@tempoxyz/id 0.0.0-stage → 0.0.0

package/dist/internal/Authorize.js

@@ -0,0 +1,326 @@
+/**
+ * Authorization requests that carry a key authorization. In a headless request, a first-party web
+ * app's page asks Tempo ID to authorize it for the signed-in user without a redirect. The request
+ * names the app's redirect URI, and its key must fit the headless ceiling. Any other app, native apps
+ * included, authorizes through a redirect, whose `/authorize` query carries the key to the approval
+ * page.
+ * @module
+ */
+import { Base64 } from 'ox';
+import { z } from 'zod';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as KeyAuthorization from './KeyAuthorization.js';
+import * as Validation from './Validation.js';
+/** A headless request came from an origin that its redirect URI does not allow. */
+export class InvalidOriginError extends ErrorResponse.define('invalid_origin') {
+    name = 'Authorize.InvalidOriginError';
+}
+/**
+ * The request names no registered app or redirect URI, the app is not a first-party app, or the app
+ * cannot receive tokens headlessly.
+ */
+export class RejectedError extends ErrorResponse.define('rejected') {
+    name = 'Authorize.RejectedError';
+    constructor(options = {}) {
+        super({
+            error_description: options.description ??
+                "Authorization request rejected. Check `client_id`, `redirect_uri`, and `scope` against the app's registration.",
+        });
+    }
+}
+/** Zod schemas for headless authorization requests and their responses. */
+export var schema;
+(function (schema) {
+    /** The tokens that a public app receives. */
+    schema.tokens = z
+        .object({
+        access_token: z.string().meta({
+            description: "The access token, a JWT that Tempo ID signs. APIs verify it against Tempo ID's JSON Web Key Set.",
+            examples: ['eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyIn0.c2lnbmF0dXJl'],
+        }),
+        expires_in: z.number().meta({
+            description: 'Seconds until the access token expires.',
+            examples: [300],
+        }),
+        id_token: z
+            .string()
+            .optional()
+            .meta({
+            description: 'The OIDC ID token, a JWT about the user. Absent when the request did not ask for the `openid` scope.',
+            examples: ['eyJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJhcHAifQ.c2lnbmF0dXJl'],
+        }),
+        refresh_token: z
+            .string()
+            .optional()
+            .meta({
+            description: 'The refresh token, which the app redeems at `/oauth2/token` for new tokens. Absent without the `offline_access` scope.',
+            examples: ['yAjhKk7QnRZ3vD9pLm2Xc8Ws5Tf1Ub4N'],
+        }),
+        token_type: z.string().meta({
+            description: 'The type of the access token (RFC 6749 §7.1).',
+            examples: ['Bearer'],
+        }),
+    })
+        .meta({ description: 'OAuth tokens for a public app.', id: 'Tokens' });
+    /** A message whose EIP-191 hash becomes a key authorization's witness. */
+    schema.challenge = z
+        .string()
+        .min(1)
+        .max(1024)
+        .optional()
+        .meta({
+        description: "A message, such as a sign-in challenge from the app's backend, whose EIP-191 hash becomes the key authorization's `witness` (TIP-1053). Requires `key_authorization`, and the app's `tempo-id:sign` scope.",
+        examples: ['Sign in to app.example.com\nNonce: 7f3a9c2e5b1d4f60'],
+    });
+    /** An app's headless authorization request. */
+    schema.request = z
+        .object({
+        challenge: schema.challenge,
+        client_id: z
+            .string()
+            .min(1)
+            .max(255)
+            .meta({
+            description: "The app's client ID.",
+            examples: ['Qk3vT9xZbLmN2pRw8YcHjF6sDaE4uGtK'],
+        }),
+        code_challenge: z
+            .string()
+            .regex(/^[\w-]{43}$/)
+            .optional()
+            .meta({
+            description: "The S256 PKCE challenge of a verifier that the app's backend holds (RFC 7636). With one, the app receives a code. Without one, a public app receives tokens.",
+            examples: ['E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM'],
+        }),
+        key_authorization: KeyAuthorization.schema.request,
+        // Schemes that run script or read files are refused.
+        redirect_uri: z
+            .url({
+            protocol: /^(?!(?:blob|data|file|javascript|vbscript)$)[a-z][a-z\d+.-]*$/,
+        })
+            .meta({
+            description: 'A registered redirect URI of a web app, whose origin the page calls from.',
+            examples: ['https://app.example.com/callback'],
+        }),
+        scope: z
+            .string()
+            .regex(/^[\w:.-]+( [\w:.-]+)*$/)
+            .max(256)
+            .optional()
+            .meta({
+            description: 'Space-separated OAuth scopes. Defaults to `openid`.',
+            examples: ['openid email offline_access'],
+        }),
+        state: z
+            .string()
+            .min(1)
+            .max(256)
+            .optional()
+            .meta({
+            description: 'An opaque value that the response returns unchanged, to bind it to the request (RFC 6749 §4.1.1).',
+            examples: ['af0ifjsldkj'],
+        }),
+    })
+        .refine((request) => !request.challenge || request.key_authorization, {
+        message: 'A challenge requires `key_authorization`, whose witness binds it',
+        path: ['challenge'],
+    })
+        // The key carries the challenge as its witness, so the owner's signature binds it.
+        .transform((request) => request.key_authorization
+        ? {
+            ...request,
+            key_authorization: KeyAuthorization.bind(request.key_authorization, { challenge: request.challenge }),
+        }
+        : request)
+        .meta({
+        description: "An app's headless authorization request.",
+        id: 'AuthorizationRequest',
+    });
+    /**
+     * The key of a redirect's authorization request: the `challenge` and the decoded
+     * `key_authorization` of its `/authorize` query, with the challenge bound as the key's witness.
+     */
+    schema.redirect = z
+        .object({ challenge: schema.challenge, key_authorization: KeyAuthorization.schema.request })
+        .refine((request) => !request.challenge || request.key_authorization, {
+        message: 'A challenge requires `key_authorization`, whose witness binds it',
+        path: ['challenge'],
+    })
+        .transform((request) => request.key_authorization
+        ? KeyAuthorization.bind(request.key_authorization, {
+            challenge: request.challenge,
+        })
+        : undefined);
+    /** What a headless authorization returns: a code or tokens, with any signed key. */
+    schema.response = z
+        .object({
+        account: KeyAuthorization.schema.account.optional(),
+        code: z
+            .string()
+            .optional()
+            .meta({
+            description: "The authorization code, when the request sent a `code_challenge`. The app's backend redeems it at `/oauth2/token`.",
+            examples: ['Vb7mQ2xLkP9sTzR4'],
+        }),
+        key_authorization: KeyAuthorization.schema.rpc.optional(),
+        state: z
+            .string()
+            .optional()
+            .meta({
+            description: "The request's `state`, unchanged. Absent when the request sent none.",
+            examples: ['af0ifjsldkj'],
+        }),
+        tokens: schema.tokens.optional().meta({
+            description: 'The tokens, when the request sent no `code_challenge`.',
+        }),
+    })
+        .meta({
+        description: 'An authorization: a code or tokens, with the signed key authorization when the request asks for one.',
+        id: 'Authorization',
+    });
+})(schema || (schema = {}));
+/**
+ * Returns why Tempo ID refuses a headless `request`, or `undefined` when the caller may make it:
+ *
+ * - The app must exist, register `redirect_uri`, and be a first-party app, which skips consent.
+ * - The app must be a web app, and its page must call from its redirect URI's origin. A native app
+ *   authorizes through an authentication sheet.
+ * - A key must come from a page of an app without a client secret, fit the headless ceiling, and
+ *   carry a challenge only for an app with the `tempo-id:sign` scope. Any other app authorizes a key
+ *   through a redirect or the device grant.
+ */
+export function check(request, options) {
+    const { app, origin } = options;
+    if (!app || !app.redirectUris.includes(request.redirect_uri))
+        return new RejectedError();
+    // A public app proves nothing about its caller, so a program that impersonates it receives what
+    // the response carries. Only first-party apps, which skip consent, authorize headlessly. Any other
+    // app's code goes to its redirect URI, after the user approves the request.
+    if (!app.skipConsent)
+        return new RejectedError({
+            description: 'Headless authorization refused: the app is not a first-party app. Send the user to `/oauth2/authorize`, and receive the code at the redirect URI.',
+        });
+    // A native app's request proves no app, since any program can send one, with or without its
+    // redirect URI's `Origin`. Its code goes to its redirect URI, through an authentication sheet.
+    if (app.type === 'native')
+        return new RejectedError({
+            description: "Headless authorization refused: a native app's request does not prove which app sends it. Open `/oauth2/authorize` in an authentication sheet, and receive the code at the redirect URI.",
+        });
+    // A browser sets `Origin` itself, so a page calls from its redirect URI's origin.
+    const redirectUri = new URL(request.redirect_uri);
+    if (origin !== redirectUri.origin)
+        return new InvalidOriginError({
+            error_description: `Invalid \`Origin\`: ${origin ?? 'none'}. Requests for this redirect URI must come from ${redirectUri.origin}.`,
+            field: 'Origin',
+            meta: { expected: redirectUri.origin, ...(origin ? { origin } : {}) },
+        });
+    const key = request.key_authorization;
+    if (!key)
+        return undefined;
+    // A confidential app proves itself only with its secret, which a page never holds, and the code
+    // redemption that checks it returns no key.
+    if (app.secret)
+        return new RejectedError({
+            description: 'Key authorization refused: the app holds a client secret, which a headless request does not prove. Authorize the key through a redirect or the device grant.',
+        });
+    return (KeyAuthorization.checkHeadless(key) ??
+        KeyAuthorization.checkChallenge({ app, clientId: request.client_id, key }));
+}
+(function (check) {
+    /** The refusals `check` returns. Its return type admits no other. */
+    check.errors = [
+        ...KeyAuthorization.checkHeadless.errors,
+        ...KeyAuthorization.checkChallenge.errors,
+        InvalidOriginError,
+        RejectedError,
+    ];
+})(check || (check = {}));
+/**
+ * Returns why Tempo ID refuses `key` in a redirect's authorization request, or `undefined` when the
+ * owner may sign it once the user approves it. The approval page shows the key, so it applies the
+ * rules of `KeyAuthorization.check` and no headless ceiling. A challenge needs the app's
+ * `tempo-id:sign` scope, and the request needs a PKCE challenge, whose verifier receives the key.
+ */
+export function checkKey(options) {
+    const { app, clientId, codeChallenge, key } = options;
+    if (!codeChallenge)
+        return new RejectedError({
+            description: 'Key authorization refused: the request names no `code_challenge`, whose verifier receives the key. Send an S256 `code_challenge`.',
+        });
+    return (KeyAuthorization.check(key) ??
+        KeyAuthorization.checkChallenge({ app, clientId, key }));
+}
+(function (checkKey) {
+    /** The refusals `checkKey` returns. Its return type admits no other. */
+    checkKey.errors = [
+        ...KeyAuthorization.check.errors,
+        ...KeyAuthorization.checkChallenge.errors,
+        RejectedError,
+    ];
+})(checkKey || (checkKey = {}));
+/**
+ * Returns the key that a redirect's authorization `query` carries: its `key_authorization`,
+ * base64url JSON, with its `challenge` bound as the witness. Returns `undefined` for a query without
+ * a key, and `Validation.InvalidFieldError` for a key that does not parse, a challenge without a
+ * key, or a repeated parameter, so a page cannot show one value and approve another.
+ */
+export function fromQuery(query) {
+    const repeated = keyParameters.find((name) => query.getAll(name).length > 1);
+    if (repeated)
+        return new Validation.InvalidFieldError({
+            issues: [
+                {
+                    message: 'Repeated parameter. Send it once',
+                    path: [repeated],
+                },
+            ],
+        });
+    const encoded = query.get('key_authorization');
+    const parsed = schema.redirect.safeParse({
+        challenge: query.get('challenge') ?? undefined,
+        key_authorization: encoded === null ? undefined : decode(encoded),
+    });
+    if (!parsed.success)
+        return new Validation.InvalidFieldError({ issues: parsed.error.issues });
+    return parsed.data;
+}
+/**
+ * Returns the parameters of an authorization request that carries `key_authorization` with
+ * `consent` added to `prompt`, so the approval page shows the key, also for an app that skips
+ * consent. A key that names no expiry gains the default, so approval signs the expiry that the page
+ * shows. Returns other parameters unchanged.
+ */
+export function prepare(parameters) {
+    if (!parameters.has('key_authorization'))
+        return parameters;
+    const prepared = new URLSearchParams(parameters);
+    const prompt = new Set((prepared.get('prompt') ?? '').split(' ').filter(Boolean));
+    prompt.add('consent');
+    prepared.set('prompt', [...prompt].join(' '));
+    // A repeated key stays as it is, so the page refuses it.
+    const [encoded, ...rest] = prepared.getAll('key_authorization');
+    const key = encoded && !rest.length ? decode(encoded) : undefined;
+    if (typeof key === 'object' &&
+        key !== null &&
+        !Array.isArray(key) &&
+        !('expiry' in key))
+        prepared.set('key_authorization', Base64.fromString(JSON.stringify({
+            ...key,
+            expiry: Math.floor(Date.now() / 1000) + KeyAuthorization.lifetime,
+        }), base64url));
+    return prepared;
+}
+/** Unpadded URL-safe Base64, as the client encodes `key_authorization`. */
+const base64url = { pad: false, url: true };
+/** The query parameters that carry a redirect's key. */
+const keyParameters = ['challenge', 'key_authorization'];
+/** Decodes base64url JSON, or returns `null`, which fails validation. */
+function decode(value) {
+    try {
+        return JSON.parse(Base64.toString(value));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=Authorize.js.map

package/dist/internal/Authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorize.js","sourceRoot":"","sources":["../../src/internal/Authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C,mFAAmF;AACnF,MAAM,OAAO,kBAAmB,SAAQ,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC1D,IAAI,GAAG,8BAA8B,CAAA;CACxD;AAED;;;GAGG;AACH,MAAM,OAAO,aAAc,SAAQ,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC;IAC/C,IAAI,GAAG,yBAAyB,CAAA;IAElD,YAAY,OAAO,GAA0B,EAAE;QAC7C,KAAK,CAAC;YACJ,iBAAiB,EACf,OAAO,CAAC,WAAW;gBACnB,gHAAgH;SACnH,CAAC,CAAA;IACJ,CAAC;CACF;AASD,2EAA2E;AAC3E,MAAM,KAAW,MAAM,CA4KtB;AA5KD,WAAiB,MAAM;IACrB,6CAA6C;IAChC,aAAM,GAAG,CAAC;SACpB,MAAM,CAAC;QACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;YAC5B,WAAW,EACT,kGAAkG;YACpG,QAAQ,EAAE,CAAC,uDAAuD,CAAC;SACpE,CAAC;QACF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;YAC1B,WAAW,EAAE,yCAAyC;YACtD,QAAQ,EAAE,CAAC,GAAG,CAAC;SAChB,CAAC;QACF,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,IAAI,CAAC;YACJ,WAAW,EACT,sGAAsG;YACxG,QAAQ,EAAE,CAAC,sDAAsD,CAAC;SACnE,CAAC;QACJ,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,IAAI,CAAC;YACJ,WAAW,EACT,wHAAwH;YAC1H,QAAQ,EAAE,CAAC,kCAAkC,CAAC;SAC/C,CAAC;QACJ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;YAC1B,WAAW,EAAE,+CAA+C;YAC5D,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB,CAAC;KACH,CAAC;SACD,IAAI,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IAExE,0EAA0E;IAC7D,gBAAS,GAAG,CAAC;SACvB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;SACT,QAAQ,EAAE;SACV,IAAI,CAAC;QACJ,WAAW,EACT,4MAA4M;QAC9M,QAAQ,EAAE,CAAC,qDAAqD,CAAC;KAClE,CAAC,CAAA;IAEJ,+CAA+C;IAClC,cAAO,GAAG,CAAC;SACrB,MAAM,CAAC;QACN,SAAS,EAAT,gBAAS;QACT,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,IAAI,CAAC;YACJ,WAAW,EAAE,sBAAsB;YACnC,QAAQ,EAAE,CAAC,kCAAkC,CAAC;SAC/C,CAAC;QACJ,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,KAAK,CAAC,aAAa,CAAC;aACpB,QAAQ,EAAE;aACV,IAAI,CAAC;YACJ,WAAW,EACT,8JAA8J;YAChK,QAAQ,EAAE,CAAC,6CAA6C,CAAC;SAC1D,CAAC;QACJ,iBAAiB,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO;QAClD,qDAAqD;QACrD,YAAY,EAAE,CAAC;aACZ,GAAG,CAAC;YACH,QAAQ,EACN,+DAA+D;SAClE,CAAC;aACD,IAAI,CAAC;YACJ,WAAW,EACT,2EAA2E;YAC7E,QAAQ,EAAE,CAAC,kCAAkC,CAAC;SAC/C,CAAC;QACJ,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,KAAK,CAAC,wBAAwB,CAAC;aAC/B,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,IAAI,CAAC;YACJ,WAAW,EAAE,qDAAqD;YAClE,QAAQ,EAAE,CAAC,6BAA6B,CAAC;SAC1C,CAAC;QACJ,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,IAAI,CAAC;YACJ,WAAW,EACT,mGAAmG;YACrG,QAAQ,EAAE,CAAC,aAAa,CAAC;SAC1B,CAAC;KACL,CAAC;SACD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,iBAAiB,EAAE;QACpE,OAAO,EACL,kEAAkE;QACpE,IAAI,EAAE,CAAC,WAAW,CAAC;KACpB,CAAC;QACF,mFAAmF;SAClF,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,iBAAiB;QACvB,CAAC,CAAC;YACE,GAAG,OAAO;YACV,iBAAiB,EAAE,gBAAgB,CAAC,IAAI,CACtC,OAAO,CAAC,iBAAiB,EACzB,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjC;SACF;QACH,CAAC,CAAC,OAAO,CACZ;SACA,IAAI,CAAC;QACJ,WAAW,EAAE,0CAA0C;QACvD,EAAE,EAAE,sBAAsB;KAC3B,CAAC,CAAA;IAEJ;;;OAGG;IACU,eAAQ,GAAG,CAAC;SACtB,MAAM,CAAC,EAAE,SAAS,EAAT,gBAAS,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;SACzE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,iBAAiB,EAAE;QACpE,OAAO,EACL,kEAAkE;QACpE,IAAI,EAAE,CAAC,WAAW,CAAC;KACpB,CAAC;SACD,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,iBAAiB;QACvB,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;YAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;QACJ,CAAC,CAAC,SAAS,CACd,CAAA;IAEH,oFAAoF;IACvE,eAAQ,GAAG,CAAC;SACtB,MAAM,CAAC;QACN,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE;QACnD,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,IAAI,CAAC;YACJ,WAAW,EACT,oHAAoH;YACtH,QAAQ,EAAE,CAAC,kBAAkB,CAAC;SAC/B,CAAC;QACJ,iBAAiB,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;QACzD,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,IAAI,CAAC;YACJ,WAAW,EACT,sEAAsE;YACxE,QAAQ,EAAE,CAAC,aAAa,CAAC;SAC1B,CAAC;QACJ,MAAM,EAAE,aAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;YAC7B,WAAW,EAAE,wDAAwD;SACtE,CAAC;KACH,CAAC;SACD,IAAI,CAAC;QACJ,WAAW,EACT,sGAAsG;QACxG,EAAE,EAAE,eAAe;KACpB,CAAC,CAAA;AACN,CAAC,EA5KgB,MAAM,KAAN,MAAM,QA4KtB;AAKD;;;;;;;;;GASG;AACH,MAAM,UAAU,KAAK,CACnB,OAAgB,EAChB,OAAsB;IAEtB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1D,OAAO,IAAI,aAAa,EAAE,CAAA;IAC5B,gGAAgG;IAChG,mGAAmG;IACnG,4EAA4E;IAC5E,IAAI,CAAC,GAAG,CAAC,WAAW;QAClB,OAAO,IAAI,aAAa,CAAC;YACvB,WAAW,EACT,mJAAmJ;SACtJ,CAAC,CAAA;IAEJ,4FAA4F;IAC5F,+FAA+F;IAC/F,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QACvB,OAAO,IAAI,aAAa,CAAC;YACvB,WAAW,EACT,0LAA0L;SAC7L,CAAC,CAAA;IAEJ,kFAAkF;IAClF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACjD,IAAI,MAAM,KAAK,WAAW,CAAC,MAAM;QAC/B,OAAO,IAAI,kBAAkB,CAAC;YAC5B,iBAAiB,EAAE,uBAAuB,MAAM,IAAI,MAAM,mDAAmD,WAAW,CAAC,MAAM,GAAG;YAClI,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACtE,CAAC,CAAA;IAEJ,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAA;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,gGAAgG;IAChG,4CAA4C;IAC5C,IAAI,GAAG,CAAC,MAAM;QACZ,OAAO,IAAI,aAAa,CAAC;YACvB,WAAW,EACT,8JAA8J;SACjK,CAAC,CAAA;IACJ,OAAO,CACL,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC;QACnC,gBAAgB,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAC3E,CAAA;AACH,CAAC;AAED,WAAiB,KAAK;IAapB,qEAAqE;IACxD,YAAM,GAAG;QACpB,GAAG,gBAAgB,CAAC,aAAa,CAAC,MAAM;QACxC,GAAG,gBAAgB,CAAC,cAAc,CAAC,MAAM;QACzC,kBAAkB;QAClB,aAAa;KACL,CAAA;AACZ,CAAC,EApBgB,KAAK,KAAL,KAAK,QAoBrB;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IACrD,IAAI,CAAC,aAAa;QAChB,OAAO,IAAI,aAAa,CAAC;YACvB,WAAW,EACT,mIAAmI;SACtI,CAAC,CAAA;IACJ,OAAO,CACL,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;QAC3B,gBAAgB,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CACxD,CAAA;AACH,CAAC;AAED,WAAiB,QAAQ;IAYvB,wEAAwE;IAC3D,eAAM,GAAG;QACpB,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM;QAChC,GAAG,gBAAgB,CAAC,cAAc,CAAC,MAAM;QACzC,aAAa;KACL,CAAA;AACZ,CAAC,EAlBgB,QAAQ,KAAR,QAAQ,QAkBxB;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,KAAsB;IAEtB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5E,IAAI,QAAQ;QACV,OAAO,IAAI,UAAU,CAAC,iBAAiB,CAAC;YACtC,MAAM,EAAE;gBACN;oBACE,OAAO,EAAE,kCAAkC;oBAC3C,IAAI,EAAE,CAAC,QAAQ,CAAC;iBACjB;aACF;SACF,CAAC,CAAA;IAEJ,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;QAC9C,iBAAiB,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;KAClE,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,OAAO;QACjB,OAAO,IAAI,UAAU,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,UAA2B;IACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO,UAAU,CAAA;IAE3D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC1D,CAAA;IACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAE7C,yDAAyD;IACzD,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC/D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;QAElB,QAAQ,CAAC,GAAG,CACV,mBAAmB,EACnB,MAAM,CAAC,UAAU,CACf,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,GAAG;YACN,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ;SAClE,CAAC,EACF,SAAS,CACV,CACF,CAAA;IACH,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAW,CAAA;AAEpD,wDAAwD;AACxD,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAU,CAAA;AAEjE,yEAAyE;AACzE,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}