? "—",
+        roles: user.roles.join(", ") || "—",
+        scopes: svc.scopesForRoles(user.roles).join(", ") || "—",
+        disabled: user.disabled,
+        created: new Date(user.createdAt).toLocaleString(),
+        "active sessions": active.length,
+        "user id": user.id,
+    };
+}, { sensitivity: "privileged" });
+const usersRunStats = jsonOp("identity.users.runStats", "Per-workflow run counts for a user, from the admin's retained run window (admin). Args { userId }.", { in: { userId: z.string() }, out: "stats" }, async (args, svc, ctx) => {
+    const user = await svc.getUser(String(args.userId));
+    if (!user)
+        throw new Error("user not found");
+    // The trace sink is the ADMIN's service — feature-detected, so this op
+    // degrades to an empty list when the admin isn't installed. Stats cover
+    // the sink's retained window (bounded ring buffer), not all time.
+    const sink = ctx.services["adminTraceSink"];
+    if (!canReadRuns(sink))
+        return [];
+    const runs = (await sink.list({ limit: 10_000 }))
+        // The admin's declarative-page data fetches (`*.route.admin.*`) and other
+        // `__`-prefixed plumbing are not the user's workflows — exclude them so
+        // they don't drown the real numbers when an admin views their own page.
+        .filter((r) => r.principal?.kind === "user" &&
+        r.principal.id === user.id &&
+        !r.workflowId.startsWith("__") &&
+        !r.workflowId.includes(".route.admin."));
+    const byWorkflow = new Map();
+    for (const r of runs) {
+        const agg = byWorkflow.get(r.workflowId) ?? { workflow: r.workflowId, runs: 0, errors: 0, lastRun: 0, totalMs: 0, timed: 0 };
+        agg.runs++;
+        if (r.status === "error")
+            agg.errors++;
+        if (r.startTime > agg.lastRun)
+            agg.lastRun = r.startTime;
+        if (r.durationMs != null) {
+            agg.totalMs += r.durationMs;
+            agg.timed++;
+        }
+        byWorkflow.set(r.workflowId, agg);
+    }
+    return [...byWorkflow.values()]
+        .sort((a, b) => b.runs - a.runs)
+        .map((a) => ({
+        workflow: a.workflow,
+        runs: a.runs,
+        errors: a.errors,
+        "avg ms": a.timed ? Math.round(a.totalMs / a.timed) : "—",
+        "last run": new Date(a.lastRun).toLocaleString(),
+    }));
+}, { sensitivity: "privileged" });
+const usersLoginLink = jsonOp("identity.users.loginLink", "Mint a single-use sign-in link for a user (admin) — for handing over manually when no email/SMS delivery is wired. Args { userId }.", { in: { userId: z.string() }, out: "result" }, async (args, svc) => {
+    const user = await svc.getUser(String(args.userId));
+    if (!user)
+        throw new Error("user not found");
+    if (user.disabled)
+        throw new Error("user is disabled — re-enable them first");
+    const issued = await svc.issueToken({ purpose: "login", email: user.email });
+    return {
+        // `copy` is the result-view convention: rendered as a copyable field
+        // (the admin prepends its origin for absolute links).
+        copy: issued.path,
+        email: user.email,
+        "valid until": new Date(issued.expiresAt).toLocaleString(),
+        note: "single use — send it over any channel",
+    };
+}, { sensitivity: "privileged" });
+const settingsGet = jsonOp("identity.settings.get", "Current identity settings (admin): the effective signup policy.", { out: "settings" }, async (_args, svc) => ({ signup: await svc.getSignup() }), { sensitivity: "privileged" });
+const settingsSet = jsonOp("identity.settings.set", 'Update identity settings (admin). Args { signup: "open" | "invite" }. Persisted — survives restarts.', { in: { signup: z.string().optional() }, out: "result" }, async (args, svc) => {
+    if (args.signup !== undefined)
+        await svc.setSignup(args.signup);
+    return { signup: await svc.getSignup() };
+}, { sensitivity: "privileged" });
+const sessionsList = jsonOp("identity.sessions.list", "List sessions, newest first (admin). Args { userId? }.", { in: { userId: z.string().optional() }, out: "sessions" }, async (args, svc) => {
+    const sessions = await svc.listSessions(args.userId ? String(args.userId) : undefined);
+    const emails = new Map();
+    for (const s of sessions) {
+        if (!emails.has(s.userId))
+            emails.set(s.userId, (await svc.getUser(s.userId))?.email ?? s.userId);
+    }
+    return sessions.map((s) => ({
+        id: s.id,
+        user: emails.get(s.userId),
+        created: new Date(s.createdAt).toISOString(),
+        lastSeen: new Date(s.lastSeenAt).toISOString(),
+        status: s.revokedAt != null ? "revoked" : s.expiresAt <= Date.now() ? "expired" : "active",
+        userAgent: s.userAgent ?? "",
+    }));
+}, { sensitivity: "privileged" });
+const sessionsRevoke = jsonOp("identity.sessions.revoke", "Revoke one session (admin): it stops resolving and its WS sockets close. Args { sessionId }.", { in: { sessionId: z.string() }, out: "result" }, async (args, svc) => {
+    await svc.revokeSession(String(args.sessionId));
+    return { ok: true };
+}, { sensitivity: "privileged" });
+/* ── auth pages & flows ────────────────────────────────────────────────── */
+const loginPage = authOp("identity.login.page", "Render the login page from the registered login methods. Query { next?, error?, sent? }.", { query: ["next", "error", "sent"] }, (args, svc) => {
+    if (args.sent)
+        return page(renderSentPage(String(args.sent)));
+    return page(renderLoginPage({
+        methods: svc.loginMethods(),
+        next: args.next,
+        error: args.error ? String(args.error) : undefined,
+    }));
+});
+const tokenCallback = authOp("identity.token.callback", "The login/invite callback: consumes a single-use token, finds-or-creates the user per the signup policy, mints a session and redirects with the cookie set.", { query: ["t", "next"], userAgent: true }, async (args, svc, req) => {
+    const loginUrl = `${svc.options.mount}/login`;
+    const raw = String(args.t ?? "");
+    if (!raw)
+        return redirectTo(`${loginUrl}?error=invalid-token`);
+    const token = await svc.consumeToken(raw);
+    if (!token || token.purpose === "bootstrap" || !token.emailNorm) {
+        // Bootstrap tokens have their own flow; never silently upgrade them here.
+        return redirectTo(`${loginUrl}?error=invalid-token`);
+    }
+    const data = token.data ?? {};
+    const invite = token.purpose === "invite";
+    const user = await svc.findOrCreateByIdentity({
+        provider: typeof data.provider === "string" ? data.provider : "magic-link",
+        subject: token.emailNorm,
+        email: token.emailNorm,
+        // The EFFECTIVE policy (admin-toggleable), not the construction-time option.
+        allowCreate: invite || (await svc.getSignup()) === "open",
+        roles: invite && Array.isArray(data.roles) ? data.roles : undefined,
+    });
+    if (!user)
+        return redirectTo(`${loginUrl}?error=signup-closed`);
+    if (user.disabled)
+        return redirectTo(`${loginUrl}?error=account-disabled`);
+    const minted = await svc.mintSession(user.id, { userAgent: args.userAgent ?? null });
+    const next = safeNextPath(args.next ?? data.next ?? req.home);
+    return redirectTo(next, sessionCookie(svc, minted.token));
+});
+const logout = authOp("identity.logout", "Revoke the current session and clear the cookie. POST (same-origin; the CSRF guard makes forged logouts inert).", {}, async (_args, svc, req) => {
+    const sessionId = req.principal.kind === "user" ? req.principal.claims?.sessionId : undefined;
+    if (typeof sessionId === "string")
+        await svc.revokeSession(sessionId);
+    return redirectTo(`${svc.options.mount}/login`, clearCookie(svc));
+});
+const welcomePage = authOp("identity.welcome.page", "Post-login landing of last resort (no AUTH_HOME_URL advertised): who you are + sign-out.", {}, (_args, svc, req) => {
+    if (req.principal.kind !== "user")
+        return redirectTo(`${svc.options.mount}/login`);
+    const claims = req.principal.claims ?? {};
+    return page(renderWelcomePage({
+        email: typeof claims.email === "string" ? claims.email : req.principal.id,
+        name: typeof claims.name === "string" ? claims.name : null,
+        mount: svc.options.mount,
+    }));
+});
+const bootstrapPage = authOp("identity.bootstrap.page", "The first-admin setup form, reached via the one-time URL printed on first boot. Query { t }.", { query: ["t"] }, (args, svc) => {
+    const t = String(args.t ?? "");
+    if (!t)
+        return redirectTo(`${svc.options.mount}/login?error=invalid-token`);
+    return page(renderBootstrapPage({ token: t, mount: svc.options.mount }));
+});
+const bootstrapSubmit = authOp("identity.bootstrap.submit", "Consume the bootstrap token, create the first user (bootstrap roles) and sign them in.", { body: ["t", "email", "name"], userAgent: true }, async (args, svc, req) => {
+    const t = String(args.t ?? "");
+    const email = String(args.email ?? "").trim();
+    if (!looksLikeEmail(email)) {
+        return page(renderBootstrapPage({ token: t, mount: svc.options.mount, error: "invalid-email" }), 400);
+    }
+    const token = await svc.consumeToken(t, "bootstrap");
+    if (!token)
+        return redirectTo(`${svc.options.mount}/login?error=invalid-token`);
+    const roles = Array.isArray(token.data?.roles) ? token.data.roles : ["admin"];
+    const user = await svc.findOrCreateByIdentity({
+        provider: "bootstrap",
+        subject: email.toLowerCase(),
+        email,
+        name: args.name ? String(args.name) : undefined,
+        allowCreate: true,
+        roles,
+    });
+    if (!user)
+        return redirectTo(`${svc.options.mount}/login?error=invalid-token`);
+    const minted = await svc.mintSession(user.id, { userAgent: args.userAgent ?? null });
+    return redirectTo(safeNextPath(token.data?.next ?? req.home), sessionCookie(svc, minted.token));
+});
+export const identityOps = [
+    whoami,
+    usersList,
+    usersInvite,
+    usersSetRoles,
+    usersToggleDisabled,
+    usersRevokeSessions,
+    usersGet,
+    usersRunStats,
+    usersLoginLink,
+    settingsGet,
+    settingsSet,
+    sessionsList,
+    sessionsRevoke,
+    loginPage,
+    tokenCallback,
+    logout,
+    welcomePage,
+    bootstrapPage,
+    bootstrapSubmit,
+];
+//# sourceMappingURL=ops.js.map

package/dist/ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.js","sourceRoot":"","sources":["../src/ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAqC,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAU/C;;;;;;GAMG;AACH,SAAS,MAAM,CACb,IAAY,EACZ,WAAmB,EACnB,EAAmD,EACnD,OAAoB,EACpB,OAAuC,EAAE;IAEzC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3B,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE;QAC9B,WAAW;QACX,4EAA4E;QAC5E,8EAA8E;QAC9E,mEAAmE;QACnE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAClI,OAAO,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAsBD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAA4E,EAAE,CAAC;AAExG;;;;;;GAMG;AACH,SAAS,MAAM,CACb,IAAY,EACZ,WAAmB,EACnB,EAA8D,EAC9D,OAAoB;IAEpB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IACvE,MAAM,MAAM,GAA6C,EAAE,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;QAAE,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9E,IAAI,EAAE,CAAC,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,IAAI;QACX,WAAW;QACX,QAAQ,EAAE,KAAK;QACf,MAAM;QACN,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,EAAE;YACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC1B;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,CAAC;YACD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACnD,MAAM,GAAG,GAAY;gBACnB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,IAAI,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,UAAU;gBAC1F,GAAG;aACJ,CAAC;YACF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACtH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAE,KAAa,EAA2B,EAAE,CAAC,CAAC;IACvF,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE;CAClI,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,GAAoB,EAA2B,EAAE,CAAC,CAAC;IACtE,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE;CACrF,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAe,EAAgB,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AACnH,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,OAAiC,EAAgB,EAAE,CACvF,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAErE,MAAM,UAAU,GAAG,CAAC,CAA4G,EAAE,EAAE,CAAC,CAAC;IACpI,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;CAC7C,CAAC,CAAC;AAEH,8EAA8E;AAE9E,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACzI,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;IACxB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS;KAC/B,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAEhF,MAAM,SAAS,GAAG,MAAM,CACtB,qBAAqB,EACrB,0DAA0D,EAC1D,EAAE,GAAG,EAAE,OAAO,EAAE,EAChB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAC7D,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,WAAW,GAAG,MAAM,CACxB,uBAAuB,EACvB,gLAAgL,EAChL,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC3E,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,KAAK,GACT,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACvB,CAAC,CAAE,IAAI,CAAC,KAAkB;QAC1B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC;QAClC,OAAO,EAAE,QAAQ;QACjB,KAAK;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,qCAAqC;QACrE,IAAI,EAAE,EAAE,KAAK,EAAE;KAChB,CAAC,CAAC;IACH,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpG,wEAAwE;IACxE,iEAAiE;IACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,aAAa,GAAG,MAAM,CAC1B,yBAAyB,EACzB,4GAA4G,EAC5G,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAC1E,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACrC,CAAC,CAAE,IAAI,CAAC,KAAkB;QAC1B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACpE,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,mBAAmB,GAAG,MAAM,CAChC,+BAA+B,EAC/B,sFAAsF,EACtF,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAC3C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,mBAAmB,GAAG,MAAM,CAChC,+BAA+B,EAC/B,2GAA2G,EAC3G,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC7C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClB,MAAM,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAcF,MAAM,WAAW,GAAG,CAAC,CAAU,EAAqB,EAAE,CAAC,OAAQ,CAA8B,EAAE,IAAI,KAAK,UAAU,CAAC;AAEnH,MAAM,QAAQ,GAAG,MAAM,CACrB,oBAAoB,EACpB,mEAAmE,EACnE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAC3C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACvF,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG;QACnC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG;QACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE;QAClD,iBAAiB,EAAE,MAAM,CAAC,MAAM;QAChC,SAAS,EAAE,IAAI,CAAC,EAAE;KACnB,CAAC;AACJ,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,aAAa,GAAG,MAAM,CAC1B,yBAAyB,EACzB,oGAAoG,EACpG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAC5C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC7C,uEAAuE;IACvE,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;SACvE,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,SAAS,EAAE,IAAI,KAAK,MAAM;QAC5B,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;QAC1B,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAC1C,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+G,CAAC;IAC1I,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7H,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,OAAO;YAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC;QACzD,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YACzB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC;YAC5B,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;QACzD,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;KACjD,CAAC,CAAC,CAAC;AACR,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,cAAc,GAAG,MAAM,CAC3B,0BAA0B,EAC1B,qIAAqI,EACrI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC7C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,OAAO;QACL,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,aAAa,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE;QAC1D,IAAI,EAAE,uCAAuC;KAC9C,CAAC;AACJ,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,WAAW,GAAG,MAAM,CACxB,uBAAuB,EACvB,iEAAiE,EACjE,EAAE,GAAG,EAAE,UAAU,EAAE,EACnB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,EACzD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,WAAW,GAAG,MAAM,CACxB,uBAAuB,EACvB,sGAAsG,EACtG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EACxD,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAA2B,CAAC,CAAC;IACrF,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;AAC3C,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,YAAY,GAAG,MAAM,CACzB,wBAAwB,EACxB,wDAAwD,EACxD,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAC1D,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QAC9C,MAAM,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QAC1F,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,MAAM,cAAc,GAAG,MAAM,CAC3B,0BAA0B,EAC1B,8FAA8F,EAC9F,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAChD,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClB,MAAM,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,EACD,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAC;AAEF,8EAA8E;AAE9E,MAAM,SAAS,GAAG,MAAM,CACtB,qBAAqB,EACrB,0FAA0F,EAC1F,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EACpC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACZ,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,CACT,eAAe,CAAC;QACd,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;KACnD,CAAC,CACH,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,MAAM,aAAa,GAAG,MAAM,CAC1B,yBAAyB,EACzB,6JAA6J,EAC7J,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EACzC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvB,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC,GAAG,QAAQ,sBAAsB,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAChE,0EAA0E;QAC1E,OAAO,UAAU,CAAC,GAAG,QAAQ,sBAAsB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC;QAC5C,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;QAC1E,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,6EAA6E;QAC7E,WAAW,EAAE,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM;QACzD,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAkB,CAAC,CAAC,CAAC,SAAS;KAClF,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,GAAG,QAAQ,sBAAsB,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,GAAG,QAAQ,yBAAyB,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAG,IAAI,CAAC,SAAoB,IAAI,IAAI,EAAE,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC,CACF,CAAC;AAEF,MAAM,MAAM,GAAG,MAAM,CACnB,iBAAiB,EACjB,iHAAiH,EACjH,EAAE,EACF,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACtE,OAAO,UAAU,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC,CACF,CAAC;AAEF,MAAM,WAAW,GAAG,MAAM,CACxB,uBAAuB,EACvB,0FAA0F,EAC1F,EAAE,EACF,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClB,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,CACT,iBAAiB,CAAC;QAChB,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;QACzE,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC1D,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK;KACzB,CAAC,CACH,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,MAAM,aAAa,GAAG,MAAM,CAC1B,yBAAyB,EACzB,8FAA8F,EAC9F,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAChB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,4BAA4B,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC,CACF,CAAC;AAEF,MAAM,eAAe,GAAG,MAAM,CAC5B,2BAA2B,EAC3B,wFAAwF,EACxF,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EACjD,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,4BAA4B,CAAC,CAAC;IAEhF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,IAAI,CAAC,KAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC;QAC5C,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE;QAC5B,KAAK;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/C,WAAW,EAAE,IAAI;QACjB,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,4BAA4B,CAAC,CAAC;IAE/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAG,IAAI,CAAC,SAAoB,IAAI,IAAI,EAAE,CAAC,CAAC;IACjG,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,MAAM;IACN,SAAS;IACT,WAAW;IACX,aAAa;IACb,mBAAmB;IACnB,mBAAmB;IACnB,QAAQ;IACR,aAAa;IACb,cAAc;IACd,WAAW;IACX,WAAW;IACX,YAAY;IACZ,cAAc;IACd,SAAS;IACT,aAAa;IACb,MAAM;IACN,WAAW;IACX,aAAa;IACb,eAAe;CAChB,CAAC"}