@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/internal/RateLimit.d.ts

@@ -0,0 +1,218 @@
+import type { Context } from 'hono';
+import type { Env } from './Env.js';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as Limits from './Limits.js';
+import type * as Realm from './Realm.js';
+declare const LimitedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "temporarily_unavailable";
+            reason: "rate_limited";
+        };
+    };
+    readonly reason: "rate_limited";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** A request exceeded one of Tempo ID's rate limits. */
+export declare class LimitedError extends LimitedError_base {
+    readonly name = "RateLimit.LimitedError";
+    constructor(options: LimitedError.Options);
+}
+export declare namespace LimitedError {
+    type Options = {
+        /** Seconds until a retry can succeed. */
+        retryAfter: number;
+    };
+}
+/** A Workers Rate Limiting binding, as the app calls it. */
+export type Limiter = {
+    /** Counts a request for `key`, and reports whether the key has requests left. */
+    limit(options: {
+        /** The counter's key. */
+        key: string;
+    }): Promise<{
+        /** Whether the request is within the limit. */
+        success: boolean;
+    }>;
+};
+declare global {
+    interface VoidGeneratedEnvBindings extends Record<Limits.Limit, Limiter> {
+    }
+}
+/**
+ * A limit as the RateLimit header fields of draft-ietf-httpapi-ratelimit-headers describe it, in
+ * `RateLimit-Policy` and `RateLimit`.
+ */
+export type Policy = {
+    /** The policy's name, such as `sign-in-ip`. */
+    name: string;
+    /** The requests a key may make within `window`. */
+    quota: number;
+    /** The window, in seconds. */
+    window: number;
+};
+/**
+ * The sign-in codes that one address receives in an hour, across every Cloudflare location. Each
+ * code takes three guesses, so an address takes at most 30 guesses an hour.
+ */
+export declare const codePolicy: Policy;
+/** The response headers a rate-limited route may send, which cross-origin callers need exposed. */
+export declare const headers: readonly ['RateLimit', 'RateLimit-Policy', 'Retry-After'];
+/**
+ * Counts the request against each limit in order, and returns a 429 response with `Retry-After` at
+ * the first one spent, or `undefined`. A limit without a key is skipped, and so is an
+ * {@link Limits.optional} limit without a binding, with a warning. The limits after a refusal are not
+ * counted, so a refused caller spends no narrower quota, such as an address's. The response
+ * is the same for every limit, so it reveals nothing about the key, such as whether an account
+ * exists. Every limit with a key adds its {@link policy} to `RateLimit-Policy`.
+ */
+export declare function check(c: Context<Env>, options: check.Options): Promise<(Response & import("hono").TypedResponse<{
+    error: "temporarily_unavailable";
+    reason: "rate_limited";
+    error_description: string;
+    error_uri: string;
+    field?: string | undefined;
+    meta?: {
+        readonly [x: string]: string | number;
+    } | undefined;
+    request_id?: string | undefined;
+}, 429, "json">) | undefined>;
+export declare namespace check {
+    type Options = {
+        /** The counters the request counts against, broadest first. */
+        limits: readonly {
+            /** The limiter's binding name, which sets the limit. */
+            binding: Limits.Limit;
+            /** The counter's key, or `undefined` to skip it. Keys never hold secrets, codes, or tokens. */
+            key: string | undefined;
+        }[];
+    };
+}
+export declare namespace check {
+    /** The refusal `check` returns. */
+    const errors: readonly [typeof LimitedError];
+}
+/**
+ * Counts the request against the counter of `binding` for `key` once, and returns whether the key
+ * has requests left. Later calls in the request for the same counter share the first outcome, so a
+ * request that reads a user's accounts in several steps, such as a sign-in's account step and its
+ * first account, counts once.
+ */
+export declare function count(c: Context<Env>, options: count.Options): Promise<boolean>;
+export declare namespace count {
+    type Options = {
+        /** The limiter's binding name, which sets the limit. */
+        binding: Limits.Limit;
+        /** The counter's key. Keys never hold secrets, codes, or tokens. */
+        key: string;
+    };
+}
+/**
+ * Counts a sign-in code for `email` in the database, and returns whether the address is within
+ * {@link codePolicy}. The Workers limits count each location on its own, so only this count bounds
+ * the guesses at one address across every location. Each count is a `verification` row that expires
+ * with the window, and a refused count deletes its row.
+ */
+export declare function countCode(db: Realm.Database, options: countCode.Options): Promise<boolean>;
+export declare namespace countCode {
+    type Options = {
+        /** The trimmed, lowercased address. */
+        email: string;
+    };
+}
+/**
+ * Adds `policy` to the response's `RateLimit-Policy`, as `"<name>";q=<quota>;w=<window>`. A
+ * response that counts against several policies lists each once. It reads no binding, so a page
+ * loader's context can call it too.
+ */
+export declare function describe(c: Context, options: describe.Options): void;
+export declare namespace describe {
+    type Options = {
+        /** The policy the request counts against. */
+        policy: Policy;
+    };
+}
+/**
+ * Returns the key for a normalized email address: its SHA-256 hash, so the counters hold no
+ * address.
+ */
+export declare function email(options: email.Options): `0x${string}`;
+export declare namespace email {
+    type Options = {
+        /** The trimmed, lowercased address. */
+        email: string;
+    };
+}
+/** Instantiates a {@link Policy}. */
+export declare function from(policy: Policy): Policy;
+/**
+ * Returns the client's key from `cf-connecting-ip`, or `undefined` for a request without one, such
+ * as an in-process call. An IPv6 address keys on its /64 prefix, since one subscriber usually holds
+ * the whole prefix and could otherwise rotate addresses within it. A Worker in another zone keys on
+ * that zone, since every such Worker arrives from the same address.
+ */
+export declare function ip(c: ip.Context): string | undefined;
+export declare namespace ip {
+    /** The request context, of which `ip` reads only the headers. */
+    type Context = {
+        req: {
+            header: (name: string) => string | undefined;
+        };
+    };
+}
+/**
+ * Returns a binding's {@link Policy}: its limit and period from `Limits`. The policy's name is the
+ * binding's name without its `_LIMIT` suffix, in kebab case, such as `sign-in-ip` for
+ * `SIGN_IN_IP_LIMIT`.
+ */
+export declare function policy(options: policy.Options): Policy;
+export declare namespace policy {
+    type Options = {
+        /** The limiter's binding name. */
+        binding: Limits.Limit;
+    };
+}
+/**
+ * Returns a 429 response with `Retry-After` and `meta: { retryAfter }`, and `RateLimit` naming the
+ * spent `policy` with no quota left (`r=0`) for `retryAfter` seconds (`t`). The body names no key
+ * or limit, so it reveals nothing about the key, such as whether an account exists. It reads no
+ * binding, so a page loader's context can call it too.
+ */
+export declare function refuse(c: Context, options: refuse.Options): Response & import("hono").TypedResponse<{
+    error: "temporarily_unavailable";
+    reason: "rate_limited";
+    error_description: string;
+    error_uri: string;
+    field?: string | undefined;
+    meta?: {
+        readonly [x: string]: string | number;
+    } | undefined;
+    request_id?: string | undefined;
+}, 429, "json">;
+export declare namespace refuse {
+    type Options = {
+        /** The spent policy. */
+        policy: Policy;
+        /** Seconds until a retry can succeed, at most the policy's window. */
+        retryAfter: number;
+    };
+}
+export {};
+//# sourceMappingURL=RateLimit.d.ts.map

package/dist/internal/RateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimit.d.ts","sourceRoot":"","sources":["../../src/internal/RateLimit.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAGnC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGxC,wDAAwD;AACxD,qBAAa,YAAa,SAAQ,iBAAoC;IACpE,SAAkB,IAAI,4BAA2B;IAEjD,YAAY,OAAO,EAAE,YAAY,CAAC,OAAO,EAKxC;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,yCAAyC;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAQD,4DAA4D;AAC5D,MAAM,MAAM,OAAO,GAAG;IACpB,iFAAiF;IACjF,KAAK,CAAC,OAAO,EAAE;QACb,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAA;KACZ,GAAG,OAAO,CAAC;QACV,+CAA+C;QAC/C,OAAO,EAAE,OAAO,CAAA;KACjB,CAAC,CAAA;CACH,CAAA;AAGD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,wBAAyB,SAAQ,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;KAAG;CAC5E;AAED;;;GAGG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU,QAIrB,CAAA;AAEF,mGAAmG;AACnG,eAAO,MAAM,OAAO,YAAI,WAAW,EAAE,kBAAkB,EAAE,aAAa,CAAU,CAAA;AAEhF;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;;;;;;;;;;8BAiClE;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,KAAK,OAAO,GAAG;QACb,+DAA+D;QAC/D,MAAM,EAAE,SAAS;YACf,wDAAwD;YACxD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAA;YACrB,+FAA+F;YAC/F,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;SACxB,EAAE,CAAA;KACJ,CAAA;CACF;AAED,yBAAiB,KAAK,CAAC;IACrB,mCAAmC;IAC5B,MAAM,MAAM,gCAA0B,CAAA;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CACnB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EACf,OAAO,EAAE,KAAK,CAAC,OAAO,GACrB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,KAAK,OAAO,GAAG;QACb,wDAAwD;QACxD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAA;QACrB,oEAAoE;QACpE,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,SAAS,CAAC,OAAO,oBA0B3B;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,GAAG;QACb,uCAAuC;QACvC,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,QAO7D;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,6CAA6C;QAC7C,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,iBAE3C;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,KAAK,OAAO,GAAG;QACb,uCAAuC;QACvC,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED,qCAAqC;AACrC,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;;GAKG;AACH,wBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,sBAwB/B;AAED,MAAM,CAAC,OAAO,WAAW,EAAE,CAAC;IAC1B,iEAAiE;IACjE,KAAK,OAAO,GAAG;QAAE,GAAG,EAAE;YAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;SAAE,CAAA;KAAE,CAAA;CACzE;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,UAW7C;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,kCAAkC;QAClC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAA;KACtB,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;;;;;;;;;;gBAKzD;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,wBAAwB;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,sEAAsE;QACtE,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF"}

package/dist/internal/RateLimit.js

@@ -0,0 +1,209 @@
+/**
+ * Rate limits through the Workers Rate Limiting bindings that `Limits` names. Each Cloudflare
+ * location counts on its own, and counts converge eventually, so a limit bounds abuse rather than
+ * counting exactly. Better Auth bounds the guesses at each sign-in code exactly, and
+ * {@link countCode} bounds an address's codes across every location in the database.
+ * @module
+ */
+import { and, eq, gt, sql } from 'drizzle-orm';
+import { Bytes, Hash } from 'ox';
+import * as Schema from '../app/db/schema.js';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as Limits from './Limits.js';
+import * as Log from './Log.js';
+import * as Timing from './Timing.js';
+/** A request exceeded one of Tempo ID's rate limits. */
+export class LimitedError extends ErrorResponse.define('rate_limited') {
+    name = 'RateLimit.LimitedError';
+    constructor(options) {
+        super({
+            error_description: `Too many requests. Try again in ${ErrorResponse.wait({ seconds: options.retryAfter })}.`,
+            meta: { retryAfter: options.retryAfter },
+        });
+    }
+}
+/**
+ * The address Cloudflare gives every Worker subrequest from another zone, whatever Worker sends it.
+ * Cloudflare names the calling zone in `cf-worker` instead.
+ */
+const workers = '2a06:98c0:3600::103';
+/**
+ * The sign-in codes that one address receives in an hour, across every Cloudflare location. Each
+ * code takes three guesses, so an address takes at most 30 guesses an hour.
+ */
+export const codePolicy = from({
+    name: 'sign-in-codes',
+    quota: 10,
+    window: 60 * 60,
+});
+/** The response headers a rate-limited route may send, which cross-origin callers need exposed. */
+export const headers = ['RateLimit', 'RateLimit-Policy', 'Retry-After'];
+/**
+ * Counts the request against each limit in order, and returns a 429 response with `Retry-After` at
+ * the first one spent, or `undefined`. A limit without a key is skipped, and so is an
+ * {@link Limits.optional} limit without a binding, with a warning. The limits after a refusal are not
+ * counted, so a refused caller spends no narrower quota, such as an address's. The response
+ * is the same for every limit, so it reveals nothing about the key, such as whether an account
+ * exists. Every limit with a key adds its {@link policy} to `RateLimit-Policy`.
+ */
+export async function check(c, options) {
+    // A deployment whose Wrangler config predates an optional limit has no binding for it. Any other
+    // missing binding throws below, so a misconfigured deployment fails closed.
+    const bindings = c.env;
+    const limits = options.limits.flatMap((limit) => {
+        if (limit.key === undefined)
+            return [];
+        if (!bindings[limit.binding] && Limits.optional.includes(limit.binding)) {
+            Log.warn(c, {
+                fields: { binding: limit.binding },
+                message: 'A rate limit has no binding, so the request is not counted.',
+            });
+            return [];
+        }
+        return [
+            {
+                ...limit,
+                key: limit.key,
+                policy: policy({ binding: limit.binding }),
+            },
+        ];
+    });
+    for (const limit of limits)
+        describe(c, { policy: limit.policy });
+    for (const limit of limits) {
+        const admitted = await count(c, { binding: limit.binding, key: limit.key });
+        // The binding reports no reset, and every counter restarts once a window passes.
+        if (!admitted)
+            return refuse(c, {
+                policy: limit.policy,
+                retryAfter: limit.policy.window,
+            });
+    }
+    return undefined;
+}
+(function (check) {
+    /** The refusal `check` returns. */
+    check.errors = [LimitedError];
+})(check || (check = {}));
+/**
+ * Counts the request against the counter of `binding` for `key` once, and returns whether the key
+ * has requests left. Later calls in the request for the same counter share the first outcome, so a
+ * request that reads a user's accounts in several steps, such as a sign-in's account step and its
+ * first account, counts once.
+ */
+export function count(c, options) {
+    const counted = c.var.counted ?? new Map();
+    if (!c.var.counted)
+        c.set('counted', counted);
+    const id = JSON.stringify([options.binding, options.key]);
+    const outcome = counted.get(id) ??
+        Timing.measure(c, c.env[options.binding].limit({ key: options.key }), 'ratelimit.limit').then((result) => result.success);
+    counted.set(id, outcome);
+    return outcome;
+}
+/**
+ * Counts a sign-in code for `email` in the database, and returns whether the address is within
+ * {@link codePolicy}. The Workers limits count each location on its own, so only this count bounds
+ * the guesses at one address across every location. Each count is a `verification` row that expires
+ * with the window, and a refused count deletes its row.
+ */
+export async function countCode(db, options) {
+    const identifier = `sign-in-codes:${email(options)}`;
+    const now = Date.now();
+    const id = crypto.randomUUID();
+    // The insert comes before the count, so of concurrent requests at most the quota passes.
+    await db.insert(Schema.verification).values({
+        expiresAt: new Date(now + codePolicy.window * 1000),
+        id,
+        identifier,
+        value: '',
+    });
+    const [row] = await db
+        .select({ count: sql `count(*)::int` })
+        .from(Schema.verification)
+        .where(and(eq(Schema.verification.identifier, identifier), gt(Schema.verification.expiresAt, new Date(now))));
+    if ((row?.count ?? 0) <= codePolicy.quota)
+        return true;
+    await db.delete(Schema.verification).where(eq(Schema.verification.id, id));
+    return false;
+}
+/**
+ * Adds `policy` to the response's `RateLimit-Policy`, as `"<name>";q=<quota>;w=<window>`. A
+ * response that counts against several policies lists each once. It reads no binding, so a page
+ * loader's context can call it too.
+ */
+export function describe(c, options) {
+    const { policy } = options;
+    c.header('ratelimit-policy', `"${policy.name}";q=${policy.quota};w=${policy.window}`, { append: true });
+}
+/**
+ * Returns the key for a normalized email address: its SHA-256 hash, so the counters hold no
+ * address.
+ */
+export function email(options) {
+    return Hash.sha256(Bytes.fromString(options.email), { as: 'Hex' });
+}
+/** Instantiates a {@link Policy}. */
+export function from(policy) {
+    return policy;
+}
+/**
+ * Returns the client's key from `cf-connecting-ip`, or `undefined` for a request without one, such
+ * as an in-process call. An IPv6 address keys on its /64 prefix, since one subscriber usually holds
+ * the whole prefix and could otherwise rotate addresses within it. A Worker in another zone keys on
+ * that zone, since every such Worker arrives from the same address.
+ */
+export function ip(c) {
+    const address = c.req.header('cf-connecting-ip');
+    // Only Cloudflare sends from this address, so `cf-worker` names the calling zone and is not the
+    // caller's to choose.
+    if (address === workers)
+        return `worker:${c.req.header('cf-worker') ?? ''}`;
+    // An IPv4 address, or an IPv6 address that embeds one, keys whole.
+    if (!address?.includes(':') || address.includes('.'))
+        return address;
+    const [head, tail] = address.toLowerCase().split('::');
+    const left = head ? head.split(':') : [];
+    const right = tail ? tail.split(':') : [];
+    const groups = tail === undefined
+        ? left
+        : [
+            ...left,
+            ...Array(Math.max(0, 8 - left.length - right.length)).fill('0'),
+            ...right,
+        ];
+    return `${groups
+        .slice(0, 4)
+        .map((group) => group.replace(/^0+(?=.)/, ''))
+        .join(':')}::/64`;
+}
+/**
+ * Returns a binding's {@link Policy}: its limit and period from `Limits`. The policy's name is the
+ * binding's name without its `_LIMIT` suffix, in kebab case, such as `sign-in-ip` for
+ * `SIGN_IN_IP_LIMIT`.
+ */
+export function policy(options) {
+    const { binding } = options;
+    const config = Limits.limits[binding];
+    return from({
+        name: binding
+            .replace(/_LIMIT$/, '')
+            .toLowerCase()
+            .replaceAll('_', '-'),
+        quota: config.limit,
+        window: config.period,
+    });
+}
+/**
+ * Returns a 429 response with `Retry-After` and `meta: { retryAfter }`, and `RateLimit` naming the
+ * spent `policy` with no quota left (`r=0`) for `retryAfter` seconds (`t`). The body names no key
+ * or limit, so it reveals nothing about the key, such as whether an account exists. It reads no
+ * binding, so a page loader's context can call it too.
+ */
+export function refuse(c, options) {
+    const { policy, retryAfter } = options;
+    c.header('ratelimit', `"${policy.name}";r=0;t=${retryAfter}`);
+    c.header('retry-after', String(retryAfter));
+    return ErrorResponse.json(c, new LimitedError({ retryAfter }));
+}
+//# sourceMappingURL=RateLimit.js.map

package/dist/internal/RateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimit.js","sourceRoot":"","sources":["../../src/internal/RateLimit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAChC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAE7C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAE/B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC,wDAAwD;AACxD,MAAM,OAAO,YAAa,SAAQ,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC;IAClD,IAAI,GAAG,wBAAwB,CAAA;IAEjD,YAAY,OAA6B;QACvC,KAAK,CAAC;YACJ,iBAAiB,EAAE,mCAAmC,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG;YAC5G,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;CACF;AASD;;;GAGG;AACH,MAAM,OAAO,GAAG,qBAAqB,CAAA;AAgCrC;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,EAAE,GAAG,EAAE;CAChB,CAAC,CAAA;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,kBAAkB,EAAE,aAAa,CAAU,CAAA;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,CAAe,EAAE,OAAsB;IACjE,iGAAiG;IACjG,4EAA4E;IAC5E,MAAM,QAAQ,GAA2C,CAAC,CAAC,GAAG,CAAA;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9C,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,CAAA;QACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE;gBACV,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;gBAClC,OAAO,EAAE,6DAA6D;aACvE,CAAC,CAAA;YACF,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO;YACL;gBACE,GAAG,KAAK;gBACR,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3C;SACF,CAAA;IACH,CAAC,CAAC,CAAA;IACF,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IAEjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;QAC3E,iFAAiF;QACjF,IAAI,CAAC,QAAQ;YACX,OAAO,MAAM,CAAC,CAAC,EAAE;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;aAChC,CAAC,CAAA;IACN,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAcD,WAAiB,KAAK;IACpB,mCAAmC;IACtB,YAAM,GAAG,CAAC,YAAY,CAAU,CAAA;AAC/C,CAAC,EAHgB,KAAK,KAAL,KAAK,QAGrB;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CACnB,CAAe,EACf,OAAsB;IAEtB,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,EAA4B,CAAA;IACpE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,CACZ,CAAC,EACD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAClD,iBAAiB,CAClB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACpC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACxB,OAAO,OAAO,CAAA;AAChB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAkB,EAClB,OAA0B;IAE1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,CAAC,OAAO,CAAC,EAAE,CAAA;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAE9B,yFAAyF;IACzF,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QAC1C,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC;QACnD,EAAE;QACF,UAAU;QACV,KAAK,EAAE,EAAE;KACV,CAAC,CAAA;IACF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC;SAC7C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,EAC9C,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CACjD,CACF,CAAA;IACH,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEtD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IAC1E,OAAO,KAAK,CAAA;AACd,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAU,EAAE,OAAyB;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC1B,CAAC,CAAC,MAAM,CACN,kBAAkB,EAClB,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,MAAM,EAAE,EACvD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAA;AACH,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,OAAsB;IAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;AACpE,CAAC;AASD,qCAAqC;AACrC,MAAM,UAAU,IAAI,CAAC,MAAc;IACjC,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,EAAE,CAAC,CAAa;IAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAChD,gGAAgG;IAChG,sBAAsB;IACtB,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAA;IAE3E,mEAAmE;IACnE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAA;IAEpE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzC,MAAM,MAAM,GACV,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,GAAG,IAAI;YACP,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/D,GAAG,KAAK;SACT,CAAA;IACP,OAAO,GAAG,MAAM;SACb,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;SAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAA;AACrB,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,OAAuB;IAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACrC,OAAO,IAAI,CAAC;QACV,IAAI,EAAE,OAAO;aACV,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,WAAW,EAAE;aACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAA;AACJ,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,CAAU,EAAE,OAAuB;IACxD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IACtC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,WAAW,UAAU,EAAE,CAAC,CAAA;IAC7D,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAC3C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;AAChE,CAAC"}