@arcblock/did-connect-service 4.1.11 → 4.1.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (121) hide show
  1. package/dist/_generated/asset-bytes.js +1 -1
  2. package/dist/_generated/asset-manifest.js +3 -3
  3. package/dist/_generated/login-bundle-string.d.ts +1 -1
  4. package/dist/_generated/login-bundle-string.d.ts.map +1 -1
  5. package/dist/_generated/login-bundle-string.js +1 -1
  6. package/dist/_generated/login-bundle-string.js.map +1 -1
  7. package/dist/access/change-role.d.ts +48 -0
  8. package/dist/access/change-role.d.ts.map +1 -0
  9. package/dist/access/change-role.js +52 -0
  10. package/dist/access/change-role.js.map +1 -0
  11. package/dist/assets/admin-core.a63bbc69.js +1464 -0
  12. package/dist/assets/admin-extra.143b5774.js +2543 -0
  13. package/dist/assets/admin-extra.5b309e5e.js +2547 -0
  14. package/dist/assets/login.4404e695.js +720 -0
  15. package/dist/assets/login.76c483c2.js +720 -0
  16. package/dist/assets/login.bb9f8b03.js +720 -0
  17. package/dist/assets/login.fa25f37a.js +720 -0
  18. package/dist/handler-errors.d.ts +118 -0
  19. package/dist/handler-errors.d.ts.map +1 -0
  20. package/dist/handler-errors.js +38 -0
  21. package/dist/handler-errors.js.map +1 -0
  22. package/dist/handlers/access-key-connect-handler.d.ts.map +1 -1
  23. package/dist/handlers/access-key-connect-handler.js +2 -1
  24. package/dist/handlers/access-key-connect-handler.js.map +1 -1
  25. package/dist/handlers/admin-instance-handler.d.ts.map +1 -1
  26. package/dist/handlers/admin-instance-handler.js +2 -1
  27. package/dist/handlers/admin-instance-handler.js.map +1 -1
  28. package/dist/handlers/auth-handler.d.ts.map +1 -1
  29. package/dist/handlers/auth-handler.js +32 -9
  30. package/dist/handlers/auth-handler.js.map +1 -1
  31. package/dist/handlers/branding-handler.d.ts.map +1 -1
  32. package/dist/handlers/branding-handler.js +12 -9
  33. package/dist/handlers/branding-handler.js.map +1 -1
  34. package/dist/handlers/did-connect-handler.d.ts.map +1 -1
  35. package/dist/handlers/did-connect-handler.js +6 -5
  36. package/dist/handlers/did-connect-handler.js.map +1 -1
  37. package/dist/handlers/email-login-handler.d.ts +1 -1
  38. package/dist/handlers/email-login-handler.d.ts.map +1 -1
  39. package/dist/handlers/email-login-handler.js +63 -12
  40. package/dist/handlers/email-login-handler.js.map +1 -1
  41. package/dist/handlers/federation-admin-handler.d.ts.map +1 -1
  42. package/dist/handlers/federation-admin-handler.js +48 -45
  43. package/dist/handlers/federation-admin-handler.js.map +1 -1
  44. package/dist/handlers/oauth-handler.d.ts.map +1 -1
  45. package/dist/handlers/oauth-handler.js +23 -12
  46. package/dist/handlers/oauth-handler.js.map +1 -1
  47. package/dist/handlers/passkey-handler.d.ts.map +1 -1
  48. package/dist/handlers/passkey-handler.js +5 -4
  49. package/dist/handlers/passkey-handler.js.map +1 -1
  50. package/dist/handlers/team-handler.d.ts.map +1 -1
  51. package/dist/handlers/team-handler.js +19 -19
  52. package/dist/handlers/team-handler.js.map +1 -1
  53. package/dist/http/security-headers.d.ts +38 -0
  54. package/dist/http/security-headers.d.ts.map +1 -0
  55. package/dist/http/security-headers.js +67 -0
  56. package/dist/http/security-headers.js.map +1 -0
  57. package/dist/identity/refresh-tokens.d.ts +21 -0
  58. package/dist/identity/refresh-tokens.d.ts.map +1 -0
  59. package/dist/identity/refresh-tokens.js +45 -0
  60. package/dist/identity/refresh-tokens.js.map +1 -0
  61. package/dist/identity/session-context.d.ts +12 -0
  62. package/dist/identity/session-context.d.ts.map +1 -1
  63. package/dist/identity/session-context.js +12 -0
  64. package/dist/identity/session-context.js.map +1 -1
  65. package/dist/identity/session-tokens.d.ts +15 -0
  66. package/dist/identity/session-tokens.d.ts.map +1 -0
  67. package/dist/identity/session-tokens.js +15 -0
  68. package/dist/identity/session-tokens.js.map +1 -0
  69. package/dist/locale.d.ts +1 -1
  70. package/dist/locale.d.ts.map +1 -1
  71. package/dist/og/ssrf-guard.d.ts.map +1 -1
  72. package/dist/og/ssrf-guard.js +21 -3
  73. package/dist/og/ssrf-guard.js.map +1 -1
  74. package/dist/og/templates.d.ts.map +1 -1
  75. package/dist/og/templates.js +33 -4
  76. package/dist/og/templates.js.map +1 -1
  77. package/dist/pages/admin/i18n.d.ts.map +1 -1
  78. package/dist/pages/admin/i18n.js +33 -9
  79. package/dist/pages/admin/i18n.js.map +1 -1
  80. package/dist/pages/admin/scripts/api-client.d.ts +1 -1
  81. package/dist/pages/admin/scripts/api-client.d.ts.map +1 -1
  82. package/dist/pages/admin/scripts/api-client.js +4 -4
  83. package/dist/pages/admin/scripts/utils.d.ts +1 -1
  84. package/dist/pages/admin/scripts/utils.d.ts.map +1 -1
  85. package/dist/pages/admin/scripts/utils.js +7 -8
  86. package/dist/pages/admin/scripts/utils.js.map +1 -1
  87. package/dist/pages/admin/tab-access-keys.d.ts +1 -1
  88. package/dist/pages/admin/tab-access-keys.d.ts.map +1 -1
  89. package/dist/pages/admin/tab-access-keys.js +4 -4
  90. package/dist/pages/admin/tab-invitations.d.ts +1 -1
  91. package/dist/pages/admin/tab-invitations.d.ts.map +1 -1
  92. package/dist/pages/admin/tab-invitations.js +2 -2
  93. package/dist/pages/admin/tab-members.d.ts +1 -1
  94. package/dist/pages/admin/tab-members.d.ts.map +1 -1
  95. package/dist/pages/admin/tab-members.js +7 -3
  96. package/dist/pages/admin/tab-members.js.map +1 -1
  97. package/dist/pages/admin/tab-profile-accounts.js +1 -1
  98. package/dist/pages/admin-instances-page.d.ts +1 -1
  99. package/dist/pages/admin-instances-page.d.ts.map +1 -1
  100. package/dist/pages/admin-instances-page.js +195 -65
  101. package/dist/pages/admin-instances-page.js.map +1 -1
  102. package/dist/pages/gen-access-key-page.d.ts +1 -1
  103. package/dist/pages/gen-access-key-page.d.ts.map +1 -1
  104. package/dist/pages/gen-access-key-page.js +163 -35
  105. package/dist/pages/gen-access-key-page.js.map +1 -1
  106. package/dist/pages/homepage.d.ts.map +1 -1
  107. package/dist/pages/homepage.js +0 -4
  108. package/dist/pages/homepage.js.map +1 -1
  109. package/dist/pages/invite-page.d.ts +1 -1
  110. package/dist/pages/invite-page.d.ts.map +1 -1
  111. package/dist/pages/invite-page.js +91 -21
  112. package/dist/pages/invite-page.js.map +1 -1
  113. package/dist/pages/oauth-callback-page.d.ts.map +1 -1
  114. package/dist/pages/oauth-callback-page.js +7 -3
  115. package/dist/pages/oauth-callback-page.js.map +1 -1
  116. package/dist/store/d1-store.d.ts +55 -1
  117. package/dist/store/d1-store.d.ts.map +1 -1
  118. package/dist/store/d1-store.js +162 -9
  119. package/dist/store/d1-store.js.map +1 -1
  120. package/migrations/0011_refresh_tokens.sql +23 -0
  121. package/package.json +5 -5
package/dist/pages/oauth-callback-page.js CHANGED
@@ -9,11 +9,15 @@
9
9
  * For POST callbacks (Apple), the server passes code/state via function params
10
10
  * since they are not available in the URL search params.
11
11
  */
12
+ /** Escape string for safe embedding inside <script> — prevents XSS breakout. */
13
+ function escapeForScript(s) {
14
+ return s.replace(/<\/(script)/gi, "<\\/$1");
15
+ }
12
16
  export function renderOAuthCallbackPage(origin, params) {
13
17
  // For POST callbacks (Apple), embed code/state directly into the page
14
18
  // since they won't be in location.search
15
- const embeddedCode = params?.code ? JSON.stringify(params.code) : "null";
16
- const embeddedState = params?.state ? JSON.stringify(params.state) : "null";
19
+ const embeddedCode = params?.code ? escapeForScript(JSON.stringify(params.code)) : "null";
20
+ const embeddedState = params?.state ? escapeForScript(JSON.stringify(params.state)) : "null";
17
21
  return `<!DOCTYPE html>
18
22
  <html><head><style>
19
23
  body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0a0a0b;color:#9394a1;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;font-size:14px}
@@ -30,7 +34,7 @@ export function renderOAuthCallbackPage(origin, params) {
30
34
  if (window.opener && code && state) {
31
35
  // Primary path: postMessage to opener window
32
36
  // Use server-known origin as safe default; override with state.returnUrl for federation cross-domain
33
- var targetOrigin = ${JSON.stringify(origin)};
37
+ var targetOrigin = ${escapeForScript(JSON.stringify(origin))};
34
38
  try {
35
39
  var stateObj = JSON.parse(atob(state));
36
40
  if (stateObj.returnUrl) targetOrigin = new URL(stateObj.returnUrl).origin;
package/dist/pages/oauth-callback-page.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"oauth-callback-page.js","sourceRoot":"","sources":["../../src/pages/oauth-callback-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,MAAwD;IAExD,sEAAsE;IACtE,yCAAyC;IACzC,MAAM,YAAY,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAE5E,OAAO;;;;;;;;;;0CAUiC,YAAY;4CACV,aAAa;;;;;2BAK9B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAiDlC,CAAC;AAChB,CAAC"}
1
+ {"version":3,"file":"oauth-callback-page.js","sourceRoot":"","sources":["../../src/pages/oauth-callback-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,gFAAgF;AAChF,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,MAAwD;IAExD,sEAAsE;IACtE,yCAAyC;IACzC,MAAM,YAAY,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAE7F,OAAO;;;;;;;;;;0CAUiC,YAAY;4CACV,aAAa;;;;;2BAK9B,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAiDnD,CAAC;AAChB,CAAC"}
package/dist/store/d1-store.d.ts CHANGED
@@ -6,6 +6,22 @@
6
6
  */
7
7
  import type { BindHostResult } from "../blocklet-service-rpc-types.js";
8
8
  import type { AccessKeyInfo, AccessPolicyInfo, AuditLogInfo, CreateAccessKeyInput, CreateAccessPolicyInput, CreateAuditLogInput, CreateInvitationInput, CreateSecurityRuleInput, InvitationInfo, MemberInfo, SecurityRuleInfo, StoredAccessKey, StoredConnectedAccount, StoredInvitation, StoredUser, UpdateAccessKeyInput, UpdateAccessPolicyInput, UpdateSecurityRuleInput } from "../types.js";
9
+ export interface IssuedRefreshToken {
10
+ /** Plaintext returned to the caller — never persisted, only its hash is. */
11
+ plaintext: string;
12
+ userDid: string;
13
+ familyId: string;
14
+ }
15
+ export type RefreshTokenStatus = {
16
+ kind: "not-found";
17
+ } | {
18
+ kind: "expired";
19
+ } | {
20
+ kind: "rotatable";
21
+ } | {
22
+ kind: "superseded";
23
+ familyId: string;
24
+ };
9
25
  type RulesCacheEntry = Array<{
10
26
  id: string;
11
27
  pathPattern: string;
@@ -305,7 +321,18 @@ export declare class D1Store {
305
321
  /** Delete all host bindings for an instance (used during instance removal). */
306
322
  deleteInstanceHosts(instanceDid: string): Promise<void>;
307
323
  createVerifyCode(code: string, subject: string, purpose: string): Promise<number>;
308
- consumeVerifyCode(code: string): Promise<{
324
+ /**
325
+ * Consume a verify code. When `id` (the row id returned by createVerifyCode / sendCode)
326
+ * is supplied, matching requires `(id, code)` together — not `code` alone — so a
327
+ * guessed code can only ever be redeemed against the exact session it was issued for,
328
+ * not any other live code in the table (see issue #58, used by the email-login flow).
329
+ *
330
+ * `id` is optional for backward compatibility with callers that only ever operate on
331
+ * their own already-authenticated subject and cross-check `subject` after consuming
332
+ * (e.g. team-handler's email-change confirmation) — those retain the pre-#58 code-only
333
+ * matching semantics unchanged.
334
+ */
335
+ consumeVerifyCode(code: string, id?: number): Promise<{
309
336
  id: number;
310
337
  subject: string;
311
338
  } | null>;
@@ -376,6 +403,33 @@ export declare class D1Store {
376
403
  deleteSecurityRulesByInstance(instanceDid: string): Promise<void>;
377
404
  /** Delete all access policies for a specific instance. */
378
405
  deleteAccessPoliciesByInstance(instanceDid: string): Promise<void>;
406
+ /**
407
+ * Mint the first refresh token in a new rotation family (login/registration).
408
+ * Only `tokenHash` (SHA-256 of the plaintext) is ever persisted — the
409
+ * plaintext returned here is not stored anywhere.
410
+ */
411
+ createRefreshToken(userDid: string, ttlSeconds?: number): Promise<IssuedRefreshToken>;
412
+ /**
413
+ * Classify an existing refresh token before deciding whether to rotate it.
414
+ * `rotatable` covers both a never-revoked token AND the same-instant-race
415
+ * case (already revoked, but its recorded child has no grandchild yet —
416
+ * i.e. a concurrent caller just rotated it a moment ago). `superseded`
417
+ * means the chain has moved on another hop since — genuine token reuse.
418
+ */
419
+ getRefreshTokenStatus(plaintext: string): Promise<RefreshTokenStatus>;
420
+ /**
421
+ * Rotate a refresh token: revoke the old one, mint a deterministic child so
422
+ * concurrent/duplicate callers converge on the same new row instead of
423
+ * racing on it. Uses the same insert-then-catch-UNIQUE-fallback pattern as
424
+ * `setSetting()` above rather than relying on `ON CONFLICT` for
425
+ * cross-request atomicity — this repo's own `setSetting` comment already
426
+ * documents that D1 concurrent writes can race past `ON CONFLICT`.
427
+ * Callers must have already checked `getRefreshTokenStatus` is
428
+ * `"rotatable"` (not `"superseded"`) before calling this.
429
+ */
430
+ rotateRefreshToken(oldPlaintext: string, rotationSecret: string): Promise<IssuedRefreshToken>;
431
+ /** Revoke every token in a rotation family (theft containment). */
432
+ revokeRefreshTokenFamily(familyId: string): Promise<void>;
379
433
  }
380
434
  export {};
381
435
  //# sourceMappingURL=d1-store.d.ts.map
package/dist/store/d1-store.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"d1-store.d.ts","sourceRoot":"","sources":["../../src/store/d1-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,eAAe,EAEf,sBAAsB,EACtB,gBAAgB,EAEhB,UAAU,EACV,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,aAAa,CAAC;AA+LrB,KAAK,eAAe,GAAG,KAAK,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAsDH,kEAAkE;AAClE,wBAAgB,gBAAgB,IAAI,IAAI,CAKvC;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,OAAO;IAmBN,OAAO,CAAC,EAAE;IAlBtB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IAEzC;;;;;;;;;;;;;;;OAeG;gBACiB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE;IAOjG;sFACkF;IAC5E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA2J9B,0DAA0D;IACpD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlF,YAAY,CAChB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IASrE,sFAAsF;IAChF,mBAAmB,CACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAQ3E,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1C,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvC,kBAAkB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B1D,UAAU,CAAC,MAAM,EAAE;QACvB,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCX,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKrD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKzD,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzE,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ/B,QAAQ,CAAC,IAAI,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC1D,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAgE7C,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAetD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQvE,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhF,iBAAiB,CACrB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,EACtF,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;IAoCV,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAStC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnF;;;OAGG;IACG,iBAAiB,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAe7F,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiD9F,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQ3D,cAAc,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAoC7D;;OAEG;IACG,2BAA2B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYzD,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhF,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYxC,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBzD,YAAY,CAAC,IAAI,EAAE,iBAAiB,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC9E,IAAI,EAAE,YAAY,EAAE,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IAgBI,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAInD,kHAAkH;YACpG,gBAAgB;IAsDxB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAgB9E,sBAAsB,CAAC,MAAM,EAAE;QACnC,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BX,sBAAsB,CAAC,OAAO,EAAE;QACpC,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCX,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQrF,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQ7E,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1D,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IASjF,oCAAoC,CACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQnC,qCAAqC,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAS9B,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAcvE,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnF,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlD,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAqCtE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAgBpE,aAAa,CAAC,IAAI,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA0D/C,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA6B1B,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5D,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IA8CtC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAclC,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAiDpE,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IA4B7D,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgC5F,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAwCxG,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAmCnE,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IA2B7D,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA4B5F,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2CxG,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ7C,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;IAYV,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAeT,sEAAsE;IAChE,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAQ3D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CACjD,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IAeK,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAC7D,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CACH;IAiCK,8BAA8B,IAAI,OAAO,CAC7C,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CACH;IAuBK,2BAA2B,IAAI,OAAO,CAC1C,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CACH;IAgCK,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAStG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASrE,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASpE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBzF,YAAY,CAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAStE,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpE,iEAAiE;IAC3D,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxF,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS5E,mGAAmG;IAC7F,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAWlG;2EACuE;IACvE,OAAO,CAAC,aAAa;IAarB,yFAAyF;IACnF,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAarE;;0EAEsE;IAChE,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAsBjG,oCAAoC;IAC9B,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrD,6DAA6D;IACvD,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQ/D,+EAA+E;IACzE,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAiBhF,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAanD,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/C,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC;IASxC,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,YAAY,CAAC,EAAE,MAAM,EACrB,UAAU,SAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAWV,cAAc,CAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAW1E,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhD,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC;IAKzC,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtC,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8DxD,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAyB9E;;;OAGG;IACG,0BAA0B,IAAI,OAAO,CAAC,eAAe,CAAC;IAqBtD,sBAAsB,CAAC,MAAM,EAAE;QACnC,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYX,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI,CAAC;IAoBH,sBAAsB,CAC1B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,wBAAwB,EAAE,MAAM,CAAC;KAClC,GACA,OAAO,CAAC,IAAI,CAAC;IAUV,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD,6BAA6B,IAAI,OAAO,CAAC,IAAI,CAAC;IASpD,2FAA2F;IACrF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAcnD,mFAAmF;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY7E,6BAA6B;IACvB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7C,oCAAoC;IAC9B,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQxC,oEAAoE;IAC9D,uBAAuB,IAAI,OAAO,CACtC,KAAK,CAAC;QACJ,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,SAAS,EAAE,OAAO,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC,CACH;IAyBD;;;OAGG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAc5D,yDAAyD;IACnD,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvE,0DAA0D;IACpD,8BAA8B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQzE"}
1
+ {"version":3,"file":"d1-store.d.ts","sourceRoot":"","sources":["../../src/store/d1-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,eAAe,EAEf,sBAAsB,EACtB,gBAAgB,EAEhB,UAAU,EACV,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,aAAa,CAAC;AAgMrB,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAM7C,KAAK,eAAe,GAAG,KAAK,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAsDH,kEAAkE;AAClE,wBAAgB,gBAAgB,IAAI,IAAI,CAKvC;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,OAAO;IAmBN,OAAO,CAAC,EAAE;IAlBtB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IAEzC;;;;;;;;;;;;;;;OAeG;gBACiB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE;IAOjG;sFACkF;IAC5E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA+K9B,0DAA0D;IACpD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlF,YAAY,CAChB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IASrE,sFAAsF;IAChF,mBAAmB,CACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAQ3E,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1C,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvC,kBAAkB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B1D,UAAU,CAAC,MAAM,EAAE;QACvB,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCX,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKrD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKzD,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzE,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ/B,QAAQ,CAAC,IAAI,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC1D,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAgE7C,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAetD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQvE,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhF,iBAAiB,CACrB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,EACtF,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;IAoCV,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAStC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnF;;;OAGG;IACG,iBAAiB,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAe7F,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiD9F,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQ3D,cAAc,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAoC7D;;OAEG;IACG,2BAA2B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYzD,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhF,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYxC,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBzD,YAAY,CAAC,IAAI,EAAE,iBAAiB,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC9E,IAAI,EAAE,YAAY,EAAE,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IAgBI,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAInD,kHAAkH;YACpG,gBAAgB;IAsDxB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAgB9E,sBAAsB,CAAC,MAAM,EAAE;QACnC,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BX,sBAAsB,CAAC,OAAO,EAAE;QACpC,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCX,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQrF,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQ7E,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1D,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IASjF,oCAAoC,CACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQnC,qCAAqC,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAS9B,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAcvE,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnF,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlD,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAqCtE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAgBpE,aAAa,CAAC,IAAI,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA0D/C,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA6B1B,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5D,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IA8CtC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAclC,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAiDpE,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IA4B7D,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgC5F,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAwCxG,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAmCnE,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IA2B7D,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA4B5F,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2CxG,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ7C,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;IAYV,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAeT,sEAAsE;IAChE,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAQ3D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CACjD,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IAeK,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAC7D,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CACH;IAiCK,8BAA8B,IAAI,OAAO,CAC7C,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CACH;IAuBK,2BAA2B,IAAI,OAAO,CAC1C,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CACH;IAgCK,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAStG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASrE,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASpE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBzF,YAAY,CAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAStE,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpE,iEAAiE;IAC3D,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxF,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS5E,mGAAmG;IAC7F,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAWlG;2EACuE;IACvE,OAAO,CAAC,aAAa;IAarB,yFAAyF;IACnF,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAarE;;0EAEsE;IAChE,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAsBjG,oCAAoC;IAC9B,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrD,6DAA6D;IACvD,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQ/D,+EAA+E;IACzE,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYvF;;;;;;;;;;OAUG;IACG,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAwB7F,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAanD,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/C,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC;IASxC,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,YAAY,CAAC,EAAE,MAAM,EACrB,UAAU,SAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAWV,cAAc,CAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAW1E,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhD,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC;IAKzC,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtC,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8DxD,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAyB9E;;;OAGG;IACG,0BAA0B,IAAI,OAAO,CAAC,eAAe,CAAC;IAqBtD,sBAAsB,CAAC,MAAM,EAAE;QACnC,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYX,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI,CAAC;IAoBH,sBAAsB,CAC1B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,wBAAwB,EAAE,MAAM,CAAC;KAClC,GACA,OAAO,CAAC,IAAI,CAAC;IAUV,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD,6BAA6B,IAAI,OAAO,CAAC,IAAI,CAAC;IASpD,2FAA2F;IACrF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAcnD,mFAAmF;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY7E,6BAA6B;IACvB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7C,oCAAoC;IAC9B,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQxC,oEAAoE;IAC9D,uBAAuB,IAAI,OAAO,CACtC,KAAK,CAAC;QACJ,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,SAAS,EAAE,OAAO,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC,CACH;IAyBD;;;OAGG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAc5D,yDAAyD;IACnD,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvE,0DAA0D;IACpD,8BAA8B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWxE;;;;OAIG;IACG,kBAAkB,CACtB,OAAO,EAAE,MAAM,EACf,UAAU,GAAE,MAAkC,GAC7C,OAAO,CAAC,kBAAkB,CAAC;IAiB9B;;;;;;OAMG;IACG,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoD3E;;;;;;;;;OASG;IACG,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmCnG,mEAAmE;IAC7D,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMhE"}
package/dist/store/d1-store.js CHANGED
@@ -5,6 +5,7 @@
5
5
  * to ensure interoperability. Unused fields default to null/empty.
6
6
  */
7
7
  import { dbToAccessType, invalidateRegexCache } from "../access/access-policy.js";
8
+ import { deriveRotatedTokenId, generateRefreshTokenId, hashRefreshToken } from "../identity/refresh-tokens.js";
8
9
  const SCHEMA_SQL = `
9
10
  CREATE TABLE IF NOT EXISTS cs_users (
10
11
  did TEXT PRIMARY KEY,
@@ -187,6 +188,10 @@ const TABLE_RENAMES = [
187
188
  // Safe because CREATE TABLE IF NOT EXISTS is idempotent — if the isolate
188
189
  // is recycled the flag resets and the migration re-runs harmlessly.
189
190
  let schemaMigrated = false;
191
+ // ── Refresh tokens (issue #121) ──────────────────────────────────────────────
192
+ // Policy default, not measured — tunable later via the existing env-config
193
+ // pattern; not blocking this fix.
194
+ const REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60; // 30 days
190
195
  let _rulesCache = null;
191
196
  let _rulesCacheAt = 0;
192
197
  const RULES_CACHE_TTL = 3600_000; // 1h — write-through invalidation handles same-isolate immediately
@@ -390,6 +395,18 @@ export class D1Store {
390
395
  updated_by TEXT
391
396
  )`),
392
397
  this.db.prepare("CREATE INDEX IF NOT EXISTS idx_instance_hosts_instance ON cs_instance_hosts(instance_did)"),
398
+ this.db.prepare(`CREATE TABLE IF NOT EXISTS cs_refresh_tokens (
399
+ tokenHash TEXT PRIMARY KEY,
400
+ userDid TEXT NOT NULL,
401
+ familyId TEXT NOT NULL,
402
+ rotatedFrom TEXT,
403
+ revokedAt TEXT,
404
+ createdAt TEXT DEFAULT (datetime('now')),
405
+ expiresAt TEXT NOT NULL
406
+ )`),
407
+ this.db.prepare("CREATE INDEX IF NOT EXISTS idx_refresh_tokens_userDid ON cs_refresh_tokens(userDid)"),
408
+ this.db.prepare("CREATE INDEX IF NOT EXISTS idx_refresh_tokens_familyId ON cs_refresh_tokens(familyId)"),
409
+ this.db.prepare("CREATE INDEX IF NOT EXISTS idx_refresh_tokens_rotatedFrom ON cs_refresh_tokens(rotatedFrom)"),
393
410
  ]);
394
411
  // Seed built-in access policies + default rule (idempotent via INSERT OR IGNORE)
395
412
  await this.ensureBuiltinPolicies();
@@ -1533,16 +1550,35 @@ export class D1Store {
1533
1550
  // D1 returns last_row_id in meta
1534
1551
  return result.meta.last_row_id ?? 0;
1535
1552
  }
1536
- async consumeVerifyCode(code) {
1537
- // Atomic consume: UPDATE first (changes = 0 if already consumed or expired),
1538
- // then SELECT to retrieve data. batch() is transactional in D1.
1553
+ /**
1554
+ * Consume a verify code. When `id` (the row id returned by createVerifyCode / sendCode)
1555
+ * is supplied, matching requires `(id, code)` together — not `code` alone — so a
1556
+ * guessed code can only ever be redeemed against the exact session it was issued for,
1557
+ * not any other live code in the table (see issue #58, used by the email-login flow).
1558
+ *
1559
+ * `id` is optional for backward compatibility with callers that only ever operate on
1560
+ * their own already-authenticated subject and cross-check `subject` after consuming
1561
+ * (e.g. team-handler's email-change confirmation) — those retain the pre-#58 code-only
1562
+ * matching semantics unchanged.
1563
+ */
1564
+ async consumeVerifyCode(code, id) {
1565
+ const hasId = id !== undefined;
1566
+ // Atomic consume: UPDATE first (changes = 0 if already consumed, expired, or id/code
1567
+ // mismatch), then SELECT to retrieve data. batch() is transactional in D1.
1568
+ const updateSql = hasId
1569
+ ? `UPDATE cs_verify_codes SET verified = 1, verified_at = datetime('now')
1570
+ WHERE code = ? AND id = ? AND verified = 0
1571
+ AND created_at > datetime('now', '-30 minutes')`
1572
+ : `UPDATE cs_verify_codes SET verified = 1, verified_at = datetime('now')
1573
+ WHERE code = ? AND verified = 0
1574
+ AND created_at > datetime('now', '-30 minutes')`;
1575
+ const selectSql = hasId
1576
+ ? "SELECT id, subject FROM cs_verify_codes WHERE code = ? AND id = ?"
1577
+ : "SELECT id, subject FROM cs_verify_codes WHERE code = ?";
1578
+ const binds = hasId ? [code, id] : [code];
1539
1579
  const [updateResult, selectResult] = await this.db.batch([
1540
- this.db
1541
- .prepare(`UPDATE cs_verify_codes SET verified = 1, verified_at = datetime('now')
1542
- WHERE code = ? AND verified = 0
1543
- AND created_at > datetime('now', '-30 minutes')`)
1544
- .bind(code),
1545
- this.db.prepare("SELECT id, subject FROM cs_verify_codes WHERE code = ?").bind(code),
1580
+ this.db.prepare(updateSql).bind(...binds),
1581
+ this.db.prepare(selectSql).bind(...binds),
1546
1582
  ]);
1547
1583
  if (!updateResult.meta?.changes)
1548
1584
  return null;
@@ -1809,5 +1845,122 @@ export class D1Store {
1809
1845
  .run();
1810
1846
  invalidateRulesCache();
1811
1847
  }
1848
+ // ─── Refresh token operations (independent, rotatable, revocable — issue #121) ─────────
1849
+ /**
1850
+ * Mint the first refresh token in a new rotation family (login/registration).
1851
+ * Only `tokenHash` (SHA-256 of the plaintext) is ever persisted — the
1852
+ * plaintext returned here is not stored anywhere.
1853
+ */
1854
+ async createRefreshToken(userDid, ttlSeconds = REFRESH_TOKEN_TTL_SECONDS) {
1855
+ const plaintext = generateRefreshTokenId();
1856
+ const familyId = generateRefreshTokenId();
1857
+ const tokenHash = await hashRefreshToken(plaintext);
1858
+ const expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString();
1859
+ await this.db
1860
+ .prepare(`INSERT INTO cs_refresh_tokens (tokenHash, userDid, familyId, rotatedFrom, createdAt, expiresAt)
1861
+ VALUES (?, ?, ?, NULL, datetime('now'), ?)`)
1862
+ .bind(tokenHash, userDid, familyId, expiresAt)
1863
+ .run();
1864
+ return { plaintext, userDid, familyId };
1865
+ }
1866
+ /**
1867
+ * Classify an existing refresh token before deciding whether to rotate it.
1868
+ * `rotatable` covers both a never-revoked token AND the same-instant-race
1869
+ * case (already revoked, but its recorded child has no grandchild yet —
1870
+ * i.e. a concurrent caller just rotated it a moment ago). `superseded`
1871
+ * means the chain has moved on another hop since — genuine token reuse.
1872
+ */
1873
+ async getRefreshTokenStatus(plaintext) {
1874
+ const tokenHash = await hashRefreshToken(plaintext);
1875
+ const row = await this.db
1876
+ .prepare(`SELECT
1877
+ x.tokenHash, x.revokedAt, x.expiresAt, x.familyId,
1878
+ child.tokenHash AS childHash,
1879
+ child.revokedAt AS childRevokedAt
1880
+ FROM cs_refresh_tokens x
1881
+ LEFT JOIN cs_refresh_tokens child ON child.rotatedFrom = x.tokenHash
1882
+ WHERE x.tokenHash = ?`)
1883
+ .bind(tokenHash)
1884
+ .first();
1885
+ if (!row)
1886
+ return { kind: "not-found" };
1887
+ if (!row.revokedAt && new Date(row.expiresAt).getTime() < Date.now()) {
1888
+ await this.db
1889
+ .prepare("UPDATE cs_refresh_tokens SET revokedAt = datetime('now') WHERE tokenHash = ? AND revokedAt IS NULL")
1890
+ .bind(row.tokenHash)
1891
+ .run();
1892
+ return { kind: "expired" };
1893
+ }
1894
+ if (!row.revokedAt)
1895
+ return { kind: "rotatable" };
1896
+ // Revoked with no recorded child at all means no legitimate rotation ever
1897
+ // happened for this token — it was revoked by revokeRefreshTokenFamily
1898
+ // (theft containment) or expiry cleanup elsewhere, not a same-instant
1899
+ // race. Do NOT treat this as rotatable, or a family-revoked token could
1900
+ // still be silently rotated back to life.
1901
+ if (!row.childHash)
1902
+ return { kind: "superseded", familyId: row.familyId };
1903
+ // A child exists: it being still un-revoked is the actual signature of a
1904
+ // same-instant race (freshly minted a moment ago by a concurrent caller,
1905
+ // nobody has used it yet) — safe to rotate again, converges on the same
1906
+ // row. If the child itself is ALREADY revoked — whether because the
1907
+ // chain legitimately rotated past it, or because revokeRefreshTokenFamily
1908
+ // force-revoked it directly without ever creating a further child — this
1909
+ // parent token is stale and must NOT be resurrected via rotate (checking
1910
+ // for a grandchild alone missed the direct-force-revoke case; a second
1911
+ // review round's implementation testing caught this).
1912
+ if (!row.childRevokedAt)
1913
+ return { kind: "rotatable" };
1914
+ return { kind: "superseded", familyId: row.familyId };
1915
+ }
1916
+ /**
1917
+ * Rotate a refresh token: revoke the old one, mint a deterministic child so
1918
+ * concurrent/duplicate callers converge on the same new row instead of
1919
+ * racing on it. Uses the same insert-then-catch-UNIQUE-fallback pattern as
1920
+ * `setSetting()` above rather than relying on `ON CONFLICT` for
1921
+ * cross-request atomicity — this repo's own `setSetting` comment already
1922
+ * documents that D1 concurrent writes can race past `ON CONFLICT`.
1923
+ * Callers must have already checked `getRefreshTokenStatus` is
1924
+ * `"rotatable"` (not `"superseded"`) before calling this.
1925
+ */
1926
+ async rotateRefreshToken(oldPlaintext, rotationSecret) {
1927
+ const oldHash = await hashRefreshToken(oldPlaintext);
1928
+ const row = await this.db
1929
+ .prepare("SELECT userDid, familyId FROM cs_refresh_tokens WHERE tokenHash = ?")
1930
+ .bind(oldHash)
1931
+ .first();
1932
+ if (!row)
1933
+ throw new Error("refresh token not found");
1934
+ await this.db
1935
+ .prepare("UPDATE cs_refresh_tokens SET revokedAt = datetime('now') WHERE tokenHash = ? AND revokedAt IS NULL")
1936
+ .bind(oldHash)
1937
+ .run();
1938
+ const newPlaintext = await deriveRotatedTokenId(oldPlaintext, rotationSecret);
1939
+ const newHash = await hashRefreshToken(newPlaintext);
1940
+ const expiresAt = new Date(Date.now() + REFRESH_TOKEN_TTL_SECONDS * 1000).toISOString();
1941
+ try {
1942
+ await this.db
1943
+ .prepare(`INSERT INTO cs_refresh_tokens (tokenHash, userDid, familyId, rotatedFrom, createdAt, expiresAt)
1944
+ VALUES (?, ?, ?, ?, datetime('now'), ?)`)
1945
+ .bind(newHash, row.userDid, row.familyId, oldHash, expiresAt)
1946
+ .run();
1947
+ return { plaintext: newPlaintext, userDid: row.userDid, familyId: row.familyId };
1948
+ }
1949
+ catch (err) {
1950
+ const msg = err instanceof Error ? err.message : String(err);
1951
+ if (!msg.includes("UNIQUE constraint"))
1952
+ throw err;
1953
+ // A concurrent caller's insert already won — converge on that same row
1954
+ // instead of erroring (this is the expected race-safe path, not a bug).
1955
+ return { plaintext: newPlaintext, userDid: row.userDid, familyId: row.familyId };
1956
+ }
1957
+ }
1958
+ /** Revoke every token in a rotation family (theft containment). */
1959
+ async revokeRefreshTokenFamily(familyId) {
1960
+ await this.db
1961
+ .prepare("UPDATE cs_refresh_tokens SET revokedAt = datetime('now') WHERE familyId = ? AND revokedAt IS NULL")
1962
+ .bind(familyId)
1963
+ .run();
1964
+ }
1812
1965
  }
1813
1966
  //# sourceMappingURL=d1-store.js.map