samlesa 3.3.2 → 3.3.4

package/build/src/binding-post.js

@@ -3,7 +3,7 @@
  * @author tngan
  * @desc Binding-level API, declare the functions using POST binding
  */
-import { wording, StatusCode } from './urn.js';
+import { wording, namespace, StatusCode } from './urn.js';
 import { randomUUID } from 'node:crypto';
 import libsaml from './libsaml.js';
 import utility, { get } from './utility.js';
@@ -94,7 +94,7 @@ async function base64LoginResponse({ requestInfo = {}, entity, user = {}, custom
         sp: entity.sp.entityMeta,
     };
     const nameIDFormat = idpSetting.nameIDFormat;
-    const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+    const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : namespace.format.unspecified;
     if (metadata && metadata.idp && metadata.sp) {
         const base = metadata.sp.getAssertionConsumerService(binding.post);
         let rawSamlResponse;

package/build/src/libsaml.js

@@ -140,7 +140,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
      * @type {LoginResponseTemplate}
      */
     const defaultLoginResponseWithoutTResponseTemplate = {
-        context: '<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="{ID}" Version="2.0" IssueInstant="{IssueInstant}" Destination="{Destination}" ><saml:Issuer>{Issuer}</saml:Issuer><samlp:Status><samlp:StatusCode Value="{StatusCode}"/></samlp:Status><saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="{AssertionID}" Version="2.0" IssueInstant="{IssueInstant}"><saml:Issuer>{Issuer}</saml:Issuer><saml:Subject><saml:NameID Format="{NameIDFormat}">{NameID}</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="{SubjectConfirmationDataNotOnOrAfter}" Recipient="{SubjectRecipient}" InResponseTo="{InResponseTo}"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="{ConditionsNotBefore}" NotOnOrAfter="{ConditionsNotOnOrAfter}"><saml:AudienceRestriction><saml:Audience>{Audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions>{AuthnStatement}{AttributeStatement}</saml:Assertion></samlp:Response>',
+        context: '<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="{ID}" Version="2.0" IssueInstant="{IssueInstant}" Destination="{Destination}" ><saml:Issuer>{Issuer}</saml:Issuer><samlp:Status><samlp:StatusCode Value="{StatusCode}"/></samlp:Status><saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="{AssertionID}" Version="2.0" IssueInstant="{IssueInstant}"><saml:Issuer>{Issuer}</saml:Issuer><saml:Subject><saml:NameID Format="{NameIDFormat}">{NameID}</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="{SubjectConfirmationDataNotOnOrAfter}" Recipient="{SubjectRecipient}" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="{ConditionsNotBefore}" NotOnOrAfter="{ConditionsNotOnOrAfter}"><saml:AudienceRestriction><saml:Audience>{Audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions>{AuthnStatement}{AttributeStatement}</saml:Assertion></samlp:Response>',
         attributes: [],
         additionalTemplates: {
             'attributeStatementTemplate': defaultAttributeStatementTemplate,

package/build/src/metadata-sp.js

@@ -220,24 +220,169 @@ export class SpMetadata extends Metadata {
     * @return {string/[string]} URL of endpoint(s)
     */
     getAssertionConsumerService(binding) {
-        if (isString(binding)) {
-            let location;
-            const bindName = namespace.binding[binding];
-            if (isNonEmptyArray(this.meta.assertionConsumerService)) {
-                this.meta.assertionConsumerService.forEach(obj => {
-                    if (obj.binding === bindName) {
-                        location = obj.location;
-                        return;
-                    }
-                });
+        // 1. 预处理 binding 参数
+        // 如果 binding 不是字符串，视为“未指定 Binding 偏好”，直接进入全局兜底逻辑 (Fallback Mode)
+        let targetBindingName = null;
+        let useFallbackMode = false;
+        if (typeof binding === 'string') {
+            const resolved = namespace.binding[binding];
+            if (resolved) {
+                targetBindingName = resolved;
+            }
+            else {
+                // 字符串传入了但 namespace 里没找到，也视为无效，进入兜底
+                console.warn(`[ACS Selection] 未知的 binding 键值: ${binding}, 将启用全局兜底策略.`);
+                useFallbackMode = true;
+            }
+        }
+        else {
+            // 非字符串类型 (null, undefined, object 等)，直接启用兜底
+            console.warn(`[ACS Selection] binding 参数类型错误 (${typeof binding}), 将启用全局兜底策略.`);
+            useFallbackMode = true;
+        }
+        const acsData = this.meta.assertionConsumerService;
+        // 2. 标准化数据为数组
+        let allCandidates = [];
+        if (Array.isArray(acsData)) {
+            allCandidates = acsData;
+        }
+        else if (acsData && typeof acsData === 'object') {
+            allCandidates = [acsData];
+        }
+        else {
+            // 数据源本身为空，直接报错
+            throw new Error("SAML Metadata Error: No AssertionConsumerService definitions found in metadata.");
+        }
+        if (allCandidates.length === 0) {
+            throw new Error("SAML Metadata Error: AssertionConsumerService list is empty.");
+        }
+        /**
+         * 核心排序与选择函数
+         * 输入一个候选数组，返回最佳的一个对象
+         */
+        const selectBestFromList = (list) => {
+            if (list.length === 0)
+                return undefined;
+            if (list.length === 1)
+                return list[0];
+            const tier1 = []; // isDefault === 'true'
+            const tier2 = []; // isDefault 不存在 或 不为 'false'
+            const tier3 = []; // 明确 isDefault === 'false'
+            list.forEach((item, originalIndex) => {
+                const isDef = item.isDefault;
+                const isTrue = (typeof isDef === 'string' && isDef.toLowerCase() === 'true');
+                const isFalse = (typeof isDef === 'string' && isDef.toLowerCase() === 'false');
+                if (isTrue) {
+                    tier1.push(item);
+                }
+                else if (!isFalse) {
+                    tier2.push(item);
+                }
+                else {
+                    tier3.push(item);
+                }
+            });
+            let selectedTier = [];
+            if (tier1.length > 0) {
+                selectedTier = tier1;
+            }
+            else if (tier2.length > 0) {
+                selectedTier = tier2;
+            }
+            else {
+                selectedTier = tier3;
+            }
+            // 二级排序：Index 升序 -> 原始顺序
+            const indexedTier = selectedTier.map((item, idx) => ({ item, originalIdx: idx }));
+            indexedTier.sort((a, b) => {
+                // 安全解析 index
+                let idxA = Infinity;
+                let idxB = Infinity;
+                if (a.item.index !== undefined && a.item.index !== null) {
+                    const parsed = parseInt(a.item.index, 10);
+                    if (!isNaN(parsed))
+                        idxA = parsed;
+                }
+                if (b.item.index !== undefined && b.item.index !== null) {
+                    const parsed = parseInt(b.item.index, 10);
+                    if (!isNaN(parsed))
+                        idxB = parsed;
+                }
+                if (idxA !== idxB) {
+                    return idxA - idxB;
+                }
+                return a.originalIdx - b.originalIdx;
+            });
+            return indexedTier[0].item;
+        };
+        let resultLocation = undefined;
+        // ==========================================
+        // 第一阶段：尝试在指定的 binding 中查找 (仅在非兜底模式下执行)
+        // ==========================================
+        if (!useFallbackMode && targetBindingName) {
+            const matchedByBinding = allCandidates.filter(obj => obj.binding === targetBindingName);
+            console.log(`[ACS Selection] 目标 Binding: ${targetBindingName}`);
+            console.log(`[ACS Selection] 匹配该 Binding 的数量: ${matchedByBinding.length}`);
+            if (matchedByBinding.length > 0) {
+                const bestInBinding = selectBestFromList(matchedByBinding);
+                if (bestInBinding) {
+                    console.log(`[ACS Selection] ✅ (阶段1) 在指定 Binding 中找到最佳项: ${bestInBinding.location}`);
+                    resultLocation = bestInBinding.location;
+                }
+            }
+        }
+        // ==========================================
+        // 第二阶段：降级/兜底策略
+        // 如果第一阶段没找到，或者一开始就进入了兜底模式 (useFallbackMode)
+        // ==========================================
+        if (!resultLocation) {
+            if (useFallbackMode) {
+                console.log(`[ACS Selection] ⚠️ 启用全局兜底策略 (未指定有效 Binding)...`);
             }
             else {
-                if (this.meta.assertionConsumerService.binding === bindName) {
-                    location = this.meta.assertionConsumerService.location;
+                console.log(`[ACS Selection] ⚠️ 指定 Binding 未找到可用项，进入降级策略...`);
+            }
+            // 2.1 全局寻找 isDefault='true'
+            const globalDefaults = allCandidates.filter(obj => obj.isDefault && String(obj.isDefault).toLowerCase() === 'true');
+            if (globalDefaults.length > 0) {
+                const best = selectBestFromList(globalDefaults);
+                if (best) {
+                    console.log(`[ACS Selection] ✅ (阶段2) 跨 Binding 找到 isDefault=true: ${best.location} (${best.binding})`);
+                    resultLocation = best.location;
+                }
+            }
+            // 2.2 全局寻找 isDefault 不为 'false' (隐式默认)
+            if (!resultLocation) {
+                const globalNonFalse = allCandidates.filter(obj => {
+                    const isDef = obj.isDefault;
+                    const isFalse = (typeof isDef === 'string' && isDef.toLowerCase() === 'false');
+                    return !isFalse;
+                });
+                if (globalNonFalse.length > 0) {
+                    const best = selectBestFromList(globalNonFalse);
+                    if (best) {
+                        console.log(`[ACS Selection] ✅ (阶段3) 跨 Binding 找到隐式默认: ${best.location} (${best.binding})`);
+                        resultLocation = best.location;
+                    }
+                }
+            }
+            // 2.3 终极兜底：所有数据中 index 最小
+            if (!resultLocation) {
+                const best = selectBestFromList(allCandidates);
+                if (best) {
+                    console.log(`[ACS Selection] ✅ (阶段4) 终极兜底，选择 index 最小: ${best.location} (${best.binding})`);
+                    resultLocation = best.location;
                 }
             }
-            return location;
         }
-        return this.meta.assertionConsumerService;
+        // ==========================================
+        // 最终检查：如果还是没找到，抛出错误
+        // ==========================================
+        if (!resultLocation) {
+            const errorMsg = "SAML Configuration Error: Unable to select any valid AssertionConsumerService URL. Metadata might be empty or malformed.";
+            console.error(`[ACS Selection] ❌ ${errorMsg}`);
+            throw new Error(errorMsg);
+        }
+        return resultLocation;
     }
 }

package/build/src/urn.js

@@ -61,17 +61,49 @@ const namespace = {
     authnContextClassRef: {
         password: 'urn:oasis:names:tc:SAML:2.0:ac:classes:Password',
         passwordProtectedTransport: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
+        tlsClient: 'urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient',
+        previousSession: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession',
+    },
+    // 【新增】认证上下文比较方式 (用于 <RequestedAuthnContext Comparison="...">)
+    authnContextComparison: {
+        exact: 'exact',
+        minimum: 'minimum',
+        maximum: 'maximum',
+        better: 'better',
     },
     format: {
+        // NameID Formats (用于 <saml:NameID Format="...">)
         emailAddress: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
         persistent: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
         transient: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-        entity: 'urn:oasis:names:tc:SAML:2.0:nameid-format:entity',
         unspecified: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
+        entity: 'urn:oasis:names:tc:SAML:2.0:nameid-format:entity',
         kerberos: 'urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos',
         windowsDomainQualifiedName: 'urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName',
         x509SubjectName: 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName',
     },
+    attributeNameFormat: {
+        // 最常用：简单的字符串名称 (如 "uid", "email")
+        basic: 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic',
+        // 常用：URI 风格 (如 "http://schemas.xmlsoap.org/claims/uid")
+        uri: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+        // 常用：OID 风格 (如 "0.9.2342.19200300.100.1.1")，通常也归类为 uri 或单独定义
+        // 注意：SAML 标准中 OID 通常使用 'uri' 格式，或者有些特定实现有专门的 oid 标识，
+        // 但标准定义的只有 basic, uri, 和 unspecified。
+        // 如果一定要显式区分 OID，有些库会自定义，但标准 URI 如下：
+        unspecified: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified',
+        // 较少用：基于 X.509 属性证书的定义
+        x500dn: 'urn:oasis:names:tc:SAML:2.0:attrname-format:X500DN',
+    },
+    consent: {
+        unspecified: 'urn:oasis:names:tc:SAML:2.0:consent:unspecified', // 默认
+        obtained: 'urn:oasis:names:tc:SAML:2.0:consent:obtained', // 已获得同意
+        prior: 'urn:oasis:names:tc:SAML:2.0:consent:prior', // 之前已获得
+        explicit: 'urn:oasis:names:tc:SAML:2.0:consent:explicit', // 明确同意
+        implicit: 'urn:oasis:names:tc:SAML:2.0:consent:implicit', // 隐式同意
+        denied: 'urn:oasis:names:tc:SAML:2.0:consent:denied', // 拒绝
+        unavailable: 'urn:oasis:names:tc:SAML:2.0:consent:unavailable', // 无法获取同意状态
+    },
     statusCode: {
         // permissible top-level status codes
         success: 'urn:oasis:names:tc:SAML:2.0:status:Success',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "samlesa",
-  "version": "3.3.2",
+  "version": "3.3.4",
   "description": "High-level API for Single Sign On (SAML 2.0) baseed on samlify ",
   "main": "build/index.js",
   "keywords": [

package/types/src/metadata-sp.d.ts

@@ -32,6 +32,6 @@ export declare class SpMetadata extends Metadata {
     * @param  {string} binding         protocol binding (e.g. redirect, post)
     * @return {string/[string]} URL of endpoint(s)
     */
-    getAssertionConsumerService(binding: string): string | string[];
+    getAssertionConsumerService(binding: string): string;
 }
 //# sourceMappingURL=metadata-sp.d.ts.map

package/types/src/metadata-sp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata-sp.d.ts","sourceRoot":"","sources":["../../src/metadata-sp.ts"],"names":[],"mappings":"AAAA;;;;EAIE;AACF,OAAO,QAAQ,EAAE,EAAC,KAAK,iBAAiB,EAAC,MAAM,eAAe,CAAC;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAMxD,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;CAE7D;AAeD,MAAM,CAAC,OAAO,WAAU,IAAI,EAAE,qBAAqB,cAElD;AAED;;EAEE;AACF,qBAAa,UAAW,SAAQ,QAAQ;IAEtC;;;MAGE;gBACU,IAAI,EAAE,qBAAqB;IAiNvC;;;MAGE;IACK,sBAAsB,IAAI,OAAO;IAGxC;;;MAGE;IACK,oBAAoB,IAAI,OAAO;IAGtC;;;;MAIE;IACK,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE;CAoBvE"}
+{"version":3,"file":"metadata-sp.d.ts","sourceRoot":"","sources":["../../src/metadata-sp.ts"],"names":[],"mappings":"AAAA;;;;EAIE;AACF,OAAO,QAAQ,EAAE,EAAC,KAAK,iBAAiB,EAAC,MAAM,eAAe,CAAC;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAMxD,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;CAE7D;AAeD,MAAM,CAAC,OAAO,WAAU,IAAI,EAAE,qBAAqB,cAElD;AAED;;EAEE;AACF,qBAAa,UAAW,SAAQ,QAAQ;IAEtC;;;MAGE;gBACU,IAAI,EAAE,qBAAqB;IAiNvC;;;MAGE;IACK,sBAAsB,IAAI,OAAO;IAGxC;;;MAGE;IACK,oBAAoB,IAAI,OAAO;IAGtC;;;;MAIE;IACK,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;CAsL5D"}

package/types/src/urn.d.ts

@@ -56,17 +56,40 @@ declare const namespace: {
     authnContextClassRef: {
         password: string;
         passwordProtectedTransport: string;
+        tlsClient: string;
+        previousSession: string;
+    };
+    authnContextComparison: {
+        exact: string;
+        minimum: string;
+        maximum: string;
+        better: string;
     };
     format: {
         emailAddress: string;
         persistent: string;
         transient: string;
-        entity: string;
         unspecified: string;
+        entity: string;
         kerberos: string;
         windowsDomainQualifiedName: string;
         x509SubjectName: string;
     };
+    attributeNameFormat: {
+        basic: string;
+        uri: string;
+        unspecified: string;
+        x500dn: string;
+    };
+    consent: {
+        unspecified: string;
+        obtained: string;
+        prior: string;
+        explicit: string;
+        implicit: string;
+        denied: string;
+        unavailable: string;
+    };
     statusCode: {
         success: string;
         requester: string;

package/types/src/urn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"urn.d.ts","sourceRoot":"","sources":["../../src/urn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oBAAY,gBAAgB;IAC1B,QAAQ,uDAAuD;IAC/D,IAAI,mDAAmD;IACvD,UAAU,8DAA8D;IACxE,QAAQ,uDAAuD;CAChE;AAED,oBAAY,qBAAqB;IAC/B,GAAG,sBAAsB;IACzB,GAAG,sBAAsB;CAC1B;AAED,oBAAY,UAAU;IAEpB,OAAO,+CAA+C;IACtD,SAAS,iDAAiD;IAC1D,SAAS,iDAAiD;IAC1D,eAAe,uDAAuD;IAEtE,UAAU,mDAAmD;IAC7D,sBAAsB,8DAA8D;IACpF,mBAAmB,2DAA2D;IAC9E,cAAc,sDAAsD;IACpE,cAAc,sDAAsD;IACpE,SAAS,iDAAiD;IAC1D,cAAc,sDAAsD;IACpE,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,wBAAwB,gEAAgE;IACxF,qBAAqB,6DAA6D;IAClF,oBAAoB,4DAA4D;IAChF,qBAAqB,6DAA6D;IAClF,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;IAC5E,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;CAC7E;AAED,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwDd,CAAC;AAEF,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BT,CAAC;AAEF,QAAA,MAAM,qBAAqB;;;;;CAK1B,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2EZ;;;WAGG;;;;;;;;;;;;;CAwBN,CAAC;AAcF,oBAAY,UAAU;IACpB,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;CAClC;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;CAyBZ,CAAC;AAIF,QAAA,MAAM,aAAa;;;;CAIlB,CAAC;AAEF,OAAO,EAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAC,CAAC"}
+{"version":3,"file":"urn.d.ts","sourceRoot":"","sources":["../../src/urn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oBAAY,gBAAgB;IAC1B,QAAQ,uDAAuD;IAC/D,IAAI,mDAAmD;IACvD,UAAU,8DAA8D;IACxE,QAAQ,uDAAuD;CAChE;AAED,oBAAY,qBAAqB;IAC/B,GAAG,sBAAsB;IACzB,GAAG,sBAAsB;CAC1B;AAED,oBAAY,UAAU;IAEpB,OAAO,+CAA+C;IACtD,SAAS,iDAAiD;IAC1D,SAAS,iDAAiD;IAC1D,eAAe,uDAAuD;IAEtE,UAAU,mDAAmD;IAC7D,sBAAsB,8DAA8D;IACpF,mBAAmB,2DAA2D;IAC9E,cAAc,sDAAsD;IACpE,cAAc,sDAAsD;IACpE,SAAS,iDAAiD;IAC1D,cAAc,sDAAsD;IACpE,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,wBAAwB,gEAAgE;IACxF,qBAAqB,6DAA6D;IAClF,oBAAoB,4DAA4D;IAChF,qBAAqB,6DAA6D;IAClF,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;IAC5E,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;CAC7E;AAED,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8Fd,CAAC;AAEF,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BT,CAAC;AAEF,QAAA,MAAM,qBAAqB;;;;;CAK1B,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2EZ;;;WAGG;;;;;;;;;;;;;CAwBN,CAAC;AAcF,oBAAY,UAAU;IACpB,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;CAClC;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;CAyBZ,CAAC;AAIF,QAAA,MAAM,aAAa;;;;CAIlB,CAAC;AAEF,OAAO,EAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAC,CAAC"}