@zintrust/core 0.7.8 → 0.9.0

package/src/middleware/BulletproofAuthMiddleware.js

@@ -93,6 +93,59 @@ const parseBulletproofHeaders = (params) => {
     };
     return { ok: true, deviceId, timezone, signingHeaders };
 };
+const isMissingDeviceStoreRegistration = (error) => {
+    if (!(error instanceof Error))
+        return false;
+    return (error.message.includes("Database connection '") && error.message.includes('is not registered'));
+};
+const normalizeStaticSecrets = (staticSecrets) => {
+    return (staticSecrets?.map((s) => (typeof s === 'string' ? s.trim() : '')).filter((s) => s !== '') ?? []);
+};
+const createDynamicSignedRequestAttempt = (params) => {
+    return async () => {
+        try {
+            return await SignedRequest.verify({
+                ...params.baseParams,
+                getSecretForKeyId: async (keyId) => {
+                    const secretForKey = await params.getSecretForKeyId(keyId, params.req);
+                    const normalized = typeof secretForKey === 'string' ? secretForKey.trim() : '';
+                    return normalized === '' ? undefined : normalized;
+                },
+            });
+        }
+        catch (error) {
+            if (params.hasStaticFallback && isMissingDeviceStoreRegistration(error)) {
+                return { ok: false, code: 'UNKNOWN_KEY', message: 'Unknown key' };
+            }
+            throw error;
+        }
+    };
+};
+const collectSignedRequestAttempts = async (params) => {
+    const staticSecrets = normalizeStaticSecrets(params.staticSecrets);
+    const attemptResolvers = [
+        createDynamicSignedRequestAttempt({
+            req: params.req,
+            baseParams: params.baseParams,
+            getSecretForKeyId: params.getSecretForKeyId,
+            hasStaticFallback: staticSecrets.length > 0,
+        }),
+        ...staticSecrets.map((secret) => async () => {
+            return SignedRequest.verify({
+                ...params.baseParams,
+                getSecretForKeyId: () => secret,
+            });
+        }),
+    ];
+    return Promise.all(attemptResolvers.map(async (attemptResolver) => {
+        try {
+            return { result: await attemptResolver(), error: undefined };
+        }
+        catch (error) {
+            return { result: undefined, error };
+        }
+    }));
+};
 const verifySignedRequest = async (params) => {
     const baseParams = {
         method: params.req.getMethod?.() ?? 'GET',
@@ -108,35 +161,35 @@ const verifySignedRequest = async (params) => {
             return params.verifyNonce(keyId, nonce, ttlMs);
         },
     };
-    const staticSecrets = params.staticSecrets
-        ?.map((s) => (typeof s === 'string' ? s.trim() : ''))
-        .filter((s) => s !== '');
-    const signed = staticSecrets !== undefined && staticSecrets.length > 0
-        ? await (async () => {
-            const attempts = await Promise.all(staticSecrets.map(async (secret) => SignedRequest.verify({
-                ...baseParams,
-                getSecretForKeyId: () => secret,
-            })));
-            // Preserve preference order based on provided secret list.
-            for (const attempt of attempts) {
-                if (attempt.ok === true)
-                    return attempt;
-            }
-            // If any attempt failed for a reason other than signature mismatch, return that.
-            for (const attempt of attempts) {
-                if (attempt.ok === false && attempt.code !== 'INVALID_SIGNATURE')
-                    return attempt;
-            }
-            return { ok: false, code: 'INVALID_SIGNATURE', message: 'Invalid signature' };
-        })()
-        : await SignedRequest.verify({
-            ...baseParams,
-            getSecretForKeyId: async (keyId) => {
-                const secretForKey = await params.getSecretForKeyId(keyId, params.req);
-                const normalized = typeof secretForKey === 'string' ? secretForKey.trim() : '';
-                return normalized === '' ? undefined : normalized;
-            },
-        });
+    const attemptOutcomes = await collectSignedRequestAttempts({
+        req: params.req,
+        baseParams,
+        getSecretForKeyId: params.getSecretForKeyId,
+        staticSecrets: params.staticSecrets,
+    });
+    const attempts = attemptOutcomes.flatMap((attemptOutcome) => {
+        return attemptOutcome.result === undefined ? [] : [attemptOutcome.result];
+    });
+    if (attempts.length === 0) {
+        const firstError = attemptOutcomes.find((attemptOutcome) => attemptOutcome.error !== undefined)?.error;
+        if (firstError !== undefined) {
+            throw firstError;
+        }
+        return { ok: false, message: 'Unauthorized' };
+    }
+    let signed = attempts[0];
+    for (const attempt of attempts) {
+        if (attempt.ok === true) {
+            signed = attempt;
+            break;
+        }
+    }
+    if (signed.ok !== true) {
+        const nonSignatureFailure = attempts.find((attempt) => attempt.ok === false && attempt.code !== 'INVALID_SIGNATURE');
+        if (nonSignatureFailure !== undefined) {
+            signed = nonSignatureFailure;
+        }
+    }
     if (!signed.ok) {
         Logger.debug('Bulletproof auth signed-request verification failed', {
             code: signed.code,
@@ -296,20 +349,31 @@ const resolveSigningConfig = (options) => {
     const signingSecretFromEnv = Env.get('BULLETPROOF_SIGNING_SECRET', appKeyFallback).trim();
     const signingSecret = (options.signingSecret ?? signingSecretFromEnv).trim();
     const backupSecrets = parseBackupSecrets(Env.get('BULLETPROOF_SIGNING_SECRET_BK', ''));
+    const staticSigningSecrets = dedupeSecrets(backupSecrets.filter((secret) => secret.trim() !== '' && secret.trim() !== signingSecret));
     const hasCustomResolver = typeof options.getSecretForKeyId === 'function';
-    const getSecretForKeyId = hasCustomResolver
-        ? options.getSecretForKeyId
-        : async (keyId) => {
-            const device = await BulletproofDeviceStore.findByDeviceId(keyId).catch(() => null);
-            if (device?.signingSecret)
+    let getSecretForKeyId;
+    if (hasCustomResolver) {
+        getSecretForKeyId = options.getSecretForKeyId;
+    }
+    else if (isNonEmptyString(signingSecret)) {
+        getSecretForKeyId = () => signingSecret;
+    }
+    else {
+        getSecretForKeyId = async (keyId) => {
+            const device = await BulletproofDeviceStore.findByDeviceId(keyId);
+            if (device && typeof device.signingSecret === 'string' && device.signingSecret !== '') {
                 return device.signingSecret;
-            return signingSecret === '' ? undefined : signingSecret;
+            }
+            return undefined;
         };
+    }
     const verifyNonce = options.verifyNonce ?? NonceReplay.createMemoryVerifier();
-    const staticSigningSecrets = hasCustomResolver
-        ? undefined
-        : dedupeSecrets([signingSecret, ...backupSecrets]);
-    return { getSecretForKeyId, verifyNonce, staticSigningSecrets };
+    const resolvedStaticSigningSecrets = hasCustomResolver ? undefined : staticSigningSecrets;
+    return {
+        getSecretForKeyId,
+        verifyNonce,
+        staticSigningSecrets: resolvedStaticSigningSecrets,
+    };
 };
 const resolveBulletproof = (options) => {
     return {

package/src/security/BulletproofDeviceStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BulletproofDeviceStore.d.ts","sourceRoot":"","sources":["../../../src/security/BulletproofDeviceStore.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,uBAAuB,GACjE,QAAQ,CAAC;IACP,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC,CAAC;AAkFL,eAAO,MAAM,sBAAsB;6BACF,MAAM,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;mBAiBhE,uBAAuB,GAAG,OAAO,CAAC,6BAA6B,CAAC;+BAsCpD,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;EAYvD,CAAC;AAEH,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"BulletproofDeviceStore.d.ts","sourceRoot":"","sources":["../../../src/security/BulletproofDeviceStore.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,uBAAuB,GACjE,QAAQ,CAAC;IACP,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC,CAAC;AA0ML,eAAO,MAAM,sBAAsB;6BACF,MAAM,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;mBA4BhE,uBAAuB,GAAG,OAAO,CAAC,6BAA6B,CAAC;+BAuDpD,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;EAavD,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/src/security/BulletproofDeviceStore.js

@@ -17,6 +17,18 @@ const getTable = () => {
 const normalizeString = (value) => {
     return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined;
 };
+const normalizeRequiredDeviceId = (value) => {
+    const normalized = normalizeString(value);
+    if (normalized !== undefined)
+        return normalized;
+    throw ErrorFactory.createValidationError('Bulletproof device store requires a non-empty deviceId');
+};
+const normalizeRequiredSigningSecret = (value) => {
+    const normalized = normalizeString(value);
+    if (normalized !== undefined)
+        return normalized;
+    throw ErrorFactory.createValidationError('Bulletproof device store requires a non-empty signingSecret');
+};
 const normalizeDate = (value) => {
     if (value instanceof Date && Number.isFinite(value.getTime()))
         return value;
@@ -26,10 +38,36 @@ const normalizeDate = (value) => {
     }
     return undefined;
 };
-const createMissingTableError = (table, error) => {
-    return ErrorFactory.createConfigError(`Bulletproof device store table '${table}' is missing required columns (run migrations)`, {
+const getErrorMessage = (error) => {
+    return error instanceof Error ? error.message : String(error);
+};
+const isSchemaError = (error) => {
+    const message = getErrorMessage(error).toLowerCase();
+    return (message.includes('no such table') ||
+        message.includes('no such column') ||
+        message.includes('unknown column') ||
+        message.includes('does not exist') ||
+        message.includes('undefined column') ||
+        message.includes('missing column'));
+};
+const createStoreError = (table, operation, error, details) => {
+    if (typeof error === 'object' && error !== null) {
+        const code = error.code;
+        if (typeof code === 'string' && code === 'CONFIG_ERROR') {
+            return error;
+        }
+    }
+    const message = getErrorMessage(error);
+    const detailPayload = { table, operation, error: message, ...details };
+    if (isSchemaError(error)) {
+        return ErrorFactory.createConfigError(`Bulletproof device store table '${table}' is missing required columns (run migrations)`, detailPayload);
+    }
+    return ErrorFactory.createDatabaseError(`Bulletproof device store ${operation} failed`, detailPayload);
+};
+const createInvalidStoredRecordError = (table, deviceId) => {
+    return ErrorFactory.createConfigError('Bulletproof device store returned an invalid record', {
         table,
-        error: error instanceof Error ? error.message : String(error),
+        ...(deviceId === undefined ? {} : { deviceId }),
     });
 };
 const toStoredRecord = (row) => {
@@ -57,63 +95,135 @@ const toStoredRecord = (row) => {
             : { updatedAt: normalizeDate(row['updated_at']) }),
     };
 };
-const toPayload = (record) => {
+const buildInsertPayload = (record) => {
     const lastSeenAt = record.lastSeenAt.toISOString();
+    const deviceId = normalizeRequiredDeviceId(record.deviceId);
+    const signingSecret = normalizeRequiredSigningSecret(record.signingSecret);
     return {
         user_id: normalizeString(record.userId) ?? null,
-        device_id: record.deviceId,
-        signing_secret: record.signingSecret,
+        device_id: deviceId,
+        signing_secret: signingSecret,
         user_agent: normalizeString(record.userAgent) ?? null,
         last_seen_at: lastSeenAt,
         created_at: lastSeenAt,
         updated_at: lastSeenAt,
     };
 };
+const buildUpdatePayload = (record) => {
+    const lastSeenAt = record.lastSeenAt.toISOString();
+    const signingSecret = normalizeRequiredSigningSecret(record.signingSecret);
+    return {
+        user_id: normalizeString(record.userId) ?? null,
+        signing_secret: signingSecret,
+        user_agent: normalizeString(record.userAgent) ?? null,
+        last_seen_at: lastSeenAt,
+        updated_at: lastSeenAt,
+    };
+};
+const buildIgnoreInsert = (db, table, columns, conflictColumns) => {
+    const columnList = columns.join(', ');
+    const placeholders = columns.map(() => '?').join(', ');
+    const driver = db.getType();
+    if (driver === 'sqlite' || driver === 'd1' || driver === 'd1-remote') {
+        return `INSERT OR IGNORE INTO ${table} (${columnList}) VALUES (${placeholders})`;
+    }
+    if (driver === 'mysql') {
+        return `INSERT IGNORE INTO ${table} (${columnList}) VALUES (${placeholders})`;
+    }
+    if (driver === 'postgresql') {
+        return `INSERT INTO ${table} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${conflictColumns.join(', ')}) DO NOTHING`;
+    }
+    if (driver === 'sqlserver') {
+        const sourceColumns = columns.map((_, index) => `v${index + 1}`);
+        const selectClause = sourceColumns.map((name) => `? AS ${name}`).join(', ');
+        const conflictClause = conflictColumns
+            .map((column) => `target.${column} = source.${column}`)
+            .join(' AND ');
+        const insertValues = columns.map((column) => `source.${column}`).join(', ');
+        const sourceProjection = columns
+            .map((column, index) => `${sourceColumns[index]} AS ${column}`)
+            .join(', ');
+        return [
+            `MERGE INTO ${table} WITH (HOLDLOCK) AS target`,
+            `USING (SELECT ${sourceProjection} FROM (SELECT ${selectClause}) seed) AS source`,
+            `ON ${conflictClause}`,
+            `WHEN NOT MATCHED THEN INSERT (${columnList}) VALUES (${insertValues});`,
+        ].join(' ');
+    }
+    return `INSERT INTO ${table} (${columnList}) VALUES (${placeholders})`;
+};
 export const BulletproofDeviceStore = Object.freeze({
     async findByDeviceId(deviceId) {
         if (!isNonEmptyString(deviceId))
             return null;
         const db = useDatabase(undefined, getConnection());
         const table = getTable();
+        const normalizedDeviceId = deviceId.trim();
         try {
             const row = await db
                 .table(table)
-                .where('device_id', '=', deviceId.trim())
+                .where('device_id', '=', normalizedDeviceId)
                 .first();
-            return row === null ? null : toStoredRecord(row);
+            if (row === null) {
+                return null;
+            }
+            const normalized = toStoredRecord(row);
+            if (normalized === null) {
+                throw createInvalidStoredRecordError(table, normalizedDeviceId);
+            }
+            return normalized;
         }
         catch (error) {
-            throw createMissingTableError(table, error);
+            throw createStoreError(table, 'lookup', error, { deviceId: normalizedDeviceId });
         }
     },
     async upsert(record) {
         const db = useDatabase(undefined, getConnection());
         const table = getTable();
-        const payload = toPayload(record);
+        const deviceId = normalizeRequiredDeviceId(record.deviceId);
+        const normalizedUserId = normalizeString(record.userId);
+        const normalizedUserAgent = normalizeString(record.userAgent);
+        const normalizedRecord = {
+            ...record,
+            deviceId,
+            signingSecret: normalizeRequiredSigningSecret(record.signingSecret),
+            ...(normalizedUserId === undefined ? {} : { userId: normalizedUserId }),
+            ...(normalizedUserAgent === undefined ? {} : { userAgent: normalizedUserAgent }),
+        };
+        const insertPayload = buildInsertPayload(normalizedRecord);
+        const updatePayload = buildUpdatePayload(normalizedRecord);
+        const insertColumns = Object.keys(insertPayload);
+        const insertValues = insertColumns.map((column) => insertPayload[column]);
+        const insertSql = buildIgnoreInsert(db, table, insertColumns, ['device_id']);
         try {
-            await db.table(table).where('device_id', '=', record.deviceId).update(payload);
-            const existing = await db
-                .table(table)
-                .where('device_id', '=', record.deviceId)
-                .first();
-            if (existing === null) {
-                await db.table(table).insert(payload);
-            }
-            const stored = await db
-                .table(table)
-                .where('device_id', '=', record.deviceId)
-                .first();
-            const normalized = stored === null ? null : toStoredRecord(stored);
-            if (normalized === null) {
-                throw ErrorFactory.createConfigError('Bulletproof device store returned an invalid record', {
-                    table,
-                    deviceId: record.deviceId,
-                });
-            }
-            return normalized;
+            return await db.transaction(async (transactionDb) => {
+                await transactionDb.table(table).where('device_id', '=', deviceId).update(updatePayload);
+                try {
+                    await transactionDb.execute(insertSql, insertValues);
+                }
+                catch (error) {
+                    const duplicateMessage = getErrorMessage(error).toLowerCase();
+                    const isDuplicateKeyError = duplicateMessage.includes('duplicate') ||
+                        duplicateMessage.includes('unique constraint') ||
+                        duplicateMessage.includes('unique failed') ||
+                        duplicateMessage.includes('duplicate key');
+                    if (!isDuplicateKeyError) {
+                        throw error;
+                    }
+                }
+                const stored = await transactionDb
+                    .table(table)
+                    .where('device_id', '=', deviceId)
+                    .first();
+                const normalized = stored === null ? null : toStoredRecord(stored);
+                if (normalized === null) {
+                    throw createInvalidStoredRecordError(table, deviceId);
+                }
+                return normalized;
+            });
         }
         catch (error) {
-            throw createMissingTableError(table, error);
+            throw createStoreError(table, 'upsert', error, { deviceId });
         }
     },
     async removeByDeviceId(deviceId) {
@@ -121,11 +231,12 @@ export const BulletproofDeviceStore = Object.freeze({
             return;
         const db = useDatabase(undefined, getConnection());
         const table = getTable();
+        const normalizedDeviceId = deviceId.trim();
         try {
-            await db.table(table).where('device_id', '=', deviceId.trim()).delete();
+            await db.table(table).where('device_id', '=', normalizedDeviceId).delete();
         }
         catch (error) {
-            throw createMissingTableError(table, error);
+            throw createStoreError(table, 'delete', error, { deviceId: normalizedDeviceId });
         }
     },
 });

package/src/security/JwtVerifier.d.ts

@@ -0,0 +1,75 @@
+import type { JwtPayload } from './JwtManager';
+export type JwtVerifierAlgorithm = 'RS256';
+type JwtVerifierJsonWebKey = Readonly<{
+    alg?: string;
+    crv?: string;
+    d?: string;
+    dp?: string;
+    dq?: string;
+    e?: string;
+    ext?: boolean;
+    k?: string;
+    key_ops?: string[];
+    kid?: string;
+    kty?: string;
+    n?: string;
+    oth?: unknown[];
+    p?: string;
+    q?: string;
+    qi?: string;
+    use?: string;
+    x?: string;
+    x5c?: string[];
+    x5t?: string;
+    'x5t#S256'?: string;
+    x5u?: string;
+    y?: string;
+}>;
+export type JwtVerifierJwk = JwtVerifierJsonWebKey & Readonly<{
+    kid?: string;
+    alg?: string;
+    use?: string;
+}>;
+export type JwtVerifierJwksDocument = Readonly<{
+    keys: readonly JwtVerifierJwk[];
+}>;
+export type JwtVerifierFailureReason = 'invalid_token_format' | 'invalid_header' | 'invalid_payload' | 'missing_kid' | 'key_not_found' | 'jwks_fetch_failed' | 'invalid_jwks' | 'unsupported_algorithm' | 'invalid_jwk' | 'invalid_signature' | 'issuer_mismatch' | 'audience_mismatch' | 'token_expired' | 'token_not_yet_valid';
+export type JwtVerifierFailure = Readonly<{
+    ok: false;
+    reason: JwtVerifierFailureReason;
+    message: string;
+    details?: unknown;
+}>;
+export type JwtVerifierSuccess = Readonly<{
+    ok: true;
+    payload: JwtPayload;
+    header: Readonly<Record<string, unknown>>;
+    jwk: JwtVerifierJwk;
+    cacheHit?: boolean;
+}>;
+export type JwtVerifierResult = JwtVerifierSuccess | JwtVerifierFailure;
+export type JwtVerifierCommonInput = Readonly<{
+    token: string;
+    algorithm?: JwtVerifierAlgorithm;
+    issuer?: string | readonly string[];
+    audience?: string | readonly string[];
+    nowMs?: number;
+}>;
+export type JwtVerifierWithJwkInput = JwtVerifierCommonInput & Readonly<{
+    jwk: JwtVerifierJwk;
+}>;
+export type JwtVerifierWithJwksInput = JwtVerifierCommonInput & Readonly<{
+    jwksUrl: string;
+    cacheKey?: string;
+    cacheTtlSeconds?: number;
+    fetcher?: typeof fetch;
+}>;
+export declare const JwtVerifier: Readonly<{
+    clearCache: (cacheKey?: string) => void;
+    verifyWithJwk: (input: JwtVerifierWithJwkInput) => Promise<JwtPayload>;
+    verifyWithJwkResult: (input: JwtVerifierWithJwkInput) => Promise<JwtVerifierResult>;
+    verifyWithJwks: (input: JwtVerifierWithJwksInput) => Promise<JwtPayload>;
+    verifyWithJwksResult: (input: JwtVerifierWithJwksInput) => Promise<JwtVerifierResult>;
+}>;
+export default JwtVerifier;
+//# sourceMappingURL=JwtVerifier.d.ts.map

package/src/security/JwtVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtVerifier.d.ts","sourceRoot":"","sources":["../../../src/security/JwtVerifier.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE3C,KAAK,qBAAqB,GAAG,QAAQ,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ,CAAC,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAChD,QAAQ,CAAC;IACP,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEL,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAChC,sBAAsB,GACtB,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,GACb,eAAe,GACf,mBAAmB,GACnB,cAAc,GACd,uBAAuB,GACvB,aAAa,GACb,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,eAAe,GACf,qBAAqB,CAAC;AAE1B,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,GAAG,EAAE,cAAc,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,sBAAsB,GAC1D,QAAQ,CAAC;IACP,GAAG,EAAE,cAAc,CAAC;CACrB,CAAC,CAAC;AAEL,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,GAC3D,QAAQ,CAAC;IACP,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,CAAC,CAAC;AA+aL,eAAO,MAAM,WAAW;4BATO,MAAM,KAAG,IAAI;2BAZR,uBAAuB,KAAG,OAAO,CAAC,UAAU,CAAC;iCA/BvC,uBAAuB,KAAG,OAAO,CAAC,iBAAiB,CAAC;4BAqCzD,wBAAwB,KAAG,OAAO,CAAC,UAAU,CAAC;kCAhC1E,wBAAwB,KAC9B,OAAO,CAAC,iBAAiB,CAAC;EAoD3B,CAAC;AAEH,eAAe,WAAW,CAAC"}