@relyper/sp-auth 0.1.0 → 0.3.0

package/dist/coins.js

@@ -0,0 +1,158 @@
+/**
+ * Client for the Relyper Coins integration API.
+ *
+ * Relyper Coins are held centrally: the wallet at the identity provider is the
+ * single source of truth for what a user can spend across every Relyper product.
+ * A service provider therefore never keeps its own balance -- it asks, and it
+ * debits, and anything it stores locally is a mirror for its own reporting.
+ *
+ * The service provider authenticates with the same client ID and secret it uses
+ * for the OIDC login, so every debit is attributable to one registered client
+ * and an operator can allow or refuse coin spending per app.
+ */
+export class RelyperCoinsError extends Error {
+    code;
+    status;
+    /** Present on insufficient_funds. */
+    balanceRc;
+    requestedRc;
+    cause;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = 'RelyperCoinsError';
+        this.code = code;
+        this.status = options.status ?? 502;
+        this.balanceRc = options.balanceRc;
+        this.requestedRc = options.requestedRc;
+        this.cause = options.cause;
+    }
+}
+/**
+ * Derives the coins API base URL from an OIDC issuer.
+ *
+ * The Relyper IdP publishes OIDC at the issuer root but mounts its regular API
+ * under `/api`, so the two differ by exactly that segment.
+ */
+export function coinsBaseUrlFromIssuer(issuer) {
+    const trimmed = trimTrailingSlashes(issuer);
+    return trimmed.endsWith('/api') ? trimmed : trimmed + '/api';
+}
+export function createRelyperCoinsClient(options) {
+    for (const key of ['baseUrl', 'clientId', 'clientSecret']) {
+        if (!options[key] || typeof options[key] !== 'string') {
+            throw new TypeError('@relyper/sp-auth/coins: ' + key + ' is required.');
+        }
+    }
+    const doFetch = options.fetch ?? globalThis.fetch;
+    if (typeof doFetch !== 'function') {
+        throw new TypeError('@relyper/sp-auth/coins: no fetch implementation available.');
+    }
+    const baseUrl = trimTrailingSlashes(options.baseUrl);
+    const timeout = options.requestTimeoutMs ?? 10_000;
+    // RFC 6749 section 2.3.1: both halves are form-urlencoded before the base64.
+    const authorization = 'Basic ' + Buffer.from(encodeURIComponent(options.clientId) + ':' + encodeURIComponent(options.clientSecret), 'utf8').toString('base64');
+    async function call(path, init) {
+        const url = baseUrl + path;
+        let response;
+        try {
+            response = await doFetch(url, {
+                method: init.method,
+                headers: {
+                    authorization,
+                    accept: 'application/json',
+                    ...(init.body === undefined ? {} : { 'content-type': 'application/json' })
+                },
+                body: init.body === undefined ? undefined : JSON.stringify(init.body),
+                signal: AbortSignal.timeout(timeout)
+            });
+        }
+        catch (cause) {
+            throw new RelyperCoinsError('unavailable', 'The Relyper coin service could not be reached.', { cause });
+        }
+        const payload = await readJson(response);
+        if (response.ok)
+            return payload ?? {};
+        const error = typeof payload?.error === 'string' ? payload.error : '';
+        if (response.status === 402 || error === 'insufficient_funds') {
+            throw new RelyperCoinsError('insufficient_funds', 'Not enough Relyper Coins.', {
+                status: 402,
+                balanceRc: numberOrUndefined(payload?.balanceRc),
+                requestedRc: numberOrUndefined(payload?.requestedRc)
+            });
+        }
+        if (response.status === 403 || error === 'coins_not_enabled_for_client') {
+            throw new RelyperCoinsError('coins_not_enabled', 'This application is not allowed to spend Relyper Coins.', {
+                status: 403
+            });
+        }
+        if (response.status === 401) {
+            throw new RelyperCoinsError('unauthorized', 'The Relyper coin service rejected this application.', {
+                status: 401
+            });
+        }
+        if (response.status === 400) {
+            throw new RelyperCoinsError('invalid_request', 'The coin request was rejected as invalid.', { status: 400 });
+        }
+        throw new RelyperCoinsError('unavailable', 'The Relyper coin service answered unexpectedly.', {
+            status: response.status
+        });
+    }
+    function walletPath(subject) {
+        if (!subject)
+            throw new TypeError('@relyper/sp-auth/coins: subject is required.');
+        return '/integrations/coins/user/' + encodeURIComponent(subject);
+    }
+    return {
+        async getWallet(subject) {
+            return (await call(walletPath(subject), { method: 'GET' }));
+        },
+        async getLedger(subject, limit = 50) {
+            const payload = await call(walletPath(subject) + '/ledger?limit=' + encodeURIComponent(String(limit)), {
+                method: 'GET'
+            });
+            return Array.isArray(payload?.items) ? payload.items : [];
+        },
+        async debit(input) {
+            if (!(input.amountRc > 0)) {
+                throw new TypeError('@relyper/sp-auth/coins: amountRc must be greater than zero.');
+            }
+            const payload = await call(walletPath(input.subject) + '/debit', {
+                method: 'POST',
+                body: {
+                    amountRc: input.amountRc,
+                    reason: input.reason,
+                    idempotencyKey: input.idempotencyKey,
+                    product: input.product,
+                    provider: input.provider,
+                    model: input.model,
+                    tenantId: input.tenantId,
+                    meta: input.meta ?? {}
+                }
+            });
+            const { ledgerEntry, dedup, ...wallet } = payload ?? {};
+            return {
+                wallet: wallet,
+                entry: ledgerEntry ?? null,
+                deduplicated: dedup === true
+            };
+        }
+    };
+}
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/')
+        end -= 1;
+    return value.slice(0, end);
+}
+function numberOrUndefined(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+async function readJson(response) {
+    try {
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=coins.js.map

package/dist/coins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coins.js","sourceRoot":"","sources":["../src/coins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgEH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IAC5B,MAAM,CAAS;IACxB,qCAAqC;IAC5B,SAAS,CAAU;IACnB,WAAW,CAAU;IACrB,KAAK,CAAW;IAEzB,YACE,IAA2B,EAC3B,OAAe,EACf,OAAO,GAAmF,EAAE;QAE5F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;CACF;AA8BD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA4B;IACnE,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAU,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,SAAS,CAAC,0BAA0B,GAAG,GAAG,GAAG,eAAe,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;IACnD,6EAA6E;IAC7E,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1C,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EACrF,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErB,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAwC;QACxE,MAAM,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC;QAC3B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE;oBACP,aAAa;oBACb,MAAM,EAAE,kBAAkB;oBAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;iBAC3E;gBACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,gDAAgD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,OAAO,IAAI,EAAE,CAAC;QAEtC,MAAM,KAAK,GAAG,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;YAC9D,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,EAAE,2BAA2B,EAAE;gBAC7E,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC;gBAChD,WAAW,EAAE,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,8BAA8B,EAAE,CAAC;YACxE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,yDAAyD,EAAE;gBAC1G,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,qDAAqD,EAAE;gBACjG,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,iDAAiD,EAAE;YAC5F,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IAED,SAAS,UAAU,CAAC,OAAe;QACjC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QAClF,OAAO,2BAA2B,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,OAAe;YAC7B,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAsB,CAAC;QACnF,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,KAAK,GAAG,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE;gBACrG,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAuB;YACjC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE;gBAC/D,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE;oBACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;iBACvB;aACF,CAAC,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;YACxD,OAAO;gBACL,MAAM,EAAE,MAA2B;gBACnC,KAAK,EAAG,WAAsC,IAAI,IAAI;gBACtD,YAAY,EAAE,KAAK,KAAK,IAAI;aAC7B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/oidc/claims.d.ts

@@ -0,0 +1,4 @@
+import type { RelyperIdentity } from '../types.js';
+export declare function asStringList(value: unknown): string[];
+export declare function defaultClaimsToIdentity(claims: Record<string, unknown>): RelyperIdentity;
+//# sourceMappingURL=claims.d.ts.map

package/dist/oidc/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/oidc/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAcnD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAQrD;AAkBD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAcxF"}

package/dist/oidc/claims.js

@@ -0,0 +1,50 @@
+/**
+ * Maps the claims of a Relyper ID token onto the identity the application sees.
+ *
+ * The IdP sends tenant information under several names for backwards
+ * compatibility (`tenant`, `tenant_id`, `tenant_ids`, `tenants`); this collapses
+ * them into one shape so service providers do not each reinvent the reading.
+ */
+function asString(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+export function asStringList(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => asString(item)).filter(Boolean);
+    }
+    const single = asString(value);
+    if (!single)
+        return [];
+    // Some providers send space- or comma-separated lists in a single claim.
+    return single.split(/[\s,]+/).map((item) => item.trim()).filter(Boolean);
+}
+function tenantIdsFrom(claims) {
+    const explicit = asStringList(claims.tenant_ids);
+    if (explicit.length)
+        return explicit;
+    const tenants = claims.tenants;
+    if (Array.isArray(tenants)) {
+        const ids = tenants
+            .map((entry) => (entry && typeof entry === 'object' ? asString(entry.tenantId) : ''))
+            .filter(Boolean);
+        if (ids.length)
+            return ids;
+    }
+    const single = asString(claims.tenant_id) || asString(claims.tenant);
+    return single ? [single] : [];
+}
+export function defaultClaimsToIdentity(claims) {
+    const email = asString(claims.email);
+    const tenantIds = tenantIdsFrom(claims);
+    return {
+        subject: asString(claims.sub),
+        email,
+        displayName: asString(claims.name) || asString(claims.preferred_username) || email || 'Relyper User',
+        roles: asStringList(claims.roles),
+        tenantId: tenantIds[0] ?? null,
+        tenantIds,
+        tenantName: asString(claims.tenant_name) || null,
+        teams: asStringList(claims.teams)
+    };
+}
+//# sourceMappingURL=claims.js.map

package/dist/oidc/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/oidc/claims.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,yEAAyE;IACzE,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,aAAa,CAAC,MAA+B;IACpD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO;aAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAE,KAAiC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACjH,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAA+B;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAExC,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7B,KAAK;QACL,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,KAAK,IAAI,cAAc;QACpG,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;QACjC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI;QAC9B,SAAS;QACT,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI;QAChD,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;KAClC,CAAC;AACJ,CAAC"}

package/dist/oidc/client.d.ts

@@ -0,0 +1,44 @@
+import type { RelyperIdentity } from '../types.js';
+import { type OidcDiscoveryDocument, type RelyperAuthorizationRequest, type RelyperLoginResult, type RelyperLoginTransaction, type RelyperOidcOptions, type ResolvedRelyperOidcOptions } from './types.js';
+export type AuthorizationRequestOptions = {
+    /** Local path to return to after the login. Anything else falls back to '/'. */
+    returnTo?: string;
+    /** OIDC `prompt`, e.g. 'login' to force re-authentication. */
+    prompt?: string;
+    /** OIDC `login_hint`, usually an e-mail address. */
+    loginHint?: string;
+};
+export type RelyperOidcClient = {
+    readonly options: ResolvedRelyperOidcOptions;
+    /** Discovery document, fetched on first use and cached afterwards. */
+    discover(): Promise<OidcDiscoveryDocument>;
+    /**
+     * Starts a login. Returns the IdP URL to redirect to plus the transaction the
+     * caller has to hand back to {@link RelyperOidcClient.completeLogin}.
+     */
+    createAuthorizationRequest(options?: AuthorizationRequestOptions): Promise<RelyperAuthorizationRequest>;
+    /**
+     * Completes a login: checks `state`, exchanges the code, verifies the ID token
+     * and returns the identity. Throws {@link RelyperOidcError} on every failure.
+     */
+    completeLogin(params: {
+        query: Record<string, string | string[] | undefined>;
+        transaction: RelyperLoginTransaction;
+    }): Promise<RelyperLoginResult>;
+    /** Role check, identical in semantics to the header-based variant. */
+    hasRole(identity: RelyperIdentity, role: string | string[], match?: 'any' | 'all'): boolean;
+    /** URL that ends the IdP session, or null if the IdP advertises none. */
+    endSessionUrl(options?: {
+        idTokenHint?: string;
+        postLogoutRedirectUri?: string;
+    }): Promise<string | null>;
+};
+export declare function createRelyperOidcClient(options: RelyperOidcOptions): RelyperOidcClient;
+/**
+ * Only a local path is ever used as a post-login target. An absolute URL, or a
+ * protocol-relative one starting with two slashes, would turn the login route
+ * into an open redirect. Backslashes are rejected too, because some browsers
+ * normalise them to forward slashes and would follow "/\\evil.example".
+ */
+export declare function safeReturnTo(value: unknown, fallback?: string): string;
+//# sourceMappingURL=client.d.ts.map

package/dist/oidc/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/oidc/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAEvB,KAAK,0BAA0B,EAEhC,MAAM,YAAY,CAAC;AAapB,MAAM,MAAM,2BAA2B,GAAG;IACxC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,sEAAsE;IACtE,QAAQ,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C;;;OAGG;IACH,0BAA0B,CAAC,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxG;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;QACrD,WAAW,EAAE,uBAAuB,CAAC;KACtC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChC,sEAAsE;IACtE,OAAO,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IAC5F,yEAAyE;IACzE,aAAa,CAAC,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3G,CAAC;AA+BF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,iBAAiB,CA6RtF;AA2BD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAM,GAAG,MAAM,CAOnE"}

package/dist/oidc/client.js

@@ -0,0 +1,340 @@
+import { createRemoteJWKSet, customFetch, jwtVerify } from 'jose';
+import { createDiscoveryLoader } from './discovery.js';
+import { defaultClaimsToIdentity } from './claims.js';
+import { codeChallengeFor, createCodeVerifier, createNonce, createState } from './pkce.js';
+import { RelyperOidcError } from './types.js';
+/**
+ * OIDC client for a Relyper service provider.
+ *
+ * Authorization Code Flow with PKCE and a confidential client: the client secret
+ * only ever travels from this server to the IdP's token endpoint, never through
+ * the browser. Every ID token is verified against the IdP's JWKS before a single
+ * claim in it is believed.
+ */
+const DEFAULT_SCOPE = 'openid email profile roles tenant teams';
+function resolveOptions(options) {
+    const required = ['issuer', 'clientId', 'clientSecret', 'redirectUri'];
+    for (const key of required) {
+        if (!options[key] || typeof options[key] !== 'string') {
+            throw new TypeError('@relyper/sp-auth/oidc: ' + key + ' is required.');
+        }
+    }
+    const requiredRoles = options.requiredRole === undefined
+        ? []
+        : (Array.isArray(options.requiredRole) ? options.requiredRole : [options.requiredRole]).filter(Boolean);
+    return {
+        issuer: trimTrailingSlashes(options.issuer),
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        redirectUri: options.redirectUri,
+        scope: options.scope ?? DEFAULT_SCOPE,
+        tokenEndpointAuthMethod: options.tokenEndpointAuthMethod ?? null,
+        requiredRoles,
+        roleMatch: options.roleMatch ?? 'any',
+        requireEmail: options.requireEmail ?? true,
+        useUserInfo: options.useUserInfo ?? false,
+        clockToleranceSeconds: options.clockToleranceSeconds ?? 60,
+        discoveryTtlMs: options.discoveryTtlMs ?? 3_600_000,
+        requestTimeoutMs: options.requestTimeoutMs ?? 10_000
+    };
+}
+export function createRelyperOidcClient(options) {
+    const resolved = resolveOptions(options);
+    const doFetch = options.fetch ?? globalThis.fetch;
+    if (typeof doFetch !== 'function') {
+        throw new TypeError('@relyper/sp-auth/oidc: no fetch implementation available.');
+    }
+    const mapClaims = options.mapClaims ?? defaultClaimsToIdentity;
+    const discovery = createDiscoveryLoader({
+        issuer: resolved.issuer,
+        ttlMs: resolved.discoveryTtlMs,
+        requestTimeoutMs: resolved.requestTimeoutMs,
+        fetch: doFetch
+    });
+    // One JWKS per jwks_uri. jose caches the keys, refetches on an unknown `kid`
+    // and rate-limits those refetches, which is exactly the key-rotation behaviour
+    // we would otherwise have to build by hand.
+    const jwksCache = new Map();
+    function jwksFor(uri) {
+        let jwks = jwksCache.get(uri);
+        if (!jwks) {
+            jwks = createRemoteJWKSet(new URL(uri), {
+                timeoutDuration: resolved.requestTimeoutMs,
+                cooldownDuration: 30_000,
+                // The JWKS has to travel the same path as every other call to the IdP,
+                // so a proxy-aware or test fetch covers key retrieval as well.
+                [customFetch]: doFetch
+            });
+            jwksCache.set(uri, jwks);
+        }
+        return jwks;
+    }
+    function authMethod(document) {
+        if (resolved.tokenEndpointAuthMethod)
+            return resolved.tokenEndpointAuthMethod;
+        const supported = document.token_endpoint_auth_methods_supported ?? [];
+        if (supported.includes('client_secret_basic'))
+            return 'client_secret_basic';
+        if (supported.includes('client_secret_post'))
+            return 'client_secret_post';
+        // The OIDC default for a confidential client when the document says nothing.
+        return 'client_secret_basic';
+    }
+    async function exchangeCode(document, code, codeVerifier) {
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: resolved.redirectUri,
+            code_verifier: codeVerifier
+        });
+        const headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json'
+        };
+        if (authMethod(document) === 'client_secret_basic') {
+            // RFC 6749 section 2.3.1: both halves are form-urlencoded before the
+            // base64. Skipping that breaks any secret holding a reserved character.
+            const credentials = encodeURIComponent(resolved.clientId) + ':' + encodeURIComponent(resolved.clientSecret);
+            headers.authorization = 'Basic ' + Buffer.from(credentials, 'utf8').toString('base64');
+        }
+        else {
+            body.set('client_id', resolved.clientId);
+            body.set('client_secret', resolved.clientSecret);
+        }
+        let response;
+        try {
+            response = await doFetch(document.token_endpoint, {
+                method: 'POST',
+                headers,
+                body: body.toString(),
+                signal: AbortSignal.timeout(resolved.requestTimeoutMs)
+            });
+        }
+        catch (cause) {
+            throw new RelyperOidcError('token_exchange_failed', 'The identity provider could not be reached.', { cause });
+        }
+        const payload = await readJson(response);
+        if (!response.ok) {
+            // The IdP's own error code is safe to log; the body may hold more, so only
+            // the two documented fields are carried over.
+            const error = typeof payload?.error === 'string' ? payload.error : 'HTTP ' + response.status;
+            const description = typeof payload?.error_description === 'string' ? payload.error_description : '';
+            throw new RelyperOidcError('token_exchange_failed', 'The login could not be completed.', {
+                detail: description ? error + ': ' + description : error
+            });
+        }
+        const idToken = typeof payload?.id_token === 'string' ? payload.id_token : '';
+        if (!idToken) {
+            throw new RelyperOidcError('token_exchange_failed', 'The identity provider returned no ID token.', {
+                detail: 'token response without id_token'
+            });
+        }
+        return {
+            idToken,
+            accessToken: typeof payload?.access_token === 'string' ? payload.access_token : '',
+            tokenType: typeof payload?.token_type === 'string' ? payload.token_type : 'Bearer',
+            expiresIn: typeof payload?.expires_in === 'number' ? payload.expires_in : null,
+            refreshToken: typeof payload?.refresh_token === 'string' ? payload.refresh_token : null,
+            scope: typeof payload?.scope === 'string' ? payload.scope : null
+        };
+    }
+    async function verifyIdToken(document, idToken, nonce) {
+        let payload;
+        try {
+            const result = await jwtVerify(idToken, jwksFor(document.jwks_uri), {
+                issuer: document.issuer,
+                audience: resolved.clientId,
+                clockTolerance: resolved.clockToleranceSeconds,
+                // Pinning the algorithms is what stops a token downgraded to `none`, or
+                // to an HMAC signed with the provider's public key, from being accepted.
+                algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256', 'ES384']
+            });
+            payload = result.payload;
+        }
+        catch (cause) {
+            throw new RelyperOidcError('invalid_id_token', 'The identity provider returned an invalid token.', {
+                cause,
+                detail: cause instanceof Error ? cause.message : undefined
+            });
+        }
+        // OpenID Connect Core 3.1.3.7 step 11: the nonce ties this token to the login
+        // this browser started. Without the check a token captured elsewhere replays.
+        if (payload.nonce !== nonce) {
+            throw new RelyperOidcError('invalid_id_token', 'The identity provider returned an invalid token.', {
+                detail: 'nonce mismatch'
+            });
+        }
+        // Step 12: with several audiences, `azp` has to name this client.
+        if (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== resolved.clientId) {
+            throw new RelyperOidcError('invalid_id_token', 'The identity provider returned an invalid token.', {
+                detail: 'azp does not match the client id'
+            });
+        }
+        if (typeof payload.sub !== 'string' || !payload.sub) {
+            throw new RelyperOidcError('invalid_id_token', 'The identity provider returned an invalid token.', {
+                detail: 'missing sub claim'
+            });
+        }
+        return payload;
+    }
+    async function fetchUserInfo(document, accessToken) {
+        if (!document.userinfo_endpoint || !accessToken)
+            return {};
+        let response;
+        try {
+            response = await doFetch(document.userinfo_endpoint, {
+                method: 'GET',
+                headers: { authorization: 'Bearer ' + accessToken, accept: 'application/json' },
+                signal: AbortSignal.timeout(resolved.requestTimeoutMs)
+            });
+        }
+        catch (cause) {
+            throw new RelyperOidcError('userinfo_failed', 'The identity provider could not be reached.', { cause });
+        }
+        if (!response.ok) {
+            throw new RelyperOidcError('userinfo_failed', 'The user profile could not be read.', {
+                detail: 'HTTP ' + response.status
+            });
+        }
+        return (await readJson(response)) ?? {};
+    }
+    return {
+        options: resolved,
+        discover: () => discovery.load(),
+        async createAuthorizationRequest(requestOptions = {}) {
+            const document = await discovery.load();
+            const transaction = {
+                state: createState(),
+                nonce: createNonce(),
+                codeVerifier: createCodeVerifier(),
+                returnTo: safeReturnTo(requestOptions.returnTo)
+            };
+            const url = new URL(document.authorization_endpoint);
+            url.searchParams.set('response_type', 'code');
+            url.searchParams.set('client_id', resolved.clientId);
+            url.searchParams.set('redirect_uri', resolved.redirectUri);
+            url.searchParams.set('scope', resolved.scope);
+            url.searchParams.set('state', transaction.state);
+            url.searchParams.set('nonce', transaction.nonce);
+            url.searchParams.set('code_challenge', codeChallengeFor(transaction.codeVerifier));
+            url.searchParams.set('code_challenge_method', 'S256');
+            if (requestOptions.prompt)
+                url.searchParams.set('prompt', requestOptions.prompt);
+            if (requestOptions.loginHint)
+                url.searchParams.set('login_hint', requestOptions.loginHint);
+            return { url: url.toString(), transaction };
+        },
+        async completeLogin({ query, transaction }) {
+            const idpError = firstValue(query.error);
+            if (idpError) {
+                throw new RelyperOidcError('idp_error', 'The identity provider refused the login.', {
+                    status: 401,
+                    detail: [idpError, firstValue(query.error_description)].filter(Boolean).join(': ')
+                });
+            }
+            const state = firstValue(query.state);
+            // A constant-time comparison would buy nothing here: whoever can measure
+            // the response already holds the cookie this is compared against.
+            if (!state || state !== transaction.state) {
+                throw new RelyperOidcError('invalid_state', 'The login could not be verified. Please try again.', {
+                    status: 400,
+                    detail: state ? 'state does not match the login transaction' : 'state parameter missing'
+                });
+            }
+            const code = firstValue(query.code);
+            if (!code) {
+                throw new RelyperOidcError('idp_error', 'The identity provider returned no authorization code.', {
+                    status: 400
+                });
+            }
+            const document = await discovery.load();
+            const tokens = await exchangeCode(document, code, transaction.codeVerifier);
+            const idClaims = await verifyIdToken(document, tokens.idToken, transaction.nonce);
+            let claims = { ...idClaims };
+            if (resolved.useUserInfo) {
+                const userInfo = await fetchUserInfo(document, tokens.accessToken);
+                // OpenID Connect Core 5.3.2: a UserInfo response whose `sub` differs from
+                // the ID token's must be discarded outright.
+                if (userInfo.sub && userInfo.sub !== idClaims.sub) {
+                    throw new RelyperOidcError('userinfo_failed', 'The user profile could not be read.', {
+                        detail: 'userinfo sub does not match the id token'
+                    });
+                }
+                claims = { ...claims, ...userInfo };
+            }
+            const identity = mapClaims(claims);
+            if (resolved.requireEmail && !identity.email) {
+                throw new RelyperOidcError('missing_email', 'The identity provider supplied no e-mail address.', {
+                    status: 403
+                });
+            }
+            if (resolved.requiredRoles.length && !matchesRoles(identity.roles, resolved.requiredRoles, resolved.roleMatch)) {
+                throw new RelyperOidcError('missing_role', 'Your account does not have access to this application.', {
+                    status: 403,
+                    detail: 'presented roles: ' + (identity.roles.join(', ') || '(none)')
+                });
+            }
+            return { identity, claims, tokens };
+        },
+        hasRole(identity, role, match = 'any') {
+            const wanted = Array.isArray(role) ? role : [role];
+            return matchesRoles(identity.roles, wanted, match);
+        },
+        async endSessionUrl(endSessionOptions = {}) {
+            const document = await discovery.load();
+            if (!document.end_session_endpoint)
+                return null;
+            const url = new URL(document.end_session_endpoint);
+            if (endSessionOptions.idTokenHint)
+                url.searchParams.set('id_token_hint', endSessionOptions.idTokenHint);
+            if (endSessionOptions.postLogoutRedirectUri) {
+                url.searchParams.set('post_logout_redirect_uri', endSessionOptions.postLogoutRedirectUri);
+            }
+            url.searchParams.set('client_id', resolved.clientId);
+            return url.toString();
+        }
+    };
+}
+function matchesRoles(actual, required, match) {
+    return match === 'all'
+        ? required.every((role) => actual.includes(role))
+        : required.some((role) => actual.includes(role));
+}
+function firstValue(value) {
+    if (Array.isArray(value))
+        return typeof value[0] === 'string' ? value[0] : '';
+    return typeof value === 'string' ? value : '';
+}
+async function readJson(response) {
+    try {
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/')
+        end -= 1;
+    return value.slice(0, end);
+}
+/**
+ * Only a local path is ever used as a post-login target. An absolute URL, or a
+ * protocol-relative one starting with two slashes, would turn the login route
+ * into an open redirect. Backslashes are rejected too, because some browsers
+ * normalise them to forward slashes and would follow "/\\evil.example".
+ */
+export function safeReturnTo(value, fallback = '/') {
+    const candidate = typeof value === 'string' ? value.trim() : '';
+    if (!candidate)
+        return fallback;
+    if (!candidate.startsWith('/'))
+        return fallback;
+    if (candidate.startsWith('//'))
+        return fallback;
+    if (candidate.includes('\\'))
+        return fallback;
+    return candidate;
+}
+//# sourceMappingURL=client.js.map

package/dist/oidc/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/oidc/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAyC,MAAM,MAAM,CAAC;AAEzG,OAAO,EAAE,qBAAqB,EAAwB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC3F,OAAO,EACL,gBAAgB,EASjB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AAEH,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAkChE,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,CAAU,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,SAAS,CAAC,yBAAyB,GAAG,GAAG,GAAG,eAAe,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS;QACtD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE1G,OAAO;QACL,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa;QACrC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,IAAI,IAAI;QAChE,aAAa;QACb,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;QACrC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;QACzC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,EAAE;QAC1D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,SAAS;QACnD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,MAAM;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAE/D,MAAM,SAAS,GAAoB,qBAAqB,CAAC;QACvD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,QAAQ,CAAC,cAAc;QAC9B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+EAA+E;IAC/E,4CAA4C;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,SAAS,OAAO,CAAC,GAAW;QAC1B,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;gBACtC,eAAe,EAAE,QAAQ,CAAC,gBAAgB;gBAC1C,gBAAgB,EAAE,MAAM;gBACxB,uEAAuE;gBACvE,+DAA+D;gBAC/D,CAAC,WAAW,CAAC,EAAE,OAAO;aACvB,CAAC,CAAC;YACH,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,UAAU,CAAC,QAA+B;QACjD,IAAI,QAAQ,CAAC,uBAAuB;YAAE,OAAO,QAAQ,CAAC,uBAAuB,CAAC;QAC9E,MAAM,SAAS,GAAG,QAAQ,CAAC,qCAAqC,IAAI,EAAE,CAAC;QACvE,IAAI,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC5E,IAAI,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,OAAO,oBAAoB,CAAC;QAC1E,6EAA6E;QAC7E,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,QAA+B,EAC/B,IAAY,EACZ,YAAoB;QAEpB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QAEF,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,qBAAqB,EAAE,CAAC;YACnD,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC5G,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,6CAA6C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,KAAK,GAAG,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC7F,MAAM,WAAW,GAAG,OAAO,OAAO,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,mCAAmC,EAAE;gBACvF,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK;aACzD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,OAAO,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,6CAA6C,EAAE;gBACjG,MAAM,EAAE,iCAAiC;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,OAAO;YACP,WAAW,EAAE,OAAO,OAAO,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;YAClF,SAAS,EAAE,OAAO,OAAO,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YAClF,SAAS,EAAE,OAAO,OAAO,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YAC9E,YAAY,EAAE,OAAO,OAAO,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;YACvF,KAAK,EAAE,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;SACjE,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,QAA+B,EAC/B,OAAe,EACf,KAAa;QAEb,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAClE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,cAAc,EAAE,QAAQ,CAAC,qBAAqB;gBAC9C,wEAAwE;gBACxE,yEAAyE;gBACzE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;aACnE,CAAC,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,kDAAkD,EAAE;gBACjG,KAAK;gBACL,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,kDAAkD,EAAE;gBACjG,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC9F,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,kDAAkD,EAAE;gBACjG,MAAM,EAAE,kCAAkC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,kDAAkD,EAAE;gBACjG,MAAM,EAAE,mBAAmB;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,QAA+B,EAAE,WAAmB;QAC/E,IAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAC3D,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE;gBACnD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,GAAG,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC/E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,qCAAqC,EAAE;gBACnF,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC,MAAM;aAClC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QAEjB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE;QAEhC,KAAK,CAAC,0BAA0B,CAAC,cAAc,GAAgC,EAAE;YAC/E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,WAAW,GAA4B;gBAC3C,KAAK,EAAE,WAAW,EAAE;gBACpB,KAAK,EAAE,WAAW,EAAE;gBACpB,YAAY,EAAE,kBAAkB,EAAE;gBAClC,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC;aAChD,CAAC;YAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;YACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,IAAI,cAAc,CAAC,MAAM;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,cAAc,CAAC,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;YAE3F,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE;YACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,0CAA0C,EAAE;oBAClF,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBACnF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtC,yEAAyE;YACzE,kEAAkE;YAClE,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC1C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,oDAAoD,EAAE;oBAChG,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,yBAAyB;iBACzF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,uDAAuD,EAAE;oBAC/F,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAElF,IAAI,MAAM,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;YACtD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;gBACnE,0EAA0E;gBAC1E,6CAA6C;gBAC7C,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;oBAClD,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,qCAAqC,EAAE;wBACnF,MAAM,EAAE,0CAA0C;qBACnD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAEnC,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC7C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,mDAAmD,EAAE;oBAC/F,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/G,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,wDAAwD,EAAE;oBACnG,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,mBAAmB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;iBACtE,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;QAED,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,GAAG,KAAK;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,iBAAiB,GAAG,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YACnD,IAAI,iBAAiB,CAAC,WAAW;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACxG,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,CAAC;gBAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;YAC5F,CAAC;YACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAgB,EAAE,QAAkB,EAAE,KAAoB;IAC9E,OAAO,KAAK,KAAK,KAAK;QACpB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,KAAoC;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,QAAQ,GAAG,GAAG;IACzD,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,OAAO,SAAS,CAAC;AACnB,CAAC"}