raffel 0.1.2

package/dist/http/auth.d.ts

@@ -0,0 +1,617 @@
+/**
+ * Authentication Middleware
+ *
+ * Provides authentication drivers for various auth strategies:
+ * - Cookie Session: Session-based auth with signed cookies
+ * - Basic Auth: HTTP Basic authentication
+ * - Bearer Token: JWT/API key token authentication
+ *
+ * @example
+ * import { basicAuth, bearerAuth, cookieSession } from 'raffel/http'
+ *
+ * // Basic Auth
+ * app.use('/admin/*', basicAuth({
+ *   username: 'admin',
+ *   password: 'secret',
+ *   realm: 'Admin Area'
+ * }))
+ *
+ * // Bearer Token
+ * app.use('/api/*', bearerAuth({
+ *   verifyToken: async (token) => {
+ *     const user = await verifyJWT(token)
+ *     return user ? { user } : null
+ *   }
+ * }))
+ *
+ * // Cookie Session
+ * app.use('*', cookieSession({
+ *   secret: 'my-secret-key',
+ *   cookieName: 'session',
+ *   maxAge: 86400
+ * }))
+ */
+import type { HttpContextInterface } from './context.js';
+import type { HttpMiddleware } from './app.js';
+/**
+ * Basic auth configuration
+ */
+export interface BasicAuthOptions {
+    /**
+     * Valid username or verification function
+     */
+    username: string | ((username: string, password: string) => boolean | Promise<boolean>);
+    /**
+     * Valid password (if username is string)
+     */
+    password?: string;
+    /**
+     * Realm for WWW-Authenticate header
+     * @default 'Secure Area'
+     */
+    realm?: string;
+    /**
+     * Custom error message
+     */
+    errorMessage?: string;
+    /**
+     * Hash function for password comparison (for timing-safe comparison)
+     */
+    hashFunction?: (password: string) => string | Promise<string>;
+}
+/**
+ * Bearer token configuration
+ */
+export interface BearerAuthOptions<T = unknown> {
+    /**
+     * Token verification function
+     * Returns user/payload data if valid, null/undefined if invalid
+     */
+    verifyToken: (token: string) => T | null | undefined | Promise<T | null | undefined>;
+    /**
+     * Header to extract token from
+     * @default 'authorization'
+     */
+    headerName?: string;
+    /**
+     * Token prefix to strip
+     * @default 'Bearer'
+     */
+    prefix?: string;
+    /**
+     * Also check query parameter for token
+     */
+    queryParam?: string;
+    /**
+     * Key in context to store verified token data
+     * @default 'auth'
+     */
+    contextKey?: string;
+    /**
+     * Custom error message
+     */
+    errorMessage?: string;
+    /**
+     * Realm for WWW-Authenticate header
+     * @default 'api'
+     */
+    realm?: string;
+}
+/**
+ * Cookie session configuration
+ */
+export interface CookieSessionOptions {
+    /**
+     * Secret key for signing cookies
+     */
+    secret: string;
+    /**
+     * Cookie name for session
+     * @default 'session'
+     */
+    cookieName?: string;
+    /**
+     * Session max age in seconds
+     * @default 86400 (24 hours)
+     */
+    maxAge?: number;
+    /**
+     * Cookie path
+     * @default '/'
+     */
+    path?: string;
+    /**
+     * Cookie domain
+     */
+    domain?: string;
+    /**
+     * Secure cookie (HTTPS only)
+     * @default true in production
+     */
+    secure?: boolean;
+    /**
+     * HttpOnly flag
+     * @default true
+     */
+    httpOnly?: boolean;
+    /**
+     * SameSite attribute
+     * @default 'Lax'
+     */
+    sameSite?: 'Strict' | 'Lax' | 'None';
+    /**
+     * Key in context to store session data
+     * @default 'session'
+     */
+    contextKey?: string;
+    /**
+     * Regenerate session ID on each request (rolling sessions)
+     * @default false
+     */
+    rolling?: boolean;
+}
+/**
+ * Session data interface
+ */
+export interface SessionData {
+    id: string;
+    data: Record<string, unknown>;
+    createdAt: number;
+    expiresAt: number;
+}
+/**
+ * Session manager interface for context
+ */
+export interface SessionManager {
+    /**
+     * Get session data
+     */
+    get<T = unknown>(key: string): T | undefined;
+    /**
+     * Set session data
+     */
+    set<T = unknown>(key: string, value: T): void;
+    /**
+     * Delete session key
+     */
+    delete(key: string): void;
+    /**
+     * Clear all session data
+     */
+    clear(): void;
+    /**
+     * Destroy session (removes cookie)
+     */
+    destroy(): void;
+    /**
+     * Regenerate session ID
+     */
+    regenerate(): void;
+    /**
+     * Get all session data
+     */
+    all(): Record<string, unknown>;
+    /**
+     * Check if session has key
+     */
+    has(key: string): boolean;
+    /**
+     * Session ID
+     */
+    readonly id: string;
+    /**
+     * Whether session was modified
+     */
+    readonly modified: boolean;
+}
+/**
+ * Create HTTP Basic Authentication middleware
+ *
+ * @param options - Basic auth configuration
+ * @returns Middleware function
+ *
+ * @example
+ * // Simple username/password
+ * app.use('/admin/*', basicAuth({
+ *   username: 'admin',
+ *   password: 'secret'
+ * }))
+ *
+ * // Custom verification
+ * app.use('/admin/*', basicAuth({
+ *   username: async (user, pass) => {
+ *     const valid = await db.verifyCredentials(user, pass)
+ *     return valid
+ *   }
+ * }))
+ */
+export declare function basicAuth<E extends Record<string, unknown> = Record<string, unknown>>(options: BasicAuthOptions): HttpMiddleware<E>;
+/**
+ * Create Bearer Token Authentication middleware
+ *
+ * @param options - Bearer auth configuration
+ * @returns Middleware function
+ *
+ * @example
+ * // JWT verification
+ * app.use('/api/*', bearerAuth({
+ *   verifyToken: async (token) => {
+ *     try {
+ *       const payload = await jwt.verify(token, secret)
+ *       return payload
+ *     } catch {
+ *       return null
+ *     }
+ *   }
+ * }))
+ *
+ * // API key verification
+ * app.use('/api/*', bearerAuth({
+ *   prefix: 'ApiKey',
+ *   verifyToken: async (key) => {
+ *     const apiKey = await db.findApiKey(key)
+ *     return apiKey ? { user: apiKey.user } : null
+ *   }
+ * }))
+ */
+export declare function bearerAuth<T = unknown, E extends Record<string, unknown> = Record<string, unknown>>(options: BearerAuthOptions<T>): HttpMiddleware<E>;
+/**
+ * Create Cookie Session middleware
+ *
+ * Provides session management via signed cookies.
+ *
+ * @param options - Session configuration
+ * @returns Middleware function
+ *
+ * @example
+ * app.use('*', cookieSession({
+ *   secret: process.env.SESSION_SECRET!,
+ *   maxAge: 60 * 60 * 24 * 7 // 1 week
+ * }))
+ *
+ * // In handler
+ * app.post('/login', async (c) => {
+ *   const session = c.get('session') as SessionManager
+ *   session.set('userId', user.id)
+ *   return c.json({ success: true })
+ * })
+ *
+ * app.get('/profile', async (c) => {
+ *   const session = c.get('session') as SessionManager
+ *   const userId = session.get('userId')
+ *   if (!userId) return c.json({ error: 'Not logged in' }, 401)
+ *   // ...
+ * })
+ */
+export declare function cookieSession<E extends Record<string, unknown> = Record<string, unknown>>(options: CookieSessionOptions): HttpMiddleware<E>;
+/**
+ * Strategy for combining multiple auth methods
+ */
+export type CompositeAuthStrategy = 'any' | 'all' | 'priority';
+/**
+ * Composite auth configuration
+ */
+export interface CompositeAuthOptions<E extends Record<string, unknown> = Record<string, unknown>> {
+    /**
+     * Array of auth middlewares to combine
+     */
+    drivers: HttpMiddleware<E>[];
+    /**
+     * Strategy for combining auth methods
+     * - 'any': First successful auth wins (OR logic) - default
+     * - 'all': All auth methods must pass (AND logic)
+     * - 'priority': Try in order, use first success, fail on first hard error
+     * @default 'any'
+     */
+    strategy?: CompositeAuthStrategy;
+    /**
+     * Custom error message when all auth methods fail
+     */
+    errorMessage?: string;
+    /**
+     * Realm for WWW-Authenticate header
+     * @default 'api'
+     */
+    realm?: string;
+}
+/**
+ * Create composite authentication middleware
+ *
+ * Combines multiple auth drivers with configurable strategies.
+ *
+ * @param options - Composite auth configuration
+ * @returns Middleware function
+ *
+ * @example
+ * // Accept either API key OR JWT token
+ * app.use('/api/*', compositeAuth({
+ *   drivers: [
+ *     bearerAuth({ verifyToken: verifyJWT }),
+ *     bearerAuth({ prefix: 'ApiKey', verifyToken: verifyApiKey })
+ *   ],
+ *   strategy: 'any' // First success wins
+ * }))
+ *
+ * @example
+ * // Require both session AND 2FA token
+ * app.use('/sensitive/*', compositeAuth({
+ *   drivers: [
+ *     cookieSession({ secret }),
+ *     bearerAuth({ headerName: 'x-2fa-token', verifyToken: verify2FA })
+ *   ],
+ *   strategy: 'all' // Both must pass
+ * }))
+ *
+ * @example
+ * // Priority: try JWT first, fall back to API key
+ * app.use('/api/*', compositeAuth({
+ *   drivers: [
+ *     bearerAuth({ verifyToken: verifyJWT }),
+ *     bearerAuth({ prefix: 'ApiKey', verifyToken: verifyApiKey })
+ *   ],
+ *   strategy: 'priority'
+ * }))
+ */
+export declare function compositeAuth<E extends Record<string, unknown> = Record<string, unknown>>(options: CompositeAuthOptions<E>): HttpMiddleware<E>;
+/**
+ * Path rule for path-based auth
+ */
+export interface PathAuthRule<E extends Record<string, unknown> = Record<string, unknown>> {
+    /**
+     * Path pattern to match (supports wildcards: /admin/*, /api/users/:id)
+     */
+    path: string;
+    /**
+     * Auth middleware to apply for this path
+     * Use null to skip auth (public route)
+     */
+    auth: HttpMiddleware<E> | null;
+}
+/**
+ * Path-based auth configuration
+ */
+export interface PathAuthOptions<E extends Record<string, unknown> = Record<string, unknown>> {
+    /**
+     * Array of path rules (evaluated in order, first match wins)
+     */
+    rules: PathAuthRule<E>[];
+    /**
+     * Default auth for paths that don't match any rule
+     * If not provided, requests that don't match any rule pass through
+     */
+    defaultAuth?: HttpMiddleware<E> | null;
+    /**
+     * Custom error message when no rule matches and defaultAuth is not set
+     */
+    errorMessage?: string;
+}
+/**
+ * Create path-based authentication middleware
+ *
+ * Routes requests to different auth middlewares based on URL path.
+ *
+ * @param options - Path auth configuration
+ * @returns Middleware function
+ *
+ * @example
+ * app.use(pathAuth({
+ *   rules: [
+ *     { path: '/public/*', auth: null }, // No auth
+ *     { path: '/admin/*', auth: basicAuth({ username: 'admin', password: 'secret' }) },
+ *     { path: '/api/*', auth: bearerAuth({ verifyToken }) },
+ *   ],
+ *   defaultAuth: bearerAuth({ verifyToken }) // Default for unmatched paths
+ * }))
+ */
+export declare function pathAuth<E extends Record<string, unknown> = Record<string, unknown>>(options: PathAuthOptions<E>): HttpMiddleware<E>;
+/**
+ * HTTP methods for path rules
+ */
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS' | '*';
+/**
+ * Path rule with method matching
+ */
+export interface PathMethodRule<E extends Record<string, unknown> = Record<string, unknown>> {
+    /**
+     * Path pattern to match (supports wildcards)
+     */
+    path: string;
+    /**
+     * HTTP method(s) to match. Use '*' for all methods.
+     */
+    method: HttpMethod | HttpMethod[];
+    /**
+     * Auth middleware to apply
+     * Use null to skip auth (public route)
+     */
+    auth: HttpMiddleware<E> | null;
+}
+/**
+ * Path rules configuration
+ */
+export interface PathRulesOptions<E extends Record<string, unknown> = Record<string, unknown>> {
+    /**
+     * Array of path + method rules (evaluated in order, first match wins)
+     */
+    rules: PathMethodRule<E>[];
+    /**
+     * Default auth for requests that don't match any rule
+     */
+    defaultAuth?: HttpMiddleware<E> | null;
+    /**
+     * Custom error for unauthorized requests
+     */
+    errorMessage?: string;
+}
+/**
+ * Create path + method based authentication middleware
+ *
+ * Routes requests to different auth middlewares based on URL path AND HTTP method.
+ * More granular than pathAuth - allows different auth for GET vs POST on same path.
+ *
+ * @param options - Path rules configuration
+ * @returns Middleware function
+ *
+ * @example
+ * app.use(pathRules({
+ *   rules: [
+ *     // Public read, auth for write
+ *     { path: '/api/posts', method: 'GET', auth: null },
+ *     { path: '/api/posts', method: ['POST', 'PUT', 'DELETE'], auth: bearerAuth({ verifyToken }) },
+ *
+ *     // All methods on admin require auth
+ *     { path: '/admin/*', method: '*', auth: basicAuth({ username, password }) },
+ *   ]
+ * }))
+ */
+export declare function pathRules<E extends Record<string, unknown> = Record<string, unknown>>(options: PathRulesOptions<E>): HttpMiddleware<E>;
+/**
+ * Login throttle configuration
+ */
+export interface LoginThrottleOptions {
+    /**
+     * Maximum failed attempts before blocking
+     * @default 5
+     */
+    maxAttempts?: number;
+    /**
+     * Time window for counting attempts (ms)
+     * @default 900000 (15 minutes)
+     */
+    windowMs?: number;
+    /**
+     * How long to block after max attempts (ms)
+     * @default 3600000 (1 hour)
+     */
+    blockDurationMs?: number;
+    /**
+     * Optional callback when an IP gets blocked
+     */
+    onBlock?: (key: string, attempts: number) => void;
+    /**
+     * Optional callback when a blocked attempt occurs
+     */
+    onBlockedAttempt?: (key: string, remainingMs: number) => void;
+}
+/**
+ * Login throttle manager interface
+ */
+export interface LoginThrottleManager {
+    /**
+     * Check if a key (IP/user) is currently blocked
+     */
+    isBlocked(key: string): boolean;
+    /**
+     * Get remaining block time in milliseconds (0 if not blocked)
+     */
+    getBlockTimeRemaining(key: string): number;
+    /**
+     * Record a failed login attempt
+     * Returns true if this attempt triggered a block
+     */
+    recordFailure(key: string): boolean;
+    /**
+     * Reset attempts for a key (call on successful login)
+     */
+    reset(key: string): void;
+    /**
+     * Get current attempt count for a key
+     */
+    getAttempts(key: string): number;
+    /**
+     * Manually block a key
+     */
+    block(key: string, durationMs?: number): void;
+    /**
+     * Manually unblock a key
+     */
+    unblock(key: string): void;
+    /**
+     * Clean up expired entries
+     */
+    cleanup(): void;
+    /**
+     * Get stats about current state
+     */
+    getStats(): {
+        trackedKeys: number;
+        blockedKeys: number;
+    };
+}
+/**
+ * Create a login throttle manager
+ *
+ * Tracks failed login attempts and blocks keys (IPs/users) after too many failures.
+ *
+ * @param options - Throttle configuration
+ * @returns LoginThrottleManager
+ *
+ * @example
+ * const throttle = createLoginThrottle({
+ *   maxAttempts: 5,
+ *   windowMs: 15 * 60 * 1000, // 15 minutes
+ *   blockDurationMs: 60 * 60 * 1000, // 1 hour
+ *   onBlock: (ip) => console.log(`Blocked IP: ${ip}`)
+ * })
+ *
+ * app.post('/login', async (c) => {
+ *   const ip = c.req.header('x-forwarded-for') || 'unknown'
+ *
+ *   if (throttle.isBlocked(ip)) {
+ *     const remaining = throttle.getBlockTimeRemaining(ip)
+ *     return c.json({
+ *       error: 'Too many failed attempts',
+ *       retryAfterMs: remaining
+ *     }, 429)
+ *   }
+ *
+ *   const valid = await verifyCredentials(username, password)
+ *   if (!valid) {
+ *     const blocked = throttle.recordFailure(ip)
+ *     if (blocked) {
+ *       return c.json({ error: 'Account locked due to too many attempts' }, 429)
+ *     }
+ *     return c.json({ error: 'Invalid credentials' }, 401)
+ *   }
+ *
+ *   throttle.reset(ip) // Clear on success
+ *   // ... create session
+ * })
+ */
+export declare function createLoginThrottle(options?: LoginThrottleOptions): LoginThrottleManager;
+/**
+ * Create login throttle middleware
+ *
+ * Automatically blocks requests from IPs with too many failures.
+ * Use with a login endpoint that calls recordFailure on bad credentials.
+ *
+ * @param throttle - Login throttle manager
+ * @param keyGenerator - Function to extract key from request (default: IP address)
+ * @returns Middleware function
+ *
+ * @example
+ * const throttle = createLoginThrottle({ maxAttempts: 5 })
+ *
+ * // Apply middleware to login route
+ * app.post('/login',
+ *   loginThrottleMiddleware(throttle),
+ *   async (c) => {
+ *     // ... verify credentials
+ *     // On failure: throttle.recordFailure(key)
+ *     // On success: throttle.reset(key)
+ *   }
+ * )
+ */
+export declare function loginThrottleMiddleware<E extends Record<string, unknown> = Record<string, unknown>>(throttle: LoginThrottleManager, keyGenerator?: (c: HttpContextInterface<E>) => string): HttpMiddleware<E>;
+declare const _default: {
+    basicAuth: typeof basicAuth;
+    bearerAuth: typeof bearerAuth;
+    cookieSession: typeof cookieSession;
+    compositeAuth: typeof compositeAuth;
+    pathAuth: typeof pathAuth;
+    pathRules: typeof pathRules;
+    createLoginThrottle: typeof createLoginThrottle;
+    loginThrottleMiddleware: typeof loginThrottleMiddleware;
+};
+export default _default;
+//# sourceMappingURL=auth.d.ts.map

package/dist/http/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/http/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AA0B9C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IAEvF;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,OAAO;IAC5C;;;OAGG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IAEpF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAEhB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IAEpC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAA;IAE5C;;OAEG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAA;IAE7C;;OAEG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAEzB;;OAEG;IACH,KAAK,IAAI,IAAI,CAAA;IAEb;;OAEG;IACH,OAAO,IAAI,IAAI,CAAA;IAEf;;OAEG;IACH,UAAU,IAAI,IAAI,CAAA;IAElB;;OAEG;IACH,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAE9B;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAEzB;;OAEG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAEnB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnF,OAAO,EAAE,gBAAgB,GACxB,cAAc,CAAC,CAAC,CAAC,CAqDnB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,UAAU,CACxB,CAAC,GAAG,OAAO,EACX,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAiDlD;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvF,OAAO,EAAE,oBAAoB,GAC5B,cAAc,CAAC,CAAC,CAAC,CAiInB;AAMD;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,CAAA;AAE9D;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/F;;OAEG;IACH,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAA;IAE5B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAEhC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvF,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC/B,cAAc,CAAC,CAAC,CAAC,CA6BnB;AAsPD;;GAEG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACvF;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IAEZ;;;OAGG;IACH,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC1F;;OAEG;IACH,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAA;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IAEtC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClF,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,GAC1B,cAAc,CAAC,CAAC,CAAC,CAqCnB;AAMD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,GAAG,CAAA;AAE/F;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzF;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IAEZ;;OAEG;IACH,MAAM,EAAE,UAAU,GAAG,UAAU,EAAE,CAAA;IAEjC;;;OAGG;IACH,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC3F;;OAEG;IACH,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAA;IAE1B;;OAEG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IAEtC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnF,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,cAAc,CAAC,CAAC,CAAC,CAuCnB;AAkBD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;IAEjD;;OAEG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,CAAA;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAE/B;;OAEG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IAE1C;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAEnC;;OAEG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAExB;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IAEhC;;OAEG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7C;;OAEG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAE1B;;OAEG;IACH,OAAO,IAAI,IAAI,CAAA;IAEf;;OAEG;IACH,QAAQ,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CACzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB,GAAG,oBAAoB,CA2I5F;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjG,QAAQ,EAAE,oBAAoB,EAC9B,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,KAAK,MAAM,GACpD,cAAc,CAAC,CAAC,CAAC,CAuCnB;;;;;;;;;;;AAqCD,wBASC"}