@we8/cms 0.1.0

package/README.md

@@ -0,0 +1,78 @@
+# @we8/cms
+
+`@we8/cms` is the core headless CMS of the we8 package: a Hono application
+carrying the content, forms, analytics, media, and SEO modules, with embedded
+Better Auth for sign-in and the `/v1` public API that every frontend consumes.
+It is single-site by construction (one site, one worker, one database, one
+bucket), it validates public pk and sk API keys itself, and it owns the AEO
+backend that is a headline feature of 0.1: llms.txt publishing,
+answer-oriented content fields, AEO check endpoints, and crawler attribution.
+
+## Requirements
+
+- Runs on Cloudflare Workers. Deploy it with `@we8/cloudflare` and `wrangler`
+  (what `npm create we8` sets up), or with your own Worker config.
+- Bindings: a D1 database as `DB`, an R2 bucket as `MEDIA`, and optionally
+  static assets as `ASSETS` for the admin portal.
+- Secrets: `BETTER_AUTH_SECRET` is required; the admin API refuses every
+  request without it. `TURNSTILE_SECRET` is optional.
+- Runtime dependencies, bundled at deploy: `hono`, `better-auth`,
+  `drizzle-orm`, `zod`. Node 20 or newer for the tooling around it.
+## Local development
+
+```sh
+cp .dev.vars.example .dev.vars   # then set a real BETTER_AUTH_SECRET
+npm run db:migrate               # apply the migrations to the local D1
+npm run db:seed                  # a working site: settings, a post, a form, dev keys
+npm run dev                      # http://localhost:8787
+```
+
+The seed publishes two development API keys in plain text, which is what makes
+local curl calls possible. Never run it against a real deployment.
+
+```sh
+curl http://localhost:8787/v1/health
+curl http://localhost:8787/llms.txt
+curl -H "X-We8-Key: pk_live_000000000000000000000000000000000000000000000000" \
+  http://localhost:8787/v1/posts
+```
+
+Create the owner account by signing up once; the endpoint closes as soon as an
+account exists.
+
+```sh
+curl -X POST http://localhost:8787/api/auth/sign-up/email \
+  -H 'Content-Type: application/json' \
+  -d '{"email":"you@example.com","password":"a-long-enough-password","name":"You"}'
+```
+
+## Serving the admin portal
+
+This worker can serve the admin portal from its own origin, so the SPA, the
+API, and the session cookie all share one host and nothing is cross-origin.
+
+```sh
+npm run build --workspace @we8/admin-app   # build the portal
+npm run admin:bundle                       # copy it into ./public
+npm run dev                                # the portal is now at /
+```
+
+`./public` is the worker's static-asset root and ships empty. A deployment that
+skips those two steps serves no assets and runs API-only, which is the headless
+install; the SPA fallback in `src/spa.ts` stands down on its own when there is
+no bundle behind the binding.
+
+## Bindings
+
+`DB` (D1) and `MEDIA` (R2), plus the vars `SITE_URL` and `CMS_VERSION` and the
+secret `BETTER_AUTH_SECRET`. `AUTH_URL`, `TURNSTILE_SECRET`, `EMAIL_MODE`, and
+`EMAIL_FROM` are optional, and `ASSETS` is the optional static-asset binding
+that carries the admin portal. See [the CMS doc](https://github.com/reveriext/we8-package/blob/main/docs/cms.md) for what
+each one does and for the architecture behind them.
+
+## More
+
+- [docs/quick-start.md](https://github.com/reveriext/we8-package/blob/main/docs/quick-start.md): three paths from nothing to
+  a working site.
+- [docs/api.md](https://github.com/reveriext/we8-package/blob/main/docs/api.md): the `/v1` contract from a frontend's side.
+- `GET /v1/openapi.json` on any install: the same contract, live and keyless.

package/dist/auth/auth.d.ts

@@ -0,0 +1,87 @@
+import type { Bindings } from '../env.js';
+import type { UserRole } from '../shared/index.js';
+/** Where the auth handler is mounted. The browser calls exactly this prefix. */
+export declare const AUTH_BASE_PATH = "/api/auth";
+/**
+ * Counts users to decide whether an account creation is the bootstrap one. A
+ * direct D1 read rather than a Better Auth call: this runs inside the user
+ * creation hook, where re-entering the auth API would be circular.
+ */
+export declare function countUsers(db: D1Database): Promise<number>;
+/** True while no account exists, which is the only window public sign-up is open. */
+export declare function isBootstrapOpen(db: D1Database): Promise<boolean>;
+/**
+ * Normalizes whatever the session carries into one of the two roles. Anything
+ * unrecognized, absent, or empty reads as `member`: least privilege, so a row
+ * written by hand or left over from a botched migration cannot grant ownership.
+ */
+export declare function normalizeRole(role: unknown): UserRole;
+/**
+ * Builds the embedded auth instance for this request's environment.
+ *
+ * Managed we8 keeps auth in a control plane and has the tenant engine trust a
+ * signed internal header. Here there is no plane to trust: Better Auth runs
+ * inside this worker, over this worker's own D1, and a session cookie is the
+ * whole story. Same library and the same patterns as the managed platform, so
+ * what is learned on one side transfers to the other.
+ *
+ * Email and password only in 0.1. Sign-up is open exactly once, to create the
+ * first user, who becomes the owner; after that the endpoint is closed at the
+ * HTTP layer (see requireBootstrapOpen) and further users are created by the
+ * owner through the admin API. Password reset sends through the email seam, so
+ * it does nothing useful until a deployment configures a sender, which is the
+ * honest behavior for a CMS that ships with no mail transport.
+ */
+export declare function createAuth(env: Bindings): import("better-auth").Auth<{
+    database: (options: import("better-auth").BetterAuthOptions) => import("better-auth").DBAdapter<import("better-auth").BetterAuthOptions>;
+    secret: string;
+    baseURL: string;
+    basePath: string;
+    trustedOrigins: string[];
+    emailAndPassword: {
+        enabled: true;
+        requireEmailVerification: false;
+        sendResetPassword: ({ user, url }: {
+            user: import("better-auth").User;
+            url: string;
+            token: string;
+        }) => Promise<void>;
+    };
+    user: {
+        additionalFields: {
+            role: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+        };
+    };
+    databaseHooks: {
+        user: {
+            create: {
+                before: (newUser: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                } & Record<string, unknown>) => Promise<{
+                    data: {
+                        role: "owner" | "member";
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                }>;
+            };
+        };
+    };
+}>;
+export type Auth = ReturnType<typeof createAuth>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAI1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD,gFAAgF;AAChF,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhE;AAED,qFAAqF;AACrF,wBAAsB,eAAe,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAErD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CvC;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/auth/auth.js

@@ -0,0 +1,90 @@
+import { betterAuth } from 'better-auth';
+import { drizzleAdapter } from 'better-auth/adapters/drizzle';
+import { drizzle } from 'drizzle-orm/d1';
+import { resolveEmailSender, sendBestEffort } from '../lib/email.js';
+import { buildPasswordResetEmail } from '../lib/notify.js';
+import { authSchema } from './schema.js';
+/** Where the auth handler is mounted. The browser calls exactly this prefix. */
+export const AUTH_BASE_PATH = '/api/auth';
+/**
+ * Counts users to decide whether an account creation is the bootstrap one. A
+ * direct D1 read rather than a Better Auth call: this runs inside the user
+ * creation hook, where re-entering the auth API would be circular.
+ */
+export async function countUsers(db) {
+    const row = await db.prepare('SELECT COUNT(*) AS count FROM user').first();
+    return row?.count ?? 0;
+}
+/** True while no account exists, which is the only window public sign-up is open. */
+export async function isBootstrapOpen(db) {
+    return (await countUsers(db)) === 0;
+}
+/**
+ * Normalizes whatever the session carries into one of the two roles. Anything
+ * unrecognized, absent, or empty reads as `member`: least privilege, so a row
+ * written by hand or left over from a botched migration cannot grant ownership.
+ */
+export function normalizeRole(role) {
+    return role === 'owner' ? 'owner' : 'member';
+}
+/**
+ * Builds the embedded auth instance for this request's environment.
+ *
+ * Managed we8 keeps auth in a control plane and has the tenant engine trust a
+ * signed internal header. Here there is no plane to trust: Better Auth runs
+ * inside this worker, over this worker's own D1, and a session cookie is the
+ * whole story. Same library and the same patterns as the managed platform, so
+ * what is learned on one side transfers to the other.
+ *
+ * Email and password only in 0.1. Sign-up is open exactly once, to create the
+ * first user, who becomes the owner; after that the endpoint is closed at the
+ * HTTP layer (see requireBootstrapOpen) and further users are created by the
+ * owner through the admin API. Password reset sends through the email seam, so
+ * it does nothing useful until a deployment configures a sender, which is the
+ * honest behavior for a CMS that ships with no mail transport.
+ */
+export function createAuth(env) {
+    const db = drizzle(env.DB);
+    const emailSender = resolveEmailSender(env);
+    const baseURL = env.AUTH_URL ?? env.SITE_URL;
+    return betterAuth({
+        database: drizzleAdapter(db, { provider: 'sqlite', schema: authSchema }),
+        // A deployment must set this. index.ts refuses to build the handler
+        // without it rather than substituting a default, because a predictable
+        // session secret is a forged session.
+        secret: env.BETTER_AUTH_SECRET ?? '',
+        baseURL,
+        basePath: AUTH_BASE_PATH,
+        trustedOrigins: [baseURL],
+        emailAndPassword: {
+            enabled: true,
+            // No mail transport is configured by default, so requiring a
+            // verification click would lock every self-hoster out of their own CMS.
+            requireEmailVerification: false,
+            // Setting this callback is what enables the reset endpoints at all. The
+            // URL is Better Auth's own, carrying the one-time token, used verbatim.
+            sendResetPassword: async ({ user, url }) => {
+                await sendBestEffort(emailSender, buildPasswordResetEmail(user.email, url));
+            },
+        },
+        user: {
+            additionalFields: {
+                // input: false is the load-bearing half. It keeps `role` out of the
+                // account-update endpoint's accepted fields, so a member cannot patch
+                // themselves to owner; the hook below is the only writer.
+                role: { type: 'string', required: false, input: false },
+            },
+        },
+        databaseHooks: {
+            user: {
+                create: {
+                    before: async (newUser) => {
+                        const role = (await isBootstrapOpen(env.DB)) ? 'owner' : 'member';
+                        return { data: { ...newUser, role } };
+                    },
+                },
+            },
+        },
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAc;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,KAAK,EAAqB,CAAC;IAC9F,OAAO,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAc;IAClD,OAAO,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAAC,GAAa;IACtC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;IAE7C,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;QACpC,OAAO;QACP,QAAQ,EAAE,cAAc;QACxB,cAAc,EAAE,CAAC,OAAO,CAAC;QACzB,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,6DAA6D;YAC7D,wEAAwE;YACxE,wBAAwB,EAAE,KAAK;YAC/B,wEAAwE;YACxE,wEAAwE;YACxE,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,MAAM,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9E,CAAC;SACF;QACD,IAAI,EAAE;YACJ,gBAAgB,EAAE;gBAChB,oEAAoE;gBACpE,sEAAsE;gBACtE,0DAA0D;gBAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;aACxD;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;wBACxB,MAAM,IAAI,GAAa,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;wBAC5E,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;oBACxC,CAAC;iBACF;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/routes.admin.d.ts

@@ -0,0 +1,22 @@
+import { Hono } from 'hono';
+import type { Bindings } from '../env.js';
+import { type AuthVariables } from '../middleware/auth.js';
+/**
+ * Site users, owner-only in full.
+ *
+ * Public sign-up closes as soon as the first account exists (see the bootstrap
+ * gate in src/index.ts), so this is how everybody after the owner gets in.
+ * Managed we8 does this from an operator command center over an organization
+ * model; standalone, the owner is the operator and there is one site, so it is
+ * four routes over the auth tables.
+ *
+ * Two invariants hold throughout: a site always keeps at least one owner, and
+ * nobody changes or deletes their own account here (the account endpoints
+ * under /api/auth are for that). Together they make it impossible to lock a
+ * site out of its own admin with a single request.
+ */
+export declare const usersAdminRoutes: Hono<{
+    Bindings: Bindings;
+    Variables: AuthVariables;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/auth/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../src/auth/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAyDzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB;cAAwB,QAAQ;eAAa,aAAa;yCAAK,CAAC"}

package/dist/auth/routes.admin.js

@@ -0,0 +1,106 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { ok, USER_ROLES } from '../shared/index.js';
+import { HttpError } from '../lib/errors.js';
+import { parseOrThrow } from '../lib/validate.js';
+import { requireOwner } from '../middleware/auth.js';
+import { createAuth, normalizeRole } from './auth.js';
+const userCreateInputSchema = z.object({
+    email: z.string().email(),
+    name: z.string().min(1).max(200),
+    password: z.string().min(8).max(200),
+});
+const userRoleInputSchema = z.object({
+    role: z.enum(USER_ROLES),
+});
+function toAdminUser(row) {
+    return {
+        id: row.id,
+        email: row.email,
+        name: row.name,
+        role: normalizeRole(row.role),
+        // Better Auth stores its timestamps as epoch seconds; the rest of this API
+        // speaks ISO strings, so the conversion happens at this boundary.
+        createdAt: new Date(row.createdAt * 1000).toISOString(),
+    };
+}
+async function countOwners(db) {
+    const row = await db
+        .prepare(`SELECT COUNT(*) AS count FROM user WHERE role = 'owner'`)
+        .first();
+    return row?.count ?? 0;
+}
+async function fetchUser(db, id) {
+    const row = await db
+        .prepare('SELECT id, email, name, role, createdAt FROM user WHERE id = ?1')
+        .bind(id)
+        .first();
+    if (!row)
+        throw new HttpError('not_found', 'user not found');
+    return row;
+}
+/**
+ * Site users, owner-only in full.
+ *
+ * Public sign-up closes as soon as the first account exists (see the bootstrap
+ * gate in src/index.ts), so this is how everybody after the owner gets in.
+ * Managed we8 does this from an operator command center over an organization
+ * model; standalone, the owner is the operator and there is one site, so it is
+ * four routes over the auth tables.
+ *
+ * Two invariants hold throughout: a site always keeps at least one owner, and
+ * nobody changes or deletes their own account here (the account endpoints
+ * under /api/auth are for that). Together they make it impossible to lock a
+ * site out of its own admin with a single request.
+ */
+export const usersAdminRoutes = new Hono();
+usersAdminRoutes.use('*', requireOwner);
+usersAdminRoutes.get('/', async (c) => {
+    const { results } = await c.env.DB.prepare('SELECT id, email, name, role, createdAt FROM user ORDER BY createdAt ASC').all();
+    return c.json(ok({ items: results.map(toAdminUser) }));
+});
+usersAdminRoutes.post('/', async (c) => {
+    const input = parseOrThrow(userCreateInputSchema, await c.req.json());
+    const auth = createAuth(c.env);
+    // Through the auth API rather than a direct insert, so the password is
+    // hashed by the same code that will later verify it. The returned session is
+    // discarded: this creates an account, it does not sign anyone in.
+    const created = await auth.api.signUpEmail({
+        body: { email: input.email, name: input.name, password: input.password },
+    });
+    return c.json(ok({ user: toAdminUser(await fetchUser(c.env.DB, created.user.id)) }), 201);
+});
+usersAdminRoutes.patch('/:id', async (c) => {
+    const input = parseOrThrow(userRoleInputSchema, await c.req.json());
+    const target = await fetchUser(c.env.DB, c.req.param('id'));
+    if (target.id === c.get('auth').userId) {
+        throw new HttpError('validation_error', 'you cannot change your own role');
+    }
+    if (normalizeRole(target.role) === 'owner' &&
+        input.role !== 'owner' &&
+        (await countOwners(c.env.DB)) <= 1) {
+        throw new HttpError('validation_error', 'a site needs at least one owner');
+    }
+    await c.env.DB.prepare(`UPDATE user SET role = ?2 WHERE id = ?1`)
+        .bind(target.id, input.role)
+        .run();
+    return c.json(ok({ user: toAdminUser(await fetchUser(c.env.DB, target.id)) }));
+});
+usersAdminRoutes.delete('/:id', async (c) => {
+    const target = await fetchUser(c.env.DB, c.req.param('id'));
+    if (target.id === c.get('auth').userId) {
+        throw new HttpError('validation_error', 'you cannot delete your own account');
+    }
+    if (normalizeRole(target.role) === 'owner' && (await countOwners(c.env.DB)) <= 1) {
+        throw new HttpError('validation_error', 'a site needs at least one owner');
+    }
+    // The foreign keys declare ON DELETE CASCADE, but D1 does not enforce
+    // foreign keys by default, so the children go explicitly and first.
+    await c.env.DB.batch([
+        c.env.DB.prepare('DELETE FROM session WHERE userId = ?1').bind(target.id),
+        c.env.DB.prepare('DELETE FROM account WHERE userId = ?1').bind(target.id),
+        c.env.DB.prepare('DELETE FROM user WHERE id = ?1').bind(target.id),
+    ]);
+    return c.json(ok({}));
+});
+//# sourceMappingURL=routes.admin.js.map

package/dist/auth/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/auth/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,EAAE,EAAE,UAAU,EAAiB,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAsB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEtD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;CACzB,CAAC,CAAC;AAkBH,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7B,2EAA2E;QAC3E,kEAAkE;QAClE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,EAAc;IACvC,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,OAAO,CAAC,yDAAyD,CAAC;SAClE,KAAK,EAAqB,CAAC;IAC9B,OAAO,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,EAAc,EAAE,EAAU;IACjD,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,OAAO,CAAC,iEAAiE,CAAC;SAC1E,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,EAAW,CAAC;IACpB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAoD,CAAC;AAE7F,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAExC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CACxC,0EAA0E,CAC3E,CAAC,GAAG,EAAW,CAAC;IACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE/B,uEAAuE;IACvE,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;QACzC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KACzE,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5F,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,IACE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO;QACtC,KAAK,CAAC,IAAI,KAAK,OAAO;QACtB,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC;SAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC;SAC3B,GAAG,EAAE,CAAC;IACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,oCAAoC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC"}