@textrp/briij-js-sdk 41.0.0

package/lib/interactive-auth.js

@@ -0,0 +1,563 @@
+import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
+import _defineProperty from "@babel/runtime/helpers/defineProperty";
+/*
+Copyright 2016 OpenMarket Ltd
+Copyright 2017 Vector Creations Ltd
+Copyright 2019 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { logger } from "./logger.js";
+import { BriijError } from "./http-api/index.js";
+var EMAIL_STAGE_TYPE = "m.login.email.identity";
+var MSISDN_STAGE_TYPE = "m.login.msisdn";
+
+/**
+ * Data returned in the body of a 401 response from a UIA endpoint.
+ *
+ * @see https://spec.matrix.org/v1.6/client-server-api/#user-interactive-api-in-the-rest-api
+ */
+
+export var AuthType = /*#__PURE__*/function (AuthType) {
+  AuthType["Password"] = "m.login.password";
+  AuthType["Recaptcha"] = "m.login.recaptcha";
+  AuthType["Terms"] = "m.login.terms";
+  AuthType["Email"] = "m.login.email.identity";
+  AuthType["Msisdn"] = "m.login.msisdn";
+  AuthType["Sso"] = "m.login.sso";
+  AuthType["SsoUnstable"] = "org.matrix.login.sso";
+  AuthType["Dummy"] = "m.login.dummy";
+  AuthType["RegistrationToken"] = "m.login.registration_token";
+  // For backwards compatability with servers that have not yet updated to
+  // use the stable "m.login.registration_token" type.
+  // The authentication flow is the same in both cases.
+  AuthType["UnstableRegistrationToken"] = "org.matrix.msc3231.login.registration_token";
+  /**
+   * m.oauth stage introduced by MSC4312:
+   * https://spec.matrix.org/v1.17/client-server-api/#oauth-authentication
+   */
+  AuthType["OAuth"] = "m.oauth";
+  return AuthType;
+}({});
+
+/**
+ * https://spec.matrix.org/v1.7/client-server-api/#password-based
+ */
+
+/**
+ * https://spec.matrix.org/v1.7/client-server-api/#google-recaptcha
+ */
+
+/**
+ * https://spec.matrix.org/v1.7/client-server-api/#email-based-identity--homeserver
+ */
+
+/**
+ * The parameters which are submitted as the `auth` dict in a UIA request
+ *
+ * @see https://spec.matrix.org/v1.6/client-server-api/#authentication-types
+ */
+
+export class NoAuthFlowFoundError extends Error {
+  constructor(m,
+  // eslint-disable-next-line @typescript-eslint/naming-convention, camelcase
+  required_stages, flows) {
+    super(m);
+    this.required_stages = required_stages;
+    this.flows = flows;
+    _defineProperty(this, "name", "NoAuthFlowFoundError");
+  }
+}
+
+/**
+ * The type of an application callback to perform the user-interactive bit of UIA.
+ *
+ * It is called with a single parameter, `makeRequest`, which is a function which takes the UIA parameters and
+ * makes the HTTP request. The `authData` parameter in `makeRequest` can be set to null to omit the `auth` field
+ * from the UIA request.
+ *
+ * The generic parameter `T` is the type of the response of the endpoint, once it is eventually successful.
+ */
+
+/**
+ * Abstracts the logic used to drive the interactive auth process.
+ *
+ * <p>Components implementing an interactive auth flow should instantiate one of
+ * these, passing in the necessary callbacks to the constructor. They should
+ * then call attemptAuth, which will return a promise which will resolve or
+ * reject when the interactive-auth process completes.
+ *
+ * <p>Meanwhile, calls will be made to the startAuthStage and doRequest
+ * callbacks, and information gathered from the user can be submitted with
+ * submitAuthDict.
+ *
+ * @param opts - options object
+ * @typeParam T - the return type of the request when it is successful
+ */
+export class InteractiveAuth {
+  constructor(opts) {
+    var _this = this;
+    _defineProperty(this, "matrixClient", void 0);
+    _defineProperty(this, "inputs", void 0);
+    _defineProperty(this, "clientSecret", void 0);
+    _defineProperty(this, "requestCallback", void 0);
+    _defineProperty(this, "busyChangedCallback", void 0);
+    _defineProperty(this, "stateUpdatedCallback", void 0);
+    _defineProperty(this, "requestEmailTokenCallback", void 0);
+    _defineProperty(this, "supportedStages", void 0);
+    // The current latest data or error received from the server during the user interactive auth flow.
+    _defineProperty(this, "data", void 0);
+    _defineProperty(this, "emailSid", void 0);
+    _defineProperty(this, "requestingEmailToken", false);
+    _defineProperty(this, "attemptAuthDeferred", null);
+    _defineProperty(this, "chosenFlow", null);
+    _defineProperty(this, "currentStage", null);
+    _defineProperty(this, "emailAttempt", 1);
+    // if we are currently trying to submit an auth dict (which includes polling)
+    // the promise the will resolve/reject when it completes
+    _defineProperty(this, "submitPromise", null);
+    /**
+     * Requests a new email token and sets the email sid for the validation session
+     */
+    _defineProperty(this, "requestEmailToken", /*#__PURE__*/_asyncToGenerator(function* () {
+      if (!_this.requestingEmailToken) {
+        logger.trace("Requesting email token. Attempt: " + _this.emailAttempt);
+        // If we've picked a flow with email auth, we send the email
+        // now because we want the request to fail as soon as possible
+        // if the email address is not valid (ie. already taken or not
+        // registered, depending on what the operation is).
+        _this.requestingEmailToken = true;
+        try {
+          var requestTokenResult = yield _this.requestEmailTokenCallback(_this.inputs.emailAddress, _this.clientSecret, _this.emailAttempt++, _this.data.session);
+          _this.emailSid = requestTokenResult.sid;
+          logger.trace("Email token request succeeded");
+        } finally {
+          _this.requestingEmailToken = false;
+        }
+      } else {
+        logger.warn("Could not request email token: Already requesting");
+      }
+    }));
+    this.matrixClient = opts.matrixClient;
+    this.data = opts.authData || {
+      flows: []
+    };
+    this.requestCallback = opts.doRequest;
+    this.busyChangedCallback = opts.busyChanged;
+    // startAuthStage included for backwards compat
+    this.stateUpdatedCallback = opts.stateUpdated || opts.startAuthStage;
+    this.requestEmailTokenCallback = opts.requestEmailToken;
+    this.inputs = opts.inputs || {};
+    if (opts.sessionId) this.data.session = opts.sessionId;
+    this.clientSecret = opts.clientSecret || this.matrixClient.generateClientSecret();
+    this.emailSid = opts.emailSid;
+    if (opts.supportedStages !== undefined) this.supportedStages = new Set(opts.supportedStages);
+  }
+
+  /**
+   * begin the authentication process.
+   *
+   * @returns which resolves to the response on success,
+   * or rejects with the error on failure. Rejects with NoAuthFlowFoundError if
+   *     no suitable authentication flow can be found
+   */
+  attemptAuth() {
+    var _this2 = this;
+    return _asyncToGenerator(function* () {
+      var _this2$data;
+      // This promise will be quite long-lived and will resolve when the
+      // request is authenticated and completes successfully.
+      _this2.attemptAuthDeferred = Promise.withResolvers();
+      // pluck the promise out now, as doRequest may clear before we return
+      var promise = _this2.attemptAuthDeferred.promise;
+
+      // if we have no flows, try a request to acquire the flows
+      if (!((_this2$data = _this2.data) !== null && _this2$data !== void 0 && (_this2$data = _this2$data.flows) !== null && _this2$data !== void 0 && _this2$data.length)) {
+        var _this2$busyChangedCal;
+        (_this2$busyChangedCal = _this2.busyChangedCallback) === null || _this2$busyChangedCal === void 0 || _this2$busyChangedCal.call(_this2, true);
+        // use the existing sessionId, if one is present.
+        var _auth = _this2.data.session ? {
+          session: _this2.data.session
+        } : null;
+        _this2.doRequest(_auth).finally(() => {
+          var _this2$busyChangedCal2;
+          (_this2$busyChangedCal2 = _this2.busyChangedCallback) === null || _this2$busyChangedCal2 === void 0 || _this2$busyChangedCal2.call(_this2, false);
+        });
+      } else {
+        _this2.startNextAuthStage();
+      }
+      return promise;
+    })();
+  }
+
+  /**
+   * Poll to check if the auth session or current stage has been
+   * completed out-of-band. If so, the attemptAuth promise will
+   * be resolved.
+   */
+  poll() {
+    var _this3 = this;
+    return _asyncToGenerator(function* () {
+      if (!_this3.data.session) return;
+      // likewise don't poll if there is no auth session in progress
+      if (!_this3.attemptAuthDeferred) return;
+      // if we currently have a request in flight, there's no point making
+      // another just to check what the status is
+      if (_this3.submitPromise) return;
+      var authDict = {};
+      if (_this3.currentStage == EMAIL_STAGE_TYPE) {
+        // The email can be validated out-of-band, but we need to provide the
+        // creds so the HS can go & check it.
+        if (_this3.emailSid) {
+          var creds = {
+            sid: _this3.emailSid,
+            client_secret: _this3.clientSecret
+          };
+          var isUrl = _this3.matrixClient.getIdentityServerUrl();
+          if (isUrl) {
+            creds.id_server = new URL(isUrl).host;
+          }
+          authDict = {
+            type: EMAIL_STAGE_TYPE,
+            threepid_creds: creds
+          };
+        }
+      }
+      _this3.submitAuthDict(authDict, true);
+    })();
+  }
+
+  /**
+   * get the auth session ID
+   *
+   * @returns session id
+   */
+  getSessionId() {
+    var _this$data;
+    return (_this$data = this.data) === null || _this$data === void 0 ? void 0 : _this$data.session;
+  }
+
+  /**
+   * get the client secret used for validation sessions
+   * with the identity server.
+   *
+   * @returns client secret
+   */
+  getClientSecret() {
+    return this.clientSecret;
+  }
+
+  /**
+   * get the server params for a given stage
+   *
+   * @param loginType - login type for the stage
+   * @returns any parameters from the server for this stage
+   */
+  getStageParams(loginType) {
+    var _this$data2;
+    return (_this$data2 = this.data) === null || _this$data2 === void 0 || (_this$data2 = _this$data2.params) === null || _this$data2 === void 0 ? void 0 : _this$data2[loginType];
+  }
+  getChosenFlow() {
+    return this.chosenFlow;
+  }
+
+  /**
+   * submit a new auth dict and fire off the request. This will either
+   * make attemptAuth resolve/reject, or cause the startAuthStage callback
+   * to be called for a new stage.
+   *
+   * @param authData - new auth dict to send to the server. Should
+   *    include a `type` property denoting the login type, as well as any
+   *    other params for that stage.
+   * @param background - If true, this request failing will not result
+   *    in the attemptAuth promise being rejected. This can be set to true
+   *    for requests that just poll to see if auth has been completed elsewhere.
+   */
+  submitAuthDict(authData) {
+    var _arguments = arguments,
+      _this4 = this;
+    return _asyncToGenerator(function* () {
+      var _this4$data;
+      var background = _arguments.length > 1 && _arguments[1] !== undefined ? _arguments[1] : false;
+      if (!_this4.attemptAuthDeferred) {
+        throw new Error("submitAuthDict() called before attemptAuth()");
+      }
+      if (!background) {
+        var _this4$busyChangedCal;
+        (_this4$busyChangedCal = _this4.busyChangedCallback) === null || _this4$busyChangedCal === void 0 || _this4$busyChangedCal.call(_this4, true);
+      }
+
+      // if we're currently trying a request, wait for it to finish
+      // as otherwise we can get multiple 200 responses which can mean
+      // things like multiple logins for register requests.
+      // (but discard any exceptions as we only care when its done,
+      // not whether it worked or not)
+      while (_this4.submitPromise) {
+        try {
+          yield _this4.submitPromise;
+        } catch (_unused) {}
+      }
+
+      // use the sessionid from the last request, if one is present.
+      var auth;
+      if ((_this4$data = _this4.data) !== null && _this4$data !== void 0 && _this4$data.session) {
+        auth = Object.assign({
+          session: _this4.data.session
+        }, authData);
+      } else {
+        auth = authData;
+      }
+      try {
+        // NB. the 'background' flag is deprecated by the busyChanged
+        // callback and is here for backwards compat
+        _this4.submitPromise = _this4.doRequest(auth, background);
+        yield _this4.submitPromise;
+      } finally {
+        _this4.submitPromise = null;
+        if (!background) {
+          var _this4$busyChangedCal2;
+          (_this4$busyChangedCal2 = _this4.busyChangedCallback) === null || _this4$busyChangedCal2 === void 0 || _this4$busyChangedCal2.call(_this4, false);
+        }
+      }
+    })();
+  }
+
+  /**
+   * Gets the sid for the email validation session
+   * Specific to m.login.email.identity
+   *
+   * @returns The sid of the email auth session
+   */
+  getEmailSid() {
+    return this.emailSid;
+  }
+
+  /**
+   * Sets the sid for the email validation session
+   * This must be set in order to successfully poll for completion
+   * of the email validation.
+   * Specific to m.login.email.identity
+   *
+   * @param sid - The sid for the email validation session
+   */
+  setEmailSid(sid) {
+    this.emailSid = sid;
+  }
+  /**
+   * Fire off a request, and either resolve the promise, or call
+   * startAuthStage.
+   *
+   * @internal
+   * @param auth - new auth dict, including session id
+   * @param background - If true, this request is a background poll, so it
+   *    failing will not result in the attemptAuth promise being rejected.
+   *    This can be set to true for requests that just poll to see if auth has
+   *    been completed elsewhere.
+   */
+  doRequest(auth) {
+    var _arguments2 = arguments,
+      _this5 = this;
+    return _asyncToGenerator(function* () {
+      var background = _arguments2.length > 1 && _arguments2[1] !== undefined ? _arguments2[1] : false;
+      try {
+        var result = yield _this5.requestCallback(auth, background);
+        _this5.attemptAuthDeferred.resolve(result);
+        _this5.attemptAuthDeferred = null;
+      } catch (error) {
+        var _matrixError$data$flo, _matrixError$data, _this5$data, _this5$chosenFlow;
+        var matrixError = error instanceof BriijError ? error : null;
+
+        // sometimes UI auth errors don't come with flows
+        var errorFlows = (_matrixError$data$flo = matrixError === null || matrixError === void 0 || (_matrixError$data = matrixError.data) === null || _matrixError$data === void 0 ? void 0 : _matrixError$data.flows) !== null && _matrixError$data$flo !== void 0 ? _matrixError$data$flo : null;
+        var haveFlows = ((_this5$data = _this5.data) === null || _this5$data === void 0 ? void 0 : _this5$data.flows) || Boolean(errorFlows);
+        if (!matrixError || matrixError.httpStatus !== 401 || !matrixError.data || !haveFlows) {
+          // doesn't look like an interactive-auth failure.
+          if (!background) {
+            var _this5$attemptAuthDef;
+            (_this5$attemptAuthDef = _this5.attemptAuthDeferred) === null || _this5$attemptAuthDef === void 0 || _this5$attemptAuthDef.reject(error);
+          } else {
+            // We ignore all failures here (even non-UI auth related ones)
+            // since we don't want to suddenly fail if the internet connection
+            // had a blip whilst we were polling
+            logger.log("Background poll request failed doing UI auth: ignoring", error);
+          }
+        }
+        if (matrixError && !matrixError.data) {
+          matrixError.data = {};
+        }
+        // if the error didn't come with flows, completed flows or session ID,
+        // copy over the ones we have. Synapse sometimes sends responses without
+        // any UI auth data (eg. when polling for email validation, if the email
+        // has not yet been validated). This appears to be a Synapse bug, which
+        // we workaround here.
+        if (matrixError && !matrixError.data.flows && !matrixError.data.completed && !matrixError.data.session) {
+          matrixError.data.flows = _this5.data.flows;
+          matrixError.data.completed = _this5.data.completed;
+          matrixError.data.session = _this5.data.session;
+        }
+        if (matrixError) {
+          _this5.data = matrixError.data;
+        }
+        try {
+          _this5.startNextAuthStage();
+        } catch (e) {
+          _this5.attemptAuthDeferred.reject(e);
+          _this5.attemptAuthDeferred = null;
+          return;
+        }
+        if (!_this5.emailSid && (_this5$chosenFlow = _this5.chosenFlow) !== null && _this5$chosenFlow !== void 0 && _this5$chosenFlow.stages.includes(AuthType.Email)) {
+          try {
+            yield _this5.requestEmailToken();
+            // NB. promise is not resolved here - at some point, doRequest
+            // will be called again and if the user has jumped through all
+            // the hoops correctly, auth will be complete and the request
+            // will succeed.
+            // Also, we should expose the fact that this request has compledted
+            // so clients can know that the email has actually been sent.
+          } catch (e) {
+            // we failed to request an email token, so fail the request.
+            // This could be due to the email already beeing registered
+            // (or not being registered, depending on what we're trying
+            // to do) or it could be a network failure. Either way, pass
+            // the failure up as the user can't complete auth if we can't
+            // send the email, for whatever reason.
+            _this5.attemptAuthDeferred.reject(e);
+            _this5.attemptAuthDeferred = null;
+          }
+        }
+      }
+    })();
+  }
+
+  /**
+   * Pick the next stage and call the callback
+   *
+   * @internal
+   * @throws {@link NoAuthFlowFoundError} If no suitable authentication flow can be found
+   */
+  startNextAuthStage() {
+    var _this$data3, _this$data4;
+    var nextStage = this.chooseStage();
+    if (!nextStage) {
+      throw new Error("No incomplete flows from the server");
+    }
+    this.currentStage = nextStage;
+    if (nextStage === AuthType.Dummy) {
+      this.submitAuthDict({
+        type: "m.login.dummy"
+      });
+      return;
+    }
+    if ((_this$data3 = this.data) !== null && _this$data3 !== void 0 && _this$data3.errcode || (_this$data4 = this.data) !== null && _this$data4 !== void 0 && _this$data4.error) {
+      var _this$data5, _this$data6;
+      this.stateUpdatedCallback(nextStage, {
+        errcode: ((_this$data5 = this.data) === null || _this$data5 === void 0 ? void 0 : _this$data5.errcode) || "",
+        error: ((_this$data6 = this.data) === null || _this$data6 === void 0 ? void 0 : _this$data6.error) || ""
+      });
+      return;
+    }
+    this.stateUpdatedCallback(nextStage, nextStage === EMAIL_STAGE_TYPE ? {
+      emailSid: this.emailSid
+    } : {});
+  }
+
+  /**
+   * Pick the next auth stage
+   *
+   * @internal
+   * @returns login type
+   * @throws {@link NoAuthFlowFoundError} If no suitable authentication flow can be found
+   */
+  chooseStage() {
+    if (this.chosenFlow === null) {
+      this.chosenFlow = this.chooseFlow();
+    }
+    logger.log("Active flow => %s", JSON.stringify(this.chosenFlow));
+    var nextStage = this.firstUncompletedStage(this.chosenFlow);
+    logger.log("Next stage: %s", nextStage);
+    return nextStage;
+  }
+
+  // Returns a low number for flows we consider best. Counts increase for longer flows and even more so
+  // for flows which contain stages not listed in `supportedStages`.
+  scoreFlow(flow) {
+    var score = flow.stages.length;
+    if (this.supportedStages !== undefined) {
+      // Add 10 points to the score for each unsupported stage in the flow.
+      score += flow.stages.filter(stage => !this.supportedStages.has(stage)).length * 10;
+    }
+    return score;
+  }
+
+  /**
+   * Pick one of the flows from the returned list
+   * If a flow using all of the inputs is found, it will
+   * be returned, otherwise, null will be returned.
+   *
+   * Only flows using all given inputs are chosen because it
+   * is likely to be surprising if the user provides a
+   * credential and it is not used. For example, for registration,
+   * this could result in the email not being used which would leave
+   * the account with no means to reset a password.
+   *
+   * @internal
+   * @returns flow
+   * @throws {@link NoAuthFlowFoundError} If no suitable authentication flow can be found
+   */
+  chooseFlow() {
+    var _this$data7;
+    var flows = ((_this$data7 = this.data) === null || _this$data7 === void 0 ? void 0 : _this$data7.flows) || [];
+
+    // we've been given an email or we've already done an email part
+    var haveEmail = Boolean(this.inputs.emailAddress) || Boolean(this.emailSid);
+    var haveMsisdn = Boolean(this.inputs.phoneCountry) && Boolean(this.inputs.phoneNumber);
+
+    // Flows are not represented in a significant order, so we can choose any we support best
+    // Sort flows based on how many unsupported stages they contain ascending
+    flows.sort((a, b) => this.scoreFlow(a) - this.scoreFlow(b));
+    for (var flow of flows) {
+      var flowHasEmail = false;
+      var flowHasMsisdn = false;
+      for (var stage of flow.stages) {
+        if (stage === EMAIL_STAGE_TYPE) {
+          flowHasEmail = true;
+        } else if (stage == MSISDN_STAGE_TYPE) {
+          flowHasMsisdn = true;
+        }
+      }
+      if (flowHasEmail == haveEmail && flowHasMsisdn == haveMsisdn) {
+        return flow;
+      }
+    }
+    var requiredStages = [];
+    if (haveEmail) requiredStages.push(EMAIL_STAGE_TYPE);
+    if (haveMsisdn) requiredStages.push(MSISDN_STAGE_TYPE);
+    // Throw an error with a fairly generic description, but with more
+    // information such that the app can give a better one if so desired.
+    throw new NoAuthFlowFoundError("No appropriate authentication flow found", requiredStages, flows);
+  }
+
+  /**
+   * Get the first uncompleted stage in the given flow
+   *
+   * @internal
+   * @returns login type
+   */
+  firstUncompletedStage(flow) {
+    var _this$data8;
+    var completed = ((_this$data8 = this.data) === null || _this$data8 === void 0 ? void 0 : _this$data8.completed) || [];
+    return flow.stages.find(stageType => !completed.includes(stageType));
+  }
+}
+//# sourceMappingURL=interactive-auth.js.map

package/lib/interactive-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive-auth.js","names":["logger","BriijError","EMAIL_STAGE_TYPE","MSISDN_STAGE_TYPE","AuthType","NoAuthFlowFoundError","Error","constructor","m","required_stages","flows","_defineProperty","InteractiveAuth","opts","_this","_asyncToGenerator","requestingEmailToken","trace","emailAttempt","requestTokenResult","requestEmailTokenCallback","inputs","emailAddress","clientSecret","data","session","emailSid","sid","warn","matrixClient","authData","requestCallback","doRequest","busyChangedCallback","busyChanged","stateUpdatedCallback","stateUpdated","startAuthStage","requestEmailToken","sessionId","generateClientSecret","supportedStages","undefined","Set","attemptAuth","_this2","_this2$data","attemptAuthDeferred","Promise","withResolvers","promise","length","_this2$busyChangedCal","call","auth","finally","_this2$busyChangedCal2","startNextAuthStage","poll","_this3","submitPromise","authDict","currentStage","creds","client_secret","isUrl","getIdentityServerUrl","id_server","URL","host","type","threepid_creds","submitAuthDict","getSessionId","_this$data","getClientSecret","getStageParams","loginType","_this$data2","params","getChosenFlow","chosenFlow","_arguments","arguments","_this4","_this4$data","background","_this4$busyChangedCal","_unused","Object","assign","_this4$busyChangedCal2","getEmailSid","setEmailSid","_arguments2","_this5","result","resolve","error","_matrixError$data$flo","_matrixError$data","_this5$data","_this5$chosenFlow","matrixError","errorFlows","haveFlows","Boolean","httpStatus","_this5$attemptAuthDef","reject","log","completed","e","stages","includes","Email","_this$data3","_this$data4","nextStage","chooseStage","Dummy","errcode","_this$data5","_this$data6","chooseFlow","JSON","stringify","firstUncompletedStage","scoreFlow","flow","score","filter","stage","has","_this$data7","haveEmail","haveMsisdn","phoneCountry","phoneNumber","sort","a","b","flowHasEmail","flowHasMsisdn","requiredStages","push","_this$data8","find","stageType"],"sources":["../src/interactive-auth.ts"],"sourcesContent":["/*\nCopyright 2016 OpenMarket Ltd\nCopyright 2017 Vector Creations Ltd\nCopyright 2019 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { logger } from \"./logger.ts\";\nimport { type BriijClient } from \"./client.ts\";\nimport { BriijError } from \"./http-api/index.ts\";\nimport { type UserIdentifier } from \"./@types/auth.ts\";\n\nconst EMAIL_STAGE_TYPE = \"m.login.email.identity\";\nconst MSISDN_STAGE_TYPE = \"m.login.msisdn\";\n\nexport interface UIAFlow {\n    stages: Array<AuthType | string>;\n}\n\nexport interface IInputs {\n    // An email address. If supplied, a flow using email verification will be chosen.\n    emailAddress?: string;\n    // An ISO two letter country code. Gives the country that opts.phoneNumber should be resolved relative to.\n    phoneCountry?: string;\n    // A phone number. If supplied, a flow using phone number validation will be chosen.\n    phoneNumber?: string;\n    registrationToken?: string;\n}\n\nexport interface IStageStatus {\n    emailSid?: string;\n    errcode?: string;\n    error?: string;\n}\n\n/**\n * Data returned in the body of a 401 response from a UIA endpoint.\n *\n * @see https://spec.matrix.org/v1.6/client-server-api/#user-interactive-api-in-the-rest-api\n */\nexport interface IAuthData {\n    /**\n     * This is a session identifier that the client must pass back to the home server,\n     * if one is provided, in subsequent attempts to authenticate in the same API call.\n     */\n    session?: string;\n    /**\n     * A list of the stages the client has completed successfully\n     */\n    completed?: string[];\n    /**\n     * A list of the login flows supported by the server for this API.\n     */\n    flows?: UIAFlow[];\n    /**\n     * Contains any information that the client will need to know in order to use a given type of authentication.\n     * For each login type presented, that type may be present as a key in this dictionary.\n     * For example, the public part of an OAuth client ID could be given here.\n     */\n    params?: Record<string, Record<string, any>>;\n}\n\nexport enum AuthType {\n    Password = \"m.login.password\",\n    Recaptcha = \"m.login.recaptcha\",\n    Terms = \"m.login.terms\",\n    Email = \"m.login.email.identity\",\n    Msisdn = \"m.login.msisdn\",\n    Sso = \"m.login.sso\",\n    SsoUnstable = \"org.matrix.login.sso\",\n    Dummy = \"m.login.dummy\",\n    RegistrationToken = \"m.login.registration_token\",\n    // For backwards compatability with servers that have not yet updated to\n    // use the stable \"m.login.registration_token\" type.\n    // The authentication flow is the same in both cases.\n    UnstableRegistrationToken = \"org.matrix.msc3231.login.registration_token\",\n    /**\n     * m.oauth stage introduced by MSC4312:\n     * https://spec.matrix.org/v1.17/client-server-api/#oauth-authentication\n     */\n    OAuth = \"m.oauth\",\n}\n\n/**\n * https://spec.matrix.org/v1.7/client-server-api/#password-based\n */\ntype PasswordDict = {\n    type: AuthType.Password;\n    identifier: UserIdentifier;\n    password: string;\n    session: string;\n};\n\n/**\n * https://spec.matrix.org/v1.7/client-server-api/#google-recaptcha\n */\ntype RecaptchaDict = {\n    type: AuthType.Recaptcha;\n    response: string;\n    session: string;\n};\n\ninterface ThreepidCreds {\n    sid: string;\n    client_secret: string;\n    id_server: string;\n    id_access_token: string;\n}\n\n/**\n * https://spec.matrix.org/v1.7/client-server-api/#email-based-identity--homeserver\n */\ntype EmailIdentityDict = {\n    type: AuthType.Email;\n    threepid_creds: ThreepidCreds;\n    session: string;\n};\n\n/**\n * The parameters which are submitted as the `auth` dict in a UIA request\n *\n * @see https://spec.matrix.org/v1.6/client-server-api/#authentication-types\n */\nexport type AuthDict =\n    | PasswordDict\n    | RecaptchaDict\n    | EmailIdentityDict\n    | { type: Exclude<string, AuthType>; [key: string]: any }\n    // eslint-disable-next-line @typescript-eslint/no-empty-object-type\n    | {};\n\nexport class NoAuthFlowFoundError extends Error {\n    public name = \"NoAuthFlowFoundError\";\n\n    public constructor(\n        m: string,\n        // eslint-disable-next-line @typescript-eslint/naming-convention, camelcase\n        public readonly required_stages: string[],\n        public readonly flows: UIAFlow[],\n    ) {\n        super(m);\n    }\n}\n\n/**\n * The type of an application callback to perform the user-interactive bit of UIA.\n *\n * It is called with a single parameter, `makeRequest`, which is a function which takes the UIA parameters and\n * makes the HTTP request. The `authData` parameter in `makeRequest` can be set to null to omit the `auth` field\n * from the UIA request.\n *\n * The generic parameter `T` is the type of the response of the endpoint, once it is eventually successful.\n */\nexport type UIAuthCallback<T> = (makeRequest: (authData: AuthDict | null) => Promise<T>) => Promise<T>;\n\ninterface IOpts<T> {\n    /**\n     * A matrix client to use for the auth process\n     */\n    matrixClient: BriijClient;\n    /**\n     * Error response from the last request. If null, a request will be made with no auth before starting.\n     */\n    authData?: IAuthData;\n    /**\n     * Inputs provided by the user and used by different stages of the auto process.\n     * The inputs provided will affect what flow is chosen.\n     */\n    inputs?: IInputs;\n    /**\n     * If resuming an existing interactive auth session, the sessionId of that session.\n     */\n    sessionId?: string;\n    /**\n     * If resuming an existing interactive auth session, the client secret for that session\n     */\n    clientSecret?: string;\n    /**\n     * If returning from having completed m.login.email.identity auth, the sid for the email verification session.\n     */\n    emailSid?: string;\n\n    /**\n     * If specified, will prefer flows which entirely consist of listed stages.\n     * These should normally be of type AuthTypes but can be string when supporting custom auth stages.\n     *\n     * This can be used to avoid needing the fallback mechanism.\n     */\n    supportedStages?: Array<AuthType | string>;\n\n    /**\n     * Called with the new auth dict to submit the request.\n     * Also passes a second deprecated arg which is a flag set to true if this request is a background request.\n     * The busyChanged callback should be used instead of the background flag.\n     * Should return a promise which resolves to the successful response or rejects with a BriijError.\n     */\n    doRequest(auth: AuthDict | null, background: boolean): Promise<T>;\n    /**\n     * Called when the status of the UI auth changes,\n     * ie. when the state of an auth stage changes of when the auth flow moves to a new stage.\n     * The arguments are: the login type (eg m.login.password); and an object which is either an error or an\n     * informational object specific to the login type.\n     * If the 'errcode' key is defined, the object is an error, and has keys:\n     *     errcode: string, the textual error code, eg. M_UNKNOWN\n     *     error: string, human readable string describing the error\n     *\n     * The login type specific objects are as follows:\n     *     m.login.email.identity:\n     *         * emailSid: string, the sid of the active email auth session\n     */\n    stateUpdated(nextStage: AuthType | string, status: IStageStatus): void;\n\n    /**\n     * A function that takes the email address (string), clientSecret (string), attempt number (int) and\n     * sessionId (string) and calls the relevant requestToken function and returns the promise returned by that\n     * function.\n     * If the resulting promise rejects, the rejection will propagate through to the attemptAuth promise.\n     */\n    requestEmailToken(email: string, secret: string, attempt: number, session: string): Promise<{ sid: string }>;\n    /**\n     * Called whenever the interactive auth logic becomes busy submitting information provided by the user or finishes.\n     * After this has been called with true the UI should indicate that a request is in progress\n     * until it is called again with false.\n     */\n    busyChanged?(busy: boolean): void;\n    startAuthStage?(nextStage: string): Promise<void>; // LEGACY\n}\n\n/**\n * Abstracts the logic used to drive the interactive auth process.\n *\n * <p>Components implementing an interactive auth flow should instantiate one of\n * these, passing in the necessary callbacks to the constructor. They should\n * then call attemptAuth, which will return a promise which will resolve or\n * reject when the interactive-auth process completes.\n *\n * <p>Meanwhile, calls will be made to the startAuthStage and doRequest\n * callbacks, and information gathered from the user can be submitted with\n * submitAuthDict.\n *\n * @param opts - options object\n * @typeParam T - the return type of the request when it is successful\n */\nexport class InteractiveAuth<T> {\n    private readonly matrixClient: BriijClient;\n    private readonly inputs: IInputs;\n    private readonly clientSecret: string;\n    private readonly requestCallback: IOpts<T>[\"doRequest\"];\n    private readonly busyChangedCallback?: IOpts<T>[\"busyChanged\"];\n    private readonly stateUpdatedCallback: IOpts<T>[\"stateUpdated\"];\n    private readonly requestEmailTokenCallback: IOpts<T>[\"requestEmailToken\"];\n    private readonly supportedStages?: Set<string>;\n\n    // The current latest data or error received from the server during the user interactive auth flow.\n    private data: IAuthData & BriijError[\"data\"];\n    private emailSid?: string;\n    private requestingEmailToken = false;\n    private attemptAuthDeferred: PromiseWithResolvers<T> | null = null;\n    private chosenFlow: UIAFlow | null = null;\n    private currentStage: string | null = null;\n\n    private emailAttempt = 1;\n\n    // if we are currently trying to submit an auth dict (which includes polling)\n    // the promise the will resolve/reject when it completes\n    private submitPromise: Promise<void> | null = null;\n\n    public constructor(opts: IOpts<T>) {\n        this.matrixClient = opts.matrixClient;\n        this.data = opts.authData || { flows: [] };\n        this.requestCallback = opts.doRequest;\n        this.busyChangedCallback = opts.busyChanged;\n        // startAuthStage included for backwards compat\n        this.stateUpdatedCallback = opts.stateUpdated || opts.startAuthStage;\n        this.requestEmailTokenCallback = opts.requestEmailToken;\n        this.inputs = opts.inputs || {};\n\n        if (opts.sessionId) this.data.session = opts.sessionId;\n        this.clientSecret = opts.clientSecret || this.matrixClient.generateClientSecret();\n        this.emailSid = opts.emailSid;\n        if (opts.supportedStages !== undefined) this.supportedStages = new Set(opts.supportedStages);\n    }\n\n    /**\n     * begin the authentication process.\n     *\n     * @returns which resolves to the response on success,\n     * or rejects with the error on failure. Rejects with NoAuthFlowFoundError if\n     *     no suitable authentication flow can be found\n     */\n    public async attemptAuth(): Promise<T> {\n        // This promise will be quite long-lived and will resolve when the\n        // request is authenticated and completes successfully.\n        this.attemptAuthDeferred = Promise.withResolvers();\n        // pluck the promise out now, as doRequest may clear before we return\n        const promise = this.attemptAuthDeferred.promise;\n\n        // if we have no flows, try a request to acquire the flows\n        if (!(this.data as IAuthData)?.flows?.length) {\n            this.busyChangedCallback?.(true);\n            // use the existing sessionId, if one is present.\n            const auth = (this.data as IAuthData).session ? { session: (this.data as IAuthData).session } : null;\n            this.doRequest(auth).finally(() => {\n                this.busyChangedCallback?.(false);\n            });\n        } else {\n            this.startNextAuthStage();\n        }\n\n        return promise;\n    }\n\n    /**\n     * Poll to check if the auth session or current stage has been\n     * completed out-of-band. If so, the attemptAuth promise will\n     * be resolved.\n     */\n    public async poll(): Promise<void> {\n        if (!(this.data as IAuthData).session) return;\n        // likewise don't poll if there is no auth session in progress\n        if (!this.attemptAuthDeferred) return;\n        // if we currently have a request in flight, there's no point making\n        // another just to check what the status is\n        if (this.submitPromise) return;\n\n        let authDict: AuthDict = {};\n        if (this.currentStage == EMAIL_STAGE_TYPE) {\n            // The email can be validated out-of-band, but we need to provide the\n            // creds so the HS can go & check it.\n            if (this.emailSid) {\n                const creds: Record<string, string> = {\n                    sid: this.emailSid,\n                    client_secret: this.clientSecret,\n                };\n                const isUrl = this.matrixClient.getIdentityServerUrl();\n                if (isUrl) {\n                    creds.id_server = new URL(isUrl).host;\n                }\n                authDict = {\n                    type: EMAIL_STAGE_TYPE,\n                    threepid_creds: creds,\n                };\n            }\n        }\n\n        this.submitAuthDict(authDict, true);\n    }\n\n    /**\n     * get the auth session ID\n     *\n     * @returns session id\n     */\n    public getSessionId(): string | undefined {\n        return (this.data as IAuthData)?.session;\n    }\n\n    /**\n     * get the client secret used for validation sessions\n     * with the identity server.\n     *\n     * @returns client secret\n     */\n    public getClientSecret(): string {\n        return this.clientSecret;\n    }\n\n    /**\n     * get the server params for a given stage\n     *\n     * @param loginType - login type for the stage\n     * @returns any parameters from the server for this stage\n     */\n    public getStageParams(loginType: string): Record<string, any> | undefined {\n        return (this.data as IAuthData)?.params?.[loginType];\n    }\n\n    public getChosenFlow(): UIAFlow | null {\n        return this.chosenFlow;\n    }\n\n    /**\n     * submit a new auth dict and fire off the request. This will either\n     * make attemptAuth resolve/reject, or cause the startAuthStage callback\n     * to be called for a new stage.\n     *\n     * @param authData - new auth dict to send to the server. Should\n     *    include a `type` property denoting the login type, as well as any\n     *    other params for that stage.\n     * @param background - If true, this request failing will not result\n     *    in the attemptAuth promise being rejected. This can be set to true\n     *    for requests that just poll to see if auth has been completed elsewhere.\n     */\n    public async submitAuthDict(authData: AuthDict, background = false): Promise<void> {\n        if (!this.attemptAuthDeferred) {\n            throw new Error(\"submitAuthDict() called before attemptAuth()\");\n        }\n\n        if (!background) {\n            this.busyChangedCallback?.(true);\n        }\n\n        // if we're currently trying a request, wait for it to finish\n        // as otherwise we can get multiple 200 responses which can mean\n        // things like multiple logins for register requests.\n        // (but discard any exceptions as we only care when its done,\n        // not whether it worked or not)\n        while (this.submitPromise) {\n            try {\n                await this.submitPromise;\n            } catch {}\n        }\n\n        // use the sessionid from the last request, if one is present.\n        let auth: AuthDict;\n        if ((this.data as IAuthData)?.session) {\n            auth = Object.assign(\n                {\n                    session: (this.data as IAuthData).session,\n                },\n                authData,\n            );\n        } else {\n            auth = authData;\n        }\n\n        try {\n            // NB. the 'background' flag is deprecated by the busyChanged\n            // callback and is here for backwards compat\n            this.submitPromise = this.doRequest(auth, background);\n            await this.submitPromise;\n        } finally {\n            this.submitPromise = null;\n            if (!background) {\n                this.busyChangedCallback?.(false);\n            }\n        }\n    }\n\n    /**\n     * Gets the sid for the email validation session\n     * Specific to m.login.email.identity\n     *\n     * @returns The sid of the email auth session\n     */\n    public getEmailSid(): string | undefined {\n        return this.emailSid;\n    }\n\n    /**\n     * Sets the sid for the email validation session\n     * This must be set in order to successfully poll for completion\n     * of the email validation.\n     * Specific to m.login.email.identity\n     *\n     * @param sid - The sid for the email validation session\n     */\n    public setEmailSid(sid: string): void {\n        this.emailSid = sid;\n    }\n\n    /**\n     * Requests a new email token and sets the email sid for the validation session\n     */\n    public requestEmailToken = async (): Promise<void> => {\n        if (!this.requestingEmailToken) {\n            logger.trace(\"Requesting email token. Attempt: \" + this.emailAttempt);\n            // If we've picked a flow with email auth, we send the email\n            // now because we want the request to fail as soon as possible\n            // if the email address is not valid (ie. already taken or not\n            // registered, depending on what the operation is).\n            this.requestingEmailToken = true;\n            try {\n                const requestTokenResult = await this.requestEmailTokenCallback(\n                    this.inputs.emailAddress!,\n                    this.clientSecret,\n                    this.emailAttempt++,\n                    (this.data as IAuthData).session!,\n                );\n                this.emailSid = requestTokenResult.sid;\n                logger.trace(\"Email token request succeeded\");\n            } finally {\n                this.requestingEmailToken = false;\n            }\n        } else {\n            logger.warn(\"Could not request email token: Already requesting\");\n        }\n    };\n\n    /**\n     * Fire off a request, and either resolve the promise, or call\n     * startAuthStage.\n     *\n     * @internal\n     * @param auth - new auth dict, including session id\n     * @param background - If true, this request is a background poll, so it\n     *    failing will not result in the attemptAuth promise being rejected.\n     *    This can be set to true for requests that just poll to see if auth has\n     *    been completed elsewhere.\n     */\n    private async doRequest(auth: AuthDict | null, background = false): Promise<void> {\n        try {\n            const result = await this.requestCallback(auth, background);\n            this.attemptAuthDeferred!.resolve(result);\n            this.attemptAuthDeferred = null;\n        } catch (error) {\n            const matrixError = error instanceof BriijError ? error : null;\n\n            // sometimes UI auth errors don't come with flows\n            const errorFlows = matrixError?.data?.flows ?? null;\n            const haveFlows = (this.data as IAuthData)?.flows || Boolean(errorFlows);\n            if (!matrixError || matrixError.httpStatus !== 401 || !matrixError.data || !haveFlows) {\n                // doesn't look like an interactive-auth failure.\n                if (!background) {\n                    this.attemptAuthDeferred?.reject(error);\n                } else {\n                    // We ignore all failures here (even non-UI auth related ones)\n                    // since we don't want to suddenly fail if the internet connection\n                    // had a blip whilst we were polling\n                    logger.log(\"Background poll request failed doing UI auth: ignoring\", error);\n                }\n            }\n            if (matrixError && !matrixError.data) {\n                matrixError.data = {};\n            }\n            // if the error didn't come with flows, completed flows or session ID,\n            // copy over the ones we have. Synapse sometimes sends responses without\n            // any UI auth data (eg. when polling for email validation, if the email\n            // has not yet been validated). This appears to be a Synapse bug, which\n            // we workaround here.\n            if (matrixError && !matrixError.data.flows && !matrixError.data.completed && !matrixError.data.session) {\n                matrixError.data.flows = (this.data as IAuthData).flows;\n                matrixError.data.completed = (this.data as IAuthData).completed;\n                matrixError.data.session = (this.data as IAuthData).session;\n            }\n            if (matrixError) {\n                this.data = matrixError.data;\n            }\n            try {\n                this.startNextAuthStage();\n            } catch (e) {\n                this.attemptAuthDeferred!.reject(e);\n                this.attemptAuthDeferred = null;\n                return;\n            }\n\n            if (!this.emailSid && this.chosenFlow?.stages.includes(AuthType.Email)) {\n                try {\n                    await this.requestEmailToken();\n                    // NB. promise is not resolved here - at some point, doRequest\n                    // will be called again and if the user has jumped through all\n                    // the hoops correctly, auth will be complete and the request\n                    // will succeed.\n                    // Also, we should expose the fact that this request has compledted\n                    // so clients can know that the email has actually been sent.\n                } catch (e) {\n                    // we failed to request an email token, so fail the request.\n                    // This could be due to the email already beeing registered\n                    // (or not being registered, depending on what we're trying\n                    // to do) or it could be a network failure. Either way, pass\n                    // the failure up as the user can't complete auth if we can't\n                    // send the email, for whatever reason.\n                    this.attemptAuthDeferred!.reject(e);\n                    this.attemptAuthDeferred = null;\n                }\n            }\n        }\n    }\n\n    /**\n     * Pick the next stage and call the callback\n     *\n     * @internal\n     * @throws {@link NoAuthFlowFoundError} If no suitable authentication flow can be found\n     */\n    private startNextAuthStage(): void {\n        const nextStage = this.chooseStage();\n        if (!nextStage) {\n            throw new Error(\"No incomplete flows from the server\");\n        }\n        this.currentStage = nextStage;\n\n        if (nextStage === AuthType.Dummy) {\n            this.submitAuthDict({\n                type: \"m.login.dummy\",\n            });\n            return;\n        }\n\n        if (this.data?.errcode || this.data?.error) {\n            this.stateUpdatedCallback(nextStage, {\n                errcode: this.data?.errcode || \"\",\n                error: this.data?.error || \"\",\n            });\n            return;\n        }\n\n        this.stateUpdatedCallback(nextStage, nextStage === EMAIL_STAGE_TYPE ? { emailSid: this.emailSid } : {});\n    }\n\n    /**\n     * Pick the next auth stage\n     *\n     * @internal\n     * @returns login type\n     * @throws {@link NoAuthFlowFoundError} If no suitable authentication flow can be found\n     */\n    private chooseStage(): AuthType | string | undefined {\n        if (this.chosenFlow === null) {\n            this.chosenFlow = this.chooseFlow();\n        }\n        logger.log(\"Active flow => %s\", JSON.stringify(this.chosenFlow));\n        const nextStage = this.firstUncompletedStage(this.chosenFlow);\n        logger.log(\"Next stage: %s\", nextStage);\n        return nextStage;\n    }\n\n    // Returns a low number for flows we consider best. Counts increase for longer flows and even more so\n    // for flows which contain stages not listed in `supportedStages`.\n    private scoreFlow(flow: UIAFlow): number {\n        let score = flow.stages.length;\n        if (this.supportedStages !== undefined) {\n            // Add 10 points to the score for each unsupported stage in the flow.\n            score += flow.stages.filter((stage) => !this.supportedStages!.has(stage)).length * 10;\n        }\n        return score;\n    }\n\n    /**\n     * Pick one of the flows from the returned list\n     * If a flow using all of the inputs is found, it will\n     * be returned, otherwise, null will be returned.\n     *\n     * Only flows using all given inputs are chosen because it\n     * is likely to be surprising if the user provides a\n     * credential and it is not used. For example, for registration,\n     * this could result in the email not being used which would leave\n     * the account with no means to reset a password.\n     *\n     * @internal\n     * @returns flow\n     * @throws {@link NoAuthFlowFoundError} If no suitable authentication flow can be found\n     */\n    private chooseFlow(): UIAFlow {\n        const flows = (this.data as IAuthData)?.flows || [];\n\n        // we've been given an email or we've already done an email part\n        const haveEmail = Boolean(this.inputs.emailAddress) || Boolean(this.emailSid);\n        const haveMsisdn = Boolean(this.inputs.phoneCountry) && Boolean(this.inputs.phoneNumber);\n\n        // Flows are not represented in a significant order, so we can choose any we support best\n        // Sort flows based on how many unsupported stages they contain ascending\n        flows.sort((a, b) => this.scoreFlow(a) - this.scoreFlow(b));\n\n        for (const flow of flows) {\n            let flowHasEmail = false;\n            let flowHasMsisdn = false;\n            for (const stage of flow.stages) {\n                if (stage === EMAIL_STAGE_TYPE) {\n                    flowHasEmail = true;\n                } else if (stage == MSISDN_STAGE_TYPE) {\n                    flowHasMsisdn = true;\n                }\n            }\n\n            if (flowHasEmail == haveEmail && flowHasMsisdn == haveMsisdn) {\n                return flow;\n            }\n        }\n\n        const requiredStages: string[] = [];\n        if (haveEmail) requiredStages.push(EMAIL_STAGE_TYPE);\n        if (haveMsisdn) requiredStages.push(MSISDN_STAGE_TYPE);\n        // Throw an error with a fairly generic description, but with more\n        // information such that the app can give a better one if so desired.\n        throw new NoAuthFlowFoundError(\"No appropriate authentication flow found\", requiredStages, flows);\n    }\n\n    /**\n     * Get the first uncompleted stage in the given flow\n     *\n     * @internal\n     * @returns login type\n     */\n    private firstUncompletedStage(flow: UIAFlow): AuthType | string | undefined {\n        const completed = (this.data as IAuthData)?.completed || [];\n        return flow.stages.find((stageType) => !completed.includes(stageType));\n    }\n}\n"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,MAAM,QAAQ,aAAa;AAEpC,SAASC,UAAU,QAAQ,qBAAqB;AAGhD,IAAMC,gBAAgB,GAAG,wBAAwB;AACjD,IAAMC,iBAAiB,GAAG,gBAAgB;;AAsB1C;AACA;AACA;AACA;AACA;;AAuBA,WAAYC,QAAQ,0BAARA,QAAQ;EAARA,QAAQ;EAARA,QAAQ;EAARA,QAAQ;EAARA,QAAQ;EAARA,QAAQ;EAARA,QAAQ;EAARA,QAAQ;EAARA,QAAQ;EAARA,QAAQ;EAUhB;EACA;EACA;EAZQA,QAAQ;EAchB;AACJ;AACA;AACA;EAjBYA,QAAQ;EAAA,OAARA,QAAQ;AAAA;;AAqBpB;AACA;AACA;;AAQA;AACA;AACA;;AAcA;AACA;AACA;;AAOA;AACA;AACA;AACA;AACA;;AASA,OAAO,MAAMC,oBAAoB,SAASC,KAAK,CAAC;EAGrCC,WAAWA,CACdC,CAAS;EACT;EACgBC,eAAyB,EACzBC,KAAgB,EAClC;IACE,KAAK,CAACF,CAAC,CAAC;IAAC,KAHOC,eAAyB,GAAzBA,eAAyB;IAAA,KACzBC,KAAgB,GAAhBA,KAAgB;IAAAC,eAAA,eANtB,sBAAsB;EASpC;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AA4EA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,eAAe,CAAI;EAwBrBL,WAAWA,CAACM,IAAc,EAAE;IAAA,IAAAC,KAAA;IAAAH,eAAA;IAAAA,eAAA;IAAAA,eAAA;IAAAA,eAAA;IAAAA,eAAA;IAAAA,eAAA;IAAAA,eAAA;IAAAA,eAAA;IAdnC;IAAAA,eAAA;IAAAA,eAAA;IAAAA,eAAA,+BAG+B,KAAK;IAAAA,eAAA,8BAC0B,IAAI;IAAAA,eAAA,qBAC7B,IAAI;IAAAA,eAAA,uBACH,IAAI;IAAAA,eAAA,uBAEnB,CAAC;IAExB;IACA;IAAAA,eAAA,wBAC8C,IAAI;IAoMlD;AACJ;AACA;IAFIA,eAAA,yCAAAI,iBAAA,CAG2B,aAA2B;MAClD,IAAI,CAACD,KAAI,CAACE,oBAAoB,EAAE;QAC5BhB,MAAM,CAACiB,KAAK,CAAC,mCAAmC,GAAGH,KAAI,CAACI,YAAY,CAAC;QACrE;QACA;QACA;QACA;QACAJ,KAAI,CAACE,oBAAoB,GAAG,IAAI;QAChC,IAAI;UACA,IAAMG,kBAAkB,SAASL,KAAI,CAACM,yBAAyB,CAC3DN,KAAI,CAACO,MAAM,CAACC,YAAY,EACxBR,KAAI,CAACS,YAAY,EACjBT,KAAI,CAACI,YAAY,EAAE,EAClBJ,KAAI,CAACU,IAAI,CAAeC,OAC7B,CAAC;UACDX,KAAI,CAACY,QAAQ,GAAGP,kBAAkB,CAACQ,GAAG;UACtC3B,MAAM,CAACiB,KAAK,CAAC,+BAA+B,CAAC;QACjD,CAAC,SAAS;UACNH,KAAI,CAACE,oBAAoB,GAAG,KAAK;QACrC;MACJ,CAAC,MAAM;QACHhB,MAAM,CAAC4B,IAAI,CAAC,mDAAmD,CAAC;MACpE;IACJ,CAAC;IA3NG,IAAI,CAACC,YAAY,GAAGhB,IAAI,CAACgB,YAAY;IACrC,IAAI,CAACL,IAAI,GAAGX,IAAI,CAACiB,QAAQ,IAAI;MAAEpB,KAAK,EAAE;IAAG,CAAC;IAC1C,IAAI,CAACqB,eAAe,GAAGlB,IAAI,CAACmB,SAAS;IACrC,IAAI,CAACC,mBAAmB,GAAGpB,IAAI,CAACqB,WAAW;IAC3C;IACA,IAAI,CAACC,oBAAoB,GAAGtB,IAAI,CAACuB,YAAY,IAAIvB,IAAI,CAACwB,cAAc;IACpE,IAAI,CAACjB,yBAAyB,GAAGP,IAAI,CAACyB,iBAAiB;IACvD,IAAI,CAACjB,MAAM,GAAGR,IAAI,CAACQ,MAAM,IAAI,CAAC,CAAC;IAE/B,IAAIR,IAAI,CAAC0B,SAAS,EAAE,IAAI,CAACf,IAAI,CAACC,OAAO,GAAGZ,IAAI,CAAC0B,SAAS;IACtD,IAAI,CAAChB,YAAY,GAAGV,IAAI,CAACU,YAAY,IAAI,IAAI,CAACM,YAAY,CAACW,oBAAoB,CAAC,CAAC;IACjF,IAAI,CAACd,QAAQ,GAAGb,IAAI,CAACa,QAAQ;IAC7B,IAAIb,IAAI,CAAC4B,eAAe,KAAKC,SAAS,EAAE,IAAI,CAACD,eAAe,GAAG,IAAIE,GAAG,CAAC9B,IAAI,CAAC4B,eAAe,CAAC;EAChG;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;EACiBG,WAAWA,CAAA,EAAe;IAAA,IAAAC,MAAA;IAAA,OAAA9B,iBAAA;MAAA,IAAA+B,WAAA;MACnC;MACA;MACAD,MAAI,CAACE,mBAAmB,GAAGC,OAAO,CAACC,aAAa,CAAC,CAAC;MAClD;MACA,IAAMC,OAAO,GAAGL,MAAI,CAACE,mBAAmB,CAACG,OAAO;;MAEhD;MACA,IAAI,GAAAJ,WAAA,GAAED,MAAI,CAACrB,IAAI,cAAAsB,WAAA,gBAAAA,WAAA,GAAVA,WAAA,CAA0BpC,KAAK,cAAAoC,WAAA,eAA/BA,WAAA,CAAiCK,MAAM,GAAE;QAAA,IAAAC,qBAAA;QAC1C,CAAAA,qBAAA,GAAAP,MAAI,CAACZ,mBAAmB,cAAAmB,qBAAA,eAAxBA,qBAAA,CAAAC,IAAA,CAAAR,MAAI,EAAuB,IAAI,CAAC;QAChC;QACA,IAAMS,KAAI,GAAIT,MAAI,CAACrB,IAAI,CAAeC,OAAO,GAAG;UAAEA,OAAO,EAAGoB,MAAI,CAACrB,IAAI,CAAeC;QAAQ,CAAC,GAAG,IAAI;QACpGoB,MAAI,CAACb,SAAS,CAACsB,KAAI,CAAC,CAACC,OAAO,CAAC,MAAM;UAAA,IAAAC,sBAAA;UAC/B,CAAAA,sBAAA,GAAAX,MAAI,CAACZ,mBAAmB,cAAAuB,sBAAA,eAAxBA,sBAAA,CAAAH,IAAA,CAAAR,MAAI,EAAuB,KAAK,CAAC;QACrC,CAAC,CAAC;MACN,CAAC,MAAM;QACHA,MAAI,CAACY,kBAAkB,CAAC,CAAC;MAC7B;MAEA,OAAOP,OAAO;IAAC;EACnB;;EAEA;AACJ;AACA;AACA;AACA;EACiBQ,IAAIA,CAAA,EAAkB;IAAA,IAAAC,MAAA;IAAA,OAAA5C,iBAAA;MAC/B,IAAI,CAAE4C,MAAI,CAACnC,IAAI,CAAeC,OAAO,EAAE;MACvC;MACA,IAAI,CAACkC,MAAI,CAACZ,mBAAmB,EAAE;MAC/B;MACA;MACA,IAAIY,MAAI,CAACC,aAAa,EAAE;MAExB,IAAIC,QAAkB,GAAG,CAAC,CAAC;MAC3B,IAAIF,MAAI,CAACG,YAAY,IAAI5D,gBAAgB,EAAE;QACvC;QACA;QACA,IAAIyD,MAAI,CAACjC,QAAQ,EAAE;UACf,IAAMqC,KAA6B,GAAG;YAClCpC,GAAG,EAAEgC,MAAI,CAACjC,QAAQ;YAClBsC,aAAa,EAAEL,MAAI,CAACpC;UACxB,CAAC;UACD,IAAM0C,KAAK,GAAGN,MAAI,CAAC9B,YAAY,CAACqC,oBAAoB,CAAC,CAAC;UACtD,IAAID,KAAK,EAAE;YACPF,KAAK,CAACI,SAAS,GAAG,IAAIC,GAAG,CAACH,KAAK,CAAC,CAACI,IAAI;UACzC;UACAR,QAAQ,GAAG;YACPS,IAAI,EAAEpE,gBAAgB;YACtBqE,cAAc,EAAER;UACpB,CAAC;QACL;MACJ;MAEAJ,MAAI,CAACa,cAAc,CAACX,QAAQ,EAAE,IAAI,CAAC;IAAC;EACxC;;EAEA;AACJ;AACA;AACA;AACA;EACWY,YAAYA,CAAA,EAAuB;IAAA,IAAAC,UAAA;IACtC,QAAAA,UAAA,GAAQ,IAAI,CAAClD,IAAI,cAAAkD,UAAA,uBAAVA,UAAA,CAA0BjD,OAAO;EAC5C;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACWkD,eAAeA,CAAA,EAAW;IAC7B,OAAO,IAAI,CAACpD,YAAY;EAC5B;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACWqD,cAAcA,CAACC,SAAiB,EAAmC;IAAA,IAAAC,WAAA;IACtE,QAAAA,WAAA,GAAQ,IAAI,CAACtD,IAAI,cAAAsD,WAAA,gBAAAA,WAAA,GAAVA,WAAA,CAA0BC,MAAM,cAAAD,WAAA,uBAAhCA,WAAA,CAAmCD,SAAS,CAAC;EACxD;EAEOG,aAAaA,CAAA,EAAmB;IACnC,OAAO,IAAI,CAACC,UAAU;EAC1B;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACiBT,cAAcA,CAAC1C,QAAkB,EAAqC;IAAA,IAAAoD,UAAA,GAAAC,SAAA;MAAAC,MAAA;IAAA,OAAArE,iBAAA;MAAA,IAAAsE,WAAA;MAAA,IAAnCC,UAAU,GAAAJ,UAAA,CAAA/B,MAAA,QAAA+B,UAAA,QAAAxC,SAAA,GAAAwC,UAAA,MAAG,KAAK;MAC9D,IAAI,CAACE,MAAI,CAACrC,mBAAmB,EAAE;QAC3B,MAAM,IAAIzC,KAAK,CAAC,8CAA8C,CAAC;MACnE;MAEA,IAAI,CAACgF,UAAU,EAAE;QAAA,IAAAC,qBAAA;QACb,CAAAA,qBAAA,GAAAH,MAAI,CAACnD,mBAAmB,cAAAsD,qBAAA,eAAxBA,qBAAA,CAAAlC,IAAA,CAAA+B,MAAI,EAAuB,IAAI,CAAC;MACpC;;MAEA;MACA;MACA;MACA;MACA;MACA,OAAOA,MAAI,CAACxB,aAAa,EAAE;QACvB,IAAI;UACA,MAAMwB,MAAI,CAACxB,aAAa;QAC5B,CAAC,CAAC,OAAA4B,OAAA,EAAM,CAAC;MACb;;MAEA;MACA,IAAIlC,IAAc;MAClB,KAAA+B,WAAA,GAAKD,MAAI,CAAC5D,IAAI,cAAA6D,WAAA,eAAVA,WAAA,CAA0B5D,OAAO,EAAE;QACnC6B,IAAI,GAAGmC,MAAM,CAACC,MAAM,CAChB;UACIjE,OAAO,EAAG2D,MAAI,CAAC5D,IAAI,CAAeC;QACtC,CAAC,EACDK,QACJ,CAAC;MACL,CAAC,MAAM;QACHwB,IAAI,GAAGxB,QAAQ;MACnB;MAEA,IAAI;QACA;QACA;QACAsD,MAAI,CAACxB,aAAa,GAAGwB,MAAI,CAACpD,SAAS,CAACsB,IAAI,EAAEgC,UAAU,CAAC;QACrD,MAAMF,MAAI,CAACxB,aAAa;MAC5B,CAAC,SAAS;QACNwB,MAAI,CAACxB,aAAa,GAAG,IAAI;QACzB,IAAI,CAAC0B,UAAU,EAAE;UAAA,IAAAK,sBAAA;UACb,CAAAA,sBAAA,GAAAP,MAAI,CAACnD,mBAAmB,cAAA0D,sBAAA,eAAxBA,sBAAA,CAAAtC,IAAA,CAAA+B,MAAI,EAAuB,KAAK,CAAC;QACrC;MACJ;IAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACWQ,WAAWA,CAAA,EAAuB;IACrC,OAAO,IAAI,CAAClE,QAAQ;EACxB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;EACWmE,WAAWA,CAAClE,GAAW,EAAQ;IAClC,IAAI,CAACD,QAAQ,GAAGC,GAAG;EACvB;EA8BA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACkBK,SAASA,CAACsB,IAAqB,EAAqC;IAAA,IAAAwC,WAAA,GAAAX,SAAA;MAAAY,MAAA;IAAA,OAAAhF,iBAAA;MAAA,IAAnCuE,UAAU,GAAAQ,WAAA,CAAA3C,MAAA,QAAA2C,WAAA,QAAApD,SAAA,GAAAoD,WAAA,MAAG,KAAK;MAC7D,IAAI;QACA,IAAME,MAAM,SAASD,MAAI,CAAChE,eAAe,CAACuB,IAAI,EAAEgC,UAAU,CAAC;QAC3DS,MAAI,CAAChD,mBAAmB,CAAEkD,OAAO,CAACD,MAAM,CAAC;QACzCD,MAAI,CAAChD,mBAAmB,GAAG,IAAI;MACnC,CAAC,CAAC,OAAOmD,KAAK,EAAE;QAAA,IAAAC,qBAAA,EAAAC,iBAAA,EAAAC,WAAA,EAAAC,iBAAA;QACZ,IAAMC,WAAW,GAAGL,KAAK,YAAYjG,UAAU,GAAGiG,KAAK,GAAG,IAAI;;QAE9D;QACA,IAAMM,UAAU,IAAAL,qBAAA,GAAGI,WAAW,aAAXA,WAAW,gBAAAH,iBAAA,GAAXG,WAAW,CAAE/E,IAAI,cAAA4E,iBAAA,uBAAjBA,iBAAA,CAAmB1F,KAAK,cAAAyF,qBAAA,cAAAA,qBAAA,GAAI,IAAI;QACnD,IAAMM,SAAS,GAAG,EAAAJ,WAAA,GAACN,MAAI,CAACvE,IAAI,cAAA6E,WAAA,uBAAVA,WAAA,CAA0B3F,KAAK,KAAIgG,OAAO,CAACF,UAAU,CAAC;QACxE,IAAI,CAACD,WAAW,IAAIA,WAAW,CAACI,UAAU,KAAK,GAAG,IAAI,CAACJ,WAAW,CAAC/E,IAAI,IAAI,CAACiF,SAAS,EAAE;UACnF;UACA,IAAI,CAACnB,UAAU,EAAE;YAAA,IAAAsB,qBAAA;YACb,CAAAA,qBAAA,GAAAb,MAAI,CAAChD,mBAAmB,cAAA6D,qBAAA,eAAxBA,qBAAA,CAA0BC,MAAM,CAACX,KAAK,CAAC;UAC3C,CAAC,MAAM;YACH;YACA;YACA;YACAlG,MAAM,CAAC8G,GAAG,CAAC,wDAAwD,EAAEZ,KAAK,CAAC;UAC/E;QACJ;QACA,IAAIK,WAAW,IAAI,CAACA,WAAW,CAAC/E,IAAI,EAAE;UAClC+E,WAAW,CAAC/E,IAAI,GAAG,CAAC,CAAC;QACzB;QACA;QACA;QACA;QACA;QACA;QACA,IAAI+E,WAAW,IAAI,CAACA,WAAW,CAAC/E,IAAI,CAACd,KAAK,IAAI,CAAC6F,WAAW,CAAC/E,IAAI,CAACuF,SAAS,IAAI,CAACR,WAAW,CAAC/E,IAAI,CAACC,OAAO,EAAE;UACpG8E,WAAW,CAAC/E,IAAI,CAACd,KAAK,GAAIqF,MAAI,CAACvE,IAAI,CAAed,KAAK;UACvD6F,WAAW,CAAC/E,IAAI,CAACuF,SAAS,GAAIhB,MAAI,CAACvE,IAAI,CAAeuF,SAAS;UAC/DR,WAAW,CAAC/E,IAAI,CAACC,OAAO,GAAIsE,MAAI,CAACvE,IAAI,CAAeC,OAAO;QAC/D;QACA,IAAI8E,WAAW,EAAE;UACbR,MAAI,CAACvE,IAAI,GAAG+E,WAAW,CAAC/E,IAAI;QAChC;QACA,IAAI;UACAuE,MAAI,CAACtC,kBAAkB,CAAC,CAAC;QAC7B,CAAC,CAAC,OAAOuD,CAAC,EAAE;UACRjB,MAAI,CAAChD,mBAAmB,CAAE8D,MAAM,CAACG,CAAC,CAAC;UACnCjB,MAAI,CAAChD,mBAAmB,GAAG,IAAI;UAC/B;QACJ;QAEA,IAAI,CAACgD,MAAI,CAACrE,QAAQ,KAAA4E,iBAAA,GAAIP,MAAI,CAACd,UAAU,cAAAqB,iBAAA,eAAfA,iBAAA,CAAiBW,MAAM,CAACC,QAAQ,CAAC9G,QAAQ,CAAC+G,KAAK,CAAC,EAAE;UACpE,IAAI;YACA,MAAMpB,MAAI,CAACzD,iBAAiB,CAAC,CAAC;YAC9B;YACA;YACA;YACA;YACA;YACA;UACJ,CAAC,CAAC,OAAO0E,CAAC,EAAE;YACR;YACA;YACA;YACA;YACA;YACA;YACAjB,MAAI,CAAChD,mBAAmB,CAAE8D,MAAM,CAACG,CAAC,CAAC;YACnCjB,MAAI,CAAChD,mBAAmB,GAAG,IAAI;UACnC;QACJ;MACJ;IAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACYU,kBAAkBA,CAAA,EAAS;IAAA,IAAA2D,WAAA,EAAAC,WAAA;IAC/B,IAAMC,SAAS,GAAG,IAAI,CAACC,WAAW,CAAC,CAAC;IACpC,IAAI,CAACD,SAAS,EAAE;MACZ,MAAM,IAAIhH,KAAK,CAAC,qCAAqC,CAAC;IAC1D;IACA,IAAI,CAACwD,YAAY,GAAGwD,SAAS;IAE7B,IAAIA,SAAS,KAAKlH,QAAQ,CAACoH,KAAK,EAAE;MAC9B,IAAI,CAAChD,cAAc,CAAC;QAChBF,IAAI,EAAE;MACV,CAAC,CAAC;MACF;IACJ;IAEA,IAAI,CAAA8C,WAAA,OAAI,CAAC5F,IAAI,cAAA4F,WAAA,eAATA,WAAA,CAAWK,OAAO,KAAAJ,WAAA,GAAI,IAAI,CAAC7F,IAAI,cAAA6F,WAAA,eAATA,WAAA,CAAWnB,KAAK,EAAE;MAAA,IAAAwB,WAAA,EAAAC,WAAA;MACxC,IAAI,CAACxF,oBAAoB,CAACmF,SAAS,EAAE;QACjCG,OAAO,EAAE,EAAAC,WAAA,OAAI,CAAClG,IAAI,cAAAkG,WAAA,uBAATA,WAAA,CAAWD,OAAO,KAAI,EAAE;QACjCvB,KAAK,EAAE,EAAAyB,WAAA,OAAI,CAACnG,IAAI,cAAAmG,WAAA,uBAATA,WAAA,CAAWzB,KAAK,KAAI;MAC/B,CAAC,CAAC;MACF;IACJ;IAEA,IAAI,CAAC/D,oBAAoB,CAACmF,SAAS,EAAEA,SAAS,KAAKpH,gBAAgB,GAAG;MAAEwB,QAAQ,EAAE,IAAI,CAACA;IAAS,CAAC,GAAG,CAAC,CAAC,CAAC;EAC3G;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;EACY6F,WAAWA,CAAA,EAAkC;IACjD,IAAI,IAAI,CAACtC,UAAU,KAAK,IAAI,EAAE;MAC1B,IAAI,CAACA,UAAU,GAAG,IAAI,CAAC2C,UAAU,CAAC,CAAC;IACvC;IACA5H,MAAM,CAAC8G,GAAG,CAAC,mBAAmB,EAAEe,IAAI,CAACC,SAAS,CAAC,IAAI,CAAC7C,UAAU,CAAC,CAAC;IAChE,IAAMqC,SAAS,GAAG,IAAI,CAACS,qBAAqB,CAAC,IAAI,CAAC9C,UAAU,CAAC;IAC7DjF,MAAM,CAAC8G,GAAG,CAAC,gBAAgB,EAAEQ,SAAS,CAAC;IACvC,OAAOA,SAAS;EACpB;;EAEA;EACA;EACQU,SAASA,CAACC,IAAa,EAAU;IACrC,IAAIC,KAAK,GAAGD,IAAI,CAAChB,MAAM,CAAC9D,MAAM;IAC9B,IAAI,IAAI,CAACV,eAAe,KAAKC,SAAS,EAAE;MACpC;MACAwF,KAAK,IAAID,IAAI,CAAChB,MAAM,CAACkB,MAAM,CAAEC,KAAK,IAAK,CAAC,IAAI,CAAC3F,eAAe,CAAE4F,GAAG,CAACD,KAAK,CAAC,CAAC,CAACjF,MAAM,GAAG,EAAE;IACzF;IACA,OAAO+E,KAAK;EAChB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACYN,UAAUA,CAAA,EAAY;IAAA,IAAAU,WAAA;IAC1B,IAAM5H,KAAK,GAAG,EAAA4H,WAAA,GAAC,IAAI,CAAC9G,IAAI,cAAA8G,WAAA,uBAAVA,WAAA,CAA0B5H,KAAK,KAAI,EAAE;;IAEnD;IACA,IAAM6H,SAAS,GAAG7B,OAAO,CAAC,IAAI,CAACrF,MAAM,CAACC,YAAY,CAAC,IAAIoF,OAAO,CAAC,IAAI,CAAChF,QAAQ,CAAC;IAC7E,IAAM8G,UAAU,GAAG9B,OAAO,CAAC,IAAI,CAACrF,MAAM,CAACoH,YAAY,CAAC,IAAI/B,OAAO,CAAC,IAAI,CAACrF,MAAM,CAACqH,WAAW,CAAC;;IAExF;IACA;IACAhI,KAAK,CAACiI,IAAI,CAAC,CAACC,CAAC,EAAEC,CAAC,KAAK,IAAI,CAACb,SAAS,CAACY,CAAC,CAAC,GAAG,IAAI,CAACZ,SAAS,CAACa,CAAC,CAAC,CAAC;IAE3D,KAAK,IAAMZ,IAAI,IAAIvH,KAAK,EAAE;MACtB,IAAIoI,YAAY,GAAG,KAAK;MACxB,IAAIC,aAAa,GAAG,KAAK;MACzB,KAAK,IAAMX,KAAK,IAAIH,IAAI,CAAChB,MAAM,EAAE;QAC7B,IAAImB,KAAK,KAAKlI,gBAAgB,EAAE;UAC5B4I,YAAY,GAAG,IAAI;QACvB,CAAC,MAAM,IAAIV,KAAK,IAAIjI,iBAAiB,EAAE;UACnC4I,aAAa,GAAG,IAAI;QACxB;MACJ;MAEA,IAAID,YAAY,IAAIP,SAAS,IAAIQ,aAAa,IAAIP,UAAU,EAAE;QAC1D,OAAOP,IAAI;MACf;IACJ;IAEA,IAAMe,cAAwB,GAAG,EAAE;IACnC,IAAIT,SAAS,EAAES,cAAc,CAACC,IAAI,CAAC/I,gBAAgB,CAAC;IACpD,IAAIsI,UAAU,EAAEQ,cAAc,CAACC,IAAI,CAAC9I,iBAAiB,CAAC;IACtD;IACA;IACA,MAAM,IAAIE,oBAAoB,CAAC,0CAA0C,EAAE2I,cAAc,EAAEtI,KAAK,CAAC;EACrG;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACYqH,qBAAqBA,CAACE,IAAa,EAAiC;IAAA,IAAAiB,WAAA;IACxE,IAAMnC,SAAS,GAAG,EAAAmC,WAAA,GAAC,IAAI,CAAC1H,IAAI,cAAA0H,WAAA,uBAAVA,WAAA,CAA0BnC,SAAS,KAAI,EAAE;IAC3D,OAAOkB,IAAI,CAAChB,MAAM,CAACkC,IAAI,CAAEC,SAAS,IAAK,CAACrC,SAAS,CAACG,QAAQ,CAACkC,SAAS,CAAC,CAAC;EAC1E;AACJ","ignoreList":[]}