@ticketlayer/backstage 4.0.0 → 4.1.0

package/README.md

@@ -40,8 +40,8 @@ are `BackstageAPIError` with `code` and `statusCode`.
 
 Bearer mode has no default refresh endpoint. It used to POST `refreshToken`
 to `/v1/auth/refresh`, which the API has removed; staff tokens are refreshed
-at the identity issuer's `/oauth/token` (the SDK's `auth` module will wrap
-that, TKT-385). On a 401 the client asks `onAuthFailure` if you gave one
+at the identity issuer's `/oauth/token`, and `createAuth(...).createClient()`
+(below) builds a client that does that by itself. On a 401 the client asks `onAuthFailure` if you gave one
 (return `true` to retry the request, reading the token again), otherwise
 POSTs `refreshToken` to `refreshEndpoint` if you set both (and hands the new
 pair to `onTokenRefresh`), and otherwise throws `BackstageAPIError` with code
@@ -49,6 +49,160 @@ pair to `onTokenRefresh`), and otherwise throws `BackstageAPIError` with code
 behind an `accessToken` resolver needs none of these. Cookie mode still
 defaults `refreshEndpoint` to the host app's own `/api/oauth/refresh`.
 
+## Signing in (first-party apps)
+
+Ticketlayer's own apps (the Backstage shell, the packaged box office on the
+desktop and on ChromeOS) sign a person in with one flow, in the shape of the
+IETF draft "OAuth 2.0 for First-Party Applications": the app starts a sign-in
+with its client id and a PKCE challenge, the person gives a password or an
+emailed code (and a second factor when they have one), and the last step
+answers a **one-time authorization code**, which the app redeems at the
+issuer's `/oauth/token`. Tokens only ever come from the token endpoint, so
+refresh rotation, revocation and DPoP binding work as for every other OAuth
+client. The steps refuse any client that is not first party: a third party
+uses the ordinary authorization code flow and the issuer's own pages.
+
+The issuer is its own host, separate from the API (`https://auth.staging.t9r.dev`
+beside `https://api.staging.t9r.dev`), so `createAuth` takes its own URL.
+
+```ts
+import { createAuth } from '@ticketlayer/backstage';
+
+const auth = createAuth({
+  issuerUrl: 'https://auth.staging.t9r.dev',
+  clientId: 'backstage-boxoffice-desktop',   // or per call
+});
+
+const pkce = await auth.pkce();              // { verifier, challenge, method: 'S256' }
+const dpop = await auth.createDpopKey();     // non-extractable ECDSA P-256 (WebCrypto)
+
+const step = await auth.start({ email, codeChallenge: pkce.challenge, dpop });
+// { method: 'password', alternatives: ['email_code'], authSession, expiresIn }
+
+let result = await auth.password({ authSession: step.authSession, password });
+// or: await auth.sendEmailCode({ authSession }); then auth.emailCode({ authSession, code })
+// -> { status: 'code', code, redirectUri } | { status: 'mfa_required', authSession, factors }
+if (result.status === 'mfa_required') {
+  result = await auth.mfa({ authSession: result.authSession, code: totp });
+}
+
+const tokens = await auth.exchange({
+  code: result.code,
+  codeVerifier: pkce.verifier,
+  redirectUri: result.redirectUri,
+  dpop,                                      // binds the tokens to the key
+});
+// { accessToken, tokenType: 'DPoP', expiresIn, expiresAt, refreshToken, organisation, ... }
+```
+
+- **`start`** answers the same whether or not the address has an account.
+  Pass `organisation: '<slug>'` to pin the first token to one organisation;
+  without it the token is pinned to the person's only organisation, or to
+  none when they have several. `method: 'sso'` with a `redirectUrl` is in the
+  type for when the issuer does home-realm discovery; it does not answer it
+  yet.
+- **A 401 from a step is the answer** (`INVALID_CREDENTIALS`,
+  `INVALID_SECOND_FACTOR`, `INVALID_AUTH_SESSION` when the ten-minute sign-in
+  has expired), thrown as `BackstageAPIError` with that code; it is never
+  treated as an expired session. Too many attempts is `SIGN_IN_RATE_LIMITED`
+  (429).
+- **Token endpoint errors** are `BackstageAPIError` with the OAuth error as
+  `code` (`invalid_grant`, `invalid_client`, ...).
+
+### A client that refreshes by itself
+
+```ts
+const session = auth.createSession({
+  baseUrl: 'https://api.staging.t9r.dev',
+  tokens,                        // or just { refreshToken } from the keychain
+  dpop,                          // exactly when the tokens are DPoP-bound
+  onTokens: (t) => keychain.set('refresh', t.refreshToken),
+  onSessionEnded: () => showSignIn(),
+});
+const client = session.client;   // or auth.createClient({...}) for the client alone
+
+await client.events.list();
+await session.selectOrganisation('acme-events');   // RFC 8693 token exchange; the client follows
+```
+
+The client is in bearer mode. Its token provider refreshes through
+`auth.refresh` ahead of expiry (30 seconds by default) and on a 401, one
+refresh at a time however many requests are waiting, and hands every new
+token set to `onTokens`: the refresh token rotates on every use, so keep the
+newest. With `dpop` every API call goes as `Authorization: DPoP` with a
+fresh proof, which is how the API accepts a bound token. `X-Ticketlayer-Org`
+is the organisation the tokens are pinned to unless you pass
+`organisationSlug`. When the issuer refuses the refresh token (revoked,
+expired or reused), `onSessionEnded` is called once and requests fail with
+`SESSION_EXPIRED`.
+
+`auth.refresh({ refreshToken, dpop })` and
+`auth.selectOrganisation({ slug, refreshToken, dpop })` are there to call
+directly too.
+
+### DPoP
+
+`createDpopKey()` makes an ECDSA P-256 pair whose private key is not
+extractable: script can sign with it and never read it, so a token bound to it
+is useless to whoever copies the token alone. Keep the `CryptoKeyPair` itself
+(IndexedDB keeps it non-extractable) and pass it back as
+`createDpopKey({ keyPair })` on the next launch. `dpopProof({ key, method, url,
+accessToken?, nonce? })` makes one proof (`typ: dpop+jwt`, `alg: ES256`, the
+public `jwk`; `htm`, `htu` without query or fragment, `iat`, a fresh `jti`,
+and `ath` when an access token goes with it). A `use_dpop_nonce` answer from
+the token endpoint is retried once with the nonce.
+
+Where the password goes differs by host: an Electron app passes it over the
+preload bridge and signs in from the main process; the isolated web app calls
+the issuer itself (its origin is allowed on `/v1/auth/*` and `/oauth/token`
+only). The shell's sign-in page calls the steps from the browser with
+`createAuth({ ..., credentials: 'include' })`, so the issuer also leaves its
+own login session, and redeems the code on its server.
+
+### The shell's server: `clientSecret`
+
+`backstage-shell` is a confidential client. Its server redeems the code and
+refreshes with its secret:
+
+```ts
+const tokens = await auth.exchange({ code, codeVerifier, redirectUri, clientSecret: process.env.SHELL_CLIENT_SECRET });
+```
+
+The secret goes as HTTP Basic (`client_secret_basic`). **It is for server code
+only and must never ship to a browser**, an Electron renderer or anything else
+a person can open: a public client has no secret and proves itself with PKCE
+and DPoP. The SDK refuses a `clientSecret` wherever `window` and `document`
+exist.
+
+### Nothing secret is logged
+
+With `debug` on, the client prints `[redacted]` for the body and the answer of
+every `/v1/auth/*` step, masks secret keys (`password`, `authSession`, tokens,
+`client_secret`, `key`, `secret`) in every other body it logs, and the token
+calls log only the grant type and the status. `test/auth-redaction.test.js`
+runs a whole sign-in with every log on and fails if a password, code, handle,
+verifier, secret or token appears.
+
+### A smoke run against a real issuer
+
+`scripts/smoke-auth.mjs` drives `start`, `password` (and `mfa`), `exchange`
+with a DPoP-bound code, one API call and a refresh against a running issuer,
+printing outcomes and never a secret:
+
+```bash
+npm run build
+TL_ISSUER_URL=https://auth.staging.t9r.dev TL_API_URL=https://api.staging.t9r.dev \
+TL_EMAIL=you@example.com TL_PASSWORD=... TL_ORG=your-org \
+  node scripts/smoke-auth.mjs
+```
+
+Against a local API (`API_SURFACE=all`, `IDENTITY_ISSUER=http://127.0.0.1:3501`,
+migrations applied and a person with a password in `identity_service.people`)
+point `TL_ISSUER_URL` at it and leave `TL_API_URL` unset. Name `TL_ORG` when the
+person belongs to more than one organisation: the token is otherwise pinned to
+none, and the issuer does not yet tell a first-party client which
+organisations there are to choose from.
+
 ## Develop
 
 ```bash

package/dist/auth/dpop.d.ts

@@ -0,0 +1,27 @@
+export interface DpopPublicJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+export interface DpopProofInput {
+    method: string;
+    url: string;
+    accessToken?: string;
+    nonce?: string;
+}
+export interface DpopKey {
+    readonly keyPair: CryptoKeyPair;
+    readonly publicJwk: DpopPublicJwk;
+    readonly thumbprint: string;
+    proof(input: DpopProofInput): Promise<string>;
+}
+export declare function dpopHtu(url: string): string;
+export declare function jwkThumbprint(jwk: DpopPublicJwk): Promise<string>;
+export declare function createDpopKey(options?: {
+    keyPair?: CryptoKeyPair;
+}): Promise<DpopKey>;
+export declare function dpopProof(input: DpopProofInput & {
+    key: Pick<DpopKey, 'keyPair' | 'publicJwk'>;
+}): Promise<string>;
+//# sourceMappingURL=dpop.d.ts.map

package/dist/auth/dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../src/auth/dpop.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AAED,MAAM,WAAW,cAAc;IAE7B,MAAM,EAAE,MAAM,CAAC;IAEf,GAAG,EAAE,MAAM,CAAC;IAEZ,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IAEtB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAElC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAKD,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG3C;AAGD,wBAAsB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;AAMD,wBAAsB,aAAa,CAAC,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,aAAa,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAqB/F;AAQD,wBAAsB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG;IAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,WAAW,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBxH"}

package/dist/auth/dpop.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dpopHtu = dpopHtu;
+exports.jwkThumbprint = jwkThumbprint;
+exports.createDpopKey = createDpopKey;
+exports.dpopProof = dpopProof;
+const encoding_1 = require("./encoding");
+const ALGORITHM = { name: 'ECDSA', namedCurve: 'P-256' };
+function dpopHtu(url) {
+    const parsed = new URL(url);
+    return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+}
+async function jwkThumbprint(jwk) {
+    return (0, encoding_1.base64url)(await (0, encoding_1.sha256)(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y })));
+}
+async function createDpopKey(options = {}) {
+    const subtle = (0, encoding_1.webCrypto)().subtle;
+    const keyPair = options.keyPair ?? (await subtle.generateKey(ALGORITHM, false, ['sign', 'verify']));
+    if (keyPair.privateKey.extractable) {
+        throw new Error('A DPoP private key must not be extractable');
+    }
+    const exported = await subtle.exportKey('jwk', keyPair.publicKey);
+    if (exported.kty !== 'EC' || exported.crv !== 'P-256' || !exported.x || !exported.y) {
+        throw new Error('A DPoP key must be an ECDSA P-256 key');
+    }
+    const publicJwk = { kty: 'EC', crv: 'P-256', x: exported.x, y: exported.y };
+    const thumbprint = await jwkThumbprint(publicJwk);
+    const key = {
+        keyPair,
+        publicJwk,
+        thumbprint,
+        proof: (input) => dpopProof({ key, ...input }),
+    };
+    return key;
+}
+async function dpopProof(input) {
+    const header = { typ: 'dpop+jwt', alg: 'ES256', jwk: input.key.publicJwk };
+    const payload = {
+        jti: (0, encoding_1.base64url)((0, encoding_1.randomBytes)(16)),
+        htm: input.method.toUpperCase(),
+        htu: dpopHtu(input.url),
+        iat: Math.floor(Date.now() / 1000),
+    };
+    if (input.accessToken)
+        payload.ath = (0, encoding_1.base64url)(await (0, encoding_1.sha256)(input.accessToken));
+    if (input.nonce)
+        payload.nonce = input.nonce;
+    const signingInput = `${(0, encoding_1.base64url)((0, encoding_1.utf8)(JSON.stringify(header)))}.${(0, encoding_1.base64url)((0, encoding_1.utf8)(JSON.stringify(payload)))}`;
+    const signature = await (0, encoding_1.webCrypto)().subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, input.key.keyPair.privateKey, (0, encoding_1.utf8)(signingInput));
+    return `${signingInput}.${(0, encoding_1.base64url)(signature)}`;
+}

package/dist/auth/encoding.d.ts

@@ -0,0 +1,8 @@
+export declare function webCrypto(): Crypto;
+export declare function base64url(bytes: ArrayBuffer | Uint8Array): string;
+export declare function base64urlDecode(value: string): Uint8Array;
+export declare const utf8: (value: string) => Uint8Array<ArrayBuffer>;
+export declare function randomBytes(length: number): Uint8Array<ArrayBuffer>;
+export declare function sha256(value: string): Promise<Uint8Array>;
+export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | undefined;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/auth/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/auth/encoding.ts"],"names":[],"mappings":"AAOA,wBAAgB,SAAS,IAAI,MAAM,CAQlC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAKjE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAMzD;AAED,eAAO,MAAM,IAAI,GAAI,OAAO,MAAM,KAAG,UAAU,CAAC,WAAW,CAA+D,CAAC;AAE3H,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAInE;AAED,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAE/D;AAGD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASjF"}

package/dist/auth/encoding.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf8 = void 0;
+exports.webCrypto = webCrypto;
+exports.base64url = base64url;
+exports.base64urlDecode = base64urlDecode;
+exports.randomBytes = randomBytes;
+exports.sha256 = sha256;
+exports.decodeJwtPayload = decodeJwtPayload;
+function webCrypto() {
+    const c = globalThis.crypto;
+    if (!c || !c.subtle || typeof c.getRandomValues !== 'function') {
+        throw new Error('@ticketlayer/backstage auth needs WebCrypto (globalThis.crypto.subtle): a browser, or Node 20 or later');
+    }
+    return c;
+}
+function base64url(bytes) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let binary = '';
+    for (let i = 0; i < view.length; i += 1)
+        binary += String.fromCharCode(view[i]);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64urlDecode(value) {
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (value.length % 4)) % 4);
+    const binary = atob(padded);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1)
+        out[i] = binary.charCodeAt(i);
+    return out;
+}
+const utf8 = (value) => new TextEncoder().encode(value);
+exports.utf8 = utf8;
+function randomBytes(length) {
+    const bytes = new Uint8Array(new ArrayBuffer(length));
+    webCrypto().getRandomValues(bytes);
+    return bytes;
+}
+async function sha256(value) {
+    return new Uint8Array(await webCrypto().subtle.digest('SHA-256', (0, exports.utf8)(value)));
+}
+function decodeJwtPayload(jwt) {
+    const part = jwt.split('.')[1];
+    if (!part)
+        return undefined;
+    try {
+        const parsed = JSON.parse(new TextDecoder().decode(base64urlDecode(part)));
+        return parsed && typeof parsed === 'object' ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/auth/index.d.ts

@@ -0,0 +1,152 @@
+import { BackstageAPIError, BackstageClient, type BackstageClientConfig, type DebugConfig } from '../client';
+import { createDpopKey, dpopProof, type DpopKey } from './dpop';
+import { pkce, pkceChallenge } from './pkce';
+export { pkce, pkceChallenge, type PkcePair } from './pkce';
+export { createDpopKey, dpopHtu, dpopProof, jwkThumbprint, type DpopKey, type DpopProofInput, type DpopPublicJwk, } from './dpop';
+export declare const TOKEN_EXCHANGE_GRANT = "urn:ietf:params:oauth:grant-type:token-exchange";
+export declare const REFRESH_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:refresh_token";
+export declare const ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+export interface AuthConfig {
+    issuerUrl: string;
+    clientId?: string;
+    tokenEndpoint?: string;
+    credentials?: RequestCredentials;
+    debug?: boolean | DebugConfig;
+    headers?: Record<string, string>;
+}
+export type SignInMethod = 'password' | 'email_code' | 'sso';
+export type SecondFactor = 'totp' | 'email';
+export interface StartInput {
+    email: string;
+    clientId?: string;
+    codeChallenge: string;
+    dpop?: Pick<DpopKey, 'thumbprint'>;
+    redirectUri?: string;
+    scope?: string;
+    organisation?: string;
+}
+export interface StartResult {
+    method: SignInMethod;
+    authSession: string;
+    alternatives: SignInMethod[];
+    expiresIn: number;
+    redirectUrl?: string;
+}
+export type StepResult = {
+    status: 'code';
+    code: string;
+    redirectUri: string;
+} | {
+    status: 'mfa_required';
+    authSession: string;
+    factors: SecondFactor[];
+};
+export interface ClientCredentials {
+    clientId?: string;
+    clientSecret?: string;
+    dpop?: DpopKey;
+}
+export interface ExchangeInput extends ClientCredentials {
+    code: string;
+    codeVerifier: string;
+    redirectUri?: string;
+}
+export interface RefreshInput extends ClientCredentials {
+    refreshToken: string;
+}
+export interface SelectOrganisationInput extends ClientCredentials {
+    slug: string;
+    refreshToken?: string;
+    accessToken?: string;
+}
+export interface OrganisationRef {
+    slug: string;
+    name: string | null;
+}
+export interface TokenSet {
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    expiresAt: number;
+    refreshToken?: string;
+    scope?: string;
+    idToken?: string;
+    organisation: OrganisationRef | null;
+    organisations?: {
+        id: string;
+        slug: string;
+        name: string;
+    }[];
+}
+export type StoredTokens = Partial<TokenSet> & {
+    accessToken?: string;
+    refreshToken?: string;
+};
+export interface SessionOptions extends Omit<BackstageClientConfig, 'authMode' | 'accessToken' | 'refreshToken' | 'onAuthFailure' | 'onTokenRefresh' | 'refreshEndpoint' | 'dpop'> {
+    tokens: StoredTokens;
+    clientId?: string;
+    clientSecret?: string;
+    dpop?: DpopKey;
+    onTokens?: (tokens: TokenSet) => void | Promise<void>;
+    onSessionEnded?: (error: BackstageAPIError) => void | Promise<void>;
+    refreshLeewaySeconds?: number;
+}
+export declare class BackstageAuth {
+    readonly issuerUrl: string;
+    readonly tokenEndpoint: string;
+    private readonly clientId?;
+    private readonly issuer;
+    private readonly logger;
+    private readonly debugConfig;
+    constructor(config: AuthConfig);
+    pkce: typeof pkce;
+    pkceChallenge: typeof pkceChallenge;
+    createDpopKey: typeof createDpopKey;
+    dpopProof: typeof dpopProof;
+    start(input: StartInput): Promise<StartResult>;
+    password(input: {
+        authSession: string;
+        password: string;
+    }): Promise<StepResult>;
+    sendEmailCode(input: {
+        authSession: string;
+    }): Promise<{
+        status: 'code_sent';
+    }>;
+    emailCode(input: {
+        authSession: string;
+        code: string;
+    }): Promise<StepResult>;
+    mfa(input: {
+        authSession: string;
+        code: string;
+    }): Promise<StepResult>;
+    private step;
+    exchange(input: ExchangeInput): Promise<TokenSet>;
+    refresh(input: RefreshInput): Promise<TokenSet>;
+    selectOrganisation(input: SelectOrganisationInput): Promise<TokenSet>;
+    private token;
+    private clientIdOf;
+    createSession(options: SessionOptions): AuthSession;
+    createClient(options: SessionOptions): BackstageClient;
+}
+export declare class AuthSession {
+    private readonly auth;
+    private readonly options;
+    readonly client: BackstageClient;
+    private current;
+    private pending?;
+    private ended;
+    private readonly leewayMs;
+    constructor(auth: BackstageAuth, options: SessionOptions);
+    get tokens(): StoredTokens;
+    get organisation(): OrganisationRef | null;
+    get hasEnded(): boolean;
+    refresh(): Promise<boolean>;
+    selectOrganisation(slug: string): Promise<TokenSet>;
+    private refreshAhead;
+    private runRefresh;
+    private adopt;
+}
+export declare function createAuth(config: AuthConfig): BackstageAuth;
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7G,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEhE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,OAAO,EACP,SAAS,EACT,aAAa,EACb,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,QAAQ,CAAC;AAMhB,eAAO,MAAM,oBAAoB,oDAAoD,CAAC;AACtF,eAAO,MAAM,kBAAkB,mDAAmD,CAAC;AACnF,eAAO,MAAM,iBAAiB,kDAAkD,CAAC;AAEjF,MAAM,WAAW,UAAU;IAMzB,SAAS,EAAE,MAAM,CAAC;IAElB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,MAAM,CAAC;IAQvB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAEjC,KAAK,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAE9B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC;AAE5C,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IAEd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,EAAE,MAAM,CAAC;IAMtB,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAEnC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAO1B,MAAM,EAAE,YAAY,CAAC;IAErB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,YAAY,EAAE,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAGD,MAAM,MAAM,UAAU,GAClB;IACE,MAAM,EAAE,MAAM,CAAC;IAEf,IAAI,EAAE,MAAM,CAAC;IAEb,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,MAAM,EAAE,cAAc,CAAC;IAEvB,WAAW,EAAE,MAAM,CAAC;IAEpB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,CAAC;AAGN,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,EAAE,MAAM,CAAC;IASlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IAErB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAEhE,IAAI,EAAE,MAAM,CAAC;IAEb,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IAEpB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;IAElB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,YAAY,EAAE,eAAe,GAAG,IAAI,CAAC;IAMrC,aAAa,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9D;AAGD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F,MAAM,WAAW,cACf,SAAQ,IAAI,CACV,qBAAqB,EACrB,UAAU,GAAG,aAAa,GAAG,cAAc,GAAG,eAAe,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,MAAM,CAC9G;IACD,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtD,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAyDD,qBAAa,aAAa;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;gBAErC,MAAM,EAAE,UAAU;IAiC9B,IAAI,cAAQ;IAEZ,aAAa,uBAAiB;IAE9B,aAAa,uBAAiB;IAE9B,SAAS,mBAAa;IAOhB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAsB9C,QAAQ,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAK/E,aAAa,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAS/E,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAM5E,GAAG,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAI5E,OAAO,CAAC,IAAI;IAaN,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IAOjD,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC;IAW/C,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC;YAW7D,KAAK;IAkDnB,OAAO,CAAC,UAAU;IAWlB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,WAAW;IAUnD,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;CAGvD;AAQD,qBAAa,WAAW;IAQpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,OAAO,CAAC,CAAmB;IACnC,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGf,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,cAAc;IA8B1C,IAAI,MAAM,IAAI,YAAY,CAEzB;IAGD,IAAI,YAAY,IAAI,eAAe,GAAG,IAAI,CAEzC;IAGD,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAGD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAWrB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAyBzD,OAAO,CAAC,YAAY;YAON,UAAU;YAuBV,KAAK;CAIpB;AAGD,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAE5D"}