@vantageos/cloud-identity 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -3,6 +3,78 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.0]
+
+**Additive — the person principal (`./person-principal`).** The decisions a
+server needs to serve a signed-in person in its own name, extracted from the
+first consumer so that every other one wires them the same way.
+
+### Added
+
+- `resolvePersonPrincipal`: a presented token's record -> `{ subject, orgSlug,
+  orgRole?, actor }`, or a typed refusal (not live, not a person's, no
+  organisation, organisation inactive or unmapped). Only the token's own
+  organisation is ever looked up.
+- `resolvePersonActingName` / `checkPersonCallShape`: the own-name rule. The
+  acting identity comes from the principal; another user's name and an agent's
+  name without that agent's credential are refused.
+- `resolvePersonTenantAccess`: strict organisation equality; unstamped refused.
+- `resolveWriterRole` / `requireWriterRole`: writer-role assertion, fail closed.
+- `PERSON_ACTOR_PREFIX`, `personActorName`, `isPersonActorName`,
+  `personTokenRecordSchema`, `PersonRefusalError` and the refusal types.
+- New subpath export `./person-principal`.
+
+## [0.8.0]
+
+**Additive — authorize a PERSON and bind an organisation (0.8.0).**
+A connector's `/authorize` that auto-approves with no user authentication, and
+derives the code's user from a client-registration profile, makes every client
+an anonymous app. This release is the flow that replaces it: Clerk session,
+verified organisation membership, a code bound to both, and an exchange that
+re-derives nothing from the client's profile.
+
+### Added
+
+- `startAuthorize` / `resumeAuthorize` (`src/authorize-flow.ts`): request
+  validation (exact `redirect_uri`, PKCE challenge required, allowed `resource`,
+  supported scopes); no Clerk session -> redirect to sign-in with an
+  HMAC-signed, short-lived state blob and no code; verified session -> one
+  organisation auto-picked, several -> an `OrgPickerModel`, a posted `orgId`
+  honoured only if it is in the user's own membership list; `requireConsent`
+  (default ON; opt out explicitly for first-party clients only). The code is single-use, short-lived and stored as a digest
+  through a consumer-supplied `AuthorizationCodeStore` whose `consume` must be
+  atomic.
+- `exchangeAuthorizationCode` (`src/token-exchange.ts`): consumes the code
+  first, then checks expiry, client, `redirect_uri`, `resource` and the PKCE
+  verifier; returns `{ sub, org_id, org_slug, org_role, aud, client_id, scope }`.
+- `verifyClerkSessionToken` (`src/clerk-session.ts`): RS256 against a
+  consumer-supplied key set; issuer, expiry, `nbf`, optional audience and
+  authorized parties.
+- `buildDiscoveryDocument`, `buildUserInfo` (`src/oidc.ts`). The document
+  advertises only what is implemented (no id_token alg, no refresh grant, no
+  client-auth methods).
+- `AuthorizeRefusal` / `AuthorizeRefusalReason` (`{ code: "AUTHORIZE_REFUSED",
+  reason }`), `oauthErrorFor`, `pkceChallengeFromVerifier`, and the types listed
+  in the README section "Authorize a person and bind an organisation".
+- Subpath exports `/authorize`, `/token-exchange`, `/clerk-session`, `/oidc`.
+
+### Security
+
+- Consent is bound to a server-issued `consentToken` (HMAC over state, user and
+  organisation set). `approved: true` without a token valid for that state and
+  that session's user is refused with `consent-required`; a client can no
+  longer mint its own state and approve on a victim's behalf.
+
+### Changed
+
+- README: the "does not verify a signed JWT" limit now names the one exception.
+- `package.json` version set to 0.8.0 (proposed; not published).
+
+### Unchanged
+
+- Every existing export keeps its behaviour and signature; no existing test
+  was edited. No new runtime dependency (Web Crypto only).
+
 ## [0.7.0]
 
 **Additive — resolution of a PRESENTED, non-master bearer.** The published

package/README.md

@@ -186,6 +186,15 @@ Visibility is granted two ways: the row's `createdBy` appears in the caller's
 `namespaceReadPrefixes`. Prefixes match on a path boundary, so a caller allowed
 `team/finance` does not thereby see `team/finance-archive`.
 
+A third way is opt-in per call. All three functions take an optional last
+argument, `grantFields` (type `GrantFieldDeclaration`, a list of property
+names). It names the row properties that carry per-row grants, such as a
+mission's `agents`. A row is then also visible when one of those properties
+names an identity in the caller's `fromAllowList`. The property can hold a
+single string or an array of strings; a value of any other shape is skipped,
+not matched. The list is data supplied by your call site; the package
+hardcodes no field names. Omitting it, or passing `[]`, adds nothing.
+
 **Token validation**
 
 - `validateMasterBearer(header, secret)` — compares an `Authorization: Bearer`
@@ -213,6 +222,8 @@ want to catch by type, and `BearerPayload`, the type returned by
 - `ValidateMasterBearerResult` — the return type of `validateMasterBearer`.
 - `ScopeFilterable` — the minimal row shape (`{ createdBy?, namespace? }`)
   accepted by `passesScopeFilter` / `scopeFilterList` / `scopeFilterGet`.
+- `GrantFieldDeclaration` — `readonly string[]`, the optional `grantFields`
+  argument of those three functions.
 - `SessionIdentity` — the human-path shape `requireTenantId` accepts under
   `{ kind: "session", identity }` (see "Both caller paths, one contract").
 - `TenantSource` — the discriminated union `requireTenantId` accepts:
@@ -275,6 +286,170 @@ want to catch by type, and `BearerPayload`, the type returned by
   // -> { tenant: "org_abc", subject: "user_123", role: "admin" }
   ```
 
+## Authorize a person and bind an organisation
+
+A connector that signs in a PERSON (a Claude or ChatGPT user) must end up with
+a token naming that person and one organisation they belong to, never an
+anonymous app. Clerk is the identity provider; this package holds the
+decisions and takes every collaborator as a parameter.
+
+```ts
+// GET /authorize
+const out = await startAuthorize(query, clerkSessionToken, cfg, deps);
+// GET /authorize/callback (the return from Clerk) and the picker's POST
+const out2 = await resumeAuthorize({ state, sessionToken, orgId, approved, consentToken }, cfg, deps);
+// POST /token (authorization_code grant)
+const res = await exchangeAuthorizationCode(
+  { code, codeVerifier, redirectUri, clientId, resource },
+  { codeStore },
+);
+```
+
+- `startAuthorize(params, sessionToken, config, deps)` validates the request
+  (registered client, exact `redirect_uri`, a PKCE challenge using the SHA-256
+  method, an allowed RFC 8707 `resource`, supported scopes). With no valid Clerk
+  session it returns `{ kind: "redirect-to-sign-in", url }` and issues nothing;
+  the return URL carries a state blob signed with HMAC (`AuthorizeConfig.stateSecret`,
+  at least 32 characters) and valid for 600 seconds by default.
+- `resumeAuthorize(input, config, deps)` rebuilds the request ONLY from that
+  signed state (a tampered or expired blob is refused), verifies the Clerk
+  session token (`verifyClerkSessionToken`: RS256 against the key set the
+  consumer supplies, issuer, expiry, optional audience and authorized parties),
+  lists the user's organisations through `deps.listMemberships`, and answers
+  with an `AuthorizeOutcome`:
+  `redirect-to-sign-in`, `org-picker` (an `OrgPickerModel` the consumer renders;
+  it lists only the user's own organisations), `redirect-to-client` (the URL
+  carrying the code and the client's `state`) or `refused`.
+  A posted `orgId` is honoured only if the verified user's own membership list
+  contains it.
+  Consent is ON by default (`requireConsent` defaults to true). What it
+  protects: a code is issued only after the person was SHOWN the picker and
+  approved it. The picker's `OrgPickerModel` carries a `consentToken`:
+  `HMAC(stateSecret, "consent-v1" NUL state NUL clerkUserId NUL sorted
+  organisation ids)`. It is bound to the exact signed state (useless for any
+  other request), to the verified user (useless under another session) and to
+  the organisation set that user was shown. `resumeAuthorize` with
+  `approved: true` refuses with `consent-required` unless the presented
+  `consentToken` verifies, compared in constant time, for that state AND the
+  session's user. Without this, a client could mint its own state (the sign-in
+  redirect hands it one), replay it with a victim's session and
+  `approved: true`, and receive a code the victim never saw a screen for.
+  The consumer renders `consentToken` as a hidden field of the picker's POST
+  form and posts it back as `consentToken`. The token IS the CSRF protection
+  for that POST, because a cross-site form cannot know it; do not add a weaker
+  substitute and do not accept the POST without it. Also set
+  `session.authorizedParties` to your own origin(s) so a Clerk session token
+  minted for another application (`azp`) is not accepted here.
+  Set `requireConsent: false` explicitly ONLY for first-party clients whose
+  redirect URIs you control; exactly one organisation is then auto-picked and
+  no token is involved.
+- The code is bound to `{ clerkUserId, orgId, orgSlug, orgRole, clientId,
+  redirectUri, codeChallenge, resource }`, stored as a digest through the
+  consumer's `AuthorizationCodeStore` (`put`, and an ATOMIC `consume`), single
+  use, 60 seconds by default. Records are `AuthorizationCodeRecord`; a consume
+  answers `ConsumeCodeResult`. `AuthorizeClient`, `ClerkOrgMembership`,
+  `AuthorizeDeps`, `ResumeInput` and `ClerkJwk` / `ClerkJwks` /
+  `VerifiedClerkSession` / `VerifyClerkSessionResult` /
+  `ClerkSessionVerifierConfig` are the shapes the consumer supplies or reads.
+- `exchangeAuthorizationCode(input, deps)` consumes the code FIRST (every
+  attempt burns it), then checks expiry, client, `redirect_uri`, resource and
+  the PKCE verifier (`pkceChallengeFromVerifier` derives a challenge). It
+  returns `AuthorizedTokenClaims`:
+  `{ sub, org_id, org_slug, org_role, aud, client_id, scope }` (`ExchangeInput`,
+  `ExchangeDeps`, `ExchangeResult`). No field comes from a client-registration
+  profile.
+- `buildDiscoveryDocument(config)` builds the discovery document
+  (`DiscoveryConfig`, `DiscoveryDocument`, `DiscoveryResult`); the issuer must
+  be https with no query. It advertises only what is implemented: the code
+  flow, PKCE, the `authorization_code` grant and UserInfo. It omits
+  `id_token_signing_alg_values_supported` (OIDC Discovery lists it as required
+  for a provider that issues id_tokens; this package issues none, so that is a
+  documented deviation), refresh tokens and client-authentication methods. A
+  consumer that implements any of them adds those keys itself. `buildUserInfo(claims, user)` returns `sub`, and
+  `email` / `email_verified` when the token carries `email`
+  (`ClerkUserLike`, `UserInfo`, `UserInfoResult`).
+- Every refusal is `{ code: "AUTHORIZE_REFUSED", reason }`
+  (`AuthorizeRefusal`, `AuthorizeRefusalReason`), the same shape as
+  `RoleRefusal`. `oauthErrorFor(refusal)` maps it to an OAuth error code and an
+  HTTP status (503 for a collaborator that failed, so an outage is not reported
+  as a bad credential). A collaborator that throws is always a refusal.
+
+Also exported as subpaths: `/authorize`, `/token-exchange`, `/clerk-session`,
+`/oidc`.
+
+Limits, stated: `redirect_uri` matching is exact (no loopback port variation);
+the package signs no access token and no id token and issues no refresh token (the consumer mints the token
+from the claims); it fetches no key set and calls no Clerk API itself.
+
+## Wiring person sign-in in an MCP server
+
+A person signed in through an OAuth connector reaches your MCP server holding a
+bearer you minted for them (see "Authorize a person and bind an organisation").
+`@vantageos/cloud-identity/person-principal` turns that bearer's token record
+into the person's principal and answers the three questions every write needs.
+It is pure: you do the lookups, it decides. A server that serves people (a PDF
+inspector, a registry, a CRM) wires it the same way:
+
+```ts
+import {
+  resolvePersonPrincipal,
+  resolvePersonActingName,
+  resolvePersonTenantAccess,
+  resolveWriterRole,
+  type PersonPrincipal,
+  type PersonRefusal,
+} from "@vantageos/cloud-identity/person-principal";
+
+// 1. Who is calling: the token row you looked up by the bearer's digest.
+const who = await resolvePersonPrincipal(
+  { principal: row.principal, subject: row.userId, orgSlug: row.orgSlug,
+    orgRole: row.orgRole, revokedAt: row.revokedAt, expiresAt: row.expiresAt },
+  { now: Date.now(), lookupOrganisation: (slug) => orgTable.get(slug) },
+  "my-tool",
+);
+if (!who.ok) return deny(who.refusal);
+
+// 2. Under what name: the token's, never the argument's.
+const name = resolvePersonActingName({
+  principal: who.principal, claimedName: args.createdBy,
+  agentCredential: presentedAgent, door: "my-tool",
+});
+if (!name.ok) return deny(name.refusal);
+
+// 3. Which rows, and may they write.
+const inOrg = resolvePersonTenantAccess({
+  principal: who.principal, rowOrgId: record.orgId, door: "my-tool" });
+const mayWrite = resolveWriterRole({
+  role: who.principal.orgRole, writerRoles: writerRolesOfOrg, door: "my-tool",
+  orgSlug: who.principal.orgSlug });
+```
+
+- `resolvePersonPrincipal(token, deps, door)` refuses a token that is expired,
+  revoked, not a person's, bound to no organisation, or bound to an inactive or
+  unmapped one. It looks up only the token's own organisation.
+- `resolvePersonActingName` returns `{ ok: true, actingAs: "person", actor }`
+  for no name or the person's own (`user:<subject>`), and refuses another
+  user's name (`PERSON_ACTS_AS_ITSELF`) and an agent's name without that
+  agent's own credential (`AGENT_CREDENTIAL_REQUIRED`, or
+  `AGENT_IDENTITY_MISMATCH` when the credential belongs to another agent).
+  `checkPersonCallShape` is the same rule for a backend door that receives a
+  person's call already stripped of its name. `PERSON_ACTOR_PREFIX`,
+  `personActorName` and `isPersonActorName` spell and reserve the actor name:
+  refuse it when someone registers an agent.
+- `resolvePersonTenantAccess` is a strict equality on the organisation; an
+  unstamped row is refused.
+- `resolveWriterRole` / `requireWriterRole` check the verified role against a
+  writer allowlist you hold as data. A missing role, a missing list and an
+  empty list all refuse. `requireWriterRole` throws `PersonRefusalError`.
+- Every refusal is a `PersonRefusal` (`PersonRefusalCode`, `PersonRefusalReason`,
+  `door`, `detail`); you choose the transport shape. `personTokenRecordSchema`,
+  `PersonTokenRecord`, `PersonPrincipal`, `OrganisationState`,
+  `PersonPrincipalDeps`, `PersonPrincipalResult`, `PersonActingNameResult` and
+  `PersonAccessResult` are the input and result types.
+
+The module verifies no credential. The token record must come from your own
+lookup of the bearer the person presented, never from a request body.
+
 ## What this package does not do
 
 Worth reading before you rely on it.
@@ -296,10 +471,11 @@ Worth reading before you rely on it.
   a token, writing its row, marking it revoked and expiring it are yours; the
   package only insists that a row it is handed be believed in constant time,
   and refused identically however it fails.
-- **It does not verify a signed JWT.** The presented-bearer path is for an
-  OPAQUE token — one whose only meaning is the row it matches. If your
-  credential carries its own signed claims, verify that signature with a JWT
-  library first; this package exports no verifier.
+- **It does not verify an arbitrary signed JWT.** The presented-bearer path is
+  for an OPAQUE token — one whose only meaning is the row it matches. The one
+  signed token it verifies is a Clerk session token (`verifyClerkSessionToken`,
+  RS256 only). For any other signed credential, verify the signature with a
+  JWT library first.
 
 ## Upgrading to 0.4.0
 

package/dist/authorize-flow.d.ts

@@ -0,0 +1,169 @@
+import { type AuthorizeRefusal } from "./authorize-shared.js";
+import { type ClerkSessionVerifierConfig } from "./clerk-session.js";
+/**
+ * The authorize flow for a PERSON: a Clerk session, a verified organisation
+ * membership, and an authorization code bound to both. Framework-agnostic:
+ * every function takes plain values and returns a plain outcome; the consumer
+ * owns HTTP, rendering and storage.
+ *
+ * The code is bound to `{ clerkUserId, orgId, orgSlug, orgRole, clientId,
+ * redirectUri, codeChallenge, resource }`. Nothing is read from a
+ * client-registration profile: a client's own fields only decide whether the
+ * request is acceptable, never what the person may reach.
+ */
+/** A registered OAuth client, as the consumer's own registry knows it. */
+export interface AuthorizeClient {
+    clientId: string;
+    /** Exact-match list; no prefix, wildcard or partial match is ever applied. */
+    redirectUris: readonly string[];
+    clientName?: string;
+    revoked?: boolean;
+}
+/** One organisation membership, in the shape Clerk's Backend API returns. */
+export interface ClerkOrgMembership {
+    role: string;
+    organization: {
+        id: string;
+        slug: string | null;
+        name: string;
+    };
+}
+/** A stored authorization code. Only the digest of the code is stored. */
+export interface AuthorizationCodeRecord {
+    codeHash: string;
+    clerkUserId: string;
+    orgId: string;
+    orgSlug: string | null;
+    orgRole: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    resource: string;
+    scope: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+}
+export type ConsumeCodeResult = {
+    status: "ok";
+    record: AuthorizationCodeRecord;
+} | {
+    status: "unknown";
+} | {
+    status: "already-used";
+};
+/**
+ * Where codes live. `consume` MUST be atomic: of two concurrent calls for the
+ * same digest exactly one gets `ok`. A read-then-write is not an
+ * implementation of this interface.
+ */
+export interface AuthorizationCodeStore {
+    put(record: AuthorizationCodeRecord): Promise<void>;
+    consume(codeHash: string): Promise<ConsumeCodeResult>;
+}
+export interface AuthorizeConfig {
+    /** HMAC secret for the state blob; at least 32 characters. Never sent to a client. */
+    stateSecret: string;
+    /** Clerk sign-in page. The return URL travels in `redirect_url`. */
+    signInUrl: string;
+    /** The consumer's endpoint that calls `resumeAuthorize`. */
+    callbackUrl: string;
+    /** Resource identifiers (RFC 8707) this server issues codes for. Exact match. */
+    allowedResources: readonly string[];
+    /** When set, every requested scope must be listed. */
+    supportedScopes?: readonly string[];
+    /** Scope granted when the request names none. Default `"openid"`. */
+    defaultScope?: string;
+    /** Verification of the Clerk session token. */
+    session: ClerkSessionVerifierConfig;
+    /** Seconds the signed state stays valid. Default 600. */
+    stateTtlSeconds?: number;
+    /** Seconds an authorization code stays valid. Default 60. */
+    codeTtlSeconds?: number;
+    /**
+     * The person must explicitly approve (the outcome is a consent model, not a
+     * code, until `approved: true` is posted back). DEFAULT TRUE: without it, any
+     * dynamically registered client could obtain a code for a signed-in victim
+     * who merely follows a link. Set `false` explicitly only for first-party
+     * clients whose redirect URIs you control; a single organisation is then
+     * auto-picked.
+     */
+    requireConsent?: boolean;
+}
+export interface AuthorizeDeps {
+    lookupClient(clientId: string): Promise<AuthorizeClient | null>;
+    /** Clerk Backend API: the user's organisation memberships. */
+    listMemberships(clerkUserId: string): Promise<readonly ClerkOrgMembership[]>;
+    codeStore: AuthorizationCodeStore;
+    /** Epoch milliseconds. */
+    now?: () => number;
+    /** Opaque code generator; default 32 random bytes, base64url. */
+    generateCode?: () => string;
+}
+export interface OrgPickerModel {
+    /** Signed state; post it back, untouched, to `resumeAuthorize`. */
+    state: string;
+    client: {
+        clientId: string;
+        clientName: string | null;
+    };
+    resource: string;
+    scope: string;
+    /** Only organisations the verified user is a member of. */
+    organizations: readonly {
+        id: string;
+        slug: string | null;
+        name: string;
+        role: string;
+    }[];
+    /** True when the person must tick approval even with one organisation. */
+    consentRequired: boolean;
+    /**
+     * Proof that THIS picker was shown to THIS verified user for THIS state.
+     * Render it as a hidden field and post it back as `consentToken`. Absent
+     * when consent is not required.
+     */
+    consentToken: string | null;
+}
+export type AuthorizeOutcome = {
+    kind: "redirect-to-sign-in";
+    url: string;
+} | {
+    kind: "org-picker";
+    model: OrgPickerModel;
+} | {
+    kind: "redirect-to-client";
+    url: string;
+} | {
+    kind: "refused";
+    refusal: AuthorizeRefusal;
+};
+export interface ResumeInput {
+    /** The `authorize_state` query parameter on the return URL (or the picker's posted state). */
+    state: string;
+    /** The Clerk session token presented on return. */
+    sessionToken: string | undefined;
+    /** The organisation the person chose in the picker. */
+    orgId?: string;
+    /** The person's explicit approval, when `requireConsent` is on. */
+    approved?: boolean;
+    /** The `consentToken` of the picker the person was shown. Required with `approved: true` when consent is on. */
+    consentToken?: string;
+}
+/**
+ * Handles `GET /authorize`. Validates the request against the registered
+ * client, then:
+ *   - no Clerk session (absent, expired or forged) -> `redirect-to-sign-in`,
+ *     carrying a signed, short-lived state blob and issuing NO code;
+ *   - a verified session -> continues exactly as `resumeAuthorize` does.
+ * A Clerk key set that cannot be reached is a refusal (`jwks-unavailable`),
+ * never a redirect and never a grant.
+ */
+export declare function startAuthorize(params: Readonly<Record<string, string | undefined>>, sessionToken: string | undefined, cfg: AuthorizeConfig, deps: AuthorizeDeps): Promise<AuthorizeOutcome>;
+/**
+ * Handles the return from Clerk (and the picker's form post). The request is
+ * rebuilt ONLY from the signed state: no query parameter other than the blob
+ * itself is read. A tampered or expired blob is refused; the client is looked
+ * up again so a client revoked mid-flow gets no code.
+ */
+export declare function resumeAuthorize(input: ResumeInput, cfg: AuthorizeConfig, deps: AuthorizeDeps): Promise<AuthorizeOutcome>;
+//# sourceMappingURL=authorize-flow.d.ts.map

package/dist/authorize-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-flow.d.ts","sourceRoot":"","sources":["../src/authorize-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAUtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;GAUG;AAMH,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sDAAsD;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,OAAO,EAAE,0BAA0B,CAAC;IACpC,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAChE,8DAA8D;IAC9D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IAC7E,SAAS,EAAE,sBAAsB,CAAC;IAClC,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,aAAa,EAAE,SAAS;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,EAAE,CAAC;IACJ,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gHAAgH;IAChH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAmPD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACpD,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAqD3B"}