@antseed/cli 0.1.178 → 0.1.180

package/dist/gateway/auth/test-helpers.js

@@ -0,0 +1,368 @@
+/** Test support for the console auth tests: a fake gateway store, an HTTP harness and a software passkey. */
+import assert from 'node:assert/strict';
+import Database from 'better-sqlite3';
+import { createHash, generateKeyPairSync, randomBytes, sign } from 'node:crypto';
+import * as http from 'node:http';
+import { ConsoleError, ConsoleRouter } from '../console-api/router.js';
+import { createConsoleAuth } from './index.js';
+export function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+export class FakeStore {
+    _now;
+    database = new Database(':memory:');
+    members = new Map();
+    roles = new Map();
+    invites = new Map();
+    keys = new Map();
+    adminTokens = new Map();
+    workspaces = [
+        { id: 'ws_default', name: 'Default', isDefault: true },
+        { id: 'ws_research', name: 'Research', isDefault: false },
+    ];
+    audits = [];
+    _seq = 0;
+    constructor(_now) {
+        this._now = _now;
+    }
+    recordAudit(input) {
+        this.audits.push({ actor: input.actor, action: input.action, ...(input.details ? { details: input.details } : {}) });
+    }
+    _id(prefix) {
+        this._seq += 1;
+        return `${prefix}_${this._seq}`;
+    }
+    addMember(input, workspaces = []) {
+        const member = {
+            id: this._id('mem'), email: null, orgRole: 'member', status: 'active', createdAt: this._now(),
+            limits: { daily: 5_000_000, monthly: null, total: null }, routingPolicy: null, maxKeys: null, ...input,
+        };
+        this.members.set(member.id, member);
+        this.roles.set(member.id, new Map(workspaces));
+        return member;
+    }
+    invite(input, workspaces = []) {
+        const member = this.addMember({ ...input, status: 'invited' }, workspaces);
+        const token = randomBytes(24).toString('base64url');
+        this.invites.set(sha256(token), { memberId: member.id, expiresAt: this._now() + 72 * 3600_000, used: false });
+        return { member, token };
+    }
+    addKey(input = {}) {
+        const secret = `antseed_${randomBytes(24).toString('base64url')}`;
+        const key = {
+            id: this._id('key'), label: 'CI key', hint: `${secret.slice(0, 12)}…`, buyerIdentity: 'default', status: 'active',
+            limits: { daily: null, monthly: 10_000_000, total: null }, topupEnabled: false, expiresAt: null, createdAt: this._now(), lastUsedAt: null,
+            workspaceId: 'ws_default', ownerMemberId: null, secret, ...input,
+        };
+        this.keys.set(key.id, key);
+        return key;
+    }
+    setStatus(id, status) {
+        this.members.set(id, { ...this.members.get(id), status });
+    }
+    getMember(id) {
+        return this.members.get(id) ?? null;
+    }
+    findMemberByEmail(email) {
+        return [...this.members.values()].find((member) => member.email?.toLowerCase() === email.toLowerCase()) ?? null;
+    }
+    memberWorkspaceRoles(memberId) {
+        return this.roles.get(memberId) ?? new Map();
+    }
+    isSetupComplete() {
+        return [...this.members.values()].some((member) => member.orgRole === 'owner' && member.status === 'active');
+    }
+    createOwner(input) {
+        return this.addMember({ label: input.label, email: input.email, orgRole: 'owner' }, [['ws_default', 'admin']]);
+    }
+    liveInviteHash(memberId, now) {
+        for (const [hash, invite] of this.invites) {
+            if (invite.memberId === memberId && !invite.used && invite.expiresAt > now)
+                return hash;
+        }
+        return null;
+    }
+    peekInvite(tokenHash, now) {
+        const invite = this.invites.get(tokenHash);
+        const member = invite && !invite.used && invite.expiresAt > now ? this.getMember(invite.memberId) : null;
+        return member?.status === 'invited' ? { member } : null;
+    }
+    consumeInvite(tokenHash, now) {
+        const invite = this.invites.get(tokenHash);
+        if (!invite || invite.used || invite.expiresAt <= now)
+            return null;
+        invite.used = true;
+        this.setStatus(invite.memberId, 'active');
+        return this.getMember(invite.memberId);
+    }
+    inviteState(tokenHash, now) {
+        const invite = this.invites.get(tokenHash);
+        if (!invite)
+            return 'unknown';
+        if (invite.used)
+            return 'used';
+        return invite.expiresAt <= now ? 'expired' : 'unknown';
+    }
+    findAdminTokenBySecret(secret) {
+        return this.adminTokens.get(secret) ?? null;
+    }
+    touchAdminToken(id) {
+        for (const token of this.adminTokens.values())
+            if (token.id === id)
+                token.lastUsedAt = this._now();
+    }
+    findKeyBySecret(secret) {
+        return [...this.keys.values()].find((key) => key.secret === secret) ?? null;
+    }
+    getKey(id) {
+        return this.keys.get(id) ?? null;
+    }
+    getWorkspace(id) {
+        return this.workspaces.find((workspace) => workspace.id === id) ?? null;
+    }
+    listWorkspaces() {
+        return this.workspaces;
+    }
+    usageStats() {
+        return { requests: 3, spentUsdc: 1_250_000 };
+    }
+    createMember(input) {
+        return this.addMember({ label: input.label, email: input.email, orgRole: input.orgRole, status: input.status }, input.workspaces.map((entry) => [entry.workspaceId, entry.role]));
+    }
+}
+/** A cookie jar per "browser". */
+export class Browser {
+    harness;
+    host;
+    extraHeaders;
+    cookies = new Map();
+    lastSetCookies = [];
+    constructor(harness, host, extraHeaders = {}) {
+        this.harness = harness;
+        this.host = host;
+        this.extraHeaders = extraHeaders;
+    }
+    async request(method, path, body, headers = {}) {
+        const cookie = [...this.cookies].map(([name, value]) => `${name}=${value}`).join('; ');
+        const response = await this.harness.raw(method, path, body, {
+            host: this.host,
+            'x-antseed-console': '1',
+            ...(cookie ? { cookie } : {}),
+            ...this.extraHeaders,
+            ...headers,
+        });
+        const setCookies = response.headers['set-cookie'] ?? [];
+        this.lastSetCookies = setCookies;
+        for (const line of setCookies) {
+            const [pair, ...attributes] = line.split(';').map((part) => part.trim());
+            const index = pair.indexOf('=');
+            const name = pair.slice(0, index);
+            const value = pair.slice(index + 1);
+            if (attributes.some((attribute) => attribute.toLowerCase() === 'max-age=0') || value === '')
+                this.cookies.delete(name);
+            else
+                this.cookies.set(name, value);
+        }
+        return response;
+    }
+}
+/** The id of the console session a browser holds (the hash of its cookie). */
+export function sessionId(browser) {
+    return sha256(browser.cookies.get('antseed_console'));
+}
+/** Invites a member and enrolls `wallet` as their sign-in method; returns the signed-in browser. */
+export async function enrollWallet(h, label, wallet, orgRole = 'member') {
+    const { member, token } = h.store.invite({ label, orgRole }, [['ws_default', 'admin']]);
+    const browser = h.browser();
+    const enrollment = (await browser.request('POST', '/auth/invite', { token })).body.enrollment;
+    const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+    const verified = await browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message), enrollment });
+    assert.equal(verified.status, 200, JSON.stringify(verified.body));
+    return { member, browser };
+}
+/** Confirms the browser's session with a wallet signature; resolves to the verify answer. */
+export async function reauthWallet(browser, wallet) {
+    const nonce = await browser.request('POST', '/auth/reauth/wallet/nonce', { address: wallet.address });
+    assert.equal(nonce.status, 200, JSON.stringify(nonce.body));
+    return browser.request('POST', '/auth/reauth/wallet/verify', { message: nonce.body.message, signature: await wallet.signMessage(nonce.body.message) });
+}
+/** Mirrors the console API server: principal resolution, public/allow checks, JSON bodies, ConsoleResponse/ConsoleError. */
+export async function startHarness(options = {}) {
+    const clock = options.clock ?? { now: Date.now() };
+    const store = (options.makeStore?.(() => clock.now) ?? new FakeStore(() => clock.now));
+    const logs = [];
+    const auth = createConsoleAuth({ store, publicUrl: options.publicUrl ?? null, now: () => clock.now, log: (message) => logs.push(message) }, { env: options.env ?? {}, ...options.authOptions });
+    const router = new ConsoleRouter();
+    auth.registerRoutes(router);
+    const server = http.createServer(async (req, res) => {
+        try {
+            const url = new URL(req.url ?? '/', 'http://internal');
+            const path = url.pathname.replace(/^\/console\/api/, '');
+            const match = router.match(req.method ?? 'GET', path);
+            if (!match)
+                throw new ConsoleError(404, 'not_found', 'not found');
+            const chunks = [];
+            for await (const chunk of req)
+                chunks.push(chunk);
+            const body = chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : undefined;
+            const principal = await auth.authenticate(req);
+            if (!match.route.options.public) {
+                if (!principal)
+                    throw new ConsoleError(401, 'unauthenticated', 'Sign in.');
+                const allow = match.route.options.allow ?? ['member', 'token'];
+                if (!allow.includes(principal.kind))
+                    throw new ConsoleError(403, 'forbidden', 'Not allowed.');
+            }
+            const result = await match.route.handler({ method: req.method, path, params: match.params, query: url.searchParams, body, headers: req.headers, principal, raw: req, res });
+            if (result === undefined)
+                return;
+            const response = result;
+            if (response && response.__consoleResponse) {
+                res.writeHead(response.status, { 'content-type': 'application/json', ...response.headers });
+                res.end(response.body === undefined ? undefined : JSON.stringify(response.body));
+                return;
+            }
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify(result));
+        }
+        catch (error) {
+            if (error instanceof ConsoleError) {
+                res.writeHead(error.status, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: { code: error.code, message: error.message } }));
+            }
+            else {
+                res.writeHead(500, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: { code: 'internal', message: String(error) } }));
+            }
+        }
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const port = server.address().port;
+    auth.setGatewayPort(port);
+    const harness = {
+        url: `http://127.0.0.1:${port}`,
+        port,
+        store,
+        auth,
+        clock,
+        logs,
+        raw(method, path, body, headers) {
+            return new Promise((resolve, reject) => {
+                const payload = body === undefined ? undefined : JSON.stringify(body);
+                const req = http.request({
+                    host: '127.0.0.1', port, method, path: `/console/api${path}`,
+                    headers: { ...(payload ? { 'content-type': 'application/json' } : {}), ...headers },
+                }, (res) => {
+                    const chunks = [];
+                    res.on('data', (chunk) => chunks.push(chunk));
+                    res.on('end', () => {
+                        const text = Buffer.concat(chunks).toString('utf8');
+                        let parsed = text;
+                        try {
+                            parsed = text ? JSON.parse(text) : undefined;
+                        }
+                        catch { /* not json */ }
+                        resolve({ status: res.statusCode ?? 0, headers: res.headers, body: parsed });
+                    });
+                });
+                req.on('error', reject);
+                req.end(payload);
+            });
+        },
+        browser(host = `localhost:${port}`, extraHeaders = {}) {
+            return new Browser(harness, host, extraHeaders);
+        },
+        close() {
+            store.database.close();
+            return new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+    return harness;
+}
+// ── Software passkey ("none" attestation, P-256) ────────────────────────────
+function cborHead(major, length) {
+    if (length < 24)
+        return Buffer.from([(major << 5) | length]);
+    if (length < 256)
+        return Buffer.from([(major << 5) | 24, length]);
+    const out = Buffer.alloc(3);
+    out[0] = (major << 5) | 25;
+    out.writeUInt16BE(length, 1);
+    return out;
+}
+function cbor(value) {
+    if (typeof value === 'number')
+        return value >= 0 ? cborHead(0, value) : cborHead(1, -1 - value);
+    if (typeof value === 'string') {
+        const bytes = Buffer.from(value, 'utf8');
+        return Buffer.concat([cborHead(3, bytes.length), bytes]);
+    }
+    if (Buffer.isBuffer(value))
+        return Buffer.concat([cborHead(2, value.length), value]);
+    const parts = [cborHead(5, value.size)];
+    for (const [key, item] of value)
+        parts.push(cbor(key), cbor(item));
+    return Buffer.concat(parts);
+}
+export class SoftwarePasskey {
+    credentialId = randomBytes(16);
+    _privateKey;
+    _publicJwk;
+    counter = 0;
+    userHandle = null;
+    constructor() {
+        const { privateKey, publicKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+        this._privateKey = privateKey;
+        const jwk = publicKey.export({ format: 'jwk' });
+        this._publicJwk = jwk;
+    }
+    get id() {
+        return this.credentialId.toString('base64url');
+    }
+    /** `userVerified: false` clears the UV flag: the authenticator proved presence, not who is holding it. */
+    register(options, origin, overrides = {}) {
+        this.userHandle = options.user.id;
+        const rpId = options.rp.id;
+        const cose = cbor(new Map([
+            [1, 2], [3, -7], [-1, 1],
+            [-2, Buffer.from(this._publicJwk.x, 'base64url')],
+            [-3, Buffer.from(this._publicJwk.y, 'base64url')],
+        ]));
+        const idLength = Buffer.alloc(2);
+        idLength.writeUInt16BE(this.credentialId.length);
+        const authData = Buffer.concat([
+            createHash('sha256').update(rpId).digest(), Buffer.from([overrides.userVerified === false ? 0x41 : 0x45]), Buffer.alloc(4), Buffer.alloc(16), idLength, this.credentialId, cose,
+        ]);
+        const attestationObject = cbor(new Map([['fmt', 'none'], ['attStmt', new Map()], ['authData', authData]]));
+        const clientDataJSON = Buffer.from(JSON.stringify({ type: 'webauthn.create', challenge: options.challenge, origin, crossOrigin: false }));
+        return {
+            id: this.id,
+            rawId: this.id,
+            type: 'public-key',
+            response: { clientDataJSON: clientDataJSON.toString('base64url'), attestationObject: attestationObject.toString('base64url'), transports: ['internal'] },
+            clientExtensionResults: {},
+            authenticatorAttachment: 'platform',
+        };
+    }
+    login(options, origin, overrides = {}) {
+        this.counter = overrides.counter ?? this.counter + 1;
+        const counter = Buffer.alloc(4);
+        counter.writeUInt32BE(this.counter);
+        const authData = Buffer.concat([createHash('sha256').update(options.rpId).digest(), Buffer.from([overrides.userVerified === false ? 0x01 : 0x05]), counter]);
+        const clientDataJSON = Buffer.from(JSON.stringify({ type: 'webauthn.get', challenge: options.challenge, origin, crossOrigin: false }));
+        const signature = sign('sha256', Buffer.concat([authData, createHash('sha256').update(clientDataJSON).digest()]), this._privateKey);
+        return {
+            id: this.id,
+            rawId: this.id,
+            type: 'public-key',
+            response: {
+                clientDataJSON: clientDataJSON.toString('base64url'),
+                authenticatorData: authData.toString('base64url'),
+                signature: signature.toString('base64url'),
+                userHandle: this.userHandle,
+            },
+            clientExtensionResults: {},
+        };
+    }
+}
+//# sourceMappingURL=test-helpers.js.map

package/dist/gateway/auth/test-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../../../src/gateway/auth/test-helpers.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AAErC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAA;AAChG,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAwC,MAAM,0BAA0B,CAAA;AAE5G,OAAO,EAAE,iBAAiB,EAA2B,MAAM,YAAY,CAAA;AAGvE,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,OAAO,SAAS;IAcS;IAbpB,QAAQ,GAAsB,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAA;IACtD,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;IACvC,KAAK,GAAG,IAAI,GAAG,EAAsC,CAAA;IACrD,OAAO,GAAG,IAAI,GAAG,EAAkE,CAAA;IACnF,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAA;IACtD,WAAW,GAAG,IAAI,GAAG,EAAwG,CAAA;IAC7H,UAAU,GAAuB;QACxC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;QACtD,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE;KAC1D,CAAA;IACQ,MAAM,GAAoI,EAAE,CAAA;IAC7I,IAAI,GAAG,CAAC,CAAA;IAEhB,YAA6B,IAAkB;QAAlB,SAAI,GAAJ,IAAI,CAAc;IAAG,CAAC;IAEnD,WAAW,CAAC,KAA+H;QACzI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACtH,CAAC;IAEO,GAAG,CAAC,MAAc;QACxB,IAAI,CAAC,IAAI,IAAI,CAAC,CAAA;QACd,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAA;IACjC,CAAC;IAED,SAAS,CAAC,KAA8C,EAAE,aAA6C,EAAE;QACvG,MAAM,MAAM,GAAe;YACzB,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE;YAC7F,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK;SACvG,CAAA;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;QAC9C,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,CAAC,KAA8C,EAAE,aAA6C,EAAE;QACpG,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,CAAC,CAAA;QAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7G,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC1B,CAAC;IAED,MAAM,CAAC,QAA0B,EAAE;QACjC,MAAM,MAAM,GAAG,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;QACjE,MAAM,GAAG,GAAG;YACV,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,QAAiB;YAC1H,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI;YACzI,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK;SACjE,CAAA;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,SAAS,CAAC,EAAU,EAAE,MAA4B;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,SAAS,CAAC,EAAU;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;IACrC,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAA;IACjH,CAAC;IAED,oBAAoB,CAAC,QAAgB;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE,CAAA;IAC9C,CAAC;IAED,eAAe;QACb,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;IAC9G,CAAC;IAED,WAAW,CAAC,KAA8C;QACxD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAChH,CAAC;IAED,cAAc,CAAC,QAAgB,EAAE,GAAW;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAA;QACzF,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,SAAiB,EAAE,GAAW;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxG,OAAO,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACzD,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,GAAW;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA;QAClE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;QAClB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,WAAW,CAAC,SAAiB,EAAE,GAAW;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC7B,IAAI,MAAM,CAAC,IAAI;YAAE,OAAO,MAAM,CAAA;QAC9B,OAAO,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,CAAC;IAED,sBAAsB,CAAC,MAAc;QACnC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;IAC7C,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;YAAE,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;gBAAE,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACpG,CAAC;IAED,eAAe,CAAC,MAAc;QAC5B,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,CAAA;IAC7E,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;IAClC,CAAC;IAED,YAAY,CAAC,EAAU;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;IACzE,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,UAAU;QACR,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;IAC9C,CAAC;IAED,YAAY,CAAC,KAAoB;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACnL,CAAC;CACF;AAYD,kCAAkC;AAClC,MAAM,OAAO,OAAO;IAIG;IAA2B;IAAuB;IAH9D,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,cAAc,GAAa,EAAE,CAAA;IAE7B,YAAqB,OAAgB,EAAW,IAAY,EAAW,eAAuC,EAAE;QAA3F,YAAO,GAAP,OAAO,CAAS;QAAW,SAAI,GAAJ,IAAI,CAAQ;QAAW,iBAAY,GAAZ,YAAY,CAA6B;IAAG,CAAC;IAEpH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,UAAkC,EAAE;QAC9F,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;YAC1D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,mBAAmB,EAAE,GAAG;YACxB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,IAAI,CAAC,YAAY;YACpB,GAAG,OAAO;SACX,CAAC,CAAA;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;QACvD,IAAI,CAAC,cAAc,GAAG,UAAU,CAAA;QAChC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YACxE,MAAM,KAAK,GAAG,IAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,IAAI,GAAG,IAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YAClC,MAAM,KAAK,GAAG,IAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YACpC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;;gBACjH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC,CAAA;AACxD,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAU,EAAE,KAAa,EAAE,MAAoB,EAAE,UAA8B,QAAQ;IACxH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IACvF,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAA;IAC3B,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;IAC7F,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;IAC/G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC5I,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACjE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC5B,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,MAAoB;IACvE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IACrG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AACxJ,CAAC;AAcD,4HAA4H;AAC5H,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAO/B,EAAE;IACJ,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IAClD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAc,CAAA;IACnG,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,MAAM,IAAI,GAAG,iBAAiB,CAC5B,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAC3G,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CACnD,CAAA;IACD,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAA;IAClC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,iBAAiB,CAAC,CAAA;YACtD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;YACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,CAAC,CAAA;YACrD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;YACjE,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAA;YAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3F,MAAM,SAAS,GAAqB,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;YAChE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAA;gBAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;gBAC9D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;YAC/F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5K,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAM;YAChC,MAAM,QAAQ,GAAG,MAAyB,CAAA;YAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC3F,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;gBAChF,OAAM;YACR,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;YAClF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;IAC5E,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAA;IACnD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IAEzB,MAAM,OAAO,GAAY;QACvB,GAAG,EAAE,oBAAoB,IAAI,EAAE;QAC/B,IAAI;QACJ,KAAK;QACL,IAAI;QACJ,KAAK;QACL,IAAI;QACJ,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;YAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;gBACrE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;oBACvB,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAI,EAAE;oBAC5D,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE;iBACpF,EAAE,CAAC,GAAG,EAAE,EAAE;oBACT,MAAM,MAAM,GAAa,EAAE,CAAA;oBAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;oBAC7C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;wBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;wBACnD,IAAI,MAAM,GAAY,IAAI,CAAA;wBAC1B,IAAI,CAAC;4BAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;wBAC7E,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;oBAC9E,CAAC,CAAC,CAAA;gBACJ,CAAC,CAAC,CAAA;gBACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACvB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAClB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,GAAG,aAAa,IAAI,EAAE,EAAE,YAAY,GAAG,EAAE;YACnD,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;QACjD,CAAC;QACD,KAAK;YACH,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;YACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAChE,CAAC;KACF,CAAA;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;IAC7C,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAA;IAC5D,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC5B,OAAO,GAAG,CAAA;AACZ,CAAC;AAID,SAAS,IAAI,CAAC,KAAgB;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAA;IAC/F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IACpF,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAClE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;IACtB,WAAW,CAAW;IACtB,UAAU,CAA0B;IACrD,OAAO,GAAG,CAAC,CAAA;IACX,UAAU,GAAkB,IAAI,CAAA;IAEhC;QACE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;QACpF,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;QAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA6B,CAAA;QAC3E,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;IACvB,CAAC;IAED,IAAI,EAAE;QACJ,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAChD,CAAC;IAED,0GAA0G;IAC1G,QAAQ,CAAC,OAAyE,EAAE,MAAc,EAAE,YAAwC,EAAE;QAC5I,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,EAAG,CAAA;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAoB;YAC3C,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACjD,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;SAClD,CAAC,CAAC,CAAA;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAChC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI;SAChL,CAAC,CAAA;QACF,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,GAAG,CAAoB,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7H,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACzI,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,EAAE,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE;YACxJ,sBAAsB,EAAE,EAAE;YAC1B,uBAAuB,EAAE,UAAU;SACpC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAA6C,EAAE,MAAc,EAAE,YAA0D,EAAE;QAC/H,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAA;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC/B,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAK,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QAC7J,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACtI,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QACnI,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE;gBACR,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACpD,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACjD,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,sBAAsB,EAAE,EAAE;SAC3B,CAAA;IACH,CAAC;CACF"}

package/dist/gateway/auth/types.d.ts

@@ -0,0 +1,145 @@
+import type Database from 'better-sqlite3';
+import type { JWTVerifyGetKey } from 'jose';
+import type { ApiKey, Member, OrgRole, WorkspaceRole, WorkspaceSummary } from '../console-api/types.js';
+/**
+ * The parts of a gateway member record auth reads. Structural, so the
+ * gateway store's `MemberRecord` satisfies it without auth importing it.
+ */
+export interface AuthMember {
+    id: string;
+    label: string;
+    email: string | null;
+    orgRole: OrgRole;
+    status: 'active' | 'invited' | 'disabled';
+    createdAt: number;
+    limits?: unknown;
+    routingPolicy?: unknown;
+    maxKeys?: number | null;
+}
+/** The parts of an API key record auth reads (`ApiKeyRecord` satisfies it). */
+export interface AuthKey {
+    id: string;
+    label: string;
+    hint: string;
+    buyerIdentity: string;
+    status: 'active' | 'revoked';
+    limits: unknown;
+    topupEnabled: boolean;
+    expiresAt: number | null;
+    createdAt: number;
+    lastUsedAt: number | null;
+    workspaceId?: string;
+    ownerMemberId?: string | null;
+    routingPolicy?: unknown;
+}
+export interface NewAuthMember {
+    label: string;
+    email: string | null;
+    orgRole: OrgRole;
+    status: 'active';
+    workspaces: Array<{
+        workspaceId: string;
+        role: WorkspaceRole;
+    }>;
+}
+/** What auth needs from `GatewayStore`; methods marked optional degrade gracefully when missing. */
+export interface AuthStore {
+    readonly database: Database.Database;
+    getMember(id: string): AuthMember | null;
+    findMemberByEmail(email: string): AuthMember | null;
+    memberWorkspaceRoles(memberId: string): ReadonlyMap<string, WorkspaceRole>;
+    isSetupComplete(): boolean;
+    createOwner(input: {
+        label: string;
+        email: string | null;
+    }): AuthMember;
+    /** The live invite behind a token hash, without consuming it. */
+    peekInvite(tokenHash: string, now: number): {
+        member: AuthMember;
+    } | null;
+    consumeInvite(tokenHash: string, now: number): AuthMember | null;
+    /** Token hash of the member's live invite; an invited member signs in by SSO only while it lasts. */
+    liveInviteHash(memberId: string, now: number): string | null;
+    /** Why an invite token is not usable: already used, expired, or unknown (also for a live one). */
+    inviteState(tokenHash: string, now: number): 'used' | 'expired' | 'unknown';
+    findKeyBySecret(secret: string): AuthKey | null;
+    getKey(id: string): AuthKey | null;
+    getWorkspace?(id: string): WorkspaceSummary | null;
+    listWorkspaces?(): WorkspaceSummary[];
+    workspaceForKey?(keyId: string): WorkspaceSummary | null;
+    usageStats?(keyId: string, since?: number): {
+        requests: number;
+        spentUsdc: number;
+    };
+    /** Used by OIDC / Cloudflare Access domain auto-join; falls back to createInvite + consumeInvite. */
+    createMember?(input: NewAuthMember): AuthMember;
+    createInvite?(input: {
+        label: string;
+        email: string | null;
+        orgRole: OrgRole;
+        workspaces: Array<{
+            workspaceId: string;
+            role: WorkspaceRole;
+        }>;
+        expiresAt: number;
+        createdBy: string | null;
+    }): {
+        token: string;
+    };
+    /**
+     * Management tokens. A token past `expiresAt`, or whose creator is no
+     * longer an active owner/admin, is refused.
+     */
+    findAdminTokenBySecret(secret: string): {
+        id: string;
+        scope: 'admin' | 'read';
+        revokedAt: number | null;
+        expiresAt?: number | null;
+        createdBy?: string | null;
+    } | null;
+    touchAdminToken?(id: string): void;
+    /** Audit log (sign-ins, failed sign-ins, setup); skipped when absent. */
+    recordAudit?(input: {
+        actor: {
+            kind: 'member' | 'token' | 'key' | 'system' | 'cli';
+            id: string | null;
+            label?: string | null;
+        };
+        action: string;
+        target?: {
+            kind: string;
+            id: string | null;
+            label?: string | null;
+        } | null;
+        details?: Record<string, unknown>;
+        ip?: string | null;
+    }): unknown;
+}
+/** Subset of `ConsoleDeps` auth uses; `ConsoleDeps` is assignable to it. */
+export interface AuthDeps {
+    store: AuthStore;
+    publicUrl: string | null;
+    now: () => number;
+    log: (message: string) => void;
+    /** Gateway listen port, for the setup link when there is no publicUrl. */
+    gatewayPort?: number;
+    /**
+     * The gateway runs behind its own Cloudflare tunnel, so `CF-Connecting-IP`
+     * from the local cloudflared is the real client address. Off by default:
+     * behind Caddy or ngrok a client could forge it.
+     */
+    trustCloudflareHeaders?: boolean;
+}
+export interface ConsoleAuthOptions {
+    /** Defaults to process.env; read for ANTSEED_OIDC_* and ANTSEED_CF_ACCESS_*. */
+    env?: Record<string, string | undefined>;
+    gatewayPort?: number;
+    /** Override how `me()` renders a member or key (gateway-core can share its own serializers). */
+    presentMember?: (member: AuthMember, credentials: Member['credentials']) => Member;
+    presentKey?: (key: AuthKey) => ApiKey;
+    /** Test hook: the Cloudflare Access signing keys instead of `https://<team>/cdn-cgi/access/certs`. */
+    cloudflareAccessKeys?: JWTVerifyGetKey;
+    /** Test hook / custom transport for OIDC discovery and token exchange. */
+    fetch?: typeof fetch;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/gateway/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAA;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAEvG;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAA;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAA;IAC5B,MAAM,EAAE,OAAO,CAAA;IACf,YAAY,EAAE,OAAO,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,QAAQ,CAAA;IAChB,UAAU,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC,CAAA;CAChE;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACpC,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IACxC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IACnD,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IAC1E,eAAe,IAAI,OAAO,CAAA;IAC1B,WAAW,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,UAAU,CAAA;IACvE,iEAAiE;IACjE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI,CAAA;IACzE,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAChE,qGAAqG;IACrG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IAC5D,kGAAkG;IAClG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IAC3E,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAAA;IAClD,cAAc,CAAC,IAAI,gBAAgB,EAAE,CAAA;IACrC,eAAe,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAAA;IACxD,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IACnF,qGAAqG;IACrG,YAAY,CAAC,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAAA;IAC/C,YAAY,CAAC,CAAC,KAAK,EAAE;QACnB,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,KAAK,CAAC;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,aAAa,CAAA;SAAE,CAAC,CAAA;QAC/D,SAAS,EAAE,MAAM,CAAA;QACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KACzB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB;;;OAGG;IACH,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;IACtK,eAAe,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,yEAAyE;IACzE,WAAW,CAAC,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE;YAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,KAAK,CAAC;YAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAA;QACxG,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAA;QAC1E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACjC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KACnB,GAAG,OAAO,CAAA;CACZ;AAED,4EAA4E;AAC5E,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,SAAS,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,GAAG,EAAE,MAAM,MAAM,CAAA;IACjB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC9B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACxC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gGAAgG;IAChG,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,MAAM,CAAA;IAClF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACrC,sGAAsG;IACtG,oBAAoB,CAAC,EAAE,eAAe,CAAA;IACtC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB"}

package/dist/gateway/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/gateway/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/gateway/auth/types.ts"],"names":[],"mappings":""}

package/dist/gateway/auth/wallet.d.ts

@@ -0,0 +1,15 @@
+export declare function normalizeAddress(value: unknown): string | null;
+export declare function newWalletNonce(): string;
+/** EIP-4361 (Sign-In with Ethereum) message text. */
+export declare function buildSignInMessage(input: {
+    domain: string;
+    address: string;
+    uri: string;
+    nonce: string;
+    issuedAt: number;
+    expiresAt: number;
+}): string;
+export declare function nonceFromMessage(message: string): string | null;
+/** Lowercase signer address, or null when the signature doesn't parse. */
+export declare function recoverSigner(message: string, signature: string): string | null;
+//# sourceMappingURL=wallet.d.ts.map

package/dist/gateway/auth/wallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/wallet.ts"],"names":[],"mappings":"AAMA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAG9D;AAED,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CActJ;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG/D;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM/E"}

package/dist/gateway/auth/wallet.js

@@ -0,0 +1,43 @@
+import { randomBytes } from 'node:crypto';
+import { getAddress, isAddress, verifyMessage } from 'ethers';
+/** Base mainnet; sign-in messages are chain-agnostic proofs of key ownership, the id is informational. */
+const SIGN_IN_CHAIN_ID = 8453;
+export function normalizeAddress(value) {
+    if (typeof value !== 'string' || !isAddress(value))
+        return null;
+    return getAddress(value);
+}
+export function newWalletNonce() {
+    // EIP-4361 nonces are alphanumeric, at least 8 characters.
+    return randomBytes(16).toString('hex');
+}
+/** EIP-4361 (Sign-In with Ethereum) message text. */
+export function buildSignInMessage(input) {
+    return [
+        `${input.domain} wants you to sign in with your Ethereum account:`,
+        input.address,
+        '',
+        'Sign in to the Antseed gateway console.',
+        '',
+        `URI: ${input.uri}`,
+        'Version: 1',
+        `Chain ID: ${SIGN_IN_CHAIN_ID}`,
+        `Nonce: ${input.nonce}`,
+        `Issued At: ${new Date(input.issuedAt).toISOString()}`,
+        `Expiration Time: ${new Date(input.expiresAt).toISOString()}`,
+    ].join('\n');
+}
+export function nonceFromMessage(message) {
+    const match = /^Nonce: ([A-Za-z0-9]{8,})$/m.exec(message);
+    return match?.[1] ?? null;
+}
+/** Lowercase signer address, or null when the signature doesn't parse. */
+export function recoverSigner(message, signature) {
+    try {
+        return verifyMessage(message, signature).toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=wallet.js.map

package/dist/gateway/auth/wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet.js","sourceRoot":"","sources":["../../../src/gateway/auth/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAA;AAE7D,0GAA0G;AAC1G,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAE7B,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/D,OAAO,UAAU,CAAC,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,2DAA2D;IAC3D,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB,CAAC,KAA2G;IAC5I,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,mDAAmD;QAClE,KAAK,CAAC,OAAO;QACb,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,QAAQ,KAAK,CAAC,GAAG,EAAE;QACnB,YAAY;QACZ,aAAa,gBAAgB,EAAE;QAC/B,UAAU,KAAK,CAAC,KAAK,EAAE;QACvB,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE;QACtD,oBAAoB,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE;KAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,SAAiB;IAC9D,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}