wcz-test 6.24.14 → 6.26.0

package/dist/server.js

@@ -1,45 +1,73 @@
-import { setCookie as u, getCookie as d, deleteCookie as l } from "@tanstack/react-start/server";
-import { generateState as m, generateCodeVerifier as f, decodeIdToken as k } from "arctic";
-import { s as p } from "./env-4ZoUrNqp.js";
-import { e as h, s as g, a as w } from "./session-7yb0BETM.js";
-const C = async (e) => {
-  const o = new URL(e.url).searchParams.get("redirect_uri") || "/", r = m(), s = f(), a = ["openid", "profile", "offline_access", "User.Read"], n = h.createAuthorizationURL(r, s, a);
-  return u("entra_oauth_state", r, {
-    secure: p.NODE_ENV === "production",
+import { setCookie as d, getCookie as u, deleteCookie as l } from "@tanstack/react-start/server";
+import { d as _, g as w, a as m, e as p, s as g, b as k } from "./session-BCQDwl6n.js";
+import { s as h } from "./env-BD4Wc07c.js";
+function v(r) {
+  const e = r.split(".");
+  if (e.length !== 3)
+    throw new Error("Invalid JWT");
+  let o;
+  try {
+    o = new TextDecoder().decode(_(e[1]));
+  } catch {
+    throw new Error("Invalid JWT: Invalid base64url encoding");
+  }
+  let t;
+  try {
+    t = JSON.parse(o);
+  } catch {
+    throw new Error("Invalid JWT: Invalid JSON encoding");
+  }
+  if (typeof t != "object" || t === null)
+    throw new Error("Invalid JWT: Invalid payload");
+  return t;
+}
+function y(r) {
+  try {
+    return v(r);
+  } catch (e) {
+    throw new Error("Invalid ID token", {
+      cause: e
+    });
+  }
+}
+const R = async (r) => {
+  const o = new URL(r.url).searchParams.get("redirect_uri") || "/", t = w(), n = m(), a = ["openid", "profile", "offline_access", "User.Read"], s = p.createAuthorizationURL(t, n, a);
+  return d("entra_oauth_state", t, {
+    secure: h.NODE_ENV === "production",
     path: "/",
     httpOnly: !0,
     sameSite: "lax",
     maxAge: 600
     // 10 minutes
-  }), u("entra_code_verifier", s, {
-    secure: p.NODE_ENV === "production",
+  }), d("entra_code_verifier", n, {
+    secure: h.NODE_ENV === "production",
     path: "/",
     httpOnly: !0,
     sameSite: "lax",
     maxAge: 600
     // 10 minutes,
-  }), u("entra_redirect_uri", o, {
-    secure: p.NODE_ENV === "production",
+  }), d("entra_redirect_uri", o, {
+    secure: h.NODE_ENV === "production",
     path: "/",
     httpOnly: !0,
     sameSite: "lax",
     maxAge: 600
     // 10 minutes,
-  }), Response.redirect(n.href);
-}, E = async (e) => {
-  const t = new URL(e.url), o = t.searchParams.get("code");
+  }), Response.redirect(s.href);
+}, S = async (r) => {
+  const e = new URL(r.url), o = e.searchParams.get("code");
   if (!o) return new Response("Missing code", {
     status: 400
   });
-  const r = t.searchParams.get("state"), s = d("entra_oauth_state") ?? null, a = d("entra_code_verifier") ?? null, n = d("entra_redirect_uri") ?? "/";
-  if (!r || !s || !a || !n) throw new Response("Missing entra oauth data in cookies", {
+  const t = e.searchParams.get("state"), n = u("entra_oauth_state") ?? null, a = u("entra_code_verifier") ?? null, s = u("entra_redirect_uri") ?? "/";
+  if (!t || !n || !a || !s) throw new Response("Missing entra oauth data in cookies", {
     status: 400
   });
-  if (r !== s) return new Response("Invalid oauth state", {
+  if (t !== n) return new Response("Invalid oauth state", {
     status: 400
   });
   l("entra_oauth_state"), l("entra_code_verifier"), l("entra_redirect_uri");
-  const i = await h.validateAuthorizationCode(o, a), _ = i.idToken(), c = k(_);
+  const i = await p.validateAuthorizationCode(o, a), f = i.idToken(), c = y(f);
   return await g({
     refreshToken: i.refreshToken(),
     user: {
@@ -47,23 +75,24 @@ const C = async (e) => {
       name: c.name.split("/")[0],
       email: c.preferred_username
     }
-  }), await w(i.accessToken()), new Response(null, {
+  }), await k(i.accessToken()), new Response(null, {
     status: 302,
     headers: {
-      Location: n
+      Location: s
     }
   });
-}, L = async (e) => {
-  const t = new URL(e.url);
+}, x = async (r) => {
+  const e = new URL(r.url);
   return new Response(null, {
     status: 302,
     headers: {
-      Location: t.href
+      Location: e.href
     }
   });
 };
 export {
-  E as callback,
-  C as login,
-  L as logout
+  S as callback,
+  R as login,
+  x as logout
 };
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sources":["../node_modules/@oslojs/jwt/dist/index.js","../node_modules/arctic/dist/oidc.js","../src/lib/auth/api.ts"],"sourcesContent":["import { decodeBase64, decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from \"@oslojs/encoding\";\nexport function parseJWT(jwt) {\n    const parts = jwt.split(\".\");\n    if (parts.length !== 3) {\n        throw new Error(\"Invalid JWT\");\n    }\n    let jsonHeader;\n    let jsonPayload;\n    let signature;\n    try {\n        jsonHeader = new TextDecoder().decode(decodeBase64urlIgnorePadding(parts[0]));\n        jsonPayload = new TextDecoder().decode(decodeBase64urlIgnorePadding(parts[1]));\n        signature = decodeBase64urlIgnorePadding(parts[2]);\n    }\n    catch {\n        throw new Error(\"Invalid JWT: Invalid base64url encoding\");\n    }\n    let header;\n    let payload;\n    try {\n        header = JSON.parse(jsonHeader);\n        payload = JSON.parse(jsonPayload);\n    }\n    catch {\n        throw new Error(\"Invalid JWT: Invalid JSON encoding\");\n    }\n    if (typeof header !== \"object\" || header === null) {\n        throw new Error(\"Invalid JWT: Invalid header\");\n    }\n    if (typeof payload !== \"object\" || payload === null) {\n        throw new Error(\"Invalid JWT: Invalid payload\");\n    }\n    const signatureMessage = new TextEncoder().encode(parts[0] + \".\" + parts[1]);\n    return [header, payload, signature, signatureMessage];\n}\nexport function decodeJWT(jwt) {\n    const parts = jwt.split(\".\");\n    if (parts.length !== 3) {\n        throw new Error(\"Invalid JWT\");\n    }\n    let jsonPayload;\n    try {\n        jsonPayload = new TextDecoder().decode(decodeBase64urlIgnorePadding(parts[1]));\n    }\n    catch {\n        throw new Error(\"Invalid JWT: Invalid base64url encoding\");\n    }\n    let payload;\n    try {\n        payload = JSON.parse(jsonPayload);\n    }\n    catch {\n        throw new Error(\"Invalid JWT: Invalid JSON encoding\");\n    }\n    if (typeof payload !== \"object\" || payload === null) {\n        throw new Error(\"Invalid JWT: Invalid payload\");\n    }\n    return payload;\n}\nexport function encodeJWT(headerJSON, payloadJSON, signature) {\n    const encodedHeader = encodeBase64urlNoPadding(new TextEncoder().encode(headerJSON));\n    const encodedPayload = encodeBase64urlNoPadding(new TextEncoder().encode(payloadJSON));\n    const encodedSignature = encodeBase64urlNoPadding(signature);\n    const jwt = encodedHeader + \".\" + encodedPayload + \".\" + encodedSignature;\n    return jwt;\n}\nexport function createJWTSignatureMessage(headerJSON, payloadJSON) {\n    const encodedHeader = encodeBase64urlNoPadding(new TextEncoder().encode(headerJSON));\n    const encodedPayload = encodeBase64urlNoPadding(new TextEncoder().encode(payloadJSON));\n    const message = encodedHeader + \".\" + encodedPayload;\n    return new TextEncoder().encode(message);\n}\nexport class JWTClaims {\n    target;\n    constructor(target) {\n        this.target = target;\n    }\n    hasIssuer() {\n        return \"iss\" in this.target;\n    }\n    issuer() {\n        if (\"iss\" in this.target && typeof this.target.iss === \"string\") {\n            return this.target.iss;\n        }\n        throw new Error(\"Invalid or missing 'iss' claim\");\n    }\n    hasSubject() {\n        return \"sub\" in this.target;\n    }\n    subject() {\n        if (\"sub\" in this.target && typeof this.target.sub === \"string\") {\n            return this.target.sub;\n        }\n        throw new Error(\"Invalid or missing 'sub' claim\");\n    }\n    hasAudiences() {\n        return \"aud\" in this.target;\n    }\n    audiences() {\n        if (\"aud\" in this.target && typeof this.target.aud === \"string\") {\n            const audiences = [this.target.aud];\n            return audiences;\n        }\n        if (\"aud\" in this.target && Array.isArray(this.target.aud)) {\n            for (const audience in this.target.aud) {\n                if (typeof audience !== \"string\") {\n                    throw new Error(\"Invalid or missing 'aud' claim\");\n                }\n            }\n            return this.target.aud;\n        }\n        throw new Error(\"Invalid or missing 'aud' claim\");\n    }\n    hasExpiration() {\n        return \"exp\" in this.target;\n    }\n    expiration() {\n        if (\"exp\" in this.target &&\n            typeof this.target.exp === \"number\" &&\n            this.target.exp >= 0 &&\n            Number.isInteger(this.target.exp)) {\n            return new Date(this.target.exp * 1000);\n        }\n        throw new Error(\"Invalid or missing 'exp' claim\");\n    }\n    verifyExpiration() {\n        if (\"exp\" in this.target &&\n            typeof this.target.exp === \"number\" &&\n            this.target.exp >= 0 &&\n            Number.isInteger(this.target.exp)) {\n            return Date.now() < this.target.exp * 1000;\n        }\n        throw new Error(\"Invalid or missing 'exp' claim\");\n    }\n    hasNotBefore() {\n        return \"nbf\" in this.target;\n    }\n    notBefore() {\n        if (\"nbf\" in this.target &&\n            typeof this.target.nbf === \"number\" &&\n            this.target.nbf >= 0 &&\n            Number.isInteger(this.target.nbf)) {\n            return new Date(this.target.nbf * 1000);\n        }\n        throw new Error(\"Invalid or missing 'nbf' claim\");\n    }\n    verifyNotBefore() {\n        if (\"nbf\" in this.target &&\n            typeof this.target.nbf === \"number\" &&\n            this.target.nbf >= 0 &&\n            Number.isInteger(this.target.nbf)) {\n            return Date.now() >= this.target.nbf * 1000;\n        }\n        throw new Error(\"Invalid or missing 'nbf' claim\");\n    }\n    hasIssuedAt() {\n        return \"iat\" in this.target;\n    }\n    issuedAt() {\n        if (\"iat\" in this.target &&\n            typeof this.target.iat === \"number\" &&\n            this.target.iat >= 0 &&\n            Number.isInteger(this.target.iat)) {\n            return new Date(this.target.iat * 1000);\n        }\n        throw new Error(\"Invalid or missing 'iat' claim\");\n    }\n    hasJWTId() {\n        return \"jti\" in this.target;\n    }\n    jwtId() {\n        if (\"jti\" in this.target && typeof this.target.jti === \"string\") {\n            return this.target.jti;\n        }\n        throw new Error(\"Invalid or missing 'jti' claim\");\n    }\n}\nexport class JWSRegisteredHeaders {\n    target;\n    constructor(target) {\n        this.target = target;\n    }\n    hasAlgorithm() {\n        return \"alg\" in this.target;\n    }\n    algorithm() {\n        if (\"alg\" in this.target && typeof this.target.alg === \"string\") {\n            return this.target.alg;\n        }\n        throw new Error(\"Invalid or missing 'alg' claim\");\n    }\n    hasJWKSetURL() {\n        return \"jku\" in this.target;\n    }\n    jwkSetURL() {\n        if (\"jku\" in this.target && typeof this.target.jku === \"string\") {\n            return this.target.jku;\n        }\n        throw new Error(\"Invalid or missing 'jku' claim\");\n    }\n    hasJWK() {\n        return \"jwk\" in this.target;\n    }\n    jwk() {\n        if (\"jwk\" in this.target && typeof this.target.jwk === \"string\") {\n            return this.target.jwk;\n        }\n        throw new Error(\"Invalid or missing 'jwk' claim\");\n    }\n    hasKeyId() {\n        return \"kid\" in this.target;\n    }\n    keyId() {\n        if (\"kid\" in this.target && typeof this.target.kid === \"string\") {\n            return this.target.kid;\n        }\n        throw new Error(\"Invalid or missing 'kid' claim\");\n    }\n    hasX509URL() {\n        return \"x5u\" in this.target;\n    }\n    x509URL() {\n        if (\"x5u\" in this.target && typeof this.target.x5u === \"string\") {\n            return this.target.x5u;\n        }\n        throw new Error(\"Invalid or missing 'x5u' claim\");\n    }\n    hasX509CertificateChain() {\n        return \"x5c\" in this.target;\n    }\n    x509CertificateChain() {\n        if (\"x5c\" in this.target && Array.isArray(this.target.x5c)) {\n            if (this.target.x5c.length === 0) {\n                throw new Error(\"Invalid or missing 'x5c' claim\");\n            }\n            const chain = [];\n            for (const encoded of this.target.x5c) {\n                if (typeof encoded !== \"string\") {\n                    throw new Error(\"Invalid or missing 'x5c' claim\");\n                }\n                try {\n                    chain.push(decodeBase64(encoded));\n                }\n                catch {\n                    throw new Error(\"Invalid or missing 'x5c' claim\");\n                }\n            }\n            return chain;\n        }\n        throw new Error(\"Invalid or missing 'x5c' claim\");\n    }\n    hasX509CertificateSHA1Thumbprint() {\n        return \"x5t\" in this.target;\n    }\n    x509CertificateSHA1Thumbprint() {\n        if (\"x5t\" in this.target && typeof this.target.x5t === \"string\") {\n            try {\n                const thumbprint = decodeBase64urlIgnorePadding(this.target.x5t);\n                return thumbprint;\n            }\n            catch {\n                throw new Error(\"Invalid or missing 'x5t' claim\");\n            }\n        }\n        throw new Error(\"Invalid or missing 'x5t' claim\");\n    }\n    hasX509CertificateSHA256Thumbprint() {\n        return \"x5t#S256\" in this.target;\n    }\n    x509CertificateSHA256Thumbprint() {\n        if (\"x5t#S256\" in this.target && typeof this.target[\"x5t#S256\"] === \"string\") {\n            try {\n                const thumbprint = decodeBase64urlIgnorePadding(this.target[\"x5t#S256\"]);\n                return thumbprint;\n            }\n            catch {\n                throw new Error(\"Invalid or missing 'x5t#S256' claim\");\n            }\n        }\n        throw new Error(\"Invalid or missing 'x5t#S256' claim\");\n    }\n    hasType() {\n        return \"typ\" in this.target;\n    }\n    type() {\n        if (\"typ\" in this.target && typeof this.target.typ === \"string\") {\n            return this.target.typ;\n        }\n        throw new Error(\"Invalid or missing 'typ' claim\");\n    }\n    hasContentType() {\n        return \"cty\" in this.target;\n    }\n    contentType() {\n        if (\"cty\" in this.target && typeof this.target.cty === \"string\") {\n            return this.target.cty;\n        }\n        throw new Error(\"Invalid or missing 'cty' claim\");\n    }\n    hasCritical() {\n        return \"crit\" in this.target;\n    }\n    critical() {\n        if (\"crit\" in this.target && Array.isArray(this.target.crit)) {\n            if (this.target.crit.length === 0) {\n                throw new Error(\"Invalid or missing 'crit' claim\");\n            }\n            for (const audience in this.target.crit) {\n                if (typeof audience !== \"string\") {\n                    throw new Error(\"Invalid or missing 'crit' claim\");\n                }\n            }\n            return this.target.crit;\n        }\n        throw new Error(\"Invalid or missing 'crit' claim\");\n    }\n}\nexport const joseAlgorithmHS256 = \"HS256\";\nexport const joseAlgorithmES256 = \"ES256\";\nexport const joseAlgorithmRS256 = \"RS256\";\n","import * as jwt from \"@oslojs/jwt\";\nexport function decodeIdToken(idToken) {\n    try {\n        return jwt.decodeJWT(idToken);\n    }\n    catch (e) {\n        throw new Error(\"Invalid ID token\", {\n            cause: e\n        });\n    }\n}\n","import { deleteCookie, getCookie, setCookie } from \"@tanstack/react-start/server\";\r\nimport { decodeIdToken, generateCodeVerifier, generateState } from \"arctic\";\r\nimport type jwt from \"jsonwebtoken\";\r\nimport { serverEnv } from \"~/env\";\r\nimport { entraId } from \"~/lib/auth/entra\";\r\nimport { setSessionAccessTokenCookie, setSessionCookie } from \"~/lib/auth/session\";\r\n\r\nexport const login = async (request: Request): Promise<Response> => {\r\n    const url = new URL(request.url);\r\n    const redirectUri = url.searchParams.get(\"redirect_uri\") || \"/\";\r\n\r\n    const state = generateState();\r\n    const codeVerifier = generateCodeVerifier();\r\n    const scopes = [\"openid\", \"profile\", \"offline_access\", \"User.Read\"];\r\n    const authorizationURL = entraId.createAuthorizationURL(state, codeVerifier, scopes);\r\n\r\n    setCookie(\"entra_oauth_state\", state, {\r\n        secure: serverEnv.NODE_ENV === \"production\",\r\n        path: \"/\",\r\n        httpOnly: true,\r\n        sameSite: \"lax\",\r\n        maxAge: 60 * 10 // 10 minutes\r\n    });\r\n\r\n    setCookie(\"entra_code_verifier\", codeVerifier, {\r\n        secure: serverEnv.NODE_ENV === \"production\",\r\n        path: \"/\",\r\n        httpOnly: true,\r\n        sameSite: \"lax\",\r\n        maxAge: 60 * 10 // 10 minutes,\r\n    });\r\n\r\n    setCookie(\"entra_redirect_uri\", redirectUri, {\r\n        secure: serverEnv.NODE_ENV === \"production\",\r\n        path: \"/\",\r\n        httpOnly: true,\r\n        sameSite: \"lax\",\r\n        maxAge: 60 * 10 // 10 minutes,\r\n    });\r\n\r\n    return Response.redirect(authorizationURL.href);\r\n};\r\n\r\nexport const callback = async (request: Request): Promise<Response> => {\r\n    const url = new URL(request.url);\r\n    const code = url.searchParams.get(\"code\");\r\n    if (!code) return new Response(\"Missing code\", { status: 400 });\r\n    const state = url.searchParams.get(\"state\");\r\n    const storedState = getCookie(\"entra_oauth_state\") ?? null;\r\n    const codeVerifier = getCookie(\"entra_code_verifier\") ?? null;\r\n    const redirectUri = getCookie(\"entra_redirect_uri\") ?? \"/\";\r\n\r\n    if (!state || !storedState || !codeVerifier || !redirectUri) throw new Response(\"Missing entra oauth data in cookies\", { status: 400 });\r\n    if (state !== storedState) return new Response(\"Invalid oauth state\", { status: 400 });\r\n\r\n    deleteCookie(\"entra_oauth_state\");\r\n    deleteCookie(\"entra_code_verifier\");\r\n    deleteCookie(\"entra_redirect_uri\");\r\n\r\n    const tokens = await entraId.validateAuthorizationCode(code, codeVerifier);\r\n\r\n    const idToken = tokens.idToken();\r\n    const claims = decodeIdToken(idToken) as jwt.JwtPayload;\r\n\r\n    await setSessionCookie({\r\n        refreshToken: tokens.refreshToken(),\r\n        user: {\r\n            id: claims.oid,\r\n            name: claims.name.split(\"/\")[0],\r\n            email: claims.preferred_username,\r\n        }\r\n    });\r\n\r\n    await setSessionAccessTokenCookie(tokens.accessToken());\r\n\r\n    return new Response(null, {\r\n        status: 302,\r\n        headers: { Location: redirectUri },\r\n    });\r\n};\r\n\r\nexport const logout = async (request: Request): Promise<Response> => {\r\n    const url = new URL(request.url);\r\n\r\n    // const { session } = await validateRequest();\r\n    // if (!session) {\r\n    //     return new Response(null, { status: 302, headers: { Location: \"/\" } });\r\n    // }\r\n    // setCookie(SESSION_COOKIE_NAME, \"\", {\r\n    //     httpOnly: true,\r\n    //     sameSite: \"lax\",\r\n    //     secure: serverEnv.NODE_ENV === \"production\",\r\n    //     maxAge: 0,\r\n    //     path: \"/\",\r\n    // });\r\n\r\n    return new Response(null, { status: 302, headers: { Location: url.href } });\r\n};\r\n"],"names":["decodeJWT","jwt","parts","jsonPayload","decodeBase64urlIgnorePadding","payload","decodeIdToken","idToken","jwt.decodeJWT","login","request","redirectUri","URL","url","searchParams","get","state","generateState","codeVerifier","generateCodeVerifier","scopes","authorizationURL","entraId","createAuthorizationURL","setCookie","secure","serverEnv","NODE_ENV","path","httpOnly","sameSite","maxAge","Response","redirect","href","callback","code","status","storedState","getCookie","deleteCookie","tokens","validateAuthorizationCode","claims","setSessionCookie","refreshToken","user","id","oid","name","split","email","preferred_username","setSessionAccessTokenCookie","accessToken","headers","Location","logout"],"mappings":";;;AAmCO,SAASA,EAAUC,GAAK;AAC3B,QAAMC,IAAQD,EAAI,MAAM,GAAG;AAC3B,MAAIC,EAAM,WAAW;AACjB,UAAM,IAAI,MAAM,aAAa;AAEjC,MAAIC;AACJ,MAAI;AACA,IAAAA,IAAc,IAAI,cAAc,OAAOC,EAA6BF,EAAM,CAAC,CAAC,CAAC;AAAA,EACjF,QACM;AACF,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC7D;AACA,MAAIG;AACJ,MAAI;AACA,IAAAA,IAAU,KAAK,MAAMF,CAAW;AAAA,EACpC,QACM;AACF,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AACA,MAAI,OAAOE,KAAY,YAAYA,MAAY;AAC3C,UAAM,IAAI,MAAM,8BAA8B;AAElD,SAAOA;AACX;ACzDO,SAASC,EAAcC,GAAS;AACnC,MAAI;AACA,WAAOC,EAAcD,CAAO;AAAA,EAChC,SACO,GAAG;AACN,UAAM,IAAI,MAAM,oBAAoB;AAAA,MAChC,OAAO;AAAA,IACnB,CAAS;AAAA,EACL;AACJ;ACHO,MAAME,IAAQ,OAAOC,MAAwC;AAEhE,QAAMC,IADM,IAAIC,IAAIF,EAAQG,GAAG,EACPC,aAAaC,IAAI,cAAc,KAAK,KAEtDC,IAAQC,EAAAA,GACRC,IAAeC,EAAAA,GACfC,IAAS,CAAC,UAAU,WAAW,kBAAkB,WAAW,GAC5DC,IAAmBC,EAAQC,uBAAuBP,GAAOE,GAAcE,CAAM;AAEnFI,SAAAA,EAAU,qBAAqBR,GAAO;AAAA,IAClCS,QAAQC,EAAUC,aAAa;AAAA,IAC/BC,MAAM;AAAA,IACNC,UAAU;AAAA,IACVC,UAAU;AAAA,IACVC,QAAQ;AAAA;AAAA,EAAK,CAChB,GAEDP,EAAU,uBAAuBN,GAAc;AAAA,IAC3CO,QAAQC,EAAUC,aAAa;AAAA,IAC/BC,MAAM;AAAA,IACNC,UAAU;AAAA,IACVC,UAAU;AAAA,IACVC,QAAQ;AAAA;AAAA,EAAK,CAChB,GAEDP,EAAU,sBAAsBb,GAAa;AAAA,IACzCc,QAAQC,EAAUC,aAAa;AAAA,IAC/BC,MAAM;AAAA,IACNC,UAAU;AAAA,IACVC,UAAU;AAAA,IACVC,QAAQ;AAAA;AAAA,EAAK,CAChB,GAEMC,SAASC,SAASZ,EAAiBa,IAAI;AAClD,GAEaC,IAAW,OAAOzB,MAAwC;AACnE,QAAMG,IAAM,IAAID,IAAIF,EAAQG,GAAG,GACzBuB,IAAOvB,EAAIC,aAAaC,IAAI,MAAM;AACxC,MAAI,CAACqB,EAAM,QAAO,IAAIJ,SAAS,gBAAgB;AAAA,IAAEK,QAAQ;AAAA,EAAA,CAAK;AAC9D,QAAMrB,IAAQH,EAAIC,aAAaC,IAAI,OAAO,GACpCuB,IAAcC,EAAU,mBAAmB,KAAK,MAChDrB,IAAeqB,EAAU,qBAAqB,KAAK,MACnD5B,IAAc4B,EAAU,oBAAoB,KAAK;AAEvD,MAAI,CAACvB,KAAS,CAACsB,KAAe,CAACpB,KAAgB,CAACP,EAAa,OAAM,IAAIqB,SAAS,uCAAuC;AAAA,IAAEK,QAAQ;AAAA,EAAA,CAAK;AACtI,MAAIrB,MAAUsB,EAAa,QAAO,IAAIN,SAAS,uBAAuB;AAAA,IAAEK,QAAQ;AAAA,EAAA,CAAK;AAErFG,EAAAA,EAAa,mBAAmB,GAChCA,EAAa,qBAAqB,GAClCA,EAAa,oBAAoB;AAEjC,QAAMC,IAAS,MAAMnB,EAAQoB,0BAA0BN,GAAMlB,CAAY,GAEnEX,IAAUkC,EAAOlC,QAAAA,GACjBoC,IAASrC,EAAcC,CAAO;AAEpC,eAAMqC,EAAiB;AAAA,IACnBC,cAAcJ,EAAOI,aAAAA;AAAAA,IACrBC,MAAM;AAAA,MACFC,IAAIJ,EAAOK;AAAAA,MACXC,MAAMN,EAAOM,KAAKC,MAAM,GAAG,EAAE,CAAC;AAAA,MAC9BC,OAAOR,EAAOS;AAAAA,IAAAA;AAAAA,EAClB,CACH,GAED,MAAMC,EAA4BZ,EAAOa,aAAa,GAE/C,IAAItB,SAAS,MAAM;AAAA,IACtBK,QAAQ;AAAA,IACRkB,SAAS;AAAA,MAAEC,UAAU7C;AAAAA,IAAAA;AAAAA,EAAY,CACpC;AACL,GAEa8C,IAAS,OAAO/C,MAAwC;AACjE,QAAMG,IAAM,IAAID,IAAIF,EAAQG,GAAG;AAc/B,SAAO,IAAImB,SAAS,MAAM;AAAA,IAAEK,QAAQ;AAAA,IAAKkB,SAAS;AAAA,MAAEC,UAAU3C,EAAIqB;AAAAA,IAAAA;AAAAA,EAAK,CAAG;AAC9E;","x_google_ignoreList":[0,1]}