@vantageos/cloud-identity 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -3,6 +3,127 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+**Additive — authorize a PERSON and bind an organisation (proposed 0.8.0).**
+A connector's `/authorize` that auto-approves with no user authentication, and
+derives the code's user from a client-registration profile, makes every client
+an anonymous app. This release is the flow that replaces it: Clerk session,
+verified organisation membership, a code bound to both, and an exchange that
+re-derives nothing from the client's profile.
+
+### Added
+
+- `startAuthorize` / `resumeAuthorize` (`src/authorize-flow.ts`): request
+  validation (exact `redirect_uri`, PKCE challenge required, allowed `resource`,
+  supported scopes); no Clerk session -> redirect to sign-in with an
+  HMAC-signed, short-lived state blob and no code; verified session -> one
+  organisation auto-picked, several -> an `OrgPickerModel`, a posted `orgId`
+  honoured only if it is in the user's own membership list; `requireConsent`
+  (default ON; opt out explicitly for first-party clients only). The code is single-use, short-lived and stored as a digest
+  through a consumer-supplied `AuthorizationCodeStore` whose `consume` must be
+  atomic.
+- `exchangeAuthorizationCode` (`src/token-exchange.ts`): consumes the code
+  first, then checks expiry, client, `redirect_uri`, `resource` and the PKCE
+  verifier; returns `{ sub, org_id, org_slug, org_role, aud, client_id, scope }`.
+- `verifyClerkSessionToken` (`src/clerk-session.ts`): RS256 against a
+  consumer-supplied key set; issuer, expiry, `nbf`, optional audience and
+  authorized parties.
+- `buildDiscoveryDocument`, `buildUserInfo` (`src/oidc.ts`). The document
+  advertises only what is implemented (no id_token alg, no refresh grant, no
+  client-auth methods).
+- `AuthorizeRefusal` / `AuthorizeRefusalReason` (`{ code: "AUTHORIZE_REFUSED",
+  reason }`), `oauthErrorFor`, `pkceChallengeFromVerifier`, and the types listed
+  in the README section "Authorize a person and bind an organisation".
+- Subpath exports `/authorize`, `/token-exchange`, `/clerk-session`, `/oidc`.
+
+### Security
+
+- Consent is bound to a server-issued `consentToken` (HMAC over state, user and
+  organisation set). `approved: true` without a token valid for that state and
+  that session's user is refused with `consent-required`; a client can no
+  longer mint its own state and approve on a victim's behalf.
+
+### Changed
+
+- README: the "does not verify a signed JWT" limit now names the one exception.
+- `package.json` version set to 0.8.0 (proposed; not published).
+
+### Unchanged
+
+- Every existing export keeps its behaviour and signature; no existing test
+  was edited. No new runtime dependency (Web Crypto only).
+
+## [0.7.0]
+
+**Additive — resolution of a PRESENTED, non-master bearer.** The published
+0.5.0 surface covered the master credential (`validateMasterBearer`) and a
+decoder that verifies nothing and says so (`decodeUnverifiedBearer`). Between
+them there was no function taking a presented non-master bearer, hashing it,
+looking the row up and returning a resolved identity or a typed refusal — so a
+consuming product wrote that primitive locally, against an untyped client, with
+the lookup failure swallowed into `null`. That is a second authority answering
+"who is calling". This release is the single one, so the local variant can be
+deleted rather than duplicated.
+
+**Version number.** This entry takes `0.7.0`, not `0.6.0`. An unmerged branch
+already claims `0.6.0` for `resolveTenantIdOrAbsent` (the non-throwing sibling
+of `requireTenantId`); leaving `0.6.0` to it means these two can land in either
+order without either having to be renumbered after review.
+
+### Added
+
+- `validatePresentedBearer(authHeader, deps)` (`src/presented-bearer.ts`) —
+  parses the header, hashes the token to a SHA-256 hex digest, obtains the row
+  through the caller-supplied `deps.lookupBySecretHash(digest)`, re-compares the
+  row's stored digest with `timingSafeEqual`, then honours row shape, revocation
+  and expiry. The package cannot query a datastore, so the read is injected; every
+  decision stays in the package. `deps.now` is an injectable clock.
+  - **The callback receives the DIGEST, never the token**, keeping a usable
+    secret out of a consumer's query and out of its query logs.
+  - **An unknown digest, a revoked row, an expired row, a row of invalid shape
+    and a row whose stored digest does not match all return ONE shared frozen
+    value**, `{ ok: false, error: "mismatch" }` — one object rather than five
+    equal literals, so the branches cannot drift apart by an added field. A
+    prober cannot learn whether a token was ever real. `deps.onRefusal` reports
+    the internal distinction (`PresentedBearerInternalReason`) to the consumer's
+    own logs; a throwing sink cannot change the outcome.
+  - **A lookup that throws is a REFUSAL** (`error: "unavailable"`), deliberately
+    outside the collapsed bucket so a datastore outage can be answered 503
+    rather than reported to every caller as a bad credential. No branch grants
+    anything on a lookup failure.
+  - Header vocabulary is `validateMasterBearer`'s, unchanged: `"missing"`,
+    `"malformed"`, `"mismatch"`. A malformed header costs no datastore read.
+- `requireAgentScopedIdentity(identity)` — the second, mandatory call for a
+  per-agent surface. An organization-wide token (a row with no agent identity)
+  resolves successfully and carries its agent as an EXPLICIT absence
+  (`AgentPresence`, a union that must be narrowed — not a nullable field a
+  caller can fail to check). The per-agent form `AgentScopedIdentity` carries a
+  module-private type brand, so it cannot be constructed outside the package: a
+  handler typed against it is reachable only through this function. Its refusal
+  is distinguishable from a bad credential on purpose — 403, not 401.
+- `sha256Hex(input)` (`src/crypto.ts`) — lower-case hex SHA-256 of a string,
+  exported so the code WRITING a token row derives the digest exactly as the
+  resolver recomputes it.
+- `storedBearerRowSchema` + `StoredBearerRow`, `AgentPresence`,
+  `ResolvedBearerIdentity`, `AgentScopedIdentity`,
+  `ValidatePresentedBearerResult`, `RequireAgentScopedResult`,
+  `PresentedBearerDeps`, `PresentedBearerInternalReason`.
+- Subpath export `@vantageos/cloud-identity/presented-bearer`.
+
+### Changed
+
+- Documentation only: `decodeUnverifiedBearer`'s security banner said the
+  production trust boundary was "not yet exported by this package". For an
+  opaque token it now is, and the banner names it. No behaviour change.
+
+### Unchanged
+
+- **Every existing export keeps its exact behaviour and signature.** The new
+  module is a new file; the only edits to existing sources are one appended
+  function in `src/crypto.ts`, new export lines in `src/index.ts`, and the
+  docstring above. No existing test was edited.
+
 ## [0.6.0]
 
 **Additive — typed refusal for reads, and a role assertion.**

package/README.md

@@ -129,6 +129,48 @@ await resolveTenant({ session: null }); // throws Error("Unauthenticated: no ses
 - `getEffectiveTenantId(ctx, args)` — resolves which tenant a request should
   act on when a caller may legitimately act on more than one.
 
+**Resolving a presented bearer token**
+
+- `validatePresentedBearer(authHeader, deps)` — takes the raw
+  `Authorization` header a non-master caller presented, and returns either a
+  resolved identity or a coarse refusal. It hashes the token, asks your
+  `deps.lookupBySecretHash` callback for the row carrying that digest,
+  re-compares the stored digest in constant time, and then checks revocation
+  and expiry. Your callback does one indexed read; every decision stays in the
+  package, so two consumers cannot drift into two different answers to "who is
+  calling".
+  - **Your callback receives the digest, never the token.** A raw secret
+    therefore never reaches your query, your query log or your slow-query log.
+    Use `sha256Hex` to produce the same digest when you WRITE a token row, so
+    the two sides agree.
+  - **An unknown token, a revoked token and an expired token return one
+    identical value** (`{ ok: false, error: "mismatch" }`). Someone probing
+    your endpoint cannot learn from the reply whether a token was ever real.
+    Pass `deps.onRefusal` to receive the distinction
+    (`PresentedBearerInternalReason`) in your own logs, where it belongs.
+  - **A failing lookup refuses.** If your callback throws, the result is
+    `{ ok: false, error: "unavailable" }` — a refusal you can answer with 503
+    instead of 401. There is no branch that grants anything when the lookup
+    fails.
+  - `deps.now` is an injectable clock, so expiry is testable without waiting.
+  - Types: `PresentedBearerDeps`, `StoredBearerRow` (validated at runtime by
+    `storedBearerRowSchema`), `ResolvedBearerIdentity`,
+    `ValidatePresentedBearerResult`.
+- `requireAgentScopedIdentity(identity)` — narrows a resolved identity to a
+  surface that acts as ONE agent, and refuses when the token has no agent.
+  A token can be organization-wide: it names a tenant and no agent. That is a
+  legitimate credential, and it must never be silently widened into whichever
+  agent the surface happened to be about. So the agent is not a nullable field
+  you have to remember to check — `ResolvedBearerIdentity.agent` is an
+  `AgentPresence`, a union you must narrow, and the per-agent form
+  (`AgentScopedIdentity`, with a plain `agentId: string`) can only be obtained
+  from this function. Returns `RequireAgentScopedResult`; its refusal is
+  distinct from a bad credential, because the right answer there is 403, not
+  401.
+- `sha256Hex(input)` — the lower-case hex SHA-256 digest of a string. Exported
+  so that the code storing a token row hashes it exactly the way the resolver
+  will recompute it. Hash once, store the digest, discard the token.
+
 **Row filtering**
 
 - `passesScopeFilter(ctx, row)` — true when this row is visible to this
@@ -233,6 +275,101 @@ want to catch by type, and `BearerPayload`, the type returned by
   // -> { tenant: "org_abc", subject: "user_123", role: "admin" }
   ```
 
+## Authorize a person and bind an organisation
+
+A connector that signs in a PERSON (a Claude or ChatGPT user) must end up with
+a token naming that person and one organisation they belong to, never an
+anonymous app. Clerk is the identity provider; this package holds the
+decisions and takes every collaborator as a parameter.
+
+```ts
+// GET /authorize
+const out = await startAuthorize(query, clerkSessionToken, cfg, deps);
+// GET /authorize/callback (the return from Clerk) and the picker's POST
+const out2 = await resumeAuthorize({ state, sessionToken, orgId, approved, consentToken }, cfg, deps);
+// POST /token (authorization_code grant)
+const res = await exchangeAuthorizationCode(
+  { code, codeVerifier, redirectUri, clientId, resource },
+  { codeStore },
+);
+```
+
+- `startAuthorize(params, sessionToken, config, deps)` validates the request
+  (registered client, exact `redirect_uri`, a PKCE challenge using the SHA-256
+  method, an allowed RFC 8707 `resource`, supported scopes). With no valid Clerk
+  session it returns `{ kind: "redirect-to-sign-in", url }` and issues nothing;
+  the return URL carries a state blob signed with HMAC (`AuthorizeConfig.stateSecret`,
+  at least 32 characters) and valid for 600 seconds by default.
+- `resumeAuthorize(input, config, deps)` rebuilds the request ONLY from that
+  signed state (a tampered or expired blob is refused), verifies the Clerk
+  session token (`verifyClerkSessionToken`: RS256 against the key set the
+  consumer supplies, issuer, expiry, optional audience and authorized parties),
+  lists the user's organisations through `deps.listMemberships`, and answers
+  with an `AuthorizeOutcome`:
+  `redirect-to-sign-in`, `org-picker` (an `OrgPickerModel` the consumer renders;
+  it lists only the user's own organisations), `redirect-to-client` (the URL
+  carrying the code and the client's `state`) or `refused`.
+  A posted `orgId` is honoured only if the verified user's own membership list
+  contains it.
+  Consent is ON by default (`requireConsent` defaults to true). What it
+  protects: a code is issued only after the person was SHOWN the picker and
+  approved it. The picker's `OrgPickerModel` carries a `consentToken`:
+  `HMAC(stateSecret, "consent-v1" NUL state NUL clerkUserId NUL sorted
+  organisation ids)`. It is bound to the exact signed state (useless for any
+  other request), to the verified user (useless under another session) and to
+  the organisation set that user was shown. `resumeAuthorize` with
+  `approved: true` refuses with `consent-required` unless the presented
+  `consentToken` verifies, compared in constant time, for that state AND the
+  session's user. Without this, a client could mint its own state (the sign-in
+  redirect hands it one), replay it with a victim's session and
+  `approved: true`, and receive a code the victim never saw a screen for.
+  The consumer renders `consentToken` as a hidden field of the picker's POST
+  form and posts it back as `consentToken`. The token IS the CSRF protection
+  for that POST, because a cross-site form cannot know it; do not add a weaker
+  substitute and do not accept the POST without it. Also set
+  `session.authorizedParties` to your own origin(s) so a Clerk session token
+  minted for another application (`azp`) is not accepted here.
+  Set `requireConsent: false` explicitly ONLY for first-party clients whose
+  redirect URIs you control; exactly one organisation is then auto-picked and
+  no token is involved.
+- The code is bound to `{ clerkUserId, orgId, orgSlug, orgRole, clientId,
+  redirectUri, codeChallenge, resource }`, stored as a digest through the
+  consumer's `AuthorizationCodeStore` (`put`, and an ATOMIC `consume`), single
+  use, 60 seconds by default. Records are `AuthorizationCodeRecord`; a consume
+  answers `ConsumeCodeResult`. `AuthorizeClient`, `ClerkOrgMembership`,
+  `AuthorizeDeps`, `ResumeInput` and `ClerkJwk` / `ClerkJwks` /
+  `VerifiedClerkSession` / `VerifyClerkSessionResult` /
+  `ClerkSessionVerifierConfig` are the shapes the consumer supplies or reads.
+- `exchangeAuthorizationCode(input, deps)` consumes the code FIRST (every
+  attempt burns it), then checks expiry, client, `redirect_uri`, resource and
+  the PKCE verifier (`pkceChallengeFromVerifier` derives a challenge). It
+  returns `AuthorizedTokenClaims`:
+  `{ sub, org_id, org_slug, org_role, aud, client_id, scope }` (`ExchangeInput`,
+  `ExchangeDeps`, `ExchangeResult`). No field comes from a client-registration
+  profile.
+- `buildDiscoveryDocument(config)` builds the discovery document
+  (`DiscoveryConfig`, `DiscoveryDocument`, `DiscoveryResult`); the issuer must
+  be https with no query. It advertises only what is implemented: the code
+  flow, PKCE, the `authorization_code` grant and UserInfo. It omits
+  `id_token_signing_alg_values_supported` (OIDC Discovery lists it as required
+  for a provider that issues id_tokens; this package issues none, so that is a
+  documented deviation), refresh tokens and client-authentication methods. A
+  consumer that implements any of them adds those keys itself. `buildUserInfo(claims, user)` returns `sub`, and
+  `email` / `email_verified` when the token carries `email`
+  (`ClerkUserLike`, `UserInfo`, `UserInfoResult`).
+- Every refusal is `{ code: "AUTHORIZE_REFUSED", reason }`
+  (`AuthorizeRefusal`, `AuthorizeRefusalReason`), the same shape as
+  `RoleRefusal`. `oauthErrorFor(refusal)` maps it to an OAuth error code and an
+  HTTP status (503 for a collaborator that failed, so an outage is not reported
+  as a bad credential). A collaborator that throws is always a refusal.
+
+Also exported as subpaths: `/authorize`, `/token-exchange`, `/clerk-session`,
+`/oidc`.
+
+Limits, stated: `redirect_uri` matching is exact (no loopback port variation);
+the package signs no access token and no id token and issues no refresh token (the consumer mints the token
+from the claims); it fetches no key set and calls no Clerk API itself.
+
 ## What this package does not do
 
 Worth reading before you rely on it.
@@ -249,6 +386,16 @@ Worth reading before you rely on it.
 - **It does not talk to your database.** `scopeFilterList` filters rows you
   have already fetched. If fetching them was itself expensive or unsafe, filter
   earlier, in your query.
+- **It does not issue, rotate or revoke tokens.** `validatePresentedBearer`
+  reads a row you already store and decides whether it may be believed. Minting
+  a token, writing its row, marking it revoked and expiring it are yours; the
+  package only insists that a row it is handed be believed in constant time,
+  and refused identically however it fails.
+- **It does not verify an arbitrary signed JWT.** The presented-bearer path is
+  for an OPAQUE token — one whose only meaning is the row it matches. The one
+  signed token it verifies is a Clerk session token (`verifyClerkSessionToken`,
+  RS256 only). For any other signed credential, verify the signature with a
+  JWT library first.
 
 ## Upgrading to 0.4.0
 

package/dist/authorize-flow.d.ts

@@ -0,0 +1,169 @@
+import { type AuthorizeRefusal } from "./authorize-shared.js";
+import { type ClerkSessionVerifierConfig } from "./clerk-session.js";
+/**
+ * The authorize flow for a PERSON: a Clerk session, a verified organisation
+ * membership, and an authorization code bound to both. Framework-agnostic:
+ * every function takes plain values and returns a plain outcome; the consumer
+ * owns HTTP, rendering and storage.
+ *
+ * The code is bound to `{ clerkUserId, orgId, orgSlug, orgRole, clientId,
+ * redirectUri, codeChallenge, resource }`. Nothing is read from a
+ * client-registration profile: a client's own fields only decide whether the
+ * request is acceptable, never what the person may reach.
+ */
+/** A registered OAuth client, as the consumer's own registry knows it. */
+export interface AuthorizeClient {
+    clientId: string;
+    /** Exact-match list; no prefix, wildcard or partial match is ever applied. */
+    redirectUris: readonly string[];
+    clientName?: string;
+    revoked?: boolean;
+}
+/** One organisation membership, in the shape Clerk's Backend API returns. */
+export interface ClerkOrgMembership {
+    role: string;
+    organization: {
+        id: string;
+        slug: string | null;
+        name: string;
+    };
+}
+/** A stored authorization code. Only the digest of the code is stored. */
+export interface AuthorizationCodeRecord {
+    codeHash: string;
+    clerkUserId: string;
+    orgId: string;
+    orgSlug: string | null;
+    orgRole: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    resource: string;
+    scope: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+}
+export type ConsumeCodeResult = {
+    status: "ok";
+    record: AuthorizationCodeRecord;
+} | {
+    status: "unknown";
+} | {
+    status: "already-used";
+};
+/**
+ * Where codes live. `consume` MUST be atomic: of two concurrent calls for the
+ * same digest exactly one gets `ok`. A read-then-write is not an
+ * implementation of this interface.
+ */
+export interface AuthorizationCodeStore {
+    put(record: AuthorizationCodeRecord): Promise<void>;
+    consume(codeHash: string): Promise<ConsumeCodeResult>;
+}
+export interface AuthorizeConfig {
+    /** HMAC secret for the state blob; at least 32 characters. Never sent to a client. */
+    stateSecret: string;
+    /** Clerk sign-in page. The return URL travels in `redirect_url`. */
+    signInUrl: string;
+    /** The consumer's endpoint that calls `resumeAuthorize`. */
+    callbackUrl: string;
+    /** Resource identifiers (RFC 8707) this server issues codes for. Exact match. */
+    allowedResources: readonly string[];
+    /** When set, every requested scope must be listed. */
+    supportedScopes?: readonly string[];
+    /** Scope granted when the request names none. Default `"openid"`. */
+    defaultScope?: string;
+    /** Verification of the Clerk session token. */
+    session: ClerkSessionVerifierConfig;
+    /** Seconds the signed state stays valid. Default 600. */
+    stateTtlSeconds?: number;
+    /** Seconds an authorization code stays valid. Default 60. */
+    codeTtlSeconds?: number;
+    /**
+     * The person must explicitly approve (the outcome is a consent model, not a
+     * code, until `approved: true` is posted back). DEFAULT TRUE: without it, any
+     * dynamically registered client could obtain a code for a signed-in victim
+     * who merely follows a link. Set `false` explicitly only for first-party
+     * clients whose redirect URIs you control; a single organisation is then
+     * auto-picked.
+     */
+    requireConsent?: boolean;
+}
+export interface AuthorizeDeps {
+    lookupClient(clientId: string): Promise<AuthorizeClient | null>;
+    /** Clerk Backend API: the user's organisation memberships. */
+    listMemberships(clerkUserId: string): Promise<readonly ClerkOrgMembership[]>;
+    codeStore: AuthorizationCodeStore;
+    /** Epoch milliseconds. */
+    now?: () => number;
+    /** Opaque code generator; default 32 random bytes, base64url. */
+    generateCode?: () => string;
+}
+export interface OrgPickerModel {
+    /** Signed state; post it back, untouched, to `resumeAuthorize`. */
+    state: string;
+    client: {
+        clientId: string;
+        clientName: string | null;
+    };
+    resource: string;
+    scope: string;
+    /** Only organisations the verified user is a member of. */
+    organizations: readonly {
+        id: string;
+        slug: string | null;
+        name: string;
+        role: string;
+    }[];
+    /** True when the person must tick approval even with one organisation. */
+    consentRequired: boolean;
+    /**
+     * Proof that THIS picker was shown to THIS verified user for THIS state.
+     * Render it as a hidden field and post it back as `consentToken`. Absent
+     * when consent is not required.
+     */
+    consentToken: string | null;
+}
+export type AuthorizeOutcome = {
+    kind: "redirect-to-sign-in";
+    url: string;
+} | {
+    kind: "org-picker";
+    model: OrgPickerModel;
+} | {
+    kind: "redirect-to-client";
+    url: string;
+} | {
+    kind: "refused";
+    refusal: AuthorizeRefusal;
+};
+export interface ResumeInput {
+    /** The `authorize_state` query parameter on the return URL (or the picker's posted state). */
+    state: string;
+    /** The Clerk session token presented on return. */
+    sessionToken: string | undefined;
+    /** The organisation the person chose in the picker. */
+    orgId?: string;
+    /** The person's explicit approval, when `requireConsent` is on. */
+    approved?: boolean;
+    /** The `consentToken` of the picker the person was shown. Required with `approved: true` when consent is on. */
+    consentToken?: string;
+}
+/**
+ * Handles `GET /authorize`. Validates the request against the registered
+ * client, then:
+ *   - no Clerk session (absent, expired or forged) -> `redirect-to-sign-in`,
+ *     carrying a signed, short-lived state blob and issuing NO code;
+ *   - a verified session -> continues exactly as `resumeAuthorize` does.
+ * A Clerk key set that cannot be reached is a refusal (`jwks-unavailable`),
+ * never a redirect and never a grant.
+ */
+export declare function startAuthorize(params: Readonly<Record<string, string | undefined>>, sessionToken: string | undefined, cfg: AuthorizeConfig, deps: AuthorizeDeps): Promise<AuthorizeOutcome>;
+/**
+ * Handles the return from Clerk (and the picker's form post). The request is
+ * rebuilt ONLY from the signed state: no query parameter other than the blob
+ * itself is read. A tampered or expired blob is refused; the client is looked
+ * up again so a client revoked mid-flow gets no code.
+ */
+export declare function resumeAuthorize(input: ResumeInput, cfg: AuthorizeConfig, deps: AuthorizeDeps): Promise<AuthorizeOutcome>;
+//# sourceMappingURL=authorize-flow.d.ts.map

package/dist/authorize-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-flow.d.ts","sourceRoot":"","sources":["../src/authorize-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAUtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;GAUG;AAMH,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sDAAsD;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,OAAO,EAAE,0BAA0B,CAAC;IACpC,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAChE,8DAA8D;IAC9D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IAC7E,SAAS,EAAE,sBAAsB,CAAC;IAClC,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,aAAa,EAAE,SAAS;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,EAAE,CAAC;IACJ,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gHAAgH;IAChH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAmPD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACpD,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAqD3B"}