@antasphere/chassis-server 1.0.0

package/dist/identity/hub-sso.js

@@ -0,0 +1,536 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { and, eq, ne } from 'drizzle-orm';
+import { account, user as userTable, userOnboarding } from '@antasphere/chassis-db';
+import { HubJwtVerifier } from './hub-jwt.js';
+/**
+ * "Sign in with Antasphere" — the cloud edition's SSO entrance
+ * (internal/federation.md, user-scoped federation). This module owns everything
+ * hub-SSO:
+ *
+ *  - the relying-party provider config for better-auth's `genericOAuth`
+ *    plugin (registered by identity/better-auth.ts ONLY when the instance
+ *    boots EDITION=cloud — an oss boot never constructs this class);
+ *  - `HubJwtVerifier`: remote-JWKS verification of hub-minted JWTs (hard
+ *    iss/aud pinning, RS256 allowlist, cached keys + one forced refresh);
+ *  - the per-login ASSERTION handoff (an AsyncLocalStorage scope spanning
+ *    the callback request — see `runWithLoginScope`);
+ *  - the per-login work better-auth does not know about: identity guard,
+ *    D10 email re-sync, and the FAIL-CLOSED login reconcile (the org
+ *    projection) — a cloud login whose reconcile pass fails must not exist.
+ *
+ * Identity comes from the ID TOKEN ONLY (aud = HUB_CLIENT_ID). The access
+ * token is never claim-bearing for the tool: the SSO code exchange sends
+ * RFC 8707 `resource = <hub>/mcp` (the `tokenResource` seam constant shared
+ * with hub-grant.ts), so the callback access token is HUB-audienced — a
+ * bearer for the hub's own `/api/v1`, which the login-time reconcile uses
+ * to read the user's org list AS THE USER. Org claims are gone from the
+ * login path entirely; the hub's caller-scoped `GET /orgs` is the ONE
+ * source of org/membership truth. Refresh + between-logins reads live in
+ * hub-grant.ts / hub-user-client.ts; SSO scopes carry `offline_access
+ * account:read` so the grant persists on the account row, plus
+ * `orgs:create` (HUB_SSO_SCOPES below) for the one write the tool makes at
+ * the hub as the user.
+ */
+/**
+ * providerId of the hub relying party — the discovery method name in
+ * `/api/v1/instance`, the better-auth callback path segment
+ * (`/api/v1/auth/oauth2/callback/antasphere` — the redirect URI in the
+ * hub's TOOL_REGISTRY entry), and the D9 trusted-provider key.
+ */
+export const HUB_SSO_PROVIDER_ID = 'antasphere';
+/**
+ * A login failure the after-hook converts into a clean, session-less
+ * redirect back to /login?error=<code>. Codes are stable (the dashboard
+ * maps them to copy); anything unexpected becomes `sso_login_failed`.
+ * `/sso/cli-connect` reuses the same errors as 403 bodies —
+ * `sso_link_refused` is its trusted-link refusal (never thrown on the
+ * browser login path, where better-auth's own linking gate answers first).
+ */
+export class HubSsoLoginError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'HubSsoLoginError';
+    }
+}
+const loginScope = new AsyncLocalStorage();
+/**
+ * The scopes the tool requests at hub sign-in — the ONE statement of the
+ * list (the provider entry below spreads it; tests import it).
+ *
+ *  - `openid profile email`: the id_token identity.
+ *  - `offline_access account:read`: the stored grant and its as-the-user
+ *    `GET /orgs` reads (hub-grant.ts, hub-user-client.ts).
+ *  - `orgs:create` (PRDCT-2443): the hub's DEDICATED scope for `POST /orgs`
+ *    — it opens that one route, to a tool-registry client only.
+ *    `account:write` does NOT open it and is deliberately not requested: a
+ *    tool holds the narrowest write it needs, nothing account-wide.
+ *
+ * DEPLOY ORDER — THE HUB FIRST. The hub's authorize endpoint
+ * (@better-auth/oauth-provider) validates every requested scope against the
+ * CLIENT's registered scopes (its tool registry seeds them) and answers
+ * `error=invalid_scope` for an unknown one — the WHOLE sign-in fails, for
+ * every user, not just workspace creation. A hub that does not yet list
+ * `orgs:create` for this client must never meet a tool that requests
+ * it. A grant minted BEFORE this shipped simply lacks the scope: the hub
+ * answers 403 `insufficient_scope` on create, which the route maps to 401
+ * `hub_reauth_required` — one sign-in heals it.
+ */
+export const HUB_SSO_SCOPES = [
+    'openid',
+    'profile',
+    'email',
+    'offline_access',
+    'account:read',
+    'orgs:create'
+];
+/**
+ * Strict whitelist for per-call authorize params (the SL-1 silent-connect
+ * seam): the dashboard's silent auto-connect passes
+ * `additionalData: { prompt: 'none' }` on `POST /sign-in/oauth2`, and the
+ * ONLY thing that may ever reach the hub's authorize URL from that
+ * caller-controlled blob is the literal `prompt=none` pair — anything else
+ * (other prompt values, extra keys) is dropped. Verified on better-auth
+ * 1.6.15 (re-verify on ANY bump): `authorizationUrlParams` may be a
+ * FUNCTION of the endpoint ctx (generic-oauth/types.d.mts), the sign-in
+ * body carries `additionalData` (generic-oauth/routes.mjs — also threaded
+ * into the state blob), and the function's return is applied to the
+ * authorization URL via `createAuthorizationURL`'s `additionalParams`.
+ */
+export function ssoAuthorizationUrlParams(body) {
+    const additionalData = body?.additionalData;
+    const prompt = additionalData?.prompt;
+    return prompt === 'none' ? { prompt: 'none' } : {};
+}
+export class HubSsoService {
+    opts;
+    verifier;
+    reconciler = null;
+    constructor(opts) {
+        this.opts = opts;
+        this.verifier = new HubJwtVerifier(opts.issuerUrl);
+    }
+    /** Boot binds the reconciler once it exists (see LoginReconciler). */
+    bindReconciler(reconciler) {
+        this.reconciler = reconciler;
+    }
+    /**
+     * Establish the per-request login scope. api/index.ts wraps EVERY
+     * /api/v1/auth/* request on cloud — an empty object store is free, and
+     * wrapping unconditionally keeps the seam independent of better-auth's
+     * internal routing.
+     */
+    runWithLoginScope(fn) {
+        return loginScope.run({}, fn);
+    }
+    /** One-shot read of the assertion the current request's getUserInfo verified. */
+    takeAssertion() {
+        const scope = loginScope.getStore();
+        const assertion = scope?.assertion;
+        if (scope)
+            delete scope.assertion;
+        return assertion;
+    }
+    /** The account site's address (the hub issuer, no trailing slash): where a refusal sends the person. */
+    accountUrl() {
+        return this.opts.issuerUrl.replace(/\/+$/, '');
+    }
+    /** Where a failed SSO login lands — the login page with a stable error code. */
+    loginErrorUrl(code) {
+        return `${this.opts.publicBaseUrl.replace(/\/+$/, '')}/login?error=${encodeURIComponent(code)}`;
+    }
+    logLoginFailure(err, localUserId) {
+        this.opts.logger.warn({ err, localUserId }, 'hub SSO login failed after callback — session revoked, redirecting with error');
+    }
+    /**
+     * The genericOAuth provider entry for the hub. Notes that are POSTURE,
+     * not accident:
+     *
+     *  - `scopes` (HUB_SSO_SCOPES) carry `offline_access account:read`: the
+     *    grant IS the between-logins credential — better-auth persists the
+     *    refresh token on the account row (encrypted; identity/better-auth.ts),
+     *    and hub-grant.ts keeps it alive — and `orgs:create`, the hub's
+     *    DEDICATED scope for `POST /orgs` (PRDCT-2443).
+     *  - `tokenUrlParams.resource` (RFC 8707) is `tokenResource` — `<hub>/mcp`
+     *    — so the minted access token is a bearer for the HUB's own API (the
+     *    login reconcile + every between-logins read), never for ours.
+     *  - `disableSignUp` stays UNSET: SSO IS the sanctioned signup entrance
+     *    on cloud — the deliberate FOURTH switch next to the three
+     *    closed-signup switches (CLAUDE.md invariant, internal/federation.md).
+     *  - `getUserInfo` replaces the plugin's default entirely, so IT owns the
+     *    emailVerified mapping — set from the hub's verified `email_verified`
+     *    claim, never defaulted.
+     */
+    providerConfig() {
+        return {
+            providerId: HUB_SSO_PROVIDER_ID,
+            discoveryUrl: this.opts.issuerUrl.replace(/\/+$/, '') + '/.well-known/openid-configuration',
+            clientId: this.opts.clientId,
+            clientSecret: this.opts.clientSecret,
+            scopes: [...HUB_SSO_SCOPES],
+            pkce: true,
+            ...(this.opts.tokenResource ? { tokenUrlParams: { resource: this.opts.tokenResource } } : {}),
+            // Per-call prompt=none passthrough for the silent auto-connect — the
+            // strict whitelist above; nothing else from the caller's
+            // additionalData ever reaches the hub authorize URL.
+            authorizationUrlParams: (ctx) => ssoAuthorizationUrlParams(ctx.body),
+            getUserInfo: (tokens) => this.getUserInfo(tokens)
+        };
+    }
+    /**
+     * Verify the callback id_token and extract the USER assertion. Returning
+     * null makes the plugin fail the login with a clean error redirect — the
+     * fail-closed path for every bad token (wrong iss/aud, expired, bad
+     * signature, malformed claims). The access token is NOT verified here —
+     * it is hub-audienced, never claim-bearing for us; it rides the login
+     * scope as the reconcile's bearer, and the HUB verifies it on use.
+     */
+    async getUserInfo(tokens) {
+        try {
+            if (!tokens.idToken)
+                throw new Error('token response carried no id_token (openid is always scoped)');
+            if (!tokens.accessToken)
+                throw new Error('token response carried no access token');
+            const idClaims = await this.verifier.verify(tokens.idToken, this.opts.clientId);
+            const assertion = buildUserAssertion(idClaims);
+            const scope = loginScope.getStore();
+            if (scope) {
+                scope.assertion = {
+                    ...assertion,
+                    accessToken: tokens.accessToken,
+                    accessTokenExpiresAt: tokens.accessTokenExpiresAt ?? null
+                };
+            }
+            else {
+                // No scope means the auth mount was not wrapped — the after-hook
+                // will fail this login closed (sso_assertion_missing). Say why.
+                this.opts.logger.error('hub SSO: getUserInfo ran outside a login scope — the callback after-hook will refuse this login');
+            }
+            return {
+                id: assertion.sub,
+                email: assertion.email,
+                name: assertion.name,
+                emailVerified: assertion.emailVerified
+            };
+        }
+        catch (err) {
+            this.opts.logger.warn({ err }, 'hub SSO: callback token rejected');
+            return null;
+        }
+    }
+    /**
+     * The per-login work (after-hook, newSession-gated, JIT and returning
+     * users alike), in fail-closed order:
+     *
+     *  1. single-hub-identity guard — undo an email-match link that would
+     *     merge two hub subjects into one local user;
+     *  2. email re-sync (D10) with the explicit duplicate-email collision
+     *     path (fail the login, corrupt nothing);
+     *  3. the FAIL-CLOSED login reconcile: one forced pass reading the user's
+     *     org list from the hub with the callback access token — reconcile IS
+     *     the projection now. A pass that does not definitively succeed
+     *     throws `sso_projection_failed` (session revoked, error redirect):
+     *     a cloud login without its projection must not exist.
+     *
+     * Throws HubSsoLoginError; the caller revokes the just-minted session and
+     * redirects. Any other throw is mapped to the generic failure code there.
+     */
+    async assertLogin(localUserId, assertion) {
+        await this.guardSingleHubIdentity(localUserId, assertion.sub);
+        await this.syncEmail(localUserId, assertion);
+        if (!this.reconciler) {
+            // Boot always binds on cloud; a missing binding is a wiring bug and
+            // must fail the login closed, never mint an unprojected session.
+            throw new HubSsoLoginError('sso_projection_failed', 'no login reconciler bound (boot wiring bug)');
+        }
+        const outcome = await this.reconciler.forceReconcile(localUserId, {
+            accessToken: assertion.accessToken,
+            expiresAt: assertion.accessTokenExpiresAt
+        });
+        if (outcome !== 'ok') {
+            throw new HubSsoLoginError('sso_projection_failed', `login reconcile pass failed (${outcome})`);
+        }
+        // SL-6: lazily mark the first login for the tool-local onboarding seam.
+        // AFTER the reconcile 'ok' (a revoked login must not leave a row) and
+        // strictly BEST-EFFORT: this write is NEVER a login failure mode — a
+        // failed insert just means the row appears on the NEXT login, and the
+        // banner semantics (`NOT EXISTS dismissed row` = welcome owed) already
+        // show the welcome without any row at all. ON CONFLICT DO NOTHING keeps
+        // returning logins from touching an existing (possibly dismissed) row.
+        try {
+            await this.opts.db.insert(userOnboarding).values({ userId: localUserId }).onConflictDoNothing();
+        }
+        catch (err) {
+            this.opts.logger.warn({ err, localUserId }, 'onboarding first-login insert failed — retry-safe (the welcome stays owed), login unaffected');
+        }
+    }
+    /**
+     * Verify a hub-minted exchange JWT (`POST /sso/cli-connect`, the H3
+     * counterpart — internal/federation.md P5) and extract its assertion. The
+     * chain, every link fail-closed:
+     *
+     *  1. `HubJwtVerifier.verify` — hub JWKS signature, `iss` pinned to the
+     *     hub, `aud` pinned to OUR resource URL (a token minted for another
+     *     tool dies here; a tool-minted MCP token dies on `iss`),
+     *     RS256 allowlist, expiry (5 s tolerance).
+     *  2. `exp` REQUIRED — jose only validates expiry when the claim exists,
+     *     and the replay ledger needs a bound; a token without one is a
+     *     contract break, refused.
+     *  3. `purpose === 'sso-connect'` REQUIRED — a hub ACCESS token carries
+     *     no purpose claim and dies here even if iss/aud ever matched.
+     *  4. `jti` REQUIRED (bounded) — the caller consumes it one-time-use.
+     *
+     * The token's TRANSITIONAL org claims (workspace_id/role/workspace_name,
+     * kept by the hub through the compat window) are deliberately NOT read —
+     * org truth comes from the connect-time reconcile, never a claim.
+     *
+     * Throws on any failure; the route maps every throw to one uniform 401
+     * (no oracle distinguishing replay from expiry from a foreign audience).
+     */
+    async verifyConnectToken(token) {
+        const claims = await this.verifier.verify(token, this.opts.resourceUrl);
+        if (typeof claims.exp !== 'number')
+            throw new Error('exchange token carries no exp');
+        if (claims.purpose !== 'sso-connect') {
+            throw new Error('token is not an sso-connect exchange token (purpose claim)');
+        }
+        const jti = claims.jti;
+        if (typeof jti !== 'string' || !jti || jti.length > 256) {
+            throw new Error('exchange token carries no usable jti');
+        }
+        const sub = claims.sub;
+        if (typeof sub !== 'string' || !sub)
+            throw new Error('exchange token carries no sub');
+        const email = claims.email;
+        if (typeof email !== 'string' || !email.includes('@')) {
+            throw new Error('exchange token carries no usable email claim');
+        }
+        const normalizedEmail = email.toLowerCase();
+        return {
+            sub,
+            email: normalizedEmail,
+            // The hub mints exchange tokens only for a live, authenticated hub
+            // user — an identity whose email the hub itself verified (H3 re-reads
+            // emailVerified LIVE at mint). The H3 contract carries no
+            // email_verified or name claim, so the honest mirror of the SSO
+            // id_token's `email_verified: true` is asserted here, and the display
+            // name falls back exactly like an SSO login with a blank profile name.
+            emailVerified: true,
+            name: normalizedEmail.split('@')[0],
+            jti,
+            expiresAt: new Date(claims.exp * 1000)
+        };
+    }
+    /**
+     * JIT-provision for `/sso/cli-connect`: resolve-or-create the local user
+     * for a VERIFIED connect assertion, then run the USER half of the
+     * per-login work — identity guard, D10 email sync. NO org projection
+     * happens here: the route stores the H3 grant (`acquireFromConnect`) and
+     * runs the same fail-closed reconcile as a browser login — the reconcile
+     * IS the projection, on the connect path too. User resolution mirrors
+     * better-auth's own OAuth linking exactly (oauth2/link-account.mjs on the
+     * pinned 1.6.15):
+     *
+     *  1. account row (providerId='antasphere', accountId=sub) → that user;
+     *  2. else a local user holding the asserted email → TRUSTED LINK (D9),
+     *     but only onto a VERIFIED local email (requireLocalEmailVerified —
+     *     an attacker-parked unverified account can never be taken over);
+     *  3. else create user + account through the internal adapter's
+     *     `createOAuthUser` — the genericOAuth JIT call, so the
+     *     databaseHooks.user.create.after seam (`user.created` → collaborator
+     *     grant sweep) fires exactly as it would for a browser SSO signup.
+     *
+     * Two concurrent first-connects race the create; the loser's unique-email
+     * violation is caught and resolved by re-running the lookup (the Phase 5
+     * duplicate-account lesson).
+     */
+    async provisionConnect(auth, assertion) {
+        let userId = await this.resolveConnectUser(auth, assertion, true);
+        if (userId === null) {
+            // Lost the create race: the winner's rows are committed now (the
+            // adapter's transaction passthrough) — one retry must resolve.
+            userId = await this.resolveConnectUser(auth, assertion, false);
+            if (userId === null) {
+                throw new HubSsoLoginError('sso_login_failed', 'user provisioning raced and re-lookup failed');
+            }
+        }
+        await this.guardSingleHubIdentity(userId, assertion.sub);
+        await this.syncEmail(userId, assertion);
+        // Re-read AFTER the D10 sync may have just rewritten the email; the
+        // response must carry what the database now holds.
+        const [row] = await this.opts.db
+            .select({ id: userTable.id, email: userTable.email, name: userTable.name })
+            .from(userTable)
+            .where(eq(userTable.id, userId))
+            .limit(1);
+        if (!row)
+            throw new HubSsoLoginError('sso_login_failed', 'user row missing after provisioning');
+        return { user: row };
+    }
+    /**
+     * The connect path's fail-closed projection pass: one forced reconcile
+     * reading the user's org list AS THE USER with their freshly stored (or
+     * pre-existing) grant. Returns the pass's own outcome — the route mints a
+     * key ONLY on 'ok' (never a born-dead key).
+     */
+    async reconcileConnect(localUserId) {
+        if (!this.reconciler) {
+            // Boot always binds on cloud; a missing binding is a wiring bug and
+            // must refuse the connect, never mint an unprojected key.
+            throw new HubSsoLoginError('sso_projection_failed', 'no login reconciler bound (boot wiring bug)');
+        }
+        return this.reconciler.forceReconcile(localUserId);
+    }
+    /**
+     * One resolution pass (see provisionConnect). Returns the local user id,
+     * or null when `mayCreate` and the create lost a uniqueness race —
+     * signalling the caller to re-run with the winner's rows visible.
+     */
+    async resolveConnectUser(auth, assertion, mayCreate) {
+        const db = this.opts.db;
+        const [linked] = await db
+            .select({ userId: account.userId })
+            .from(account)
+            .where(and(eq(account.providerId, HUB_SSO_PROVIDER_ID), eq(account.accountId, assertion.sub)))
+            .limit(1);
+        if (linked)
+            return linked.userId;
+        const [existing] = await db
+            .select({ id: userTable.id, emailVerified: userTable.emailVerified })
+            .from(userTable)
+            .where(eq(userTable.email, assertion.email))
+            .limit(1);
+        const authCtx = await auth.$context;
+        if (existing) {
+            if (!existing.emailVerified) {
+                // requireLocalEmailVerified, mirrored: linking a trusted provider
+                // onto an UNVERIFIED local account is the classic pre-registration
+                // takeover — refuse, exactly like the browser SSO path does.
+                throw new HubSsoLoginError('sso_link_refused', 'a local account holds this email but its address is unverified — refusing the trusted link');
+            }
+            await authCtx.internalAdapter.linkAccount({
+                providerId: HUB_SSO_PROVIDER_ID,
+                accountId: assertion.sub,
+                userId: existing.id
+            });
+            return existing.id;
+        }
+        if (!mayCreate)
+            return null;
+        try {
+            const created = await authCtx.internalAdapter.createOAuthUser({ email: assertion.email, name: assertion.name, emailVerified: assertion.emailVerified }, { providerId: HUB_SSO_PROVIDER_ID, accountId: assertion.sub });
+            return created.user.id;
+        }
+        catch (err) {
+            // The only expected failure is the unique-email (or duplicate-link)
+            // violation from a concurrent first-connect — resolvable by retry.
+            this.opts.logger.warn({ err }, 'sso cli-connect: JIT create raced — retrying resolution');
+            return null;
+        }
+    }
+    /**
+     * A local user may hold AT MOST ONE hub identity. The dangerous path:
+     * hub user B's email was changed (hub-side, verified there) to an address
+     * some local user A still carries because A's projection is stale — B's
+     * first login then finds no account row, matches A by email, and the D9
+     * trusted link merges B onto A's local user (and A's resources). Detect the
+     * second `antasphere` accountId, DELETE the NEWEST link row, and fail the
+     * login. The conflict clears when A next logs in (their email re-syncs
+     * away) or an operator intervenes.
+     *
+     * The undo keys on RECENCY, not on the current login's `sub`. On the
+     * normal conflict they are the same row (the trusted link just inserted
+     * it). They differ only in residue states where TWO rows pre-exist — a
+     * crash between better-auth's link and this hook, or a second identity
+     * linked via the explicit /oauth2/link flow (which mints no session, so
+     * this guard never saw it). Deleting the current-sub row there would let
+     * the ESTABLISHED identity's own login destroy itself (and two
+     * concurrent conflicting logins destroy BOTH rows, stranding the user);
+     * the newest row is always the intruding link, never the long-standing
+     * identity, so the user self-heals on retry.
+     */
+    async guardSingleHubIdentity(localUserId, sub) {
+        const rows = await this.opts.db
+            .select({ accountId: account.accountId, createdAt: account.createdAt })
+            .from(account)
+            .where(and(eq(account.userId, localUserId), eq(account.providerId, HUB_SSO_PROVIDER_ID)));
+        if (!rows.some((r) => r.accountId !== sub))
+            return;
+        const newest = [...rows].sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || b.accountId.localeCompare(a.accountId))[0];
+        await this.opts.db
+            .delete(account)
+            .where(and(eq(account.userId, localUserId), eq(account.providerId, HUB_SSO_PROVIDER_ID), eq(account.accountId, newest.accountId)));
+        throw new HubSsoLoginError('sso_identity_conflict', `hub subject ${sub} maps to a local user already linked to a different hub subject — newest link undone`);
+    }
+    /**
+     * D10: the hub is the identity source on cloud, so the local email FOLLOWS
+     * the (verified) hub email at every login — email-keyed features (the
+     * collaborator grant sweep) must see the current address. A collision with
+     * another local user's email fails the login cleanly; the unique
+     * constraint on user.email backstops the read-then-write race.
+     */
+    async syncEmail(localUserId, assertion) {
+        const email = assertion.email.toLowerCase();
+        const [row] = await this.opts.db
+            .select({ email: userTable.email, emailVerified: userTable.emailVerified })
+            .from(userTable)
+            .where(eq(userTable.id, localUserId))
+            .limit(1);
+        if (!row)
+            throw new HubSsoLoginError('sso_login_failed', 'user row missing after callback');
+        const emailChanged = row.email !== email;
+        // For an UNCHANGED address, emailVerified is a LATCH: once this instance
+        // holds the address as verified, a weaker hub assertion never flips it
+        // back — break-glass (api/break-glass.ts) refuses unverified users, so a
+        // downward sync could close the operator door if the hub's posture ever
+        // allowed an unverified login. A CHANGED address takes the hub's
+        // asserted state honestly (the new mailbox is unproven). Mirrors
+        // better-auth's own overrideUserInfo semantics.
+        const emailVerified = emailChanged
+            ? assertion.emailVerified
+            : row.emailVerified || assertion.emailVerified;
+        if (!emailChanged && row.emailVerified === emailVerified)
+            return;
+        if (emailChanged) {
+            const [holder] = await this.opts.db
+                .select({ id: userTable.id })
+                .from(userTable)
+                .where(and(eq(userTable.email, email), ne(userTable.id, localUserId)))
+                .limit(1);
+            if (holder) {
+                throw new HubSsoLoginError('sso_email_conflict', `hub-asserted email is already held by another local user — refusing to sync`);
+            }
+        }
+        try {
+            await this.opts.db
+                .update(userTable)
+                .set({ email, emailVerified, updatedAt: new Date() })
+                .where(eq(userTable.id, localUserId));
+        }
+        catch {
+            // Concurrent claim of the same address between check and write.
+            throw new HubSsoLoginError('sso_email_conflict', 'email sync lost a uniqueness race');
+        }
+    }
+}
+/** The SSO-login user assertion, from the VERIFIED id_token ONLY. */
+function buildUserAssertion(idClaims) {
+    const sub = idClaims.sub;
+    if (typeof sub !== 'string' || !sub)
+        throw new Error('id_token carries no sub');
+    const email = idClaims.email;
+    if (typeof email !== 'string' || !email.includes('@')) {
+        throw new Error('id_token carries no usable email claim');
+    }
+    const normalizedEmail = email.toLowerCase();
+    const rawName = idClaims.name;
+    const name = typeof rawName === 'string' && rawName.trim() ? rawName : normalizedEmail.split('@')[0];
+    return {
+        sub,
+        email: normalizedEmail,
+        emailVerified: idClaims.email_verified === true,
+        name
+    };
+}
+//# sourceMappingURL=hub-sso.js.map

package/dist/identity/hub-sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-sso.js","sourceRoot":"","sources":["../../src/identity/hub-sso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,cAAc,EAAW,MAAM,wBAAwB,CAAC;AAE7F,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AA6DhD;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IADX,YACW,IAMa,EACtB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QATN,SAAI,GAAJ,IAAI,CAMS;QAItB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAsBD,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAc,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,QAAQ;IACR,SAAS;IACT,OAAO;IACP,gBAAgB;IAChB,cAAc;IACd,aAAa;CACL,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,MAAM,cAAc,GAAI,IAAwD,EAAE,cAAc,CAAC;IACjG,MAAM,MAAM,GAAI,cAA0D,EAAE,MAAM,CAAC;IACnF,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AA2BD,MAAM,OAAO,aAAa;IAIK;IAHZ,QAAQ,CAAiB;IAClC,UAAU,GAA2B,IAAI,CAAC;IAElD,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAED,sEAAsE;IACtE,cAAc,CAAC,UAA2B;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAI,EAAW;QAC9B,OAAO,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,iFAAiF;IACjF,aAAa;QACX,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,CAAC;QACnC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,SAAS,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,wGAAwG;IACxG,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,gFAAgF;IAChF,aAAa,CAAC,IAAY;QACxB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,eAAe,CAAC,GAAY,EAAE,WAAmB;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,GAAG,EAAE,WAAW,EAAE,EACpB,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc;QACZ,OAAO;YACL,UAAU,EAAE,mBAAmB;YAC/B,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mCAAmC;YAC3F,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;YAC3B,IAAI,EAAE,IAAI;YACV,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,qEAAqE;YACrE,yDAAyD;YACzD,qDAAqD;YACrD,sBAAsB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC;YACpE,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;SAClD,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CAAC,MAIzB;QACC,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChF,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,SAAS,GAAG;oBAChB,GAAG,SAAS;oBACZ,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,IAAI;iBAC1D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,iEAAiE;gBACjE,gEAAgE;gBAChE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,iGAAiG,CAClG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,SAAS,CAAC,GAAG;gBACjB,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,aAAa,EAAE,SAAS,CAAC,aAAa;aACvC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,kCAAkC,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,SAA8B;QACnE,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,6CAA6C,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE;YAChE,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS,EAAE,SAAS,CAAC,oBAAoB;SAC1C,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,gCAAgC,OAAO,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC;QAClG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,GAAG,EAAE,WAAW,EAAE,EACpB,8FAA8F,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxE,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG;YACH,KAAK,EAAE,eAAe;YACtB,mEAAmE;YACnE,sEAAsE;YACtE,0DAA0D;YAC1D,gEAAgE;YAChE,sEAAsE;YACtE,uEAAuE;YACvE,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE;YACpC,GAAG;YACH,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,gBAAgB,CACpB,IAAqB,EACrB,SAA8B;QAE9B,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAClE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxC,oEAAoE;QACpE,mDAAmD;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;aAC1E,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC/B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;QAChG,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,oEAAoE;YACpE,0DAA0D;YAC1D,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,6CAA6C,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC9B,IAAqB,EACrB,SAA8B,EAC9B,SAAkB;QAElB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAClC,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;aAC7F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAEjC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC;aACpE,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;aAC3C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QACpC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC5B,kEAAkE;gBAClE,mEAAmE;gBACnE,6DAA6D;gBAC7D,MAAM,IAAI,gBAAgB,CACxB,kBAAkB,EAClB,4FAA4F,CAC7F,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC;gBACxC,UAAU,EAAE,mBAAmB;gBAC/B,SAAS,EAAE,SAAS,CAAC,GAAG;gBACxB,MAAM,EAAE,QAAQ,CAAC,EAAE;aACpB,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,eAAe,CAC3D,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,EACxF,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,CAC9D,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,mEAAmE;YACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,yDAAyD,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,sBAAsB,CAAC,WAAmB,EAAE,GAAW;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5B,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aACtE,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;YAAE,OAAO;QACnD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAClG,CAAC,CAAC,CAAE,CAAC;QACN,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACf,MAAM,CAAC,OAAO,CAAC;aACf,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAC/B,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAC3C,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CACxC,CACF,CAAC;QACJ,MAAM,IAAI,gBAAgB,CACxB,uBAAuB,EACvB,eAAe,GAAG,sFAAsF,CACzG,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,SAA0B;QACrE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC;aAC1E,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;aACpC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;QAC5F,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC;QACzC,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,iEAAiE;QACjE,iEAAiE;QACjE,gDAAgD;QAChD,MAAM,aAAa,GAAG,YAAY;YAChC,CAAC,CAAC,SAAS,CAAC,aAAa;YACzB,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,KAAK,aAAa;YAAE,OAAO;QACjE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;iBAChC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;iBAC5B,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;iBACrE,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,EACpB,6EAA6E,CAC9E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;iBACf,MAAM,CAAC,SAAS,CAAC;iBACjB,GAAG,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACpD,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;CACF;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,QAAoB;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACtG,OAAO;QACL,GAAG;QACH,KAAK,EAAE,eAAe;QACtB,aAAa,EAAE,QAAQ,CAAC,cAAc,KAAK,IAAI;QAC/C,IAAI;KACL,CAAC;AACJ,CAAC"}