@tempoxyz/id 0.0.0-stage → 0.0.0

package/dist/internal/Passkey.d.ts

@@ -0,0 +1,528 @@
+import { Hex } from 'ox';
+import { z } from 'zod';
+import * as Schema from '../app/db/schema.js';
+import type * as Apps from './Apps.js';
+import * as Authorize from './Authorize.js';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as Owner from './Owner.js';
+import type * as Realm from './Realm.js';
+declare const LinkExpiredError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "invalid_request";
+            reason: "passkey_link_expired";
+        };
+    };
+    readonly reason: "passkey_link_expired";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/**
+ * The email step's link to a wallet.tempo passkey expired, or the browser holds no link cookie for it.
+ * The refusal comes before the code is checked, so the code stays valid for a sign-in without the
+ * passkey.
+ */
+export declare class LinkExpiredError extends LinkExpiredError_base {
+    readonly name = "Passkey.LinkExpiredError";
+    constructor();
+}
+declare const NotPermittedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "unauthorized_client";
+            reason: "passkey_not_permitted";
+        };
+    };
+    readonly reason: "passkey_not_permitted";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/**
+ * A passkey sign-in names an app, or reaches a realm, that holds no passkeys for Tempo ID, or no
+ * passkeys whose relying party covers the app's page.
+ */
+export declare class NotPermittedError extends NotPermittedError_base {
+    readonly name = "Passkey.NotPermittedError";
+    constructor(options?: NotPermittedError.Options);
+}
+export declare namespace NotPermittedError {
+    type Options = {
+        /** The client ID of the app the sign-in names, if any. */
+        clientId?: string | undefined;
+        /** The origin of the app's page that runs the ceremony, or absent for Tempo ID's own page. */
+        origin?: string | undefined;
+    };
+}
+declare const WebAuthnRejectedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "access_denied";
+            reason: "webauthn_rejected";
+        };
+    };
+    readonly reason: "webauthn_rejected";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/**
+ * A passkey ceremony failed: its challenge is unknown, spent, or expired, or the response does not
+ * verify. One refusal covers every case, so it reveals neither which check failed nor whether a
+ * credential exists.
+ */
+export declare class WebAuthnRejectedError extends WebAuthnRejectedError_base {
+    readonly name = "Passkey.WebAuthnRejectedError";
+    constructor();
+}
+/** A passkey assertion, as `webauthx/client`'s `Authentication.sign` serializes it. */
+export type Assertion = z.output<typeof schema.assertion>;
+/** A challenge that Tempo ID issued, as `take` returns it once spent. */
+export type Challenge = {
+    /** The challenge, as hex. */
+    challenge: Hex.Hex;
+    /** The client ID of the app the sign-in named, or `null` for none. */
+    clientId: string | null;
+    /**
+     * The SHA-256 digest of the email step's link that the challenge confirms, as hex, or `undefined`
+     * for a sign-in challenge.
+     */
+    link: string | undefined;
+    /**
+     * The origin of the app's page that the ceremony runs at, or `undefined` for Tempo ID's own page.
+     */
+    origin: string | undefined;
+    /**
+     * The realm whose relying party the challenge was issued for, or `undefined` when the stored
+     * challenge names none, which skips the wallet.tempo lookup.
+     */
+    realmId: string | undefined;
+    /** The relying party the challenge was issued for. */
+    rpId: string;
+    /**
+     * The witness that a one-tap challenge's key authorization digest binds, or `undefined` for a
+     * random challenge.
+     */
+    witness: Hex.Hex | undefined;
+};
+/** A row of the `keys` table. */
+export type Key = typeof Schema.keys.$inferSelect;
+/** A verified wallet.tempo passkey that waits for an emailed code to name its user. */
+export type Link = z.output<typeof schema.link>;
+/**
+ * A challenge for a passkey's signature of a key authorization, as `takeSignature` returns it once
+ * spent. The challenge is the key authorization's digest.
+ */
+export type SignatureChallenge = {
+    /** The address of the Tempo Account that the key acts for, lowercase. */
+    account: string;
+    /** The client ID of the app that requests the key. */
+    clientId: string;
+    /** The passkey that must sign. */
+    credential: Owner.Credential;
+    /** The digest of the key authorization, as hex. */
+    digest: Hex.Hex;
+};
+/** Seconds a challenge lasts. */
+export declare const lifetime: number;
+/** Seconds a deferred link lasts. */
+export declare const linkLifetime: number;
+/** Zod schemas for passkey ceremonies. */
+export declare namespace schema {
+    /**
+     * A credential ID in canonical unpadded base64url, of at most 1,023 bytes, as WebAuthn bounds it:
+     * 1,364 characters.
+     */
+    const credentialId: z.ZodString;
+    /** A passkey assertion, as `webauthx/client`'s `Authentication.sign` serializes it. */
+    const assertion: z.ZodObject<{
+        id: z.ZodString;
+        metadata: z.ZodObject<{
+            authenticatorData: z.ZodTemplateLiteral<`0x${string}`>;
+            challengeIndex: z.ZodOptional<z.ZodNumber>;
+            clientDataJSON: z.ZodString;
+            typeIndex: z.ZodOptional<z.ZodNumber>;
+            userVerificationRequired: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>;
+        raw: z.ZodObject<{
+            authenticatorAttachment: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            id: z.ZodString;
+            rawId: z.ZodString;
+            response: z.ZodObject<{
+                clientDataJSON: z.ZodString;
+            }, z.core.$strip>;
+            type: z.ZodString;
+        }, z.core.$strip>;
+        signature: z.ZodTemplateLiteral<`0x${string}`>;
+    }, z.core.$strip>;
+    /** The client data fields that `take` and `verify` read. */
+    const clientData: z.ZodObject<{
+        challenge: z.ZodString;
+        crossOrigin: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+    /** A deferred link, as `seal` encrypts it. */
+    const link: z.ZodObject<{
+        address: z.ZodString;
+        createdAt: z.ZodNullable<z.ZodNumber>;
+        expiresAt: z.ZodNumber;
+        host: z.ZodString;
+        id: z.ZodString;
+        nonce: z.ZodString;
+        publicKey: z.ZodTemplateLiteral<`0x${string}`>;
+        rpId: z.ZodString;
+    }, z.core.$strip>;
+    /** A signature challenge's `verification` value. */
+    const signature: z.ZodObject<{
+        account: z.ZodString;
+        clientId: z.ZodString;
+        credential: z.ZodObject<{
+            id: z.ZodString;
+            publicKey: z.ZodTemplateLiteral<`0x${string}`>;
+            rpId: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    /** The passkey step, which an approval of a key for a passkey-owned account returns. */
+    const step: z.ZodObject<{
+        step: z.ZodObject<{
+            options: z.ZodObject<{
+                publicKey: z.ZodObject<{
+                    allowCredentials: z.ZodArray<z.ZodObject<{
+                        id: z.ZodString;
+                        type: z.ZodLiteral<"public-key">;
+                    }, z.core.$strip>>;
+                    challenge: z.ZodTemplateLiteral<`0x${string}`>;
+                    rpId: z.ZodString;
+                    userVerification: z.ZodLiteral<"required">;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            type: z.ZodLiteral<"passkey">;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    /** A challenge's `verification` value. */
+    const value: z.ZodObject<{
+        clientId: z.ZodNullable<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        origin: z.ZodOptional<z.ZodString>;
+        realmId: z.ZodOptional<z.ZodString>;
+        rpId: z.ZodString;
+        witness: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+    }, z.core.$strip>;
+}
+/**
+ * Issues a challenge for a sign-in at `rpId`, stores it until it expires, and returns it as hex. The
+ * challenge is random, or the digest of a key authorization for a one-tap sign-in, which stores its
+ * witness beside it.
+ */
+export declare function challenge(db: Realm.Database, options: challenge.Options): Promise<`0x${string}`>;
+export declare namespace challenge {
+    type Options = {
+        /** The client ID of the app the sign-in names, or `null` for none. */
+        clientId: string | null;
+        /**
+         * The SHA-256 digest of the email step's link that the challenge confirms, as hex. Absent for a
+         * sign-in challenge.
+         */
+        link?: string | undefined;
+        /**
+         * The digest of the key authorization that a one-tap sign-in signs, and the witness that the
+         * digest binds. The digest takes the place of a random challenge. Absent for a plain sign-in.
+         */
+        oneTap?: {
+            /** The key authorization's digest, as hex. */
+            digest: Hex.Hex;
+            /** The witness that the digest binds. */
+            witness: Hex.Hex;
+        } | undefined;
+        /**
+         * The origin of the app's page that the ceremony runs at. Absent for Tempo ID's own page. Only
+         * an assertion that reports it, from a request that page sends, spends the challenge.
+         */
+        origin?: string | undefined;
+        /** The realm whose relying party the sign-in uses. */
+        realmId: string;
+        /** The relying party ID the passkey must belong to. */
+        rpId: string;
+    };
+}
+/**
+ * Returns why Tempo ID refuses a passkey ceremony on an app's page, or `undefined` when the page may
+ * run one. Tempo ID verifies the assertion for the page's origin, so only a first-party web app's
+ * page, at the origin of one of its redirect URIs, runs a ceremony:
+ *
+ * - A page sends the app's `client_id`, and the app must exist, be enabled, and skip consent.
+ * - A native app's request proves no app, so it signs in through an authentication sheet.
+ * - The request's `Origin` must be the origin of one of the app's redirect URIs.
+ */
+export declare function checkPage(options: checkPage.Options): ErrorResponse.Instance<typeof checkPage.errors> | undefined;
+export declare namespace checkPage {
+    type Options = {
+        /** The app that `clientId` names, or `undefined` when no enabled app has it. */
+        app: Pick<Apps.App, 'redirectUris' | 'skipConsent' | 'type'> | undefined;
+        /** The client ID that the request sends, if any. */
+        clientId: string | undefined;
+        /** The request's `Origin`, if any. */
+        origin: string | undefined;
+    };
+    /** The refusals `checkPage` returns. Its return type admits no other. */
+    const errors: readonly [typeof Authorize.InvalidOriginError, typeof Authorize.RejectedError];
+}
+/**
+ * Returns the passkey with the credential `id` that belongs to `rpId`, or `undefined` when Tempo ID
+ * stores none.
+ */
+export declare function get(db: Realm.Database, options: get.Options): Promise<{
+    address: string;
+    createdAt: Date;
+    id: string;
+    publicKey: string;
+    rpId: string;
+    source: string;
+    type: string;
+    userId: string;
+} | undefined>;
+export declare namespace get {
+    type Options = {
+        /** The credential ID, base64url. */
+        id: string;
+        /** The relying party ID the passkey must belong to. */
+        rpId: string;
+    };
+}
+/**
+ * Stores a verified wallet.tempo passkey for `userId`, and returns the user the passkey's row names.
+ * A concurrent first sign-in of the same passkey can store the row first, so the row decides.
+ * Returns `undefined` when another passkey holds the address.
+ */
+export declare function link(db: Realm.Database, options: link.Options): Promise<string | undefined>;
+export declare namespace link {
+    type Options = {
+        /** The passkey that wallet.tempo returned, which the assertion verified. */
+        credential: {
+            /** The address that the public key derives. */
+            address: string;
+            /** When wallet.tempo created the passkey, in milliseconds, or `null` when it has no time. */
+            createdAt: number | null;
+            /** The uncompressed P256 public key, hex. */
+            publicKey: Hex.Hex;
+        };
+        /** The credential ID, base64url. */
+        id: string;
+        /** The relying party of the passkey: the `default` realm's, which wallet.tempo shares. */
+        rpId: string;
+        /** The user the passkey links to. */
+        userId: string;
+    };
+}
+/**
+ * Instantiates a passkey sign-in plugin for Better Auth. Its server-only `signInPasskey` endpoint
+ * creates a session for a user whose assertion a route verified, and sets the session cookie. Like
+ * every sign-in, it continues an app's authorization that `oauth_query` names.
+ */
+export declare function plugin(): {
+    endpoints: {
+        signInPasskey: import("better-auth").StrictEndpoint<string, {
+            body: z.ZodObject<{
+                oauth_query: z.ZodOptional<z.ZodString>;
+                userId: z.ZodString;
+            }, z.core.$strip>;
+            method: "POST";
+        }, {
+            user: {
+                email: string;
+                id: string;
+            };
+        }>;
+    };
+    id: "tempo-id-passkey";
+};
+/**
+ * Returns the first of `realms` that holds passkeys which can sign in at `origin`, and at `page`
+ * when given, with its relying party ID, or `undefined` when none can. A WebAuthn ceremony runs
+ * only at an origin whose host is the relying party ID or one of its subdomains.
+ */
+export declare function relyingParty(realms: readonly Realm.Realm[], options: relyingParty.Options): {
+    realmId: string;
+    rpId: string;
+} | undefined;
+export declare namespace relyingParty {
+    type Options = {
+        /** Tempo ID's own origin. */
+        origin: string;
+        /**
+         * The origin of the app's page that runs the ceremony, if any. The relying party must cover it
+         * and Tempo ID's origin both, so the page shares a site with Tempo ID, and the browser sends the
+         * session cookie on the page's requests after the sign-in.
+         */
+        page?: string | undefined;
+    };
+}
+/**
+ * Stores the digest of a key authorization as the challenge of a signature by `credential`, until it
+ * expires. Only the user with `userId` spends it, for the same account, app, and passkey.
+ */
+export declare function requestSignature(db: Realm.Database, options: requestSignature.Options): Promise<void>;
+export declare namespace requestSignature {
+    type Options = {
+        /** The address of the Tempo Account that the key acts for. */
+        account: string;
+        /** The client ID of the app that requests the key. */
+        clientId: string;
+        /** The passkey that must sign: the account's owner. */
+        credential: Owner.Credential;
+        /** The digest of the key authorization, as hex. */
+        digest: Hex.Hex;
+        /** The signed-in user's ID. */
+        userId: string;
+    };
+}
+/**
+ * Encrypts a deferred link with a key derived from `secret`, for the link cookie. The cookie cannot
+ * be read, changed, or forged without the secret.
+ */
+export declare function seal(value: Link, options: seal.Options): Promise<string>;
+export declare namespace seal {
+    type Options = {
+        /** The `SECRET` variable. */
+        secret: string;
+    };
+}
+/**
+ * Spends the challenge that `clientDataJSON` names, and returns it, or `undefined` when it is
+ * unknown, spent, or expired. One statement deletes and returns the row, so two concurrent
+ * assertions over one challenge cannot both spend it.
+ */
+export declare function take(db: Realm.Database, options: take.Options): Promise<Challenge | undefined>;
+export declare namespace take {
+    type Options = {
+        /** The assertion's client data, as the JSON string the browser collected. */
+        clientDataJSON: string;
+    };
+}
+/**
+ * Spends the signature challenge that `clientDataJSON` names, for the user, app, account, and
+ * passkey of `options`, and returns it, or `undefined` when it is unknown, spent, or expired. One
+ * statement deletes and returns the rows, so two concurrent assertions over one challenge cannot
+ * both spend it, and an approval for another app, account, or passkey spends none of its rows.
+ *
+ * Returns the challenge only when `verify` accepts it with the assertion. Every step for the same
+ * key issues the same digest, so the transaction then records the assertion as spent until
+ * `expiry`, for a year at most, and returns `undefined` for an assertion that it recorded before. A captured assertion
+ * thus signs no second approval, and an assertion that does not verify leaves no record.
+ */
+export declare function takeSignature(db: Realm.Database, options: takeSignature.Options): Promise<SignatureChallenge | undefined>;
+export declare namespace takeSignature {
+    type Options = {
+        /** The address of the Tempo Account that the key acts for. */
+        account: string;
+        /** The assertion's authenticator data, as hex. */
+        authenticatorData: Hex.Hex;
+        /** The client ID of the app that requests the key. */
+        clientId: string;
+        /** The assertion's client data, as the JSON string the browser collected. */
+        clientDataJSON: string;
+        /** The credential ID of the passkey that signed, base64url. */
+        credentialId: string;
+        /**
+         * When the key expires, in Unix seconds. The spent assertion stays recorded until then, for a
+         * year at most.
+         */
+        expiry: number;
+        /** The assertion's signature, as hex. */
+        signature: Hex.Hex;
+        /** The signed-in user's ID. */
+        userId: string;
+        /**
+         * Returns whether the assertion verifies over the spent challenge, for the account, app, and
+         * passkey that it names. It runs in the transaction, so it performs no I/O.
+         */
+        verify: (challenge: SignatureChallenge) => boolean;
+    };
+}
+/**
+ * Decrypts the link cookie's value, and returns the deferred link, or `undefined` when the value
+ * does not decrypt with `secret`, has another shape, came from another host, or expired.
+ */
+export declare function unseal(sealed: string, options: unseal.Options): Promise<{
+    address: string;
+    createdAt: number | null;
+    expiresAt: number;
+    host: string;
+    id: string;
+    nonce: string;
+    publicKey: `0x${string}`;
+    rpId: string;
+} | undefined>;
+export declare namespace unseal {
+    type Options = {
+        /** The host that serves the request, which must be the one that sealed the link. */
+        host: string;
+        /** The `SECRET` variable. */
+        secret: string;
+    };
+}
+/**
+ * Returns whether `assertion` signs `challenge` with `publicKey`, at `origin`, for `rpId`, with the
+ * user present and verified, outside a cross-origin iframe. The client cannot waive user
+ * verification.
+ */
+export declare function verify(assertion: Assertion, options: verify.Options): boolean;
+export declare namespace verify {
+    type Options = {
+        /** The challenge that Tempo ID issued, as hex. */
+        challenge: Hex.Hex;
+        /** The origin the ceremony must report: Tempo ID's own, or the app's page that the challenge names. */
+        origin: string;
+        /** The passkey's uncompressed P256 public key, hex. */
+        publicKey: Hex.Hex;
+        /** The relying party ID the challenge was issued for. */
+        rpId: string;
+    };
+}
+export {};
+//# sourceMappingURL=Passkey.d.ts.map

package/dist/internal/Passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Passkey.d.ts","sourceRoot":"","sources":["../../src/internal/Passkey.ts"],"names":[],"mappings":"AAcA,OAAO,EAAgB,GAAG,EAAE,MAAM,IAAI,CAAA;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAExC;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,qBAErC;IACC,SAAkB,IAAI,8BAA6B;IAEnD,cAMC;CACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,sBAEtC;IACC,SAAkB,IAAI,+BAA8B;IAEpD,YAAY,OAAO,GAAE,iBAAiB,CAAC,OAAY,EAoBlD;CACF;AAED,MAAM,CAAC,OAAO,WAAW,iBAAiB,CAAC;IACzC,KAAK,OAAO,GAAG;QACb,0DAA0D;QAC1D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC7B,8FAA8F;QAC9F,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC5B,CAAA;CACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,0BAE1C;IACC,SAAkB,IAAI,mCAAkC;IAExD,cAKC;CACF;AAED,uFAAuF;AACvF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAA;AAEzD,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG;IACtB,6BAA6B;IAC7B,SAAS,EAAE,GAAG,CAAC,GAAG,CAAA;IAClB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB;;OAEG;IACH,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B;;;OAGG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,OAAO,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;CAC7B,CAAA;AAED,iCAAiC;AACjC,MAAM,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAA;AAEjD,uFAAuF;AACvF,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;AAE/C;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAA;IAChB,kCAAkC;IAClC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAA;IAC5B,mDAAmD;IACnD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAA;CAChB,CAAA;AAED,iCAAiC;AACjC,eAAO,MAAM,QAAQ,QAAS,CAAA;AAE9B,qCAAqC;AACrC,eAAO,MAAM,YAAY,QAAS,CAAA;AAwBlC,0CAA0C;AAC1C,yBAAiB,MAAM,CAAC;IAItB;;;OAGG;IACI,MAAM,YAAY,aAA6B,CAAA;IAEtD,uFAAuF;IAChF,MAAM,SAAS;;;;;;;;;;;;;;;;;;;qBAgHlB,CAAA;IAEJ,4DAA4D;IACrD,MAAM,UAAU;;;qBAGrB,CAAA;IAEF,8CAA8C;IACvC,MAAM,IAAI;;;;;;;;;qBAYf,CAAA;IAEF,oDAAoD;IAC7C,MAAM,SAAS;;;;;;;;qBAQpB,CAAA;IAEF,wFAAwF;IACjF,MAAM,IAAI;;;;;;;;;;;;;;;qBAoEb,CAAA;IAEJ,0CAA0C;IACnC,MAAM,KAAK;;;;;;;qBAUhB,CAAA;CACH;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,SAAS,CAAC,OAAO,0BAsB3B;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,GAAG;QACb,sEAAsE;QACtE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB;;;WAGG;QACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB;;;WAGG;QACH,MAAM,CAAC,EACH;YACE,8CAA8C;YAC9C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAA;YACf,yCAAyC;YACzC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAA;SACjB,GACD,SAAS,CAAA;QACb;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,sDAAsD;QACtD,OAAO,EAAE,MAAM,CAAA;QACf,uDAAuD;QACvD,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,SAAS,CAAC,OAAO,GACzB,aAAa,CAAC,QAAQ,CAAC,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,SAAS,CA+B7D;AAED,yBAAiB,SAAS,CAAC;IACzB,KAAY,OAAO,GAAG;QACpB,gFAAgF;QAChF,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,GAAG,MAAM,CAAC,GAAG,SAAS,CAAA;QACxE,oDAAoD;QACpD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,sCAAsC;QACtC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,CAAA;IAED,yEAAyE;IAClE,MAAM,MAAM,gFAGT,CAAA;CACX;AAED;;;GAGG;AACH,wBAAsB,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO;;;;;;;;;eAQjE;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,KAAK,OAAO,GAAG;QACb,oCAAoC;QACpC,EAAE,EAAE,MAAM,CAAA;QACV,uDAAuD;QACvD,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,+BAoCnE;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,4EAA4E;QAC5E,UAAU,EAAE;YACV,+CAA+C;YAC/C,OAAO,EAAE,MAAM,CAAA;YACf,6FAA6F;YAC7F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;YACxB,6CAA6C;YAC7C,SAAS,EAAE,GAAG,CAAC,GAAG,CAAA;SACnB,CAAA;QACD,oCAAoC;QACpC,EAAE,EAAE,MAAM,CAAA;QACV,0FAA0F;QAC1F,IAAI,EAAE,MAAM,CAAA;QACZ,qCAAqC;QACrC,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AA4BD;;;;GAIG;AACH,wBAAgB,MAAM;;QAGhB,aAAa;;;;;;;;gBAiBiB,KAAK;gBAAc,EAAE;;;;;EAMxD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,KAAK,CAAC,KAAK,EAAE,EAC9B,OAAO,EAAE,YAAY,CAAC,OAAO;;;cAc9B;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,6BAA6B;QAC7B,MAAM,EAAE,MAAM,CAAA;QACd;;;;WAIG;QACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC1B,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,gBAAgB,CAAC,OAAO,iBAqBlC;AAED,MAAM,CAAC,OAAO,WAAW,gBAAgB,CAAC;IACxC,KAAK,OAAO,GAAG;QACb,8DAA8D;QAC9D,OAAO,EAAE,MAAM,CAAA;QACf,sDAAsD;QACtD,QAAQ,EAAE,MAAM,CAAA;QAChB,uDAAuD;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU,CAAA;QAC5B,mDAAmD;QACnD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAA;QACf,+BAA+B;QAC/B,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,mBAK5D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,6BAA6B;QAC7B,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CACxB,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,IAAI,CAAC,OAAO,GACpB,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAgChC;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,6EAA6E;QAC7E,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,aAAa,CAAC,OAAO,GAC7B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CA8DzC;AAED,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,KAAK,OAAO,GAAG;QACb,8DAA8D;QAC9D,OAAO,EAAE,MAAM,CAAA;QACf,kDAAkD;QAClD,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAA;QAC1B,sDAAsD;QACtD,QAAQ,EAAE,MAAM,CAAA;QAChB,6EAA6E;QAC7E,cAAc,EAAE,MAAM,CAAA;QACtB,+DAA+D;QAC/D,YAAY,EAAE,MAAM,CAAA;QACpB;;;WAGG;QACH,MAAM,EAAE,MAAM,CAAA;QACd,yCAAyC;QACzC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAA;QAClB,+BAA+B;QAC/B,MAAM,EAAE,MAAM,CAAA;QACd;;;WAGG;QACH,MAAM,EAAE,CAAC,SAAS,EAAE,kBAAkB,KAAK,OAAO,CAAA;KACnD,CAAA;CACF;AAkCD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;;;;;;;;;eAWnE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,oFAAoF;QACpF,IAAI,EAAE,MAAM,CAAA;QACZ,6BAA6B;QAC7B,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,WAwBnE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,kDAAkD;QAClD,SAAS,EAAE,GAAG,CAAC,GAAG,CAAA;QAClB,uGAAuG;QACvG,MAAM,EAAE,MAAM,CAAA;QACd,uDAAuD;QACvD,SAAS,EAAE,GAAG,CAAC,GAAG,CAAA;QAClB,yDAAyD;QACzD,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF"}