@amodalai/runtime 0.3.69 → 0.3.71

package/dist/src/auth/index.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Pluggable auth — the Warden-shape primitive layer.
+ *
+ *   import {authenticate, JwksAuthStrategy} from '@amodalai/runtime/auth';
+ *
+ *   const platformJwt = new JwksAuthStrategy({jwksUrl: '...'});
+ *   const endUser     = new OidcStrategy({...});
+ *
+ *   // Per-route strategy lists. Studio routes only ever see platformJwt;
+ *   // chat routes accept either platformJwt (Studio testing) OR endUser.
+ *   app.use('/api/files', authenticate(platformJwt));
+ *   app.use('/chat',      authenticate(platformJwt, endUser));
+ *
+ *   // Mount any login-flow routes a strategy registers.
+ *   app.use(authRouter(endUser));
+ *
+ * Single-winner chain semantics: first strategy whose `valid(req)` is
+ * true and `authenticate(req)` returns `'authenticated'` wins. No
+ * merging, no implicit identity overrides.
+ */
+export type { AuthStrategy, AuthResult, AuthSession } from './types.js';
+export { authenticate, authRouter, getSession } from './compose.js';
+export type { AuthLogEvent, AuthenticateOptions } from './compose.js';
+export { JwksAuthStrategy } from './strategies/jwks.js';
+export type { JwksAuthStrategyOptions } from './strategies/jwks.js';
+export { ApiKeyAuthStrategy } from './strategies/api-key.js';
+export type { ApiKeyAuthStrategyOptions, ApiKeyValidationResult, } from './strategies/api-key.js';
+export { HeaderAuthStrategy } from './strategies/header.js';
+export type { HeaderAuthStrategyOptions } from './strategies/header.js';
+export { NoneAuthStrategy } from './strategies/none.js';
+export type { NoneAuthStrategyOptions } from './strategies/none.js';
+export { CookieSessionStrategy } from './strategies/cookie.js';
+export type { CookieSessionStrategyOptions } from './strategies/cookie.js';
+export { JwtSecretAuthStrategy } from './strategies/jwt-secret.js';
+export type { JwtSecretAuthStrategyOptions } from './strategies/jwt-secret.js';
+export { OidcAuthStrategy } from './strategies/oidc.js';
+export type { OidcAuthStrategyOptions } from './strategies/oidc.js';
+export { AmodalAuthStrategy } from './strategies/amodal.js';
+export type { AmodalAuthStrategyOptions } from './strategies/amodal.js';
+export { AuthConfigSchema, parseAuthConfig } from './config.js';
+export type { AuthConfig, NoneAuthConfig, JwtSecretAuthConfig, OidcAuthConfig, HeaderAuthConfig, CustomAuthConfig, AmodalAuthConfig, } from './config.js';
+export { createAuthStrategy } from './factory.js';
+export { loadCustomStrategy } from './strategies/custom-loader.js';

package/dist/src/auth/index.js

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export { authenticate, authRouter, getSession } from './compose.js';
+export { JwksAuthStrategy } from './strategies/jwks.js';
+export { ApiKeyAuthStrategy } from './strategies/api-key.js';
+export { HeaderAuthStrategy } from './strategies/header.js';
+export { NoneAuthStrategy } from './strategies/none.js';
+export { CookieSessionStrategy } from './strategies/cookie.js';
+export { JwtSecretAuthStrategy } from './strategies/jwt-secret.js';
+export { OidcAuthStrategy } from './strategies/oidc.js';
+export { AmodalAuthStrategy } from './strategies/amodal.js';
+// Config-driven auth — `auth` field in `amodal.json` → AuthStrategy
+export { AuthConfigSchema, parseAuthConfig } from './config.js';
+export { createAuthStrategy } from './factory.js';
+export { loadCustomStrategy } from './strategies/custom-loader.js';
+//# sourceMappingURL=index.js.map

package/dist/src/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwBH,OAAO,EAAC,YAAY,EAAE,UAAU,EAAE,UAAU,EAAC,MAAM,cAAc,CAAC;AAGlE,OAAO,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAC,kBAAkB,EAAC,MAAM,yBAAyB,CAAC;AAM3D,OAAO,EAAC,kBAAkB,EAAC,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAC,qBAAqB,EAAC,MAAM,wBAAwB,CAAC;AAG7D,OAAO,EAAC,qBAAqB,EAAC,MAAM,4BAA4B,CAAC;AAGjE,OAAO,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAC,kBAAkB,EAAC,MAAM,wBAAwB,CAAC;AAG1D,oEAAoE;AACpE,OAAO,EAAC,gBAAgB,EAAE,eAAe,EAAC,MAAM,aAAa,CAAC;AAU9D,OAAO,EAAC,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAChD,OAAO,EAAC,kBAAkB,EAAC,MAAM,+BAA+B,CAAC"}

package/dist/src/auth/strategies/amodal.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * AmodalAuthStrategy — "Sign in with Amodal."
+ *
+ * The zero-config option for agent owners on the Amodal cloud. End users
+ * sign in with their existing Amodal account; the runtime verifies the
+ * platform-issued JWT against Amodal's JWKS. cf-worker handles the
+ * redirect-to-login dance upstream — by the time a request reaches the
+ * runtime, it carries a valid platform JWT in `Authorization: Bearer`.
+ *
+ * Internally just a `JwksAuthStrategy` preconfigured with Amodal's JWKS
+ * URL and issuer. Self-hosters running their own Amodal-equivalent
+ * platform can override both via constructor options.
+ */
+import type { Request } from 'express';
+import type { AuthResult, AuthStrategy } from '../types.js';
+export interface AmodalAuthStrategyOptions {
+    /**
+     * Override the platform JWKS URL. Defaults to `AMODAL_JWKS_URL` env
+     * var, then to `https://api.amodalai.com/.well-known/jwks.json`.
+     */
+    jwksUrl?: string;
+    /** Override the expected `iss` claim. Defaults to `'aitize-platform'`. */
+    issuer?: string;
+}
+export declare class AmodalAuthStrategy implements AuthStrategy {
+    readonly name = "amodal";
+    private readonly inner;
+    constructor(options?: AmodalAuthStrategyOptions);
+    valid(req: Request): boolean;
+    authenticate(req: Request): Promise<AuthResult>;
+}

package/dist/src/auth/strategies/amodal.js

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { JwksAuthStrategy } from './jwks.js';
+const DEFAULT_AMODAL_JWKS_URL = 'https://api.amodalai.com/.well-known/jwks.json';
+const DEFAULT_AMODAL_ISSUER = 'aitize-platform';
+export class AmodalAuthStrategy {
+    name = 'amodal';
+    inner;
+    constructor(options = {}) {
+        this.inner = new JwksAuthStrategy({
+            jwksUrl: options.jwksUrl ??
+                process.env['AMODAL_JWKS_URL'] ??
+                DEFAULT_AMODAL_JWKS_URL,
+            issuer: options.issuer ?? DEFAULT_AMODAL_ISSUER,
+            authMethod: 'amodal',
+        });
+    }
+    valid(req) {
+        return this.inner.valid(req);
+    }
+    authenticate(req) {
+        return this.inner.authenticate(req);
+    }
+}
+//# sourceMappingURL=amodal.js.map

package/dist/src/auth/strategies/amodal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"amodal.js","sourceRoot":"","sources":["../../../../src/auth/strategies/amodal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH,OAAO,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAY3C,MAAM,uBAAuB,GAAG,gDAAgD,CAAC;AACjF,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEhD,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,QAAQ,CAAC;IACR,KAAK,CAAmB;IAEzC,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC;YAChC,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC9B,uBAAuB;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,qBAAqB;YAC/C,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAY;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,YAAY,CAAC,GAAY;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/src/auth/strategies/api-key.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { Request } from 'express';
+import type { AuthResult, AuthStrategy } from '../types.js';
+export interface ApiKeyValidationResult {
+    /** Required — the principal id this key represents. */
+    userId: string;
+    email?: string;
+    /** Optional — the agent this key is scoped to. */
+    agentId?: string;
+}
+export interface ApiKeyAuthStrategyOptions {
+    /**
+     * Validate the API key. Return `null` for "not a valid key" (chain
+     * rejects with 401). Throw to signal an upstream error (callers can
+     * upgrade these to 502s by wrapping the strategy if desired).
+     */
+    validate: (apiKey: string) => Promise<ApiKeyValidationResult | null>;
+    /** Cache TTL for successful validations (ms). Defaults to 5 minutes. */
+    cacheTtlMs?: number;
+    /** Cap on the LRU cache. Defaults to 10,000 entries. */
+    cacheMaxEntries?: number;
+    /** Token prefix this strategy matches. Defaults to `'ak_'`. */
+    keyPrefix?: string;
+    /** Override `AuthSession.method`. Defaults to `'api-key'`. */
+    authMethod?: string;
+}
+export declare class ApiKeyAuthStrategy implements AuthStrategy {
+    readonly name = "api-key";
+    private readonly validate;
+    private readonly keyPrefix;
+    private readonly authMethod;
+    private readonly cache;
+    constructor(options: ApiKeyAuthStrategyOptions);
+    valid(req: Request): boolean;
+    authenticate(req: Request): Promise<AuthResult>;
+    private buildSession;
+}

package/dist/src/auth/strategies/api-key.js

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * ApiKeyAuthStrategy — `ak_*` Bearer tokens, validated via a caller-
+ * supplied callback (cloud's `/api/me`, a self-hoster's own DB query,
+ * etc.). LRU-cached so repeated requests with the same key skip the
+ * validation round-trip.
+ */
+import { LRUCache } from 'lru-cache';
+const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_CACHE_MAX = 10_000;
+export class ApiKeyAuthStrategy {
+    name = 'api-key';
+    validate;
+    keyPrefix;
+    authMethod;
+    cache;
+    constructor(options) {
+        this.validate = options.validate;
+        this.keyPrefix = options.keyPrefix ?? 'ak_';
+        this.authMethod = options.authMethod ?? 'api-key';
+        this.cache = new LRUCache({
+            max: options.cacheMaxEntries ?? DEFAULT_CACHE_MAX,
+            ttl: options.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS,
+        });
+    }
+    valid(req) {
+        const auth = req.headers['authorization'];
+        if (typeof auth !== 'string' || !auth.startsWith('Bearer '))
+            return false;
+        const token = auth.slice(7);
+        return token.startsWith(this.keyPrefix);
+    }
+    async authenticate(req) {
+        const auth = req.headers['authorization'];
+        if (typeof auth !== 'string')
+            return { kind: 'rejected', reason: 'No bearer token' };
+        const token = auth.slice(7);
+        const cached = this.cache.get(token);
+        if (cached) {
+            return { kind: 'authenticated', session: this.buildSession(cached) };
+        }
+        const result = await this.validate(token);
+        if (!result)
+            return { kind: 'rejected', reason: 'Invalid API key' };
+        this.cache.set(token, result);
+        return { kind: 'authenticated', session: this.buildSession(result) };
+    }
+    buildSession(result) {
+        return {
+            user: {
+                id: result.userId,
+                ...(result.email ? { email: result.email } : {}),
+            },
+            method: this.authMethod,
+            ...(result.agentId ? { agentId: result.agentId } : {}),
+        };
+    }
+}
+//# sourceMappingURL=api-key.js.map

package/dist/src/auth/strategies/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../../../src/auth/strategies/api-key.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,OAAO,EAAC,QAAQ,EAAC,MAAM,WAAW,CAAC;AA6BnC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,SAAS,CAAC;IACT,QAAQ,CAAwC;IAChD,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,KAAK,CAA2C;IAEjE,YAAY,OAAkC;QAC5C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAiC;YACxD,GAAG,EAAE,OAAO,CAAC,eAAe,IAAI,iBAAiB;YACjD,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,oBAAoB;SAChD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAY;QAChB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAY;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAC,CAAC;QACnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAC,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,EAAC,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAC,CAAC;IACrE,CAAC;IAEO,YAAY,CAAC,MAA8B;QACjD,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,MAAM,CAAC,MAAM;gBACjB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C;YACD,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;CACF"}

package/dist/src/auth/strategies/auth-modes.integration.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export {};

package/dist/src/auth/strategies/auth-modes.integration.test.js

@@ -0,0 +1,363 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * End-to-end tests for the simpler auth modes — `none`, `header`,
+ * `jwt_secret`, `custom`, `amodal` — exercised through a real Express
+ * app over real HTTP. The OIDC strategy gets its own integration file
+ * (`oidc.integration.test.ts`) since it requires booting a full IdP.
+ *
+ * Each test:
+ *  1. Constructs the strategy via `createAuthStrategy(config)` so the
+ *     factory's wiring is on the hot path (not just the strategy's
+ *     constructor).
+ *  2. Mounts it on a real Express server bound to a random port.
+ *  3. Hits a protected route with appropriate credentials.
+ *  4. Asserts both the success and rejection paths.
+ */
+import http from 'node:http';
+import { randomBytes, generateKeyPairSync } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve } from 'node:path';
+import express from 'express';
+import { SignJWT, exportJWK } from 'jose';
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { createAuthStrategy } from '../factory.js';
+import { authenticate, getSession } from '../compose.js';
+async function startProtectedApp(strategy) {
+    const app = express();
+    app.get('/protected', authenticate(strategy), (_req, res) => {
+        const session = getSession(res);
+        res.json({ user: session?.user, method: session?.method });
+    });
+    return new Promise((resolve, reject) => {
+        const server = http.createServer(app);
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            resolve({
+                url: `http://127.0.0.1:${addr.port}`,
+                close: () => new Promise((closeResolve, closeReject) => {
+                    server.close((err) => err ? closeReject(err) : closeResolve());
+                }),
+            });
+        });
+    });
+}
+async function getJson(url, init = {}) {
+    const res = await fetch(url, init);
+    let body = {};
+    if (res.headers.get('content-type')?.includes('application/json')) {
+        body = (await res.json());
+    }
+    return { status: res.status, body };
+}
+// ---------------------------------------------------------------------------
+// none
+// ---------------------------------------------------------------------------
+describe('none mode — integration', () => {
+    let app;
+    beforeAll(async () => {
+        const strategy = await createAuthStrategy({ type: 'none' });
+        app = await startProtectedApp(strategy);
+    });
+    afterAll(async () => {
+        if (app)
+            await app.close();
+    });
+    it('lets every request through with the synthesized anonymous user', async () => {
+        const { status, body } = await getJson(`${app.url}/protected`);
+        expect(status).toBe(200);
+        expect(body.user?.id).toBe('anonymous');
+        expect(body.method).toBe('none');
+    });
+    it('respects a custom userId override', async () => {
+        const strategy = await createAuthStrategy({ type: 'none', userId: 'guest' });
+        const guestApp = await startProtectedApp(strategy);
+        try {
+            const { status, body } = await getJson(`${guestApp.url}/protected`);
+            expect(status).toBe(200);
+            expect(body.user?.id).toBe('guest');
+        }
+        finally {
+            await guestApp.close();
+        }
+    });
+});
+// ---------------------------------------------------------------------------
+// header
+// ---------------------------------------------------------------------------
+describe('header mode — integration', () => {
+    let app;
+    beforeAll(async () => {
+        const strategy = await createAuthStrategy({ type: 'header' });
+        app = await startProtectedApp(strategy);
+    });
+    afterAll(async () => {
+        if (app)
+            await app.close();
+    });
+    it('reads identity from the default X-Auth-User header', async () => {
+        const { status, body } = await getJson(`${app.url}/protected`, {
+            headers: { 'X-Auth-User': 'alice' },
+        });
+        expect(status).toBe(200);
+        expect(body.user?.id).toBe('alice');
+        expect(body.method).toBe('header');
+    });
+    it('rejects requests with no identity header', async () => {
+        const { status } = await getJson(`${app.url}/protected`);
+        expect(status).toBe(401);
+    });
+    it('honours a configured headerName', async () => {
+        const strategy = await createAuthStrategy({
+            type: 'header',
+            headerName: 'X-Forwarded-User',
+        });
+        const customApp = await startProtectedApp(strategy);
+        try {
+            const ok = await getJson(`${customApp.url}/protected`, {
+                headers: { 'X-Forwarded-User': 'bob' },
+            });
+            expect(ok.status).toBe(200);
+            expect(ok.body.user?.id).toBe('bob');
+            // wrong header → rejected
+            const bad = await getJson(`${customApp.url}/protected`, {
+                headers: { 'X-Auth-User': 'eve' },
+            });
+            expect(bad.status).toBe(401);
+        }
+        finally {
+            await customApp.close();
+        }
+    });
+});
+// ---------------------------------------------------------------------------
+// jwt_secret
+// ---------------------------------------------------------------------------
+describe('jwt_secret mode — integration', () => {
+    const SECRET = 'shared-hmac-secret-please-rotate';
+    let app;
+    async function mintToken(claims = {}, ttl = 300) {
+        const key = new TextEncoder().encode(SECRET);
+        return new SignJWT({ sub: 'user-1', email: 'u1@example.com', name: 'User One', ...claims })
+            .setProtectedHeader({ alg: 'HS256' })
+            .setIssuedAt()
+            .setExpirationTime(`${ttl}s`)
+            .sign(key);
+    }
+    beforeAll(async () => {
+        const strategy = await createAuthStrategy({ type: 'jwt_secret', secret: SECRET });
+        app = await startProtectedApp(strategy);
+    });
+    afterAll(async () => {
+        if (app)
+            await app.close();
+    });
+    it('accepts a valid HS256 bearer token', async () => {
+        const token = await mintToken();
+        const { status, body } = await getJson(`${app.url}/protected`, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        expect(status).toBe(200);
+        expect(body.user?.id).toBe('user-1');
+        expect(body.user?.email).toBe('u1@example.com');
+    });
+    it('rejects a tampered signature', async () => {
+        const token = await mintToken();
+        const tampered = `${token.slice(0, -3)}AAA`;
+        const { status } = await getJson(`${app.url}/protected`, {
+            headers: { Authorization: `Bearer ${tampered}` },
+        });
+        expect(status).toBe(401);
+    });
+    it('rejects a token signed with a different secret', async () => {
+        const wrongKey = new TextEncoder().encode('different-secret-of-similar-length');
+        const token = await new SignJWT({ sub: 'imposter' })
+            .setProtectedHeader({ alg: 'HS256' })
+            .setIssuedAt()
+            .setExpirationTime('5m')
+            .sign(wrongKey);
+        const { status } = await getJson(`${app.url}/protected`, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        expect(status).toBe(401);
+    });
+    it('rejects when no Authorization header is sent', async () => {
+        const { status } = await getJson(`${app.url}/protected`);
+        expect(status).toBe(401);
+    });
+    it('enforces issuer when configured', async () => {
+        const strategy = await createAuthStrategy({
+            type: 'jwt_secret',
+            secret: SECRET,
+            issuer: 'expected-issuer',
+        });
+        const issuerApp = await startProtectedApp(strategy);
+        try {
+            const goodKey = new TextEncoder().encode(SECRET);
+            const goodToken = await new SignJWT({ sub: 'user-1' })
+                .setProtectedHeader({ alg: 'HS256' })
+                .setIssuedAt()
+                .setExpirationTime('5m')
+                .setIssuer('expected-issuer')
+                .sign(goodKey);
+            const badToken = await new SignJWT({ sub: 'user-1' })
+                .setProtectedHeader({ alg: 'HS256' })
+                .setIssuedAt()
+                .setExpirationTime('5m')
+                .setIssuer('other-issuer')
+                .sign(goodKey);
+            const ok = await getJson(`${issuerApp.url}/protected`, {
+                headers: { Authorization: `Bearer ${goodToken}` },
+            });
+            expect(ok.status).toBe(200);
+            const bad = await getJson(`${issuerApp.url}/protected`, {
+                headers: { Authorization: `Bearer ${badToken}` },
+            });
+            expect(bad.status).toBe(401);
+        }
+        finally {
+            await issuerApp.close();
+        }
+    });
+});
+// ---------------------------------------------------------------------------
+// custom
+// ---------------------------------------------------------------------------
+describe('custom mode — integration', () => {
+    let app;
+    beforeAll(async () => {
+        // Resolve the fixture path relative to this test file so the dynamic
+        // import works regardless of cwd.
+        const here = dirname(fileURLToPath(import.meta.url));
+        const modulePath = resolve(here, '../__fixtures__/custom-strategy.ts');
+        const strategy = await createAuthStrategy({ type: 'custom', module: modulePath });
+        app = await startProtectedApp(strategy);
+    });
+    afterAll(async () => {
+        if (app)
+            await app.close();
+    });
+    it('authenticates when the fixture token matches', async () => {
+        const { status, body } = await getJson(`${app.url}/protected`, {
+            headers: { 'X-Custom-Token': 'secret-value' },
+        });
+        expect(status).toBe(200);
+        expect(body.user?.id).toBe('custom-user');
+        expect(body.method).toBe('custom-test');
+    });
+    it('rejects when the fixture token is wrong', async () => {
+        const { status } = await getJson(`${app.url}/protected`, {
+            headers: { 'X-Custom-Token': 'not-the-secret' },
+        });
+        expect(status).toBe(401);
+    });
+    it('rejects when the fixture header is missing', async () => {
+        const { status } = await getJson(`${app.url}/protected`);
+        expect(status).toBe(401);
+    });
+    it('throws at construction when the module path does not exist', async () => {
+        await expect(createAuthStrategy({ type: 'custom', module: '/path/that/does/not/exist.ts' })).rejects.toThrow(/Failed to load custom auth strategy/);
+    });
+});
+async function startJwksServer() {
+    // jose's exportJWK + SignJWT accept Node's KeyObject as a valid KeyLike.
+    const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+    const publicJwk = await exportJWK(publicKey);
+    const kid = randomBytes(8).toString('hex');
+    publicJwk.kid = kid;
+    publicJwk.alg = 'RS256';
+    publicJwk.use = 'sig';
+    const app = express();
+    app.get('/.well-known/jwks.json', (_req, res) => {
+        res.json({ keys: [publicJwk] });
+    });
+    const signingKey = privateKey;
+    return new Promise((resolve, reject) => {
+        const server = http.createServer(app);
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            const url = `http://127.0.0.1:${addr.port}`;
+            resolve({
+                url,
+                jwksUrl: `${url}/.well-known/jwks.json`,
+                signingKey,
+                kid,
+                close: () => new Promise((closeResolve, closeReject) => {
+                    server.close((err) => err ? closeReject(err) : closeResolve());
+                }),
+            });
+        });
+    });
+}
+describe('amodal mode — integration', () => {
+    const ISSUER = 'integration-test-platform';
+    let jwks;
+    let app;
+    async function mintPlatformToken(claims = {}, issuer = ISSUER) {
+        return new SignJWT({ sub: 'amodal-user-1', email: 'a1@amodal.test', ...claims })
+            .setProtectedHeader({ alg: 'RS256', kid: jwks.kid })
+            .setIssuedAt()
+            .setIssuer(issuer)
+            .setExpirationTime('5m')
+            .sign(jwks.signingKey);
+    }
+    beforeAll(async () => {
+        jwks = await startJwksServer();
+        const strategy = await createAuthStrategy({
+            type: 'amodal',
+            jwksUrl: jwks.jwksUrl,
+            issuer: ISSUER,
+        });
+        app = await startProtectedApp(strategy);
+    });
+    afterAll(async () => {
+        if (app)
+            await app.close();
+        if (jwks)
+            await jwks.close();
+    });
+    it('accepts a platform-signed JWT verified against the JWKS', async () => {
+        const token = await mintPlatformToken();
+        const { status, body } = await getJson(`${app.url}/protected`, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        expect(status).toBe(200);
+        expect(body.user?.id).toBe('amodal-user-1');
+        expect(body.method).toBe('amodal');
+    });
+    it('rejects a token with the wrong issuer', async () => {
+        const token = await mintPlatformToken({}, 'someone-elses-platform');
+        const { status } = await getJson(`${app.url}/protected`, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        expect(status).toBe(401);
+    });
+    it('rejects a token signed by a different key', async () => {
+        const otherJwks = await startJwksServer();
+        try {
+            const token = await new SignJWT({ sub: 'imposter' })
+                .setProtectedHeader({ alg: 'RS256', kid: otherJwks.kid })
+                .setIssuedAt()
+                .setIssuer(ISSUER)
+                .setExpirationTime('5m')
+                .sign(otherJwks.signingKey);
+            const { status } = await getJson(`${app.url}/protected`, {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            expect(status).toBe(401);
+        }
+        finally {
+            await otherJwks.close();
+        }
+    });
+    it('rejects when no bearer token is sent', async () => {
+        const { status } = await getJson(`${app.url}/protected`);
+        expect(status).toBe(401);
+    });
+});
+//# sourceMappingURL=auth-modes.integration.test.js.map

package/dist/src/auth/strategies/auth-modes.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-modes.integration.test.js","sourceRoot":"","sources":["../../../../src/auth/strategies/auth-modes.integration.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;;GAaG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAC,WAAW,EAAE,mBAAmB,EAAC,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAC,aAAa,EAAC,MAAM,UAAU,CAAC;AACvC,OAAO,EAAC,OAAO,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AAC3C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAC,OAAO,EAAE,SAAS,EAAC,MAAM,MAAM,CAAC;AAExC,OAAO,EAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAC,MAAM,QAAQ,CAAC;AAEjE,OAAO,EAAC,kBAAkB,EAAC,MAAM,eAAe,CAAC;AACjD,OAAO,EAAC,YAAY,EAAE,UAAU,EAAC,MAAM,eAAe,CAAC;AAQvD,KAAK,UAAU,iBAAiB,CAAC,QAAsB;IACrD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;YAC7C,OAAO,CAAC;gBACN,GAAG,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE;gBACpC,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;oBAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACnB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CACxC,CAAC;gBACJ,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,OAAoB,EAAE;IAIxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,IAAI,GAAoB,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;IAC/C,CAAC;IACD,OAAO,EAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAI,GAAe,CAAC;IAEpB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAC,IAAI,EAAE,MAAM,EAAC,CAAC,CAAC;QAC1D,GAAG,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,IAAI,GAAG;YAAE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAC,MAAM,EAAE,IAAI,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAC,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,EAAC,MAAM,EAAE,IAAI,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAI,GAAe,CAAC;IAEpB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAC,IAAI,EAAE,QAAQ,EAAC,CAAC,CAAC;QAC5D,GAAG,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,IAAI,GAAG;YAAE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAC,MAAM,EAAE,IAAI,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,EAAE;YAC3D,OAAO,EAAE,EAAC,aAAa,EAAE,OAAO,EAAC;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;YACxC,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,kBAAkB;SAC/B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,YAAY,EAAE;gBACrD,OAAO,EAAE,EAAC,kBAAkB,EAAE,KAAK,EAAC;aACrC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAErC,0BAA0B;YAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,YAAY,EAAE;gBACtD,OAAO,EAAE,EAAC,aAAa,EAAE,KAAK,EAAC;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,MAAM,MAAM,GAAG,kCAAkC,CAAC;IAClD,IAAI,GAAe,CAAC;IAEpB,KAAK,UAAU,SAAS,CAAC,SAAkC,EAAE,EAAE,GAAG,GAAG,GAAG;QACtE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,IAAI,OAAO,CAAC,EAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,EAAC,CAAC;aACtF,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAC,CAAC;aAClC,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;aAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAC,CAAC,CAAC;QAChF,GAAG,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,IAAI,GAAG;YAAE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,MAAM,EAAC,MAAM,EAAE,IAAI,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,EAAE;YAC3D,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,KAAK,EAAE,EAAC;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,EAAE;YACrD,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAC;SAC/C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAC,GAAG,EAAE,UAAU,EAAC,CAAC;aAC/C,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAC,CAAC;aAClC,WAAW,EAAE;aACb,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,EAAE;YACrD,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,KAAK,EAAE,EAAC;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;YACxC,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,iBAAiB;SAC1B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAC,EAAC,GAAG,EAAE,QAAQ,EAAC,CAAC;iBACjD,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAC,CAAC;iBAClC,WAAW,EAAE;iBACb,iBAAiB,CAAC,IAAI,CAAC;iBACvB,SAAS,CAAC,iBAAiB,CAAC;iBAC5B,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAC,EAAC,GAAG,EAAE,QAAQ,EAAC,CAAC;iBAChD,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAC,CAAC;iBAClC,WAAW,EAAE;iBACb,iBAAiB,CAAC,IAAI,CAAC;iBACvB,SAAS,CAAC,cAAc,CAAC;iBACzB,IAAI,CAAC,OAAO,CAAC,CAAC;YAEjB,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,YAAY,EAAE;gBACrD,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,SAAS,EAAE,EAAC;aAChD,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE5B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,YAAY,EAAE;gBACtD,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAC;aAC/C,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAI,GAAe,CAAC;IAEpB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,oCAAoC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAC,CAAC,CAAC;QAChF,GAAG,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,IAAI,GAAG;YAAE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAC,MAAM,EAAE,IAAI,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,EAAE;YAC3D,OAAO,EAAE,EAAC,gBAAgB,EAAE,cAAc,EAAC;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,EAAE;YACrD,OAAO,EAAE,EAAC,gBAAgB,EAAE,gBAAgB,EAAC;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,MAAM,CACV,kBAAkB,CAAC,EAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,8BAA8B,EAAC,CAAC,CAC7E,CAAC,OAAO,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAcH,KAAK,UAAU,eAAe;IAC5B,yEAAyE;IACzE,MAAM,EAAC,SAAS,EAAE,UAAU,EAAC,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAC,aAAa,EAAE,IAAI,EAAC,CAAC,CAAC;IAClF,MAAM,SAAS,GAAQ,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC;IACpB,SAAS,CAAC,GAAG,GAAG,OAAO,CAAC;IACxB,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;IAEtB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9C,GAAG,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,CAAC,SAAS,CAAC,EAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,UAAU,CAAC;IAE9B,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;YAC7C,MAAM,GAAG,GAAG,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5C,OAAO,CAAC;gBACN,GAAG;gBACH,OAAO,EAAE,GAAG,GAAG,wBAAwB;gBACvC,UAAU;gBACV,GAAG;gBACH,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;oBAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACnB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CACxC,CAAC;gBACJ,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,MAAM,MAAM,GAAG,2BAA2B,CAAC;IAC3C,IAAI,IAAiB,CAAC;IACtB,IAAI,GAAe,CAAC;IAEpB,KAAK,UAAU,iBAAiB,CAC9B,SAAkC,EAAE,EACpC,MAAM,GAAG,MAAM;QAEf,OAAO,IAAI,OAAO,CAAC,EAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,MAAM,EAAC,CAAC;aAC3E,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAC,CAAC;aACjD,WAAW,EAAE;aACb,SAAS,CAAC,MAAM,CAAC;aACjB,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IAED,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;YACxC,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,GAAG,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,IAAI,GAAG;YAAE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,IAAI;YAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,KAAK,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACxC,MAAM,EAAC,MAAM,EAAE,IAAI,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,EAAE;YAC3D,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,KAAK,EAAE,EAAC;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACpE,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,EAAE;YACrD,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,KAAK,EAAE,EAAC;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,SAAS,GAAG,MAAM,eAAe,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAC,GAAG,EAAE,UAAU,EAAC,CAAC;iBAC/C,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAC,CAAC;iBACtD,WAAW,EAAE;iBACb,SAAS,CAAC,MAAM,CAAC;iBACjB,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,EAAE;gBACrD,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,KAAK,EAAE,EAAC;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}