@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/totp.js

@@ -1,208 +0,0 @@
-import { userIdFromIdentitySubject } from "./identity.js";
-import { callVerifierSignature } from "./mutations/signature.js";
-import { callSignIn } from "./mutations/signin.js";
-import { callVerifier } from "./mutations/verifier.js";
-import { mutateTotpInsert, mutateTotpMarkVerified, mutateTotpUpdateLastUsed, mutateVerifierDelete, queryTotpById, queryTotpVerifiedByUserId, queryUserById, queryVerifierById } from "./types.js";
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-import { encodeBase32LowerCaseNoPadding } from "@oslojs/encoding";
-import { createTOTPKeyURI, verifyTOTPWithGracePeriod } from "@oslojs/otp";
-
-//#region src/server/totp.ts
-/**
-* Server-side TOTP ceremony logic for two-factor authentication.
-*
-* Handles the three phases of the TOTP flow:
-* 1. setup   — generate a TOTP secret and `otpauth://` URI for enrollment
-* 2. confirm — verify the first code from the authenticator app
-* 3. verify  — verify a TOTP code during sign-in (2FA challenge)
-*/
-const TOTP_FLOWS = [
-	"setup",
-	"confirm",
-	"verify"
-];
-const resolveTotpFlowFx = (params) => {
-	const flow = params.flow;
-	return typeof flow === "string" && TOTP_FLOWS.includes(flow) ? Fx.succeed(flow) : Cv.fail({
-		code: "TOTP_MISSING_FLOW",
-		message: "Missing `flow` parameter. Expected one of: setup, confirm, verify"
-	});
-};
-const requireTotpVerifierFx = (verifier) => verifier != null ? Fx.succeed(verifier) : Cv.fail({
-	code: "TOTP_MISSING_VERIFIER",
-	message: "Missing verifier for TOTP operation."
-});
-const requireTotpCodeFx = (params) => typeof params.code === "string" ? Fx.succeed(params.code) : Cv.fail({
-	code: "TOTP_MISSING_CODE",
-	message: "Missing TOTP code."
-});
-const requireTotpIdFx = (params) => typeof params.totpId === "string" ? Fx.succeed(params.totpId) : Cv.fail({
-	code: "TOTP_MISSING_ID",
-	message: "Missing TOTP enrollment ID."
-});
-const resolveTotpDispatchFx = (params, verifier) => resolveTotpFlowFx(params).pipe(Fx.chain((flow) => Fx.match({ flow }).on("flow", {
-	setup: () => Fx.succeed({
-		flow: "setup",
-		params
-	}),
-	confirm: () => Fx.gen(function* () {
-		const resolvedVerifier = yield* requireTotpVerifierFx(verifier);
-		return {
-			flow: "confirm",
-			code: yield* requireTotpCodeFx(params),
-			totpId: yield* requireTotpIdFx(params),
-			verifier: resolvedVerifier
-		};
-	}),
-	verify: () => Fx.gen(function* () {
-		const resolvedVerifier = yield* requireTotpVerifierFx(verifier);
-		return {
-			flow: "verify",
-			code: yield* requireTotpCodeFx(params),
-			verifier: resolvedVerifier
-		};
-	})
-})));
-/** @internal */
-const handleTotp = (ctx, provider, args) => {
-	return resolveTotpDispatchFx(args.params ?? {}, args.verifier).pipe(Fx.chain((dispatch) => Fx.match(dispatch).on("flow", {
-		setup: ({ params }) => Fx.from({
-			ok: () => ctx.auth.getUserIdentity(),
-			err: (e) => Cv.error({
-				code: "INTERNAL_ERROR",
-				message: String(e)
-			})
-		}).pipe(Fx.chain((identity) => identity === null ? Cv.fail({
-			code: "TOTP_AUTH_REQUIRED",
-			message: "Sign in first, then set up two-factor authentication."
-		}) : Fx.succeed(userIdFromIdentitySubject(identity.subject))), Fx.chain((userId) => Fx.from({
-			ok: async () => {
-				const secret = new Uint8Array(20);
-				crypto.getRandomValues(secret);
-				let accountName = params.accountName;
-				if (!accountName) accountName = (await queryUserById(ctx, userId))?.email ?? "user";
-				const uri = createTOTPKeyURI(provider.options.issuer, accountName, secret, provider.options.period, provider.options.digits);
-				const base32Secret = encodeBase32LowerCaseNoPadding(secret);
-				const verifier = await callVerifier(ctx);
-				await callVerifierSignature(ctx, {
-					verifier,
-					signature: JSON.stringify({
-						secret: Array.from(secret),
-						userId,
-						digits: provider.options.digits,
-						period: provider.options.period
-					})
-				});
-				return {
-					kind: "totpSetup",
-					uri,
-					secret: base32Secret,
-					verifier,
-					totpId: await mutateTotpInsert(ctx, {
-						userId,
-						secret: secret.buffer.slice(secret.byteOffset, secret.byteOffset + secret.byteLength),
-						digits: provider.options.digits,
-						period: provider.options.period,
-						verified: false,
-						name: typeof params.name === "string" ? params.name : void 0,
-						createdAt: Date.now()
-					})
-				};
-			},
-			err: (e) => Cv.error({
-				code: "INTERNAL_ERROR",
-				message: `TOTP setup failed: ${String(e)}`
-			})
-		}))),
-		confirm: ({ code, totpId, verifier }) => Fx.from({
-			ok: () => ctx.auth.getUserIdentity(),
-			err: (e) => Cv.error({
-				code: "INTERNAL_ERROR",
-				message: String(e)
-			})
-		}).pipe(Fx.chain((identity) => identity === null ? Cv.fail({
-			code: "TOTP_AUTH_REQUIRED",
-			message: "Sign in first, then set up two-factor authentication."
-		}) : Fx.succeed(userIdFromIdentitySubject(identity.subject))), Fx.chain((userId) => Fx.from({
-			ok: () => queryTotpById(ctx, totpId),
-			err: () => Cv.error({
-				code: "TOTP_NOT_FOUND",
-				message: "TOTP enrollment not found."
-			})
-		}).pipe(Fx.chain((doc) => doc === null ? Cv.fail({
-			code: "TOTP_NOT_FOUND",
-			message: "TOTP enrollment not found."
-		}) : Fx.succeed(doc)), Fx.chain((totpDoc) => totpDoc.verified ? Cv.fail({
-			code: "TOTP_ALREADY_VERIFIED",
-			message: "TOTP enrollment is already verified."
-		}) : Fx.succeed(totpDoc))).pipe(Fx.chain((totpDoc) => verifyTOTPWithGracePeriod(new Uint8Array(totpDoc.secret), provider.options.period, provider.options.digits, code, 30) ? Fx.succeed(totpDoc) : Cv.fail({
-			code: "TOTP_INVALID_CODE",
-			message: "Invalid TOTP code."
-		}))).pipe(Fx.chain((_totpDoc) => Fx.from({
-			ok: async () => {
-				await mutateTotpMarkVerified(ctx, totpId, Date.now());
-				await mutateVerifierDelete(ctx, verifier);
-				return callSignIn(ctx, {
-					userId,
-					generateTokens: true
-				});
-			},
-			err: (e) => Cv.error({
-				code: "INTERNAL_ERROR",
-				message: String(e)
-			})
-		}))).pipe(Fx.map((signInResult) => ({
-			kind: "signedIn",
-			signedIn: signInResult
-		}))))),
-		verify: ({ code, verifier }) => Fx.from({
-			ok: () => queryVerifierById(ctx, verifier),
-			err: () => Cv.error({
-				code: "TOTP_INVALID_VERIFIER",
-				message: "Invalid or expired TOTP verifier."
-			})
-		}).pipe(Fx.chain((doc) => doc === null ? Cv.fail({
-			code: "TOTP_INVALID_VERIFIER",
-			message: "Invalid or expired TOTP verifier."
-		}) : Fx.succeed(doc)), Fx.map((doc) => {
-			return {
-				userId: JSON.parse(doc.signature).userId,
-				code,
-				verifier
-			};
-		}), Fx.chain(({ userId, code: code$1, verifier: verifier$1 }) => Fx.from({
-			ok: () => queryTotpVerifiedByUserId(ctx, userId),
-			err: () => Cv.error({
-				code: "TOTP_NO_ENROLLMENT",
-				message: "No verified TOTP enrollment found."
-			})
-		}).pipe(Fx.chain((totpDoc) => totpDoc === null ? Cv.fail({
-			code: "TOTP_NO_ENROLLMENT",
-			message: "No verified TOTP enrollment found."
-		}) : Fx.succeed(totpDoc)), Fx.chain((totpDoc) => verifyTOTPWithGracePeriod(new Uint8Array(totpDoc.secret), totpDoc.period, totpDoc.digits, code$1, 30) ? Fx.succeed(totpDoc) : Cv.fail({
-			code: "TOTP_INVALID_CODE",
-			message: "Invalid TOTP code."
-		})), Fx.chain((totpDoc) => Fx.from({
-			ok: async () => {
-				await mutateTotpUpdateLastUsed(ctx, totpDoc._id, Date.now());
-				await mutateVerifierDelete(ctx, verifier$1);
-				return callSignIn(ctx, {
-					userId,
-					generateTokens: true
-				});
-			},
-			err: (e) => Cv.error({
-				code: "INTERNAL_ERROR",
-				message: String(e)
-			})
-		})), Fx.map((signInResult) => ({
-			kind: "signedIn",
-			signedIn: signInResult
-		})))))
-	})));
-};
-
-//#endregion
-export { handleTotp };
-//# sourceMappingURL=totp.js.map

package/dist/component/server/totp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.js","names":["code","verifier"],"sources":["../../../src/server/totp.ts"],"sourcesContent":["/**\n * Server-side TOTP ceremony logic for two-factor authentication.\n *\n * Handles the three phases of the TOTP flow:\n * 1. setup   — generate a TOTP secret and `otpauth://` URI for enrollment\n * 2. confirm — verify the first code from the authenticator app\n * 3. verify  — verify a TOTP code during sign-in (2FA challenge)\n */\n\nimport { encodeBase32LowerCaseNoPadding } from \"@oslojs/encoding\";\nimport { verifyTOTPWithGracePeriod, createTOTPKeyURI } from \"@oslojs/otp\";\nimport type { Fx as FxType } from \"@robelest/fx\";\nimport { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport type { ConvexError } from \"convex/values\";\n\nimport { userIdFromIdentitySubject } from \"./identity\";\nimport { callSignIn, callVerifier } from \"./mutations/index\";\nimport { callVerifierSignature } from \"./mutations/signature\";\nimport { TotpProviderConfig, GenericActionCtxWithAuthConfig } from \"./types\";\nimport {\n  AuthDataModel,\n  SessionInfo,\n  queryUserById,\n  queryTotpById,\n  queryTotpVerifiedByUserId,\n  queryVerifierById,\n  mutateTotpInsert,\n  mutateTotpMarkVerified,\n  mutateTotpUpdateLastUsed,\n  mutateVerifierDelete,\n} from \"./types\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\n// ============================================================================\n// Setup flow\n// ============================================================================\n\n// ============================================================================\n// Confirm flow\n// ============================================================================\n\n// ============================================================================\n// Verify flow (2FA during sign-in)\n// ============================================================================\n\n// ============================================================================\n// Main dispatch\n// ============================================================================\n\ntype TotpResult =\n  | { kind: \"signedIn\"; signedIn: SessionInfo | null }\n  | {\n      kind: \"totpSetup\";\n      uri: string;\n      secret: string;\n      verifier: string;\n      totpId: string;\n    };\n\nconst TOTP_FLOWS = [\"setup\", \"confirm\", \"verify\"] as const;\n\ntype TotpFlow = (typeof TOTP_FLOWS)[number];\n\ntype TotpDispatch =\n  | { flow: \"setup\"; params: Record<string, unknown> }\n  | { flow: \"confirm\"; code: string; totpId: string; verifier: string }\n  | { flow: \"verify\"; code: string; verifier: string };\n\nconst resolveTotpFlowFx = (\n  params: Record<string, unknown>,\n): FxType<TotpFlow, ConvexError<any>> => {\n  const flow = params.flow;\n  return typeof flow === \"string\" && TOTP_FLOWS.includes(flow as never)\n    ? Fx.succeed(flow as TotpFlow)\n    : Cv.fail({\n        code: \"TOTP_MISSING_FLOW\",\n        message:\n          \"Missing `flow` parameter. Expected one of: setup, confirm, verify\",\n      });\n};\n\nconst requireTotpVerifierFx = (\n  verifier: string | undefined,\n): FxType<string, ConvexError<any>> =>\n  verifier != null\n    ? Fx.succeed(verifier)\n    : Cv.fail({\n        code: \"TOTP_MISSING_VERIFIER\",\n        message: \"Missing verifier for TOTP operation.\",\n      });\n\nconst requireTotpCodeFx = (\n  params: Record<string, unknown>,\n): FxType<string, ConvexError<any>> =>\n  typeof params.code === \"string\"\n    ? Fx.succeed(params.code)\n    : Cv.fail({ code: \"TOTP_MISSING_CODE\", message: \"Missing TOTP code.\" });\n\nconst requireTotpIdFx = (\n  params: Record<string, unknown>,\n): FxType<string, ConvexError<any>> =>\n  typeof params.totpId === \"string\"\n    ? Fx.succeed(params.totpId)\n    : Cv.fail({\n        code: \"TOTP_MISSING_ID\",\n        message: \"Missing TOTP enrollment ID.\",\n      });\n\nconst resolveTotpDispatchFx = (\n  params: Record<string, unknown>,\n  verifier: string | undefined,\n): FxType<TotpDispatch, ConvexError<any>> =>\n  resolveTotpFlowFx(params).pipe(\n    Fx.chain((flow) =>\n      Fx.match({ flow }).on(\"flow\", {\n        setup: () => Fx.succeed({ flow: \"setup\" as const, params }),\n        confirm: () =>\n          Fx.gen(function* () {\n            const resolvedVerifier = yield* requireTotpVerifierFx(verifier);\n            const code = yield* requireTotpCodeFx(params);\n            const totpId = yield* requireTotpIdFx(params);\n            return {\n              flow: \"confirm\" as const,\n              code,\n              totpId,\n              verifier: resolvedVerifier,\n            };\n          }),\n        verify: () =>\n          Fx.gen(function* () {\n            const resolvedVerifier = yield* requireTotpVerifierFx(verifier);\n            const code = yield* requireTotpCodeFx(params);\n            return {\n              flow: \"verify\" as const,\n              code,\n              verifier: resolvedVerifier,\n            };\n          }),\n      }),\n    ),\n  );\n\n/** @internal */\nexport const handleTotp = (\n  ctx: EnrichedActionCtx,\n  provider: TotpProviderConfig,\n  args: { params?: Record<string, any>; verifier?: string },\n): FxType<TotpResult, ConvexError<any>> => {\n  const params = (args.params ?? {}) as Record<string, unknown>;\n\n  return resolveTotpDispatchFx(params, args.verifier).pipe(\n    Fx.chain((dispatch) =>\n      Fx.match(dispatch).on(\"flow\", {\n        setup: ({ params }) =>\n          Fx.from({\n            ok: () => ctx.auth.getUserIdentity(),\n            err: (e) =>\n              Cv.error({ code: \"INTERNAL_ERROR\", message: String(e) }),\n          }).pipe(\n            Fx.chain((identity) =>\n              identity === null\n                ? Cv.fail({\n                    code: \"TOTP_AUTH_REQUIRED\",\n                    message:\n                      \"Sign in first, then set up two-factor authentication.\",\n                  })\n                : Fx.succeed(userIdFromIdentitySubject(identity.subject)),\n            ),\n            Fx.chain((userId) =>\n              Fx.from({\n                ok: async () => {\n                  const secret = new Uint8Array(20);\n                  crypto.getRandomValues(secret);\n\n                  let accountName: string = params.accountName as string;\n                  if (!accountName) {\n                    const user = await queryUserById(ctx, userId);\n                    accountName = user?.email ?? \"user\";\n                  }\n\n                  const uri = createTOTPKeyURI(\n                    provider.options.issuer,\n                    accountName,\n                    secret,\n                    provider.options.period,\n                    provider.options.digits,\n                  );\n                  const base32Secret = encodeBase32LowerCaseNoPadding(secret);\n\n                  const verifier = await callVerifier(ctx);\n                  await callVerifierSignature(ctx, {\n                    verifier,\n                    signature: JSON.stringify({\n                      secret: Array.from(secret),\n                      userId,\n                      digits: provider.options.digits,\n                      period: provider.options.period,\n                    }),\n                  });\n\n                  const totpId = await mutateTotpInsert(ctx, {\n                    userId,\n                    secret: secret.buffer.slice(\n                      secret.byteOffset,\n                      secret.byteOffset + secret.byteLength,\n                    ),\n                    digits: provider.options.digits,\n                    period: provider.options.period,\n                    verified: false,\n                    name:\n                      typeof params.name === \"string\" ? params.name : undefined,\n                    createdAt: Date.now(),\n                  });\n\n                  return {\n                    kind: \"totpSetup\" as const,\n                    uri,\n                    secret: base32Secret,\n                    verifier,\n                    totpId,\n                  };\n                },\n                err: (e) =>\n                  Cv.error({\n                    code: \"INTERNAL_ERROR\",\n                    message: `TOTP setup failed: ${String(e)}`,\n                  }),\n              }),\n            ),\n          ),\n        confirm: ({ code, totpId, verifier }) =>\n          Fx.from({\n            ok: () => ctx.auth.getUserIdentity(),\n            err: (e) =>\n              Cv.error({ code: \"INTERNAL_ERROR\", message: String(e) }),\n          }).pipe(\n            Fx.chain((identity) =>\n              identity === null\n                ? Cv.fail({\n                    code: \"TOTP_AUTH_REQUIRED\",\n                    message:\n                      \"Sign in first, then set up two-factor authentication.\",\n                  })\n                : Fx.succeed(userIdFromIdentitySubject(identity.subject)),\n            ),\n            Fx.chain((userId) =>\n              Fx.from({\n                ok: () => queryTotpById(ctx, totpId),\n                err: () =>\n                  Cv.error({\n                    code: \"TOTP_NOT_FOUND\",\n                    message: \"TOTP enrollment not found.\",\n                  }),\n              })\n                .pipe(\n                  Fx.chain((doc) =>\n                    doc === null\n                      ? Cv.fail({\n                          code: \"TOTP_NOT_FOUND\",\n                          message: \"TOTP enrollment not found.\",\n                        })\n                      : Fx.succeed(doc),\n                  ),\n                  Fx.chain((totpDoc) =>\n                    totpDoc.verified\n                      ? Cv.fail({\n                          code: \"TOTP_ALREADY_VERIFIED\",\n                          message: \"TOTP enrollment is already verified.\",\n                        })\n                      : Fx.succeed(totpDoc),\n                  ),\n                )\n                .pipe(\n                  Fx.chain((totpDoc) =>\n                    verifyTOTPWithGracePeriod(\n                      new Uint8Array(totpDoc.secret),\n                      provider.options.period,\n                      provider.options.digits,\n                      code,\n                      30,\n                    )\n                      ? Fx.succeed(totpDoc)\n                      : Cv.fail({\n                          code: \"TOTP_INVALID_CODE\",\n                          message: \"Invalid TOTP code.\",\n                        }),\n                  ),\n                )\n                .pipe(\n                  Fx.chain((_totpDoc) =>\n                    Fx.from({\n                      ok: async () => {\n                        await mutateTotpMarkVerified(ctx, totpId, Date.now());\n                        await mutateVerifierDelete(ctx, verifier);\n                        return callSignIn(ctx, {\n                          userId,\n                          generateTokens: true,\n                        });\n                      },\n                      err: (e) =>\n                        Cv.error({\n                          code: \"INTERNAL_ERROR\",\n                          message: String(e),\n                        }),\n                    }),\n                  ),\n                )\n                .pipe(\n                  Fx.map((signInResult) => ({\n                    kind: \"signedIn\" as const,\n                    signedIn: signInResult,\n                  })),\n                ),\n            ),\n          ),\n        verify: ({ code, verifier }) =>\n          Fx.from({\n            ok: () => queryVerifierById(ctx, verifier),\n            err: () =>\n              Cv.error({\n                code: \"TOTP_INVALID_VERIFIER\",\n                message: \"Invalid or expired TOTP verifier.\",\n              }),\n          }).pipe(\n            Fx.chain((doc) =>\n              doc === null\n                ? Cv.fail({\n                    code: \"TOTP_INVALID_VERIFIER\",\n                    message: \"Invalid or expired TOTP verifier.\",\n                  })\n                : Fx.succeed(doc),\n            ),\n            Fx.map((doc) => {\n              const data = JSON.parse(doc.signature!);\n              return { userId: data.userId as string, code, verifier };\n            }),\n            Fx.chain(({ userId, code, verifier }) =>\n              Fx.from({\n                ok: () => queryTotpVerifiedByUserId(ctx, userId),\n                err: () =>\n                  Cv.error({\n                    code: \"TOTP_NO_ENROLLMENT\",\n                    message: \"No verified TOTP enrollment found.\",\n                  }),\n              }).pipe(\n                Fx.chain((totpDoc) =>\n                  totpDoc === null\n                    ? Cv.fail({\n                        code: \"TOTP_NO_ENROLLMENT\",\n                        message: \"No verified TOTP enrollment found.\",\n                      })\n                    : Fx.succeed(totpDoc),\n                ),\n                Fx.chain((totpDoc) =>\n                  verifyTOTPWithGracePeriod(\n                    new Uint8Array(totpDoc.secret),\n                    totpDoc.period,\n                    totpDoc.digits,\n                    code,\n                    30,\n                  )\n                    ? Fx.succeed(totpDoc)\n                    : Cv.fail({\n                        code: \"TOTP_INVALID_CODE\",\n                        message: \"Invalid TOTP code.\",\n                      }),\n                ),\n                Fx.chain((totpDoc) =>\n                  Fx.from({\n                    ok: async () => {\n                      await mutateTotpUpdateLastUsed(\n                        ctx,\n                        totpDoc._id,\n                        Date.now(),\n                      );\n                      await mutateVerifierDelete(ctx, verifier);\n                      return callSignIn(ctx, { userId, generateTokens: true });\n                    },\n                    err: (e) =>\n                      Cv.error({ code: \"INTERNAL_ERROR\", message: String(e) }),\n                  }),\n                ),\n                Fx.map((signInResult) => ({\n                  kind: \"signedIn\" as const,\n                  signedIn: signInResult,\n                })),\n              ),\n            ),\n          ),\n      }),\n    ),\n  );\n};\n\n// ============================================================================\n// Helpers\n// ============================================================================\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6DA,MAAM,aAAa;CAAC;CAAS;CAAW;CAAS;AASjD,MAAM,qBACJ,WACuC;CACvC,MAAM,OAAO,OAAO;AACpB,QAAO,OAAO,SAAS,YAAY,WAAW,SAAS,KAAc,GACjE,GAAG,QAAQ,KAAiB,GAC5B,GAAG,KAAK;EACN,MAAM;EACN,SACE;EACH,CAAC;;AAGR,MAAM,yBACJ,aAEA,YAAY,OACR,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK;CACN,MAAM;CACN,SAAS;CACV,CAAC;AAER,MAAM,qBACJ,WAEA,OAAO,OAAO,SAAS,WACnB,GAAG,QAAQ,OAAO,KAAK,GACvB,GAAG,KAAK;CAAE,MAAM;CAAqB,SAAS;CAAsB,CAAC;AAE3E,MAAM,mBACJ,WAEA,OAAO,OAAO,WAAW,WACrB,GAAG,QAAQ,OAAO,OAAO,GACzB,GAAG,KAAK;CACN,MAAM;CACN,SAAS;CACV,CAAC;AAER,MAAM,yBACJ,QACA,aAEA,kBAAkB,OAAO,CAAC,KACxB,GAAG,OAAO,SACR,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ;CAC5B,aAAa,GAAG,QAAQ;EAAE,MAAM;EAAkB;EAAQ,CAAC;CAC3D,eACE,GAAG,IAAI,aAAa;EAClB,MAAM,mBAAmB,OAAO,sBAAsB,SAAS;AAG/D,SAAO;GACL,MAAM;GACN,MAJW,OAAO,kBAAkB,OAAO;GAK3C,QAJa,OAAO,gBAAgB,OAAO;GAK3C,UAAU;GACX;GACD;CACJ,cACE,GAAG,IAAI,aAAa;EAClB,MAAM,mBAAmB,OAAO,sBAAsB,SAAS;AAE/D,SAAO;GACL,MAAM;GACN,MAHW,OAAO,kBAAkB,OAAO;GAI3C,UAAU;GACX;GACD;CACL,CAAC,CACH,CACF;;AAGH,MAAa,cACX,KACA,UACA,SACyC;AAGzC,QAAO,sBAFS,KAAK,UAAU,EAAE,EAEI,KAAK,SAAS,CAAC,KAClD,GAAG,OAAO,aACR,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ;EAC5B,QAAQ,EAAE,aACR,GAAG,KAAK;GACN,UAAU,IAAI,KAAK,iBAAiB;GACpC,MAAM,MACJ,GAAG,MAAM;IAAE,MAAM;IAAkB,SAAS,OAAO,EAAE;IAAE,CAAC;GAC3D,CAAC,CAAC,KACD,GAAG,OAAO,aACR,aAAa,OACT,GAAG,KAAK;GACN,MAAM;GACN,SACE;GACH,CAAC,GACF,GAAG,QAAQ,0BAA0B,SAAS,QAAQ,CAAC,CAC5D,EACD,GAAG,OAAO,WACR,GAAG,KAAK;GACN,IAAI,YAAY;IACd,MAAM,SAAS,IAAI,WAAW,GAAG;AACjC,WAAO,gBAAgB,OAAO;IAE9B,IAAI,cAAsB,OAAO;AACjC,QAAI,CAAC,YAEH,gBADa,MAAM,cAAc,KAAK,OAAO,GACzB,SAAS;IAG/B,MAAM,MAAM,iBACV,SAAS,QAAQ,QACjB,aACA,QACA,SAAS,QAAQ,QACjB,SAAS,QAAQ,OAClB;IACD,MAAM,eAAe,+BAA+B,OAAO;IAE3D,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,UAAM,sBAAsB,KAAK;KAC/B;KACA,WAAW,KAAK,UAAU;MACxB,QAAQ,MAAM,KAAK,OAAO;MAC1B;MACA,QAAQ,SAAS,QAAQ;MACzB,QAAQ,SAAS,QAAQ;MAC1B,CAAC;KACH,CAAC;AAgBF,WAAO;KACL,MAAM;KACN;KACA,QAAQ;KACR;KACA,QAnBa,MAAM,iBAAiB,KAAK;MACzC;MACA,QAAQ,OAAO,OAAO,MACpB,OAAO,YACP,OAAO,aAAa,OAAO,WAC5B;MACD,QAAQ,SAAS,QAAQ;MACzB,QAAQ,SAAS,QAAQ;MACzB,UAAU;MACV,MACE,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;MAClD,WAAW,KAAK,KAAK;MACtB,CAAC;KAQD;;GAEH,MAAM,MACJ,GAAG,MAAM;IACP,MAAM;IACN,SAAS,sBAAsB,OAAO,EAAE;IACzC,CAAC;GACL,CAAC,CACH,CACF;EACH,UAAU,EAAE,MAAM,QAAQ,eACxB,GAAG,KAAK;GACN,UAAU,IAAI,KAAK,iBAAiB;GACpC,MAAM,MACJ,GAAG,MAAM;IAAE,MAAM;IAAkB,SAAS,OAAO,EAAE;IAAE,CAAC;GAC3D,CAAC,CAAC,KACD,GAAG,OAAO,aACR,aAAa,OACT,GAAG,KAAK;GACN,MAAM;GACN,SACE;GACH,CAAC,GACF,GAAG,QAAQ,0BAA0B,SAAS,QAAQ,CAAC,CAC5D,EACD,GAAG,OAAO,WACR,GAAG,KAAK;GACN,UAAU,cAAc,KAAK,OAAO;GACpC,WACE,GAAG,MAAM;IACP,MAAM;IACN,SAAS;IACV,CAAC;GACL,CAAC,CACC,KACC,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,GACF,GAAG,QAAQ,IAAI,CACpB,EACD,GAAG,OAAO,YACR,QAAQ,WACJ,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,GACF,GAAG,QAAQ,QAAQ,CACxB,CACF,CACA,KACC,GAAG,OAAO,YACR,0BACE,IAAI,WAAW,QAAQ,OAAO,EAC9B,SAAS,QAAQ,QACjB,SAAS,QAAQ,QACjB,MACA,GACD,GACG,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,CACP,CACF,CACA,KACC,GAAG,OAAO,aACR,GAAG,KAAK;GACN,IAAI,YAAY;AACd,UAAM,uBAAuB,KAAK,QAAQ,KAAK,KAAK,CAAC;AACrD,UAAM,qBAAqB,KAAK,SAAS;AACzC,WAAO,WAAW,KAAK;KACrB;KACA,gBAAgB;KACjB,CAAC;;GAEJ,MAAM,MACJ,GAAG,MAAM;IACP,MAAM;IACN,SAAS,OAAO,EAAE;IACnB,CAAC;GACL,CAAC,CACH,CACF,CACA,KACC,GAAG,KAAK,kBAAkB;GACxB,MAAM;GACN,UAAU;GACX,EAAE,CACJ,CACJ,CACF;EACH,SAAS,EAAE,MAAM,eACf,GAAG,KAAK;GACN,UAAU,kBAAkB,KAAK,SAAS;GAC1C,WACE,GAAG,MAAM;IACP,MAAM;IACN,SAAS;IACV,CAAC;GACL,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,GACF,GAAG,QAAQ,IAAI,CACpB,EACD,GAAG,KAAK,QAAQ;AAEd,UAAO;IAAE,QADI,KAAK,MAAM,IAAI,UAAW,CACjB;IAAkB;IAAM;IAAU;IACxD,EACF,GAAG,OAAO,EAAE,QAAQ,cAAM,2BACxB,GAAG,KAAK;GACN,UAAU,0BAA0B,KAAK,OAAO;GAChD,WACE,GAAG,MAAM;IACP,MAAM;IACN,SAAS;IACV,CAAC;GACL,CAAC,CAAC,KACD,GAAG,OAAO,YACR,YAAY,OACR,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,GACF,GAAG,QAAQ,QAAQ,CACxB,EACD,GAAG,OAAO,YACR,0BACE,IAAI,WAAW,QAAQ,OAAO,EAC9B,QAAQ,QACR,QAAQ,QACRA,QACA,GACD,GACG,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,CACP,EACD,GAAG,OAAO,YACR,GAAG,KAAK;GACN,IAAI,YAAY;AACd,UAAM,yBACJ,KACA,QAAQ,KACR,KAAK,KAAK,CACX;AACD,UAAM,qBAAqB,KAAKC,WAAS;AACzC,WAAO,WAAW,KAAK;KAAE;KAAQ,gBAAgB;KAAM,CAAC;;GAE1D,MAAM,MACJ,GAAG,MAAM;IAAE,MAAM;IAAkB,SAAS,OAAO,EAAE;IAAE,CAAC;GAC3D,CAAC,CACH,EACD,GAAG,KAAK,kBAAkB;GACxB,MAAM;GACN,UAAU;GACX,EAAE,CACJ,CACF,CACF;EACJ,CAAC,CACH,CACF"}