@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/auth-handoff.js

@@ -0,0 +1,482 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { createHash, randomBytes } from "crypto";
+import { safeSameOriginPath } from "@aglyn/shared-util-http/safe-redirect";
+import firebaseAdmin from "./firebase-admin.js";
+import { consumeOnce } from "./consume-once.js";
+import { CONSOLE_DOMAINS_COLLECTION, normalizeConsoleDomain, resolveConsoleDomain } from "./console-domains.js";
+import { safeEqual } from "./safe-equal.js";
+/**
+ * Cross-domain console session handoff — the 1099e mechanism (AGL-1902),
+ * built to `docs/design/agl-1099a-cross-domain-session-handoff.md`.
+ *
+ * ## The problem
+ *
+ * The console's session cookie is minted with `Domain=.aglyn.com`, which is
+ * why workspace subdomains can delegate interactive sign-in to
+ * `auth.aglyn.com` and pick the session back up. `console.acme-agency.com`
+ * shares no parent domain, so that mechanism is not merely inconvenient there,
+ * it is unavailable. A custom console domain needs its own first-party
+ * session, bootstrapped by a hand-off from the auth host.
+ *
+ * ## Threat model
+ *
+ * The credential in flight would, if stolen, be a full session on someone
+ * else's account. Four attacks, and what refuses each:
+ *
+ * 1. **The return secret leaks** — our own edge access logs, a log drain, a
+ *    `Referer` on a subresource, a shoulder. Useless alone: redemption also
+ *    requires the VERIFIER, which lives only in an `HttpOnly` cookie the
+ *    custom domain set on the browser that started the flow. (The secret is
+ *    additionally carried in the URL FRAGMENT, which is never transmitted to
+ *    any server — so the one channel we own and cannot audit never sees it.)
+ * 2. **The attacker starts a flow and phishes the victim into finishing it**,
+ *    so the attacker holds the verifier. Useless: the secret is delivered only
+ *    to the browser that completed sign-in — the victim's.
+ * 3. **The attacker replays a redemption.** Refused by {@link consumeOnce}: the
+ *    record is read and mutated in one serializable transaction, so a second
+ *    consume finds `redeemed` whatever the outcome of the first, and two
+ *    concurrent redemptions cannot both commit.
+ * 4. **The attacker redeems at their own origin**, or points a domain they
+ *    genuinely own at us. Refused twice over: the record names its
+ *    `targetHost` at initiation and redemption requires the request's own
+ *    `Host` to match, and — the load-bearing one —
+ *    {@link authorizeConsoleHandoff} refuses unless the signed-in user is a
+ *    MEMBER of the org that owns the target host. Verified-domain status is
+ *    not sufficient. A victim phished onto `console.aglyn-support.com` signs
+ *    in on the genuine auth host, their credential never touches the
+ *    attacker's origin, and they are told they have no access to that
+ *    workspace.
+ *
+ * The token itself is opaque random bytes with a stored SHA-256, following
+ * `hashApiKey`/`generateApiKeyToken` — not a signed claims blob. Single use
+ * requires a server-side record, and once the record exists a signature buys
+ * nothing and adds a key to keep in step across two Vercel projects.
+ *
+ * ## Two windows, because they answer different questions
+ *
+ * `pending` gets 15 minutes: the user may type a password, do MFA, verify an
+ * email, and a pending record grants nothing. `authorized` gets 120 seconds:
+ * one `location.replace` and one same-origin POST. Anything slower is a broken
+ * flow, not a slow user.
+ *
+ * **Clock skew is not a threat here and the reason is structural: no timestamp
+ * originates in a browser.** Both legs run on our own serverless runtime and
+ * compare against a value another instance of the same runtime wrote. There is
+ * no skew-tolerance parameter to tune, and adding one would only widen the
+ * replay window.
+ *
+ * ## Not built here, and deliberately
+ *
+ * Staff impersonation is refused at authorize. A staff session on
+ * customer-controlled infrastructure is a credential sitting on someone else's
+ * server, and support can use `{slug}.aglyn.com`, which works today.
+ */ const firestore = ()=>firebaseAdmin.app().firestore();
+/** Firestore collection holding pending/authorized handoffs. */ export const AUTH_HANDOFFS_COLLECTION = 'authHandoffs';
+/** Name of the host-only verifier cookie the custom domain sets. */ export const HANDOFF_VERIFIER_COOKIE = '__aglyn_handoff';
+/** initiate → authorize. Generous; a pending record grants nothing. */ export const HANDOFF_PENDING_TTL_MS = 15 * 60 * 1000;
+/** authorize → redeem. One navigation and one same-origin POST. */ export const HANDOFF_AUTHORIZED_TTL_MS = 120 * 1000;
+/** SHA-256 hex, the same shape `hashApiKey` stores. */ export function hashHandoffSecret(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+/** 32 random bytes, base64url — opaque, and carrying nothing to lie about. */ function newSecret() {
+    return randomBytes(32).toString('base64url');
+}
+/**
+ * A `continuePath` that cannot leave the custom domain.
+ *
+ * The handoff lands the user somewhere immediately after signing them in,
+ * which is the worst possible moment to hand control to an attacker-chosen
+ * origin — so this defers to {@link safeSameOriginPath}, which resolves the
+ * value and compares origins instead of testing its shape (AGL-1881).
+ *
+ * This function used to reject `//evil.example` and `/\evil.example` by
+ * inspecting the characters. That list read as complete and was not: the URL
+ * parser deletes tab, LF and CR before parsing, so `/<TAB>/evil.example`
+ * contains neither `//` nor `\` and still resolves to `https://evil.example/`.
+ * Enumerating tricks is the bug; asking the parser is the fix.
+ */ export function safeContinuePath(input) {
+    return safeSameOriginPath(input, '/');
+}
+/**
+ * Create a `pending` handoff for `targetHost`, returning the id and verifier.
+ *
+ * Called on the custom domain, unauthenticated: nothing about a pending record
+ * is a capability. It names the host the request actually arrived on — never a
+ * host from a parameter — which is what makes the `targetHost` check at
+ * redemption mean anything.
+ */ export async function startConsoleHandoff(options) {
+    var _options_nowMs, _options_orgSlug;
+    const targetHost = normalizeConsoleDomain(options.targetHost);
+    if (!targetHost) return null;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const requestId = crypto.randomUUID();
+    const verifier = newSecret();
+    const expiresAtMs = nowMs + HANDOFF_PENDING_TTL_MS;
+    await firestore().collection(AUTH_HANDOFFS_COLLECTION).doc(requestId).set({
+        targetHost,
+        orgSlug: (_options_orgSlug = options.orgSlug) != null ? _options_orgSlug : null,
+        continuePath: safeContinuePath(options.continuePath),
+        verifierHash: hashHandoffSecret(verifier),
+        secretHash: null,
+        status: 'pending',
+        uid: null,
+        tenantId: null,
+        createdAt: nowMs,
+        // A Firestore `Timestamp`, matching the idiom in `passkeys.ts` and
+        // `rate-limit-store.ts`. TTL deletion is best-effort within ~72h, so
+        // EXPIRY IS ENFORCED IN CODE and the TTL policy is hygiene only —
+        // never the other way round.
+        expiresAt: new Date(expiresAtMs)
+    });
+    return {
+        requestId,
+        verifier,
+        expiresAtMs
+    };
+}
+/**
+ * Authorize a pending handoff, on the AUTH HOST, for a signed-in user.
+ *
+ * `isMember` is injected rather than resolved here so this module stays free
+ * of the membership model, and so the test can exercise the refusal without a
+ * membership fixture. It receives the target host as well as the slug because
+ * the ORG ID lives on the claim and `resolveConsoleDomain` deliberately never
+ * returns it — a verdict is read by an unauthenticated route. It is called
+ * only after the domain has been shown to be live, so a refusal never reveals
+ * whether an org exists.
+ *
+ * The write flips `pending → authorized` inside {@link consumeOnce}, so a
+ * second authorize of the same id finds `not-pending`. That matters: without
+ * it, an attacker who obtained a request id could keep re-authorizing it and
+ * mint a fresh secret each time the victim signed in.
+ */ export async function authorizeConsoleHandoff(options) {
+    var _options_nowMs, _peek_get, _peek_get1, _ref;
+    var _consumed_value;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const requestId = options.requestId;
+    if (!requestId || requestId.includes('/')) {
+        return {
+            ok: false,
+            reason: 'unknown-request',
+            orgSlug: null
+        };
+    }
+    const ref = firestore().collection(AUTH_HANDOFFS_COLLECTION).doc(requestId);
+    // Read first, only to answer the questions that need an AWAIT — domain
+    // liveness and membership — because neither can be performed inside a
+    // transaction. Every check that can race is re-made inside `consumeOnce`
+    // below, against the state it reads for itself.
+    let peek;
+    try {
+        peek = await ref.get();
+    } catch (unused) {
+        return {
+            ok: false,
+            reason: 'unknown-request',
+            orgSlug: null
+        };
+    }
+    if (!peek.exists) return {
+        ok: false,
+        reason: 'unknown-request',
+        orgSlug: null
+    };
+    const targetHost = String((_peek_get = peek.get('targetHost')) != null ? _peek_get : '');
+    const orgSlug = (_peek_get1 = peek.get('orgSlug')) != null ? _peek_get1 : null;
+    // Staff impersonation over a custom console domain is refused outright
+    // (AGL-1353 §8.15). A staff session on customer-controlled infrastructure is
+    // a credential sitting on someone else's server; support uses the workspace
+    // subdomain, which works today.
+    if (options.impersonated) {
+        return {
+            ok: false,
+            reason: 'impersonation',
+            orgSlug
+        };
+    }
+    const verdict = await resolveConsoleDomain(targetHost);
+    // `degraded` refuses here, unlike the routing gate. Routing fails OPEN
+    // because a console going dark on a timeout is worse than the residual
+    // exposure; MINTING A SESSION on a domain we could not confirm is live is
+    // the opposite trade, and the user still has a working
+    // `{slug}.aglyn.com` to fall back to.
+    if (!verdict.servable) {
+        return {
+            ok: false,
+            reason: 'domain-inactive',
+            orgSlug: verdict.orgSlug
+        };
+    }
+    // THE check. Verified custom-domain status is not sufficient — an attacker
+    // can verify a domain they genuinely own. Membership in the org that owns
+    // the target host is what makes the feature safe to sell, and it is the
+    // first thing a reviewer should look for.
+    if (!await options.isMember({
+        targetHost,
+        orgSlug: verdict.orgSlug
+    })) {
+        return {
+            ok: false,
+            reason: 'not-a-member',
+            orgSlug: verdict.orgSlug
+        };
+    }
+    const secret = newSecret();
+    const consumed = await consumeOnce(firestore(), ref, (data)=>{
+        var _data_targetHost, _data_createdAt, _data_continuePath, _options_tenantId;
+        if (data['status'] !== 'pending') {
+            return {
+                accept: false,
+                reason: 'not-pending'
+            };
+        }
+        if (String((_data_targetHost = data['targetHost']) != null ? _data_targetHost : '') !== targetHost) {
+            return {
+                accept: false,
+                reason: 'host-mismatch'
+            };
+        }
+        const createdAt = Number((_data_createdAt = data['createdAt']) != null ? _data_createdAt : 0);
+        if (!createdAt || nowMs - createdAt > HANDOFF_PENDING_TTL_MS) {
+            return {
+                accept: false,
+                reason: 'expired'
+            };
+        }
+        return {
+            accept: true,
+            value: {
+                continuePath: String((_data_continuePath = data['continuePath']) != null ? _data_continuePath : '/')
+            },
+            patch: {
+                status: 'authorized',
+                secretHash: hashHandoffSecret(secret),
+                uid: options.uid,
+                tenantId: (_options_tenantId = options.tenantId) != null ? _options_tenantId : null,
+                authorizedAt: nowMs,
+                // The window shortens the moment it is authorized: 120 s, not the
+                // remainder of the pending 15 minutes.
+                expiresAt: new Date(nowMs + HANDOFF_AUTHORIZED_TTL_MS)
+            }
+        };
+    });
+    if (!consumed.ok) {
+        const reason = consumed.reason;
+        return {
+            ok: false,
+            reason: reason === 'absent' ? 'unknown-request' : reason != null ? reason : 'unknown-request',
+            orgSlug: verdict.orgSlug
+        };
+    }
+    return {
+        ok: true,
+        secret,
+        targetHost,
+        continuePath: (_ref = (_consumed_value = consumed.value) == null ? void 0 : _consumed_value.continuePath) != null ? _ref : '/'
+    };
+}
+/**
+ * Consume an authorized handoff, on the CUSTOM DOMAIN.
+ *
+ * Both secrets are required and both are checked INSIDE the transaction, so
+ * the checks cannot be raced against the consume.
+ *
+ * `verifiers` is every value of the `__aglyn_handoff` cookie on the request,
+ * not one. A compromised sibling host under the customer's own apex can set a
+ * `Domain=.acme-agency.com` cookie of the same name, which SHADOWS the
+ * host-only one in the `Cookie` header with no way to tell them apart — the
+ * precise failure AGL-1259 hit with duplicate `__session` cookies. Hashing
+ * every value and accepting if any matches is safe by construction (only the
+ * real `V` hashes to `verifierHash`) and turns a hijack attempt into a no-op
+ * rather than a denial of service.
+ */ export async function redeemConsoleHandoff(options) {
+    var _options_nowMs;
+    var _consumed_value;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const requestId = options.requestId;
+    if (!requestId || requestId.includes('/')) {
+        return {
+            ok: false,
+            reason: 'unknown-request'
+        };
+    }
+    const requestHost = normalizeConsoleDomain(options.requestHost);
+    if (!requestHost) return {
+        ok: false,
+        reason: 'host-mismatch'
+    };
+    // Liveness and revocation, both of which need an AWAIT and so cannot live
+    // inside the transaction. D6 requires BOTH legs of the session to honour the
+    // epoch — "the redemption endpoint and the `GET` exchange" — and this leg is
+    // the one that had neither check.
+    //
+    // It matters because `/api/*` sits OUTSIDE the middleware matcher, so
+    // `serveConsoleDomain` never sees this route: a suspended or detached domain
+    // is refused a console to render and was still handed a working redemption.
+    // And the `GET` exchange cannot cover for it, because the credential a
+    // redemption mints is NEWER than the bump that was supposed to kill it — an
+    // epoch can only refuse a cookie it predates.
+    const verdict = await resolveConsoleDomain(requestHost);
+    // `degraded` refuses here, for `authorize`'s reason: routing fails OPEN
+    // because a console going dark on a timeout is worse than the residual
+    // exposure, but MINTING a session on a domain we could not confirm is live is
+    // the opposite trade, and the user still has `{slug}.aglyn.com` to fall back
+    // to.
+    if (!verdict.servable) return {
+        ok: false,
+        reason: 'domain-inactive'
+    };
+    const epoch = await readConsoleSessionEpoch(requestHost);
+    const ref = firestore().collection(AUTH_HANDOFFS_COLLECTION).doc(requestId);
+    const consumed = await consumeOnce(firestore(), ref, (data)=>{
+        var _data_targetHost, _data_authorizedAt, _data_secretHash, _data_verifierHash, _data_uid, _data_tenantId, _data_continuePath;
+        const status = data['status'];
+        if (status === 'redeemed') {
+            return {
+                accept: false,
+                reason: 'already-redeemed'
+            };
+        }
+        if (status !== 'authorized') {
+            return {
+                accept: false,
+                reason: 'not-authorized'
+            };
+        }
+        // Origin binding, half one: the record names its target and redemption
+        // requires the request's OWN host to match. Half two — the verifier below
+        // — is the load-bearing one, because an unbound token is a theft primitive
+        // even when the attacker controls no domain at all: they would simply POST
+        // it to our own redemption endpoint from their own machine.
+        if (String((_data_targetHost = data['targetHost']) != null ? _data_targetHost : '') !== requestHost) {
+            return {
+                accept: false,
+                reason: 'host-mismatch'
+            };
+        }
+        const authorizedAt = Number((_data_authorizedAt = data['authorizedAt']) != null ? _data_authorizedAt : 0);
+        if (!authorizedAt || nowMs - authorizedAt > HANDOFF_AUTHORIZED_TTL_MS) {
+            return {
+                accept: false,
+                reason: 'expired'
+            };
+        }
+        // D7 orders a detach `sessionEpoch = now` FIRST, then the Vercel delete,
+        // precisely so sessions die while we still control the host. An
+        // authorization that predates the bump is one of those sessions, and it is
+        // refused WITHOUT a write: `consumeOnce` does not destroy a refused record
+        // by default, so this cannot be used to knock out a concurrent legitimate
+        // redemption.
+        if (epoch > 0 && authorizedAt < epoch) {
+            return {
+                accept: false,
+                reason: 'revoked'
+            };
+        }
+        if (!safeEqual(hashHandoffSecret(options.secret), String((_data_secretHash = data['secretHash']) != null ? _data_secretHash : ''))) {
+            return {
+                accept: false,
+                reason: 'bad-secret'
+            };
+        }
+        const verifierHash = String((_data_verifierHash = data['verifierHash']) != null ? _data_verifierHash : '');
+        const verifierOk = options.verifiers.some((candidate)=>safeEqual(hashHandoffSecret(candidate), verifierHash));
+        if (!verifierOk) return {
+            accept: false,
+            reason: 'bad-verifier'
+        };
+        return {
+            accept: true,
+            value: {
+                uid: String((_data_uid = data['uid']) != null ? _data_uid : ''),
+                tenantId: (_data_tenantId = data['tenantId']) != null ? _data_tenantId : null,
+                continuePath: String((_data_continuePath = data['continuePath']) != null ? _data_continuePath : '/')
+            },
+            patch: {
+                status: 'redeemed',
+                redeemedAt: nowMs,
+                // Nothing that could re-authorize it survives the consume.
+                secretHash: null,
+                verifierHash: null
+            }
+        };
+    });
+    if (!consumed.ok || !((_consumed_value = consumed.value) == null ? void 0 : _consumed_value.uid)) {
+        const reason = consumed.reason;
+        return {
+            ok: false,
+            reason: reason === 'absent' ? 'unknown-request' : reason != null ? reason : 'unknown-request'
+        };
+    }
+    return {
+        ok: true,
+        uid: consumed.value.uid,
+        tenantId: consumed.value.tenantId,
+        continuePath: consumed.value.continuePath
+    };
+}
+/**
+ * `consoleDomains/{host}.sessionEpoch`, or `0` when there is no usable one.
+ *
+ * `0` is returned for every unreadable shape — an unnormalizable host, an
+ * absent document, a Firestore error, a non-finite or non-positive value — and
+ * every caller reads `0` as "this control has nothing to say", i.e. FAILS OPEN.
+ * That is deliberate and matches every other console-domain lookup: the Vercel
+ * allowlist is the boundary and this is defence in depth, so a Firestore blip
+ * must not lock every custom domain out of its own session.
+ *
+ * Note the split with {@link consoleSessionEpochRefuses}: failing open on a
+ * missing EPOCH is not the same as failing open on a missing CREDENTIAL DATE.
+ * A cookie whose `iat` cannot be read is refused, because an undateable
+ * credential cannot be shown to postdate a revocation.
+ */ export async function readConsoleSessionEpoch(host) {
+    var _snapshot_get;
+    const domain = normalizeConsoleDomain(host);
+    if (!domain) return 0;
+    let snapshot;
+    try {
+        snapshot = await firestore().collection(CONSOLE_DOMAINS_COLLECTION).doc(domain).get();
+    } catch (unused) {
+        return 0;
+    }
+    if (!snapshot.exists) return 0;
+    const epoch = Number((_snapshot_get = snapshot.get('sessionEpoch')) != null ? _snapshot_get : 0);
+    return Number.isFinite(epoch) && epoch > 0 ? epoch : 0;
+}
+/**
+ * The revocation epoch on a console domain (AGL-1353 D6).
+ *
+ * A session cookie minted before the epoch is dead. Bumping `sessionEpoch` —
+ * which `suspendOnDowngrade` and `releaseConsoleDomain` already do — therefore
+ * invalidates every outstanding cookie for that host instantly, at our
+ * boundary. Our boundary is the ONLY place a Firebase session cookie has any
+ * value: it is opaque and can only be cashed by `verifySessionCookie` under
+ * our Admin credentials.
+ *
+ * Fails OPEN on a read error, matching every other console-domain lookup.
+ */ export async function consoleSessionEpochRefuses(options) {
+    var _options_cookieIssuedAtMs;
+    const epoch = await readConsoleSessionEpoch(options.host);
+    if (epoch <= 0) return false;
+    const issuedAt = Number((_options_cookieIssuedAtMs = options.cookieIssuedAtMs) != null ? _options_cookieIssuedAtMs : 0);
+    // An undateable cookie cannot be shown to postdate the epoch, and the safe
+    // direction for a revocation control is to refuse it.
+    if (!Number.isFinite(issuedAt) || issuedAt <= 0) return true;
+    return issuedAt < epoch;
+}
+
+//# sourceMappingURL=auth-handoff.js.map

package/src/lib/server/auth-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/auth-handoff.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createHash, randomBytes } from 'crypto'\nimport { safeSameOriginPath } from '@aglyn/shared-util-http/safe-redirect'\nimport firebaseAdmin from './firebase-admin'\nimport { consumeOnce } from './consume-once'\nimport {\n  CONSOLE_DOMAINS_COLLECTION,\n  normalizeConsoleDomain,\n  resolveConsoleDomain,\n} from './console-domains'\nimport { safeEqual } from './safe-equal'\n\n/**\n * Cross-domain console session handoff — the 1099e mechanism (AGL-1902),\n * built to `docs/design/agl-1099a-cross-domain-session-handoff.md`.\n *\n * ## The problem\n *\n * The console's session cookie is minted with `Domain=.aglyn.com`, which is\n * why workspace subdomains can delegate interactive sign-in to\n * `auth.aglyn.com` and pick the session back up. `console.acme-agency.com`\n * shares no parent domain, so that mechanism is not merely inconvenient there,\n * it is unavailable. A custom console domain needs its own first-party\n * session, bootstrapped by a hand-off from the auth host.\n *\n * ## Threat model\n *\n * The credential in flight would, if stolen, be a full session on someone\n * else's account. Four attacks, and what refuses each:\n *\n * 1. **The return secret leaks** — our own edge access logs, a log drain, a\n *    `Referer` on a subresource, a shoulder. Useless alone: redemption also\n *    requires the VERIFIER, which lives only in an `HttpOnly` cookie the\n *    custom domain set on the browser that started the flow. (The secret is\n *    additionally carried in the URL FRAGMENT, which is never transmitted to\n *    any server — so the one channel we own and cannot audit never sees it.)\n * 2. **The attacker starts a flow and phishes the victim into finishing it**,\n *    so the attacker holds the verifier. Useless: the secret is delivered only\n *    to the browser that completed sign-in — the victim's.\n * 3. **The attacker replays a redemption.** Refused by {@link consumeOnce}: the\n *    record is read and mutated in one serializable transaction, so a second\n *    consume finds `redeemed` whatever the outcome of the first, and two\n *    concurrent redemptions cannot both commit.\n * 4. **The attacker redeems at their own origin**, or points a domain they\n *    genuinely own at us. Refused twice over: the record names its\n *    `targetHost` at initiation and redemption requires the request's own\n *    `Host` to match, and — the load-bearing one —\n *    {@link authorizeConsoleHandoff} refuses unless the signed-in user is a\n *    MEMBER of the org that owns the target host. Verified-domain status is\n *    not sufficient. A victim phished onto `console.aglyn-support.com` signs\n *    in on the genuine auth host, their credential never touches the\n *    attacker's origin, and they are told they have no access to that\n *    workspace.\n *\n * The token itself is opaque random bytes with a stored SHA-256, following\n * `hashApiKey`/`generateApiKeyToken` — not a signed claims blob. Single use\n * requires a server-side record, and once the record exists a signature buys\n * nothing and adds a key to keep in step across two Vercel projects.\n *\n * ## Two windows, because they answer different questions\n *\n * `pending` gets 15 minutes: the user may type a password, do MFA, verify an\n * email, and a pending record grants nothing. `authorized` gets 120 seconds:\n * one `location.replace` and one same-origin POST. Anything slower is a broken\n * flow, not a slow user.\n *\n * **Clock skew is not a threat here and the reason is structural: no timestamp\n * originates in a browser.** Both legs run on our own serverless runtime and\n * compare against a value another instance of the same runtime wrote. There is\n * no skew-tolerance parameter to tune, and adding one would only widen the\n * replay window.\n *\n * ## Not built here, and deliberately\n *\n * Staff impersonation is refused at authorize. A staff session on\n * customer-controlled infrastructure is a credential sitting on someone else's\n * server, and support can use `{slug}.aglyn.com`, which works today.\n */\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/** Firestore collection holding pending/authorized handoffs. */\nexport const AUTH_HANDOFFS_COLLECTION = 'authHandoffs'\n\n/** Name of the host-only verifier cookie the custom domain sets. */\nexport const HANDOFF_VERIFIER_COOKIE = '__aglyn_handoff'\n\n/** initiate → authorize. Generous; a pending record grants nothing. */\nexport const HANDOFF_PENDING_TTL_MS = 15 * 60 * 1000\n\n/** authorize → redeem. One navigation and one same-origin POST. */\nexport const HANDOFF_AUTHORIZED_TTL_MS = 120 * 1000\n\nexport type HandoffStatus = 'pending' | 'authorized' | 'redeemed'\n\n/** SHA-256 hex, the same shape `hashApiKey` stores. */\nexport function hashHandoffSecret(value: string): string {\n  return createHash('sha256').update(value, 'utf8').digest('hex')\n}\n\n/** 32 random bytes, base64url — opaque, and carrying nothing to lie about. */\nfunction newSecret(): string {\n  return randomBytes(32).toString('base64url')\n}\n\n/**\n * A `continuePath` that cannot leave the custom domain.\n *\n * The handoff lands the user somewhere immediately after signing them in,\n * which is the worst possible moment to hand control to an attacker-chosen\n * origin — so this defers to {@link safeSameOriginPath}, which resolves the\n * value and compares origins instead of testing its shape (AGL-1881).\n *\n * This function used to reject `//evil.example` and `/\\evil.example` by\n * inspecting the characters. That list read as complete and was not: the URL\n * parser deletes tab, LF and CR before parsing, so `/<TAB>/evil.example`\n * contains neither `//` nor `\\` and still resolves to `https://evil.example/`.\n * Enumerating tricks is the bug; asking the parser is the fix.\n */\nexport function safeContinuePath(input: string | null | undefined): string {\n  return safeSameOriginPath(input, '/')\n}\n\nexport interface StartedHandoff {\n  requestId: string\n  /** `V` — goes in the custom domain's own host-only cookie. */\n  verifier: string\n  expiresAtMs: number\n}\n\n/**\n * Create a `pending` handoff for `targetHost`, returning the id and verifier.\n *\n * Called on the custom domain, unauthenticated: nothing about a pending record\n * is a capability. It names the host the request actually arrived on — never a\n * host from a parameter — which is what makes the `targetHost` check at\n * redemption mean anything.\n */\nexport async function startConsoleHandoff(options: {\n  targetHost: string\n  orgSlug: string | null\n  continuePath?: string | null\n  nowMs?: number\n}): Promise<StartedHandoff | null> {\n  const targetHost = normalizeConsoleDomain(options.targetHost)\n  if (!targetHost) return null\n  const nowMs = options.nowMs ?? Date.now()\n  const requestId = crypto.randomUUID()\n  const verifier = newSecret()\n  const expiresAtMs = nowMs + HANDOFF_PENDING_TTL_MS\n  await firestore()\n    .collection(AUTH_HANDOFFS_COLLECTION)\n    .doc(requestId)\n    .set({\n      targetHost,\n      orgSlug: options.orgSlug ?? null,\n      continuePath: safeContinuePath(options.continuePath),\n      verifierHash: hashHandoffSecret(verifier),\n      secretHash: null,\n      status: 'pending' satisfies HandoffStatus,\n      uid: null,\n      tenantId: null,\n      createdAt: nowMs,\n      // A Firestore `Timestamp`, matching the idiom in `passkeys.ts` and\n      // `rate-limit-store.ts`. TTL deletion is best-effort within ~72h, so\n      // EXPIRY IS ENFORCED IN CODE and the TTL policy is hygiene only —\n      // never the other way round.\n      expiresAt: new Date(expiresAtMs),\n    })\n  return { requestId, verifier, expiresAtMs }\n}\n\nexport type AuthorizeRefusal =\n  | 'unknown-request'\n  | 'not-pending'\n  | 'expired'\n  | 'host-mismatch'\n  | 'domain-inactive'\n  | 'not-a-member'\n  | 'impersonation'\n\nexport type AuthorizeResult =\n  | {\n      ok: true\n      /** `S` — goes in the return URL's FRAGMENT, never its query. */\n      secret: string\n      targetHost: string\n      continuePath: string\n    }\n  | { ok: false; reason: AuthorizeRefusal; orgSlug: string | null }\n\n/**\n * Authorize a pending handoff, on the AUTH HOST, for a signed-in user.\n *\n * `isMember` is injected rather than resolved here so this module stays free\n * of the membership model, and so the test can exercise the refusal without a\n * membership fixture. It receives the target host as well as the slug because\n * the ORG ID lives on the claim and `resolveConsoleDomain` deliberately never\n * returns it — a verdict is read by an unauthenticated route. It is called\n * only after the domain has been shown to be live, so a refusal never reveals\n * whether an org exists.\n *\n * The write flips `pending → authorized` inside {@link consumeOnce}, so a\n * second authorize of the same id finds `not-pending`. That matters: without\n * it, an attacker who obtained a request id could keep re-authorizing it and\n * mint a fresh secret each time the victim signed in.\n */\nexport async function authorizeConsoleHandoff(options: {\n  requestId: string\n  uid: string\n  tenantId?: string | null\n  impersonated?: boolean\n  isMember: (context: {\n    targetHost: string\n    orgSlug: string | null\n  }) => Promise<boolean>\n  nowMs?: number\n}): Promise<AuthorizeResult> {\n  const nowMs = options.nowMs ?? Date.now()\n  const requestId = options.requestId\n  if (!requestId || requestId.includes('/')) {\n    return { ok: false, reason: 'unknown-request', orgSlug: null }\n  }\n  const ref = firestore().collection(AUTH_HANDOFFS_COLLECTION).doc(requestId)\n\n  // Read first, only to answer the questions that need an AWAIT — domain\n  // liveness and membership — because neither can be performed inside a\n  // transaction. Every check that can race is re-made inside `consumeOnce`\n  // below, against the state it reads for itself.\n  let peek: FirebaseFirestore.DocumentSnapshot\n  try {\n    peek = await ref.get()\n  } catch {\n    return { ok: false, reason: 'unknown-request', orgSlug: null }\n  }\n  if (!peek.exists) return { ok: false, reason: 'unknown-request', orgSlug: null }\n  const targetHost = String(peek.get('targetHost') ?? '')\n  const orgSlug = (peek.get('orgSlug') as string | null) ?? null\n\n  // Staff impersonation over a custom console domain is refused outright\n  // (AGL-1353 §8.15). A staff session on customer-controlled infrastructure is\n  // a credential sitting on someone else's server; support uses the workspace\n  // subdomain, which works today.\n  if (options.impersonated) {\n    return { ok: false, reason: 'impersonation', orgSlug }\n  }\n\n  const verdict = await resolveConsoleDomain(targetHost)\n  // `degraded` refuses here, unlike the routing gate. Routing fails OPEN\n  // because a console going dark on a timeout is worse than the residual\n  // exposure; MINTING A SESSION on a domain we could not confirm is live is\n  // the opposite trade, and the user still has a working\n  // `{slug}.aglyn.com` to fall back to.\n  if (!verdict.servable) {\n    return { ok: false, reason: 'domain-inactive', orgSlug: verdict.orgSlug }\n  }\n\n  // THE check. Verified custom-domain status is not sufficient — an attacker\n  // can verify a domain they genuinely own. Membership in the org that owns\n  // the target host is what makes the feature safe to sell, and it is the\n  // first thing a reviewer should look for.\n  if (!(await options.isMember({ targetHost, orgSlug: verdict.orgSlug }))) {\n    return { ok: false, reason: 'not-a-member', orgSlug: verdict.orgSlug }\n  }\n\n  const secret = newSecret()\n  const consumed = await consumeOnce<{ continuePath: string }>(\n    firestore(),\n    ref,\n    (data) => {\n      if (data['status'] !== 'pending') {\n        return { accept: false, reason: 'not-pending' }\n      }\n      if (String(data['targetHost'] ?? '') !== targetHost) {\n        return { accept: false, reason: 'host-mismatch' }\n      }\n      const createdAt = Number(data['createdAt'] ?? 0)\n      if (!createdAt || nowMs - createdAt > HANDOFF_PENDING_TTL_MS) {\n        return { accept: false, reason: 'expired' }\n      }\n      return {\n        accept: true,\n        value: { continuePath: String(data['continuePath'] ?? '/') },\n        patch: {\n          status: 'authorized' satisfies HandoffStatus,\n          secretHash: hashHandoffSecret(secret),\n          uid: options.uid,\n          tenantId: options.tenantId ?? null,\n          authorizedAt: nowMs,\n          // The window shortens the moment it is authorized: 120 s, not the\n          // remainder of the pending 15 minutes.\n          expiresAt: new Date(nowMs + HANDOFF_AUTHORIZED_TTL_MS),\n        },\n      }\n    },\n  )\n  if (!consumed.ok) {\n    const reason = consumed.reason\n    return {\n      ok: false,\n      reason:\n        reason === 'absent'\n          ? 'unknown-request'\n          : (reason as AuthorizeRefusal) ?? 'unknown-request',\n      orgSlug: verdict.orgSlug,\n    }\n  }\n  return {\n    ok: true,\n    secret,\n    targetHost,\n    continuePath: consumed.value?.continuePath ?? '/',\n  }\n}\n\nexport type RedeemRefusal =\n  | 'unknown-request'\n  | 'already-redeemed'\n  | 'not-authorized'\n  | 'expired'\n  | 'host-mismatch'\n  | 'bad-secret'\n  | 'bad-verifier'\n  | 'domain-inactive'\n  | 'revoked'\n\nexport type RedeemResult =\n  | { ok: true; uid: string; tenantId: string | null; continuePath: string }\n  | { ok: false; reason: RedeemRefusal }\n\n/**\n * Consume an authorized handoff, on the CUSTOM DOMAIN.\n *\n * Both secrets are required and both are checked INSIDE the transaction, so\n * the checks cannot be raced against the consume.\n *\n * `verifiers` is every value of the `__aglyn_handoff` cookie on the request,\n * not one. A compromised sibling host under the customer's own apex can set a\n * `Domain=.acme-agency.com` cookie of the same name, which SHADOWS the\n * host-only one in the `Cookie` header with no way to tell them apart — the\n * precise failure AGL-1259 hit with duplicate `__session` cookies. Hashing\n * every value and accepting if any matches is safe by construction (only the\n * real `V` hashes to `verifierHash`) and turns a hijack attempt into a no-op\n * rather than a denial of service.\n */\nexport async function redeemConsoleHandoff(options: {\n  requestId: string\n  secret: string\n  verifiers: string[]\n  requestHost: string\n  nowMs?: number\n}): Promise<RedeemResult> {\n  const nowMs = options.nowMs ?? Date.now()\n  const requestId = options.requestId\n  if (!requestId || requestId.includes('/')) {\n    return { ok: false, reason: 'unknown-request' }\n  }\n  const requestHost = normalizeConsoleDomain(options.requestHost)\n  if (!requestHost) return { ok: false, reason: 'host-mismatch' }\n\n  // Liveness and revocation, both of which need an AWAIT and so cannot live\n  // inside the transaction. D6 requires BOTH legs of the session to honour the\n  // epoch — \"the redemption endpoint and the `GET` exchange\" — and this leg is\n  // the one that had neither check.\n  //\n  // It matters because `/api/*` sits OUTSIDE the middleware matcher, so\n  // `serveConsoleDomain` never sees this route: a suspended or detached domain\n  // is refused a console to render and was still handed a working redemption.\n  // And the `GET` exchange cannot cover for it, because the credential a\n  // redemption mints is NEWER than the bump that was supposed to kill it — an\n  // epoch can only refuse a cookie it predates.\n  const verdict = await resolveConsoleDomain(requestHost)\n  // `degraded` refuses here, for `authorize`'s reason: routing fails OPEN\n  // because a console going dark on a timeout is worse than the residual\n  // exposure, but MINTING a session on a domain we could not confirm is live is\n  // the opposite trade, and the user still has `{slug}.aglyn.com` to fall back\n  // to.\n  if (!verdict.servable) return { ok: false, reason: 'domain-inactive' }\n  const epoch = await readConsoleSessionEpoch(requestHost)\n\n  const ref = firestore().collection(AUTH_HANDOFFS_COLLECTION).doc(requestId)\n\n  const consumed = await consumeOnce<{\n    uid: string\n    tenantId: string | null\n    continuePath: string\n  }>(firestore(), ref, (data) => {\n    const status = data['status']\n    if (status === 'redeemed') {\n      return { accept: false, reason: 'already-redeemed' }\n    }\n    if (status !== 'authorized') {\n      return { accept: false, reason: 'not-authorized' }\n    }\n    // Origin binding, half one: the record names its target and redemption\n    // requires the request's OWN host to match. Half two — the verifier below\n    // — is the load-bearing one, because an unbound token is a theft primitive\n    // even when the attacker controls no domain at all: they would simply POST\n    // it to our own redemption endpoint from their own machine.\n    if (String(data['targetHost'] ?? '') !== requestHost) {\n      return { accept: false, reason: 'host-mismatch' }\n    }\n    const authorizedAt = Number(data['authorizedAt'] ?? 0)\n    if (!authorizedAt || nowMs - authorizedAt > HANDOFF_AUTHORIZED_TTL_MS) {\n      return { accept: false, reason: 'expired' }\n    }\n    // D7 orders a detach `sessionEpoch = now` FIRST, then the Vercel delete,\n    // precisely so sessions die while we still control the host. An\n    // authorization that predates the bump is one of those sessions, and it is\n    // refused WITHOUT a write: `consumeOnce` does not destroy a refused record\n    // by default, so this cannot be used to knock out a concurrent legitimate\n    // redemption.\n    if (epoch > 0 && authorizedAt < epoch) {\n      return { accept: false, reason: 'revoked' }\n    }\n    if (!safeEqual(hashHandoffSecret(options.secret), String(data['secretHash'] ?? ''))) {\n      return { accept: false, reason: 'bad-secret' }\n    }\n    const verifierHash = String(data['verifierHash'] ?? '')\n    const verifierOk = options.verifiers.some((candidate) =>\n      safeEqual(hashHandoffSecret(candidate), verifierHash),\n    )\n    if (!verifierOk) return { accept: false, reason: 'bad-verifier' }\n    return {\n      accept: true,\n      value: {\n        uid: String(data['uid'] ?? ''),\n        tenantId: (data['tenantId'] as string | null) ?? null,\n        continuePath: String(data['continuePath'] ?? '/'),\n      },\n      patch: {\n        status: 'redeemed' satisfies HandoffStatus,\n        redeemedAt: nowMs,\n        // Nothing that could re-authorize it survives the consume.\n        secretHash: null,\n        verifierHash: null,\n      },\n    }\n  })\n\n  if (!consumed.ok || !consumed.value?.uid) {\n    const reason = consumed.reason\n    return {\n      ok: false,\n      reason:\n        reason === 'absent'\n          ? 'unknown-request'\n          : (reason as RedeemRefusal) ?? 'unknown-request',\n    }\n  }\n  return {\n    ok: true,\n    uid: consumed.value.uid,\n    tenantId: consumed.value.tenantId,\n    continuePath: consumed.value.continuePath,\n  }\n}\n\n/**\n * `consoleDomains/{host}.sessionEpoch`, or `0` when there is no usable one.\n *\n * `0` is returned for every unreadable shape — an unnormalizable host, an\n * absent document, a Firestore error, a non-finite or non-positive value — and\n * every caller reads `0` as \"this control has nothing to say\", i.e. FAILS OPEN.\n * That is deliberate and matches every other console-domain lookup: the Vercel\n * allowlist is the boundary and this is defence in depth, so a Firestore blip\n * must not lock every custom domain out of its own session.\n *\n * Note the split with {@link consoleSessionEpochRefuses}: failing open on a\n * missing EPOCH is not the same as failing open on a missing CREDENTIAL DATE.\n * A cookie whose `iat` cannot be read is refused, because an undateable\n * credential cannot be shown to postdate a revocation.\n */\nexport async function readConsoleSessionEpoch(host: string): Promise<number> {\n  const domain = normalizeConsoleDomain(host)\n  if (!domain) return 0\n  let snapshot: FirebaseFirestore.DocumentSnapshot\n  try {\n    snapshot = await firestore()\n      .collection(CONSOLE_DOMAINS_COLLECTION)\n      .doc(domain)\n      .get()\n  } catch {\n    return 0\n  }\n  if (!snapshot.exists) return 0\n  const epoch = Number(snapshot.get('sessionEpoch') ?? 0)\n  return Number.isFinite(epoch) && epoch > 0 ? epoch : 0\n}\n\n/**\n * The revocation epoch on a console domain (AGL-1353 D6).\n *\n * A session cookie minted before the epoch is dead. Bumping `sessionEpoch` —\n * which `suspendOnDowngrade` and `releaseConsoleDomain` already do — therefore\n * invalidates every outstanding cookie for that host instantly, at our\n * boundary. Our boundary is the ONLY place a Firebase session cookie has any\n * value: it is opaque and can only be cashed by `verifySessionCookie` under\n * our Admin credentials.\n *\n * Fails OPEN on a read error, matching every other console-domain lookup.\n */\nexport async function consoleSessionEpochRefuses(options: {\n  host: string\n  cookieIssuedAtMs: number | null\n}): Promise<boolean> {\n  const epoch = await readConsoleSessionEpoch(options.host)\n  if (epoch <= 0) return false\n  const issuedAt = Number(options.cookieIssuedAtMs ?? 0)\n  // An undateable cookie cannot be shown to postdate the epoch, and the safe\n  // direction for a revocation control is to refuse it.\n  if (!Number.isFinite(issuedAt) || issuedAt <= 0) return true\n  return issuedAt < epoch\n}\n"],"names":["createHash","randomBytes","safeSameOriginPath","firebaseAdmin","consumeOnce","CONSOLE_DOMAINS_COLLECTION","normalizeConsoleDomain","resolveConsoleDomain","safeEqual","firestore","app","AUTH_HANDOFFS_COLLECTION","HANDOFF_VERIFIER_COOKIE","HANDOFF_PENDING_TTL_MS","HANDOFF_AUTHORIZED_TTL_MS","hashHandoffSecret","value","update","digest","newSecret","toString","safeContinuePath","input","startConsoleHandoff","options","targetHost","nowMs","Date","now","requestId","crypto","randomUUID","verifier","expiresAtMs","collection","doc","set","orgSlug","continuePath","verifierHash","secretHash","status","uid","tenantId","createdAt","expiresAt","authorizeConsoleHandoff","peek","consumed","includes","ok","reason","ref","get","exists","String","impersonated","verdict","servable","isMember","secret","data","accept","Number","patch","authorizedAt","redeemConsoleHandoff","requestHost","epoch","readConsoleSessionEpoch","verifierOk","verifiers","some","candidate","redeemedAt","host","snapshot","domain","isFinite","consoleSessionEpochRefuses","issuedAt","cookieIssuedAtMs"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,EAAEC,WAAW,QAAQ,SAAQ;AAChD,SAASC,kBAAkB,QAAQ,wCAAuC;AAC1E,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,WAAW,QAAQ,oBAAgB;AAC5C,SACEC,0BAA0B,EAC1BC,sBAAsB,EACtBC,oBAAoB,QACf,uBAAmB;AAC1B,SAASC,SAAS,QAAQ,kBAAc;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiEC,GAED,MAAMC,YAAY,IAAMN,cAAcO,GAAG,GAAGD,SAAS;AAErD,8DAA8D,GAC9D,OAAO,MAAME,2BAA2B,eAAc;AAEtD,kEAAkE,GAClE,OAAO,MAAMC,0BAA0B,kBAAiB;AAExD,qEAAqE,GACrE,OAAO,MAAMC,yBAAyB,KAAK,KAAK,KAAI;AAEpD,iEAAiE,GACjE,OAAO,MAAMC,4BAA4B,MAAM,KAAI;AAInD,qDAAqD,GACrD,OAAO,SAASC,kBAAkBC,KAAa;IAC7C,OAAOhB,WAAW,UAAUiB,MAAM,CAACD,OAAO,QAAQE,MAAM,CAAC;AAC3D;AAEA,4EAA4E,GAC5E,SAASC;IACP,OAAOlB,YAAY,IAAImB,QAAQ,CAAC;AAClC;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASC,iBAAiBC,KAAgC;IAC/D,OAAOpB,mBAAmBoB,OAAO;AACnC;AASA;;;;;;;CAOC,GACD,OAAO,eAAeC,oBAAoBC,OAKzC;QAGeA,gBASDA;IAXb,MAAMC,aAAanB,uBAAuBkB,QAAQC,UAAU;IAC5D,IAAI,CAACA,YAAY,OAAO;IACxB,MAAMC,SAAQF,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiBG,KAAKC,GAAG;IACvC,MAAMC,YAAYC,OAAOC,UAAU;IACnC,MAAMC,WAAWb;IACjB,MAAMc,cAAcP,QAAQb;IAC5B,MAAMJ,YACHyB,UAAU,CAACvB,0BACXwB,GAAG,CAACN,WACJO,GAAG,CAAC;QACHX;QACAY,OAAO,GAAEb,mBAAAA,QAAQa,OAAO,YAAfb,mBAAmB;QAC5Bc,cAAcjB,iBAAiBG,QAAQc,YAAY;QACnDC,cAAcxB,kBAAkBiB;QAChCQ,YAAY;QACZC,QAAQ;QACRC,KAAK;QACLC,UAAU;QACVC,WAAWlB;QACX,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClE,6BAA6B;QAC7BmB,WAAW,IAAIlB,KAAKM;IACtB;IACF,OAAO;QAAEJ;QAAWG;QAAUC;IAAY;AAC5C;AAqBA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,eAAea,wBAAwBtB,OAU7C;QACeA,gBAkBYuB,WACTA;QA0EDC;IA7FhB,MAAMtB,SAAQF,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiBG,KAAKC,GAAG;IACvC,MAAMC,YAAYL,QAAQK,SAAS;IACnC,IAAI,CAACA,aAAaA,UAAUoB,QAAQ,CAAC,MAAM;QACzC,OAAO;YAAEC,IAAI;YAAOC,QAAQ;YAAmBd,SAAS;QAAK;IAC/D;IACA,MAAMe,MAAM3C,YAAYyB,UAAU,CAACvB,0BAA0BwB,GAAG,CAACN;IAEjE,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,gDAAgD;IAChD,IAAIkB;IACJ,IAAI;QACFA,OAAO,MAAMK,IAAIC,GAAG;IACtB,EAAE,eAAM;QACN,OAAO;YAAEH,IAAI;YAAOC,QAAQ;YAAmBd,SAAS;QAAK;IAC/D;IACA,IAAI,CAACU,KAAKO,MAAM,EAAE,OAAO;QAAEJ,IAAI;QAAOC,QAAQ;QAAmBd,SAAS;IAAK;IAC/E,MAAMZ,aAAa8B,QAAOR,YAAAA,KAAKM,GAAG,CAAC,yBAATN,YAA0B;IACpD,MAAMV,WAAWU,aAAAA,KAAKM,GAAG,CAAC,sBAATN,aAAyC;IAE1D,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,gCAAgC;IAChC,IAAIvB,QAAQgC,YAAY,EAAE;QACxB,OAAO;YAAEN,IAAI;YAAOC,QAAQ;YAAiBd;QAAQ;IACvD;IAEA,MAAMoB,UAAU,MAAMlD,qBAAqBkB;IAC3C,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,uDAAuD;IACvD,sCAAsC;IACtC,IAAI,CAACgC,QAAQC,QAAQ,EAAE;QACrB,OAAO;YAAER,IAAI;YAAOC,QAAQ;YAAmBd,SAASoB,QAAQpB,OAAO;QAAC;IAC1E;IAEA,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,0CAA0C;IAC1C,IAAI,CAAE,MAAMb,QAAQmC,QAAQ,CAAC;QAAElC;QAAYY,SAASoB,QAAQpB,OAAO;IAAC,IAAK;QACvE,OAAO;YAAEa,IAAI;YAAOC,QAAQ;YAAgBd,SAASoB,QAAQpB,OAAO;QAAC;IACvE;IAEA,MAAMuB,SAASzC;IACf,MAAM6B,WAAW,MAAM5C,YACrBK,aACA2C,KACA,CAACS;YAIYA,kBAGcA,iBAMOA,oBAKlBrC;QAjBd,IAAIqC,IAAI,CAAC,SAAS,KAAK,WAAW;YAChC,OAAO;gBAAEC,QAAQ;gBAAOX,QAAQ;YAAc;QAChD;QACA,IAAII,QAAOM,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB,QAAQpC,YAAY;YACnD,OAAO;gBAAEqC,QAAQ;gBAAOX,QAAQ;YAAgB;QAClD;QACA,MAAMP,YAAYmB,QAAOF,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB;QAC9C,IAAI,CAACjB,aAAalB,QAAQkB,YAAY/B,wBAAwB;YAC5D,OAAO;gBAAEiD,QAAQ;gBAAOX,QAAQ;YAAU;QAC5C;QACA,OAAO;YACLW,QAAQ;YACR9C,OAAO;gBAAEsB,cAAciB,QAAOM,qBAAAA,IAAI,CAAC,eAAe,YAApBA,qBAAwB;YAAK;YAC3DG,OAAO;gBACLvB,QAAQ;gBACRD,YAAYzB,kBAAkB6C;gBAC9BlB,KAAKlB,QAAQkB,GAAG;gBAChBC,QAAQ,GAAEnB,oBAAAA,QAAQmB,QAAQ,YAAhBnB,oBAAoB;gBAC9ByC,cAAcvC;gBACd,kEAAkE;gBAClE,uCAAuC;gBACvCmB,WAAW,IAAIlB,KAAKD,QAAQZ;YAC9B;QACF;IACF;IAEF,IAAI,CAACkC,SAASE,EAAE,EAAE;QAChB,MAAMC,SAASH,SAASG,MAAM;QAC9B,OAAO;YACLD,IAAI;YACJC,QACEA,WAAW,WACP,oBACCA,iBAAAA,SAA+B;YACtCd,SAASoB,QAAQpB,OAAO;QAC1B;IACF;IACA,OAAO;QACLa,IAAI;QACJU;QACAnC;QACAa,YAAY,WAAEU,kBAAAA,SAAShC,KAAK,qBAAdgC,gBAAgBV,YAAY,mBAAI;IAChD;AACF;AAiBA;;;;;;;;;;;;;;CAcC,GACD,OAAO,eAAe4B,qBAAqB1C,OAM1C;QACeA;QAwFOwB;IAxFrB,MAAMtB,SAAQF,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiBG,KAAKC,GAAG;IACvC,MAAMC,YAAYL,QAAQK,SAAS;IACnC,IAAI,CAACA,aAAaA,UAAUoB,QAAQ,CAAC,MAAM;QACzC,OAAO;YAAEC,IAAI;YAAOC,QAAQ;QAAkB;IAChD;IACA,MAAMgB,cAAc7D,uBAAuBkB,QAAQ2C,WAAW;IAC9D,IAAI,CAACA,aAAa,OAAO;QAAEjB,IAAI;QAAOC,QAAQ;IAAgB;IAE9D,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,kCAAkC;IAClC,EAAE;IACF,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAMM,UAAU,MAAMlD,qBAAqB4D;IAC3C,wEAAwE;IACxE,uEAAuE;IACvE,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM;IACN,IAAI,CAACV,QAAQC,QAAQ,EAAE,OAAO;QAAER,IAAI;QAAOC,QAAQ;IAAkB;IACrE,MAAMiB,QAAQ,MAAMC,wBAAwBF;IAE5C,MAAMf,MAAM3C,YAAYyB,UAAU,CAACvB,0BAA0BwB,GAAG,CAACN;IAEjE,MAAMmB,WAAW,MAAM5C,YAIpBK,aAAa2C,KAAK,CAACS;YAaTA,kBAGiBA,oBAa6BA,kBAG7BA,oBAQZA,WACDA,gBACUA;QAzCzB,MAAMpB,SAASoB,IAAI,CAAC,SAAS;QAC7B,IAAIpB,WAAW,YAAY;YACzB,OAAO;gBAAEqB,QAAQ;gBAAOX,QAAQ;YAAmB;QACrD;QACA,IAAIV,WAAW,cAAc;YAC3B,OAAO;gBAAEqB,QAAQ;gBAAOX,QAAQ;YAAiB;QACnD;QACA,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAII,QAAOM,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB,QAAQM,aAAa;YACpD,OAAO;gBAAEL,QAAQ;gBAAOX,QAAQ;YAAgB;QAClD;QACA,MAAMc,eAAeF,QAAOF,qBAAAA,IAAI,CAAC,eAAe,YAApBA,qBAAwB;QACpD,IAAI,CAACI,gBAAgBvC,QAAQuC,eAAenD,2BAA2B;YACrE,OAAO;gBAAEgD,QAAQ;gBAAOX,QAAQ;YAAU;QAC5C;QACA,yEAAyE;QACzE,gEAAgE;QAChE,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,cAAc;QACd,IAAIiB,QAAQ,KAAKH,eAAeG,OAAO;YACrC,OAAO;gBAAEN,QAAQ;gBAAOX,QAAQ;YAAU;QAC5C;QACA,IAAI,CAAC3C,UAAUO,kBAAkBS,QAAQoC,MAAM,GAAGL,QAAOM,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB,MAAM;YACnF,OAAO;gBAAEC,QAAQ;gBAAOX,QAAQ;YAAa;QAC/C;QACA,MAAMZ,eAAegB,QAAOM,qBAAAA,IAAI,CAAC,eAAe,YAApBA,qBAAwB;QACpD,MAAMS,aAAa9C,QAAQ+C,SAAS,CAACC,IAAI,CAAC,CAACC,YACzCjE,UAAUO,kBAAkB0D,YAAYlC;QAE1C,IAAI,CAAC+B,YAAY,OAAO;YAAER,QAAQ;YAAOX,QAAQ;QAAe;QAChE,OAAO;YACLW,QAAQ;YACR9C,OAAO;gBACL0B,KAAKa,QAAOM,YAAAA,IAAI,CAAC,MAAM,YAAXA,YAAe;gBAC3BlB,QAAQ,GAAGkB,iBAAAA,IAAI,CAAC,WAAW,YAAhBA,iBAAsC;gBACjDvB,cAAciB,QAAOM,qBAAAA,IAAI,CAAC,eAAe,YAApBA,qBAAwB;YAC/C;YACAG,OAAO;gBACLvB,QAAQ;gBACRiC,YAAYhD;gBACZ,2DAA2D;gBAC3Dc,YAAY;gBACZD,cAAc;YAChB;QACF;IACF;IAEA,IAAI,CAACS,SAASE,EAAE,IAAI,GAACF,kBAAAA,SAAShC,KAAK,qBAAdgC,gBAAgBN,GAAG,GAAE;QACxC,MAAMS,SAASH,SAASG,MAAM;QAC9B,OAAO;YACLD,IAAI;YACJC,QACEA,WAAW,WACP,oBACCA,iBAAAA,SAA4B;QACrC;IACF;IACA,OAAO;QACLD,IAAI;QACJR,KAAKM,SAAShC,KAAK,CAAC0B,GAAG;QACvBC,UAAUK,SAAShC,KAAK,CAAC2B,QAAQ;QACjCL,cAAcU,SAAShC,KAAK,CAACsB,YAAY;IAC3C;AACF;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,eAAe+B,wBAAwBM,IAAY;QAanCC;IAZrB,MAAMC,SAASvE,uBAAuBqE;IACtC,IAAI,CAACE,QAAQ,OAAO;IACpB,IAAID;IACJ,IAAI;QACFA,WAAW,MAAMnE,YACdyB,UAAU,CAAC7B,4BACX8B,GAAG,CAAC0C,QACJxB,GAAG;IACR,EAAE,eAAM;QACN,OAAO;IACT;IACA,IAAI,CAACuB,SAAStB,MAAM,EAAE,OAAO;IAC7B,MAAMc,QAAQL,QAAOa,gBAAAA,SAASvB,GAAG,CAAC,2BAAbuB,gBAAgC;IACrD,OAAOb,OAAOe,QAAQ,CAACV,UAAUA,QAAQ,IAAIA,QAAQ;AACvD;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,eAAeW,2BAA2BvD,OAGhD;QAGyBA;IAFxB,MAAM4C,QAAQ,MAAMC,wBAAwB7C,QAAQmD,IAAI;IACxD,IAAIP,SAAS,GAAG,OAAO;IACvB,MAAMY,WAAWjB,QAAOvC,4BAAAA,QAAQyD,gBAAgB,YAAxBzD,4BAA4B;IACpD,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,CAACuC,OAAOe,QAAQ,CAACE,aAAaA,YAAY,GAAG,OAAO;IACxD,OAAOA,WAAWZ;AACpB"}