@willyim/idp 0.1.0

package/dist/src/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @willyim/idp — login for apps that don't own identity.
+ *
+ * The IdP is the single source of truth for who someone is and what they may
+ * do. The app runs no auth framework: it owns one session table, which is a
+ * handle to IdP truth rather than a record of it.
+ *
+ * Zero runtime dependencies. `fetch` + WebCrypto + `Request`/`Response`, so the
+ * same build runs on Cloudflare Workers, Node ≥20 and Bun.
+ *
+ *   @willyim/idp               this module — client + session
+ *   @willyim/idp/drizzle       the session store, and the `idp_session` table
+ *   @willyim/idp/react-router  the auth route and the loader guards
+ */
+export { createIdpClient, createPkce, DEFAULT_SCOPES, IdpError, type AuthorizationUrlInput, type Discovery, type IdpClient, type IdpClientOptions, type Tokens, } from "./client.js";
+export { createIdp, DEFAULT_SESSION_COOKIE, safeNext, type Idp, type IdpOptions, type Session, type SessionOptions, } from "./session.js";
+export { memorySessions, type MemorySessionStore, type SessionRecord, type SessionStore, } from "./store.js";
+export { grants, normalizeClaims, PERMISSIONS_CLAIM, WORKSPACES_CLAIM, type Actor, type Claims, type Workspace, } from "./claims.js";
+export { parseDuration, type Duration } from "./duration.js";
+export { clearCookie, parseCookies, readCookie, serializeCookie, type CookieOptions, } from "./cookie.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,eAAe,EACf,UAAU,EACV,cAAc,EACd,QAAQ,EACR,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,QAAQ,EACR,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,cAAc,GACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,MAAM,EACN,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,EACV,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,aAAa,CAAA"}

package/dist/src/index.js

@@ -0,0 +1,20 @@
+/**
+ * @willyim/idp — login for apps that don't own identity.
+ *
+ * The IdP is the single source of truth for who someone is and what they may
+ * do. The app runs no auth framework: it owns one session table, which is a
+ * handle to IdP truth rather than a record of it.
+ *
+ * Zero runtime dependencies. `fetch` + WebCrypto + `Request`/`Response`, so the
+ * same build runs on Cloudflare Workers, Node ≥20 and Bun.
+ *
+ *   @willyim/idp               this module — client + session
+ *   @willyim/idp/drizzle       the session store, and the `idp_session` table
+ *   @willyim/idp/react-router  the auth route and the loader guards
+ */
+export { createIdpClient, createPkce, DEFAULT_SCOPES, IdpError, } from "./client.js";
+export { createIdp, DEFAULT_SESSION_COOKIE, safeNext, } from "./session.js";
+export { memorySessions, } from "./store.js";
+export { grants, normalizeClaims, PERMISSIONS_CLAIM, WORKSPACES_CLAIM, } from "./claims.js";
+export { parseDuration } from "./duration.js";
+export { clearCookie, parseCookies, readCookie, serializeCookie, } from "./cookie.js";

package/dist/src/react-router/index.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @willyim/idp/react-router — the whole auth layer as one splat route and two
+ * guards.
+ *
+ *   // app/routes/auth.$.tsx
+ *   export const { loader, action } = createAuthRoute(({ context }) => context.idp)
+ *
+ *   // anywhere
+ *   const session = await requireSession(args)
+ *   const session = await requirePermission(args, "admin")
+ *
+ * No react-router import: the adapter only ever produces `Response`s and
+ * functions, both of which react-router already understands. That keeps the
+ * subpath dependency-free too, and makes it usable from any framework whose
+ * handlers take a `Request`.
+ */
+import type { Idp, Session } from "../session.js";
+/** The loader/action argument shape, narrowed to what the adapter reads. */
+export type RouteArgs = {
+    request: Request;
+    context?: unknown;
+    params?: Record<string, string | undefined>;
+};
+export type IdpResolver = (args: RouteArgs) => Idp | Promise<Idp>;
+export type AuthRouteOptions = {
+    /** Where this splat route is mounted. Default `/auth`. */
+    basePath?: string;
+    /** Where to land after a login with no `?next=`. Default `/`. */
+    defaultRedirect?: string;
+    /** Where to land after logout. Default `defaultRedirect`. */
+    logoutRedirect?: string;
+    /**
+     * Also end the IdP's SSO session on logout (RP-initiated logout). Default
+     * true. Set false to keep logout app-local — useful while the OAuth client
+     * has no `enable_end_session` / `post_logout_redirect_uris` registered.
+     */
+    idpLogout?: boolean;
+    /**
+     * The registered OAuth redirect URI. Defaults to `${origin}${basePath}/callback`,
+     * which is what you register in the IdP console.
+     */
+    redirectUri?: (request: Request) => string;
+};
+/**
+ * Serves `/auth/login`, `/auth/callback` and `/auth/logout` from a single splat
+ * route. `loader` covers the GET navigations; `action` covers a POSTed logout
+ * (and login), which is what you want from a form so a link prefetch can't log
+ * anyone out.
+ */
+export declare function createAuthRoute(getIdp: IdpResolver, options?: AuthRouteOptions): {
+    loader: (args: RouteArgs) => Promise<Response>;
+    action: (args: RouteArgs) => Promise<Response>;
+};
+export type GuardOptions = {
+    /** Use this Idp instead of `context.idp`. */
+    idp?: Idp;
+    /** Where `requireSession` sends anonymous visitors. Default `/auth/login`. */
+    loginPath?: string;
+    /** Skip the `?next=` round trip. */
+    preserveNext?: boolean;
+};
+/** The session for this request, or null. Never throws for the anonymous case. */
+export declare function getSession(args: RouteArgs, options?: GuardOptions): Promise<Session | null>;
+/**
+ * The session, or a redirect to login preserving where the visitor was going.
+ * Throwing a `Response` is how react-router short-circuits a loader.
+ */
+export declare function requireSession(args: RouteArgs, options?: GuardOptions): Promise<Session>;
+/**
+ * `requireSession` plus a permission check. A logged-out visitor is redirected
+ * to log in; a logged-in one without the permission gets a 403 — re-authenticating
+ * wouldn't help them.
+ */
+export declare function requirePermission(args: RouteArgs, permission: string, options?: GuardOptions): Promise<Session>;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/react-router/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/react-router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGjD,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAC5C,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;AAEjE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAA;CAC3C,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAE,gBAAqB;mBA+ChE,SAAS;mBACT,SAAS;EAE3B;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,6CAA6C;IAC7C,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oCAAoC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,kFAAkF;AAClF,wBAAsB,UAAU,CAC9B,IAAI,EAAE,SAAS,EACf,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAEzB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,EACf,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,OAAO,CAAC,CAMlB"}

package/dist/src/react-router/index.js

@@ -0,0 +1,110 @@
+/**
+ * @willyim/idp/react-router — the whole auth layer as one splat route and two
+ * guards.
+ *
+ *   // app/routes/auth.$.tsx
+ *   export const { loader, action } = createAuthRoute(({ context }) => context.idp)
+ *
+ *   // anywhere
+ *   const session = await requireSession(args)
+ *   const session = await requirePermission(args, "admin")
+ *
+ * No react-router import: the adapter only ever produces `Response`s and
+ * functions, both of which react-router already understands. That keeps the
+ * subpath dependency-free too, and makes it usable from any framework whose
+ * handlers take a `Request`.
+ */
+import { safeNext } from "../session.js";
+/**
+ * Serves `/auth/login`, `/auth/callback` and `/auth/logout` from a single splat
+ * route. `loader` covers the GET navigations; `action` covers a POSTed logout
+ * (and login), which is what you want from a form so a link prefetch can't log
+ * anyone out.
+ */
+export function createAuthRoute(getIdp, options = {}) {
+    const basePath = (options.basePath ?? "/auth").replace(/\/+$/, "");
+    const defaultRedirect = options.defaultRedirect ?? "/";
+    const logoutRedirect = options.logoutRedirect ?? defaultRedirect;
+    const redirectUriFor = (request) => options.redirectUri?.(request) ?? new URL(`${basePath}/callback`, request.url).toString();
+    async function handle(args) {
+        const url = new URL(args.request.url);
+        const action = url.pathname.slice(url.pathname.lastIndexOf("/") + 1);
+        const idp = await getIdp(args);
+        if (action === "login") {
+            const next = safeNext(url.searchParams.get("next"));
+            const { url: authorizeUrl, headers } = await idp.startLogin({
+                redirectUri: redirectUriFor(args.request),
+                next,
+                prompt: url.searchParams.get("prompt") ?? undefined,
+                loginHint: url.searchParams.get("login_hint") ?? undefined,
+            });
+            return redirect(authorizeUrl, headers);
+        }
+        if (action === "callback") {
+            const { headers, next } = await idp.completeLogin(args.request, {
+                redirectUri: redirectUriFor(args.request),
+            });
+            return redirect(next === "/" ? defaultRedirect : next, headers);
+        }
+        if (action === "logout") {
+            const redirectTo = new URL(logoutRedirect, url.origin).toString();
+            const { headers, url: endSession } = await idp.logout(args.request, {
+                redirectTo,
+                idpLogout: options.idpLogout,
+            });
+            // The local session is already gone. If there's no usable end-session URL
+            // we just land the visitor back on the app; the IdP's SSO session simply
+            // outlives the app's.
+            return redirect(endSession ?? redirectTo, headers);
+        }
+        return new Response("not found", { status: 404 });
+    }
+    return {
+        loader: (args) => handle(args),
+        action: (args) => handle(args),
+    };
+}
+/** The session for this request, or null. Never throws for the anonymous case. */
+export async function getSession(args, options = {}) {
+    return resolveIdp(args, options).getSession(args.request);
+}
+/**
+ * The session, or a redirect to login preserving where the visitor was going.
+ * Throwing a `Response` is how react-router short-circuits a loader.
+ */
+export async function requireSession(args, options = {}) {
+    const session = await getSession(args, options);
+    if (session)
+        return session;
+    const url = new URL(args.request.url);
+    const loginUrl = new URL(options.loginPath ?? "/auth/login", url.origin);
+    if (options.preserveNext !== false) {
+        loginUrl.searchParams.set("next", `${url.pathname}${url.search}`);
+    }
+    throw redirect(loginUrl.toString());
+}
+/**
+ * `requireSession` plus a permission check. A logged-out visitor is redirected
+ * to log in; a logged-in one without the permission gets a 403 — re-authenticating
+ * wouldn't help them.
+ */
+export async function requirePermission(args, permission, options = {}) {
+    const session = await requireSession(args, options);
+    if (!session.can(permission)) {
+        throw new Response(`Forbidden: missing ${permission}`, { status: 403 });
+    }
+    return session;
+}
+function resolveIdp(args, options) {
+    const idp = options.idp ?? args.context?.idp;
+    if (!idp) {
+        throw new Error("@willyim/idp/react-router: no Idp found. Put it on the load context as `idp`, " +
+            "or pass `{ idp }` to the guard.");
+    }
+    return idp;
+}
+function redirect(location, headers) {
+    const merged = new Headers(headers);
+    merged.set("location", location);
+    return new Response(null, { status: 302, headers: merged });
+}

package/dist/src/session.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Layer 1 — the app session. The cookie holds an HMAC-signed opaque session id;
+ * everything else lives in the row. The signature is checked before the store is
+ * touched, so a junk cookie never costs a query.
+ *
+ * Permissions are a TTL-cached projection of IdP truth: inside the freshness
+ * window we read the row, past it we re-read `/userinfo`. That per-freshness
+ * call doubles as a liveness ping — it is how a revocation at the IdP reaches
+ * the app, in minutes rather than in session-lengths.
+ */
+import type { Actor, Claims, Workspace } from "./claims.js";
+import { type IdpClientOptions } from "./client.js";
+import { type Duration } from "./duration.js";
+import type { SessionStore } from "./store.js";
+export declare const DEFAULT_SESSION_COOKIE = "idp_session";
+export type SessionOptions = {
+    /** HMAC key for the session cookie. Rotating it logs everyone out. */
+    secret: string;
+    /** Idle timeout. Slides on use via `updateAge`. Default `"7d"`. */
+    expiresIn?: Duration;
+    /** Only slide the expiry once the session is this far into its life. Default `"1d"`. */
+    updateAge?: Duration;
+    /** How long cached claims are trusted before `/userinfo` is re-read. Default `"5m"`. */
+    freshness?: Duration;
+    /** Hard cap measured from login — no amount of sliding gets past it. */
+    absoluteExpiresIn?: Duration;
+    cookieName?: string;
+    cookieDomain?: string;
+    /** Off only for local http development. Default true. */
+    secure?: boolean;
+    sameSite?: "lax" | "strict" | "none";
+    path?: string;
+};
+export type IdpOptions = IdpClientOptions & {
+    sessions: SessionStore;
+    session: SessionOptions;
+    /** Testing hook: the clock the session logic reads. */
+    now?: () => Date;
+    /** Emit dev-mode warnings (clamped session length, …). Default: off in production. */
+    debug?: boolean;
+};
+/**
+ * A live session. Safe to project into loader data — it carries claims, never
+ * tokens. `can()` and `renewCookie()` are methods, so a plain serialization of
+ * this object gives the browser exactly the data and none of the behaviour.
+ */
+export type Session = {
+    id: string;
+    sub: string;
+    email: string;
+    name: string | null;
+    image: string | null;
+    permissions: string[];
+    workspaces: Workspace[];
+    actor: Actor | null;
+    createdAt: Date;
+    expiresAt: Date;
+    /** Exact match, or a `resource:*` / `*` grant that covers it. */
+    can(permission: string): boolean;
+    /**
+     * The `Set-Cookie` that extends the browser's cookie to match a session whose
+     * expiry just slid, or null when nothing changed. Attach it to the response
+     * if you want sliding sessions to survive the cookie's own `Max-Age`.
+     */
+    renewCookie(): string | null;
+};
+export type Idp = ReturnType<typeof createIdp>;
+export declare function createIdp(options: IdpOptions): {
+    /** The Layer 0 client, for anything the session layer doesn't wrap. */
+    client: {
+        discover: () => Promise<import("./client.js").Discovery>;
+        authorizationUrl(input: import("./client.js").AuthorizationUrlInput): Promise<string>;
+        exchangeCode(input: {
+            code: string;
+            redirectUri: string;
+            codeVerifier: string;
+        }): Promise<import("./client.js").Tokens>;
+        refresh(refreshToken: string): Promise<import("./client.js").Tokens>;
+        userinfo(accessToken: string): Promise<Claims>;
+        logoutUrl(input: {
+            idToken?: string | null;
+            redirectTo?: string;
+        }): Promise<string | null>;
+    };
+    /**
+     * Step one of login: where to send the browser, plus the `Set-Cookie` that
+     * carries the CSRF state and the PKCE verifier through the round trip.
+     */
+    startLogin(input: {
+        redirectUri: string;
+        /** Path to return to after the callback. Only same-site paths are honoured. */
+        next?: string;
+        prompt?: string;
+        loginHint?: string;
+    }): Promise<{
+        url: string;
+        headers: Headers;
+    }>;
+    /**
+     * Step two: verify the state, exchange the code, read live claims, and write
+     * the session row. Returns the `Set-Cookie` headers and where to go next.
+     */
+    completeLogin(request: Request, input: {
+        redirectUri: string;
+    }): Promise<{
+        session: Session;
+        headers: Headers;
+        next: string;
+    }>;
+    /**
+     * The session for this request, or null. One store read on the common path;
+     * a `/userinfo` round trip once the freshness window has closed.
+     */
+    getSession(request: Request): Promise<Session | null>;
+    /**
+     * Log this browser out: delete the row, expire the cookie. The returned
+     * headers also clear any half-finished login state.
+     */
+    destroySession: (request: Request) => Promise<Headers>;
+    /** Log a subject out of every browser. Instant — revocation is a row delete. */
+    destroyAllSessions(sub: string): Promise<void>;
+    /**
+     * Log out locally *and* at the IdP. The row is deleted and the cookie
+     * expired before anything else happens, so however the RP-initiated logout
+     * goes — endpoint missing, client not registered for it, IdP down — the
+     * visitor is never left signed in here.
+     *
+     * `url` is the IdP's end-session URL to send the browser to, or null when
+     * there isn't a usable one; redirect somewhere local in that case.
+     */
+    logout(request: Request, input?: {
+        redirectTo?: string;
+        idpLogout?: boolean;
+    }): Promise<{
+        headers: Headers;
+        url: string | null;
+    }>;
+};
+/** Only same-site paths survive as `?next=` — an open redirect is not a feature. */
+export declare function safeNext(next: string | null | undefined): string | undefined;
+//# sourceMappingURL=session.d.ts.map

package/dist/src/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE3D,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAA;AAQpB,OAAO,EAAiB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,YAAY,CAAA;AAE7D,eAAO,MAAM,sBAAsB,gBAAgB,CAAA;AAKnD,MAAM,MAAM,cAAc,GAAG;IAC3B,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,SAAS,CAAC,EAAE,QAAQ,CAAA;IACpB,wFAAwF;IACxF,SAAS,CAAC,EAAE,QAAQ,CAAA;IACpB,wFAAwF;IACxF,SAAS,CAAC,EAAE,QAAQ,CAAA;IACpB,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,QAAQ,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yDAAyD;IACzD,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,QAAQ,EAAE,YAAY,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;IAChB,sFAAsF;IACtF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,iEAAiE;IACjE,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;IAChC;;;;OAIG;IACH,WAAW,IAAI,MAAM,GAAG,IAAI,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAA;AAI9C,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU;IAqNzC,uEAAuE;;;;;;;;;;;;mBAnFnD,CAAC;sBACnB,CAAF;;;IAqFA;;;OAGG;sBACqB;QACtB,WAAW,EAAE,MAAM,CAAA;QACnB,+EAA+E;QAC/E,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAuB9C;;;OAGG;2BAEQ,OAAO,SACT;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAmEhE;;;OAGG;wBACuB,OAAO,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAuB3D;;;OAGG;8BAtJkC,OAAO,KAAG,OAAO,CAAC,OAAO,CAAC;IAyJ/D,gFAAgF;4BAClD,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD;;;;;;;;OAQG;oBAEQ,OAAO,UACT;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAClD,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;EAWvD;AAMD,oFAAoF;AACpF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI5E"}