@atproto/bsky 0.2.2 → 0.3.0

package/dist/auth-verifier.js

@@ -40,6 +40,9 @@ export class AuthVerifier {
                 // @NOTE temporarily accept entryway session tokens to shed load from PDS instances
                 const token = bearerTokenFromReq(ctx.req);
                 const header = token ? jose.decodeProtectedHeader(token) : undefined;
+                if (header?.typ === 'bff+jwt') {
+                    return this.bffSession(ctx);
+                }
                 if (header?.typ === 'at+jwt') {
                     // we should never use entryway session tokens in the case of flexible auth audiences (namely in the case of getFeed)
                     if (opts.skipAudCheck) {
@@ -163,6 +166,35 @@ export class AuthVerifier {
                 },
             };
         };
+        this.bffSession = async (reqCtx) => {
+            if (!this.bffJwtSecret) {
+                throw new AuthRequiredError('BFF authentication is not configured');
+            }
+            const token = bearerTokenFromReq(reqCtx.req);
+            if (!token)
+                throw new AuthRequiredError(undefined, 'AuthMissing');
+            const { payload } = await jose
+                .jwtVerify(token, this.bffJwtSecret, {
+                algorithms: ['HS256'],
+                audience: this.ownDid,
+                requiredClaims: ['aud', 'exp', 'sub'],
+            })
+                .catch(() => {
+                throw new AuthRequiredError('BFF token could not be verified', 'InvalidToken');
+            });
+            if (payload.aud !== this.ownDid ||
+                typeof payload.sub !== 'string' ||
+                !isDidString(payload.sub)) {
+                throw new AuthRequiredError('Malformed BFF token', 'InvalidToken');
+            }
+            return {
+                credentials: {
+                    type: 'standard',
+                    aud: this.ownDid,
+                    iss: payload.sub,
+                },
+            };
+        };
         this.modService = async (reqCtx) => {
             const { iss, aud } = await this.verifyServiceJwt(reqCtx, {
                 aud: this.ownDid,
@@ -186,6 +218,7 @@ export class AuthVerifier {
         this.modServiceDid = opts.modServiceDid;
         this.adminPasses = new Set(opts.adminPasses);
         this.entrywayJwtPublicKey = opts.entrywayJwtPublicKey;
+        this.bffJwtSecret = opts.bffJwtSecret;
     }
     parseRoleCreds(req) {
         const parsed = parseBasicAuth(req.headers.authorization || '');

package/dist/auth-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAkB,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,GAAG,MAAM,aAAa,CAAA;AAClC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAChE,OAAO,EAAkB,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EACL,iBAAiB,EAEjB,4BAA4B,EAC5B,YAAY,EACZ,SAAS,IAAI,gBAAgB,GAC9B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,IAAI,EAEJ,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAY9B,MAAM,CAAN,IAAY,UAIX;AAJD,WAAY,UAAU;IACpB,6CAAK,CAAA;IACL,iDAAO,CAAA;IACP,iDAAO,CAAA;AACT,CAAC,EAJW,UAAU,KAAV,UAAU,QAIrB;AAiCD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,oBAAoB;IACpB,qBAAqB;IACrB,+BAA+B;CAChC,CAAC,CAAA;AAUF,MAAM,OAAO,YAAY;IAOvB,YACS,SAA0B,EACjC,IAAsB;QADf,cAAS,GAAT,SAAS,CAAiB;QAanC,0CAA0C;QAC1C,kCAA6B,GAC3B,CAAC,IAAsB,EAAE,EAAE,CAC3B,KAAK,EAAE,GAAW,EAAwC,EAAE;YAC1D,6DAA6D;YAC7D,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;gBACvB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;gBAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAA;gBAC3C,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;oBACxC,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;gBAChD,CAAC;gBACD,OAAO;oBACL,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE;iBAC5C,CAAA;YACH,CAAC;iBAAM,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,mFAAmF;gBACnF,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBACpE,IAAI,MAAM,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC7B,qHAAqH;oBACrH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;wBACtB,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;oBAChE,CAAC;oBACD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;gBAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;oBACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,GAAG,EAAE,IAAI;oBACT,GAAG,EAAE,IAAI;iBACV,CAAC,CAAA;gBACF,IACE,CAAC,IAAI,CAAC,YAAY;oBAClB,CAAE,IAAI,CAAC,oBAAoC,CAAC,GAAG,CAAC,GAAG,CAAC,EACpD,CAAC;oBACD,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;gBACH,CAAC;gBACD,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,UAAU;wBAChB,GAAG;wBACH,GAAG;qBACJ;iBACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,SAAS,EAAE,CAAA;YACzB,CAAC;QACH,CAAC,CAAA;QAEH,qBAAgB,GACd,IAAI,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAA;QAExC,aAAQ,GAAG,KAAK,EAAE,GAAW,EAA2B,EAAE;YACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YAC/C,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvC,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;YACvD,CAAC;YACD,OAAO,MAAwB,CAAA;QACjC,CAAC,CAAA;QAED,SAAI,GAAG,CAAC,GAAW,EAAc,EAAE;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtC,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YACD,OAAO;gBACL,WAAW,EAAE;oBACX,GAAG,KAAK;oBACR,IAAI,EAAE,MAAM;iBACb;aACF,CAAA;QACH,CAAC,CAAA;QAED,mBAAc,GAAG,KAAK,EACpB,GAAW,EAC2B,EAAE;YACxC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACvB,CAAC;QACH,CAAC,CAAA;QAED,2BAAsB,GAAG,KAAK,EAC5B,GAAW,EACwC,EAAE;YACrD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;oBACtC,OAAO;wBACL,WAAW,EAAE;4BACX,GAAG,KAAK;4BACR,IAAI,EAAE,MAAM;yBACb;qBACF,CAAA;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;oBAC/C,OAAO,IAAI,CAAC,SAAS,EAAE,CAAA;gBACzB,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,iBAAiB,EAAE,CAAA;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC,CAAA;QAED,wFAAwF;QACxF,6FAA6F;QAC7F,iEAAiE;QACjE,oBAAe,GAAG,KAAK,EAAE,MAAc,EAA2B,EAAE;YAClE,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;YACvD,CAAC;YAED,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC/B,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAChE,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,IAAI;iBACnB,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,CAAC;iBAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,iBAAiB,EAAE,CAAC;oBACxC,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAA;gBAClE,CAAC;gBACD,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,cAAc,CACf,CAAA;YACH,CAAC,CAAC,CAAA;YAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAA;YAC5C,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC/B,wDAAwD;gBACxD,8CAA8C;gBAC9C,MAAM,IAAI,iBAAiB,CACzB,qCAAqC,EACrC,cAAc,CACf,CAAA;YACH,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAChE,CAAC;iBAAM,IACL,OAAO,GAAG,KAAK,QAAQ;gBACvB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC3B,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC9B,CAAC;gBACD,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;YAC9D,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAChE,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,UAAU;oBAChB,GAAG,EAAE,IAAI,CAAC,MAAM;oBAChB,GAAG,EAAE,GAA2C;iBACjD;aACF,CAAA;QACH,CAAC,CAAA;QAED,eAAU,GAAG,KAAK,EAAE,MAAc,EAA6B,EAAE;YAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE;gBACvD,GAAG,EAAE,IAAI,CAAC,MAAM;gBAChB,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,aAAa,kBAAkB,CAAC;aACnE,CAAC,CAAA;YACF,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAA;QAC3D,CAAC,CAAA;QAED,qBAAgB,GAAG,KAAK,EACtB,MAAc,EAC0B,EAAE;YAC1C,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAChC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC,CAAA;QAjMC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,oBAAoB,GAAG,IAAI,GAAG,CAAC;YAClC,IAAI,CAAC,MAAM;YACX,GAAG,IAAI,CAAC,qBAAqB;SAC9B,CAAC,CAAA;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;QACvC,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5C,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAA;IACvD,CAAC;IA2LD,cAAc,CAAC,GAAoB;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;QAC9D,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,CAAA;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QAC3E,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;QACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACvC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAMpB,MAAc,EAAE,IAAc;QAC9B,MAAM,aAAa,GAAG,KAAK,EACzB,GAAW,EACX,aAAsB,EACL,EAAE;YACnB,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;YACjD,CAAC;YAED,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,IAAI,QAAkC,CAAA;YACtC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;gBACjD,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;YACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;YACnD,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAA;QACD,MAAM,cAAc,GAAG,GAAG,EAAE;YAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpC,IACE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,EACvC,CAAC;gBACD,MAAM,IAAI,iBAAiB,CACzB,OAAO,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,CAAC,+CAA+C,GAAG,EAAE;oBACtD,CAAC,CAAC,mDAAmD,GAAG,EAAE,EAC5D,qBAAqB,CACtB,CAAA;YACH,CAAC;QACH,CAAC,CAAA;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QACD,iGAAiG;QACjG,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,MAAM,EACN,IAAI,CAAC,GAAG,EACR,IAAI,EACJ,aAAa,EACb,sBAAsB,CACvB,CAAA;QACD,IACE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACzC,OAAO,CAAC,GAAG,KAAK,SAAS,EACzB,CAAC;YACD,+DAA+D;YAC/D,4EAA4E;YAC5E,cAAc,EAAE,CAAA;QAClB,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GACqD;YAClE,GAAG,EAAE,OAAO,CAAC,GACqD;SACnE,CAAA;IACH,CAAC;IAED,YAAY,CAAC,GAAW;QACtB,OAAO;YACL,IAAI,CAAC,aAAa;YAClB,GAAG,IAAI,CAAC,aAAa,kBAAkB;SACxC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC;IAED,SAAS;QACP,OAAO;YACL,WAAW,EAAE;gBACX,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,IAAI;aACV;SACF,CAAA;IACH,CAAC;IAED,UAAU,CACR,KAAkE;QAElE,MAAM,MAAM,GACV,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QACtE,MAAM,2BAA2B,GAC/B,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa;YACxC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU;gBACpC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QAC7C,MAAM,kBAAkB,GACtB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,CAAA;QAC1C,MAAM,YAAY,GAChB,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa;YACxC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU;gBACpC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QAE7C,OAAO;YACL,MAAM;YACN,gBAAgB,EAAE,2BAA2B;YAC7C,eAAe,EAAE,2BAA2B;YAC5C,kBAAkB;YAClB,YAAY;YACZ,gBAAgB,EAAE,YAAY,IAAI,MAAM,KAAK,IAAI;SAClD,CAAA;IACH,CAAC;CACF;AAED,UAAU;AACV,YAAY;AAEZ,MAAM,MAAM,GAAG,SAAS,CAAA;AACxB,MAAM,KAAK,GAAG,QAAQ,CAAA;AAEtB,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAW,EAAE;IACtD,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;AAC/D,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAW,EAAE;IACrD,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;AAC9D,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;AAC3C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAa,EACkC,EAAE;IACjD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,MAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAAA;IACnC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAU,EAAE;IAC3E,OAAO,CACL,KAAK;QACL,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,CAC7E,CAAA;AACH,CAAC,CAAA;AAED,MAAM,wBAAwB,GAAG,CAC/B,SAA8B,EACnB,EAAE;IACb,2EAA2E;IAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC5E,OAAO,MAAM,CAAC,eAAe,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,GAAG,EAAE;YACH,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,WAAW;YAChB,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC;YACnD,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC;SACrD;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,OAAO,wBAAwB,CAAC,YAAY,CAAC,CAAA;AAC/C,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAChB,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,EAAE;IACF,MAAM,GAAG,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAA;IAE/C,OAAO,MAAM,CAAC,MAAM,CAClB,QAAQ,EACR,IAAI,EACJ;QACE,GAAG;QACH,WAAW,EAAE,YAAY;KAC1B,EACD,GAAG,CACJ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAA6B,KAAK,EACnE,MAAc,EACd,QAAoB,EACpB,QAAoB,EACpB,GAAW,EACX,EAAE;IACF,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACvD,CAAC;IAED,OAAO,4BAA4B,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;AACtE,CAAC,CAAA","sourcesContent":["import crypto, { type KeyObject } from 'node:crypto'\nimport { secp256k1 } from '@noble/curves/secp256k1'\nimport type express from 'express'\nimport * as jose from 'jose'\nimport * as ui8 from 'uint8arrays'\nimport { SECP256K1_JWT_ALG, parseDidKey } from '@atproto/crypto'\nimport { type DidString, isDidString } from '@atproto/lex'\nimport {\n  AuthRequiredError,\n  type VerifySignatureWithKeyFn,\n  cryptoVerifySignatureWithKey,\n  parseReqNsid,\n  verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport {\n  Code,\n  type DataPlaneClient,\n  getKeyAsDidKey,\n  isDataplaneError,\n  unpackIdentityKeys,\n} from './data-plane/index.js'\nimport type { GetIdentityByDidResponse } from './proto/bsky_pb.js'\n\ntype ReqCtx = {\n  req: express.Request\n}\n\ntype StandardAuthOpts = {\n  skipAudCheck?: boolean\n  lxmCheck?: (method?: string) => boolean\n}\n\nexport enum RoleStatus {\n  Valid,\n  Invalid,\n  Missing,\n}\n\ntype NullOutput = {\n  credentials: {\n    type: 'none'\n    iss: null\n  }\n}\n\ntype StandardOutput = {\n  credentials: {\n    type: 'standard'\n    /** @note we don't validate this to be a {@link DidString} (we might want to in the future) */\n    aud: string\n    iss: DidString | `${DidString}#${string}`\n  }\n}\n\ntype RoleOutput = {\n  credentials: {\n    type: 'role'\n    admin: boolean\n  }\n}\n\ntype ModServiceOutput = {\n  credentials: {\n    type: 'mod_service'\n    aud: DidString\n    iss: DidString | `${DidString}#${string}`\n  }\n}\n\nconst ALLOWED_AUTH_SCOPES = new Set([\n  'com.atproto.access',\n  'com.atproto.appPass',\n  'com.atproto.appPassPrivileged',\n])\n\nexport type AuthVerifierOpts = {\n  ownDid: DidString\n  alternateAudienceDids: DidString[]\n  modServiceDid: DidString\n  adminPasses: string[]\n  entrywayJwtPublicKey?: KeyObject\n}\n\nexport class AuthVerifier {\n  public ownDid: DidString\n  public standardAudienceDids: Set<DidString>\n  public modServiceDid: DidString\n  private adminPasses: Set<string>\n  private entrywayJwtPublicKey?: KeyObject\n\n  constructor(\n    public dataplane: DataPlaneClient,\n    opts: AuthVerifierOpts,\n  ) {\n    this.ownDid = opts.ownDid\n    this.standardAudienceDids = new Set([\n      opts.ownDid,\n      ...opts.alternateAudienceDids,\n    ])\n    this.modServiceDid = opts.modServiceDid\n    this.adminPasses = new Set(opts.adminPasses)\n    this.entrywayJwtPublicKey = opts.entrywayJwtPublicKey\n  }\n\n  // verifiers (arrow fns to preserve scope)\n  standardOptionalParameterized =\n    (opts: StandardAuthOpts) =>\n    async (ctx: ReqCtx): Promise<StandardOutput | NullOutput> => {\n      // @TODO remove! basic auth + did supported just for testing.\n      if (isBasicToken(ctx.req)) {\n        const aud = this.ownDid\n        const iss = ctx.req.headers['appview-as-did']\n        if (typeof iss !== 'string' || !isDidString(iss)) {\n          throw new AuthRequiredError('bad issuer')\n        }\n        if (!this.parseRoleCreds(ctx.req).admin) {\n          throw new AuthRequiredError('bad credentials')\n        }\n        return {\n          credentials: { type: 'standard', iss, aud },\n        }\n      } else if (isBearerToken(ctx.req)) {\n        // @NOTE temporarily accept entryway session tokens to shed load from PDS instances\n        const token = bearerTokenFromReq(ctx.req)\n        const header = token ? jose.decodeProtectedHeader(token) : undefined\n        if (header?.typ === 'at+jwt') {\n          // we should never use entryway session tokens in the case of flexible auth audiences (namely in the case of getFeed)\n          if (opts.skipAudCheck) {\n            throw new AuthRequiredError('Malformed token', 'InvalidToken')\n          }\n          return this.entrywaySession(ctx)\n        }\n\n        const { iss, aud } = await this.verifyServiceJwt(ctx, {\n          lxmCheck: opts.lxmCheck,\n          iss: null,\n          aud: null,\n        })\n        if (\n          !opts.skipAudCheck &&\n          !(this.standardAudienceDids as Set<string>).has(aud)\n        ) {\n          throw new AuthRequiredError(\n            'jwt audience does not match service did',\n            'BadJwtAudience',\n          )\n        }\n        return {\n          credentials: {\n            type: 'standard',\n            iss,\n            aud,\n          },\n        }\n      } else {\n        return this.nullCreds()\n      }\n    }\n\n  standardOptional: (ctx: ReqCtx) => Promise<StandardOutput | NullOutput> =\n    this.standardOptionalParameterized({})\n\n  standard = async (ctx: ReqCtx): Promise<StandardOutput> => {\n    const output = await this.standardOptional(ctx)\n    if (output.credentials.type === 'none') {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n    return output as StandardOutput\n  }\n\n  role = (ctx: ReqCtx): RoleOutput => {\n    const creds = this.parseRoleCreds(ctx.req)\n    if (creds.status !== RoleStatus.Valid) {\n      throw new AuthRequiredError()\n    }\n    return {\n      credentials: {\n        ...creds,\n        type: 'role',\n      },\n    }\n  }\n\n  standardOrRole = async (\n    ctx: ReqCtx,\n  ): Promise<StandardOutput | RoleOutput> => {\n    if (isBearerToken(ctx.req)) {\n      return this.standard(ctx)\n    } else {\n      return this.role(ctx)\n    }\n  }\n\n  optionalStandardOrRole = async (\n    ctx: ReqCtx,\n  ): Promise<StandardOutput | RoleOutput | NullOutput> => {\n    if (isBearerToken(ctx.req)) {\n      return await this.standard(ctx)\n    } else {\n      const creds = this.parseRoleCreds(ctx.req)\n      if (creds.status === RoleStatus.Valid) {\n        return {\n          credentials: {\n            ...creds,\n            type: 'role',\n          },\n        }\n      } else if (creds.status === RoleStatus.Missing) {\n        return this.nullCreds()\n      } else {\n        throw new AuthRequiredError()\n      }\n    }\n  }\n\n  // @NOTE this auth verifier method is not recommended to be implemented by most appviews\n  // this is a short term fix to remove proxy load from Bluesky's PDS and in line with possible\n  // future plans to have the client talk directly with the appview\n  entrywaySession = async (reqCtx: ReqCtx): Promise<StandardOutput> => {\n    const token = bearerTokenFromReq(reqCtx.req)\n    if (!token) {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n\n    // if entryway jwt key not configured then do not parsed these tokens\n    if (!this.entrywayJwtPublicKey) {\n      throw new AuthRequiredError('Malformed token', 'InvalidToken')\n    }\n\n    const res = await jose\n      .jwtVerify(token, this.entrywayJwtPublicKey)\n      .catch((err) => {\n        if (err?.['code'] === 'ERR_JWT_EXPIRED') {\n          throw new AuthRequiredError('Token has expired', 'ExpiredToken')\n        }\n        throw new AuthRequiredError(\n          'Token could not be verified',\n          'InvalidToken',\n        )\n      })\n\n    const { sub, aud, scope, cnf } = res.payload\n    if (typeof cnf !== 'undefined') {\n      // Proof-of-Possession (PoP) tokens are not allowed here\n      // https://www.rfc-editor.org/rfc/rfc7800.html\n      throw new AuthRequiredError(\n        'Malformed token: DPoP not supported',\n        'InvalidToken',\n      )\n    }\n    if (typeof sub !== 'string' || !sub.startsWith('did:')) {\n      throw new AuthRequiredError('Malformed token', 'InvalidToken')\n    } else if (\n      typeof aud !== 'string' ||\n      !aud.startsWith('did:web:') ||\n      !aud.endsWith('.bsky.network')\n    ) {\n      throw new AuthRequiredError('Bad token aud', 'InvalidToken')\n    } else if (typeof scope !== 'string' || !ALLOWED_AUTH_SCOPES.has(scope)) {\n      throw new AuthRequiredError('Bad token scope', 'InvalidToken')\n    }\n\n    return {\n      credentials: {\n        type: 'standard',\n        aud: this.ownDid,\n        iss: sub as DidString | `${DidString}#${string}`,\n      },\n    }\n  }\n\n  modService = async (reqCtx: ReqCtx): Promise<ModServiceOutput> => {\n    const { iss, aud } = await this.verifyServiceJwt(reqCtx, {\n      aud: this.ownDid,\n      iss: [this.modServiceDid, `${this.modServiceDid}#atproto_labeler`],\n    })\n    return { credentials: { type: 'mod_service', aud, iss } }\n  }\n\n  roleOrModService = async (\n    reqCtx: ReqCtx,\n  ): Promise<RoleOutput | ModServiceOutput> => {\n    if (isBearerToken(reqCtx.req)) {\n      return this.modService(reqCtx)\n    } else {\n      return this.role(reqCtx)\n    }\n  }\n\n  parseRoleCreds(req: express.Request) {\n    const parsed = parseBasicAuth(req.headers.authorization || '')\n    const { Missing, Valid, Invalid } = RoleStatus\n    if (!parsed) {\n      return { status: Missing, admin: false, moderator: false, triage: false }\n    }\n    const { username, password } = parsed\n    if (username === 'admin' && this.adminPasses.has(password)) {\n      return { status: Valid, admin: true }\n    }\n    return { status: Invalid, admin: false }\n  }\n\n  async verifyServiceJwt<\n    TOptions extends {\n      iss: string[] | null\n      aud: string | null\n      lxmCheck?: (method?: string) => boolean\n    },\n  >(reqCtx: ReqCtx, opts: TOptions) {\n    const getSigningKey = async (\n      iss: string,\n      _forceRefresh: boolean, // @TODO consider propagating to dataplane\n    ): Promise<string> => {\n      if (opts.iss !== null && !opts.iss.includes(iss)) {\n        throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n      }\n      const [did, serviceId] = iss.split('#')\n      if (!isDidString(did)) {\n        throw new AuthRequiredError('identity unknown')\n      }\n\n      const keyId =\n        serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n      let identity: GetIdentityByDidResponse\n      try {\n        identity = await this.dataplane.getIdentityByDid({ did })\n      } catch (err) {\n        if (isDataplaneError(err, Code.NotFound)) {\n          throw new AuthRequiredError('identity unknown')\n        }\n        throw err\n      }\n      const keys = unpackIdentityKeys(identity.keys)\n      const didKey = getKeyAsDidKey(keys, { id: keyId })\n      if (!didKey) {\n        throw new AuthRequiredError('missing or bad key')\n      }\n      return didKey\n    }\n    const assertLxmCheck = () => {\n      const lxm = parseReqNsid(reqCtx.req)\n      if (\n        (opts.lxmCheck && !opts.lxmCheck(payload.lxm)) ||\n        (!opts.lxmCheck && payload.lxm !== lxm)\n      ) {\n        throw new AuthRequiredError(\n          payload.lxm !== undefined\n            ? `bad jwt lexicon method (\"lxm\"). must match: ${lxm}`\n            : `missing jwt lexicon method (\"lxm\"). must match: ${lxm}`,\n          'BadJwtLexiconMethod',\n        )\n      }\n    }\n\n    const jwtStr = bearerTokenFromReq(reqCtx.req)\n    if (!jwtStr) {\n      throw new AuthRequiredError('missing jwt', 'MissingJwt')\n    }\n    // if validating additional scopes, skip scope check in initial validation & follow up afterwards\n    const payload = await verifyServiceJwt(\n      jwtStr,\n      opts.aud,\n      null,\n      getSigningKey,\n      verifySignatureWithKey,\n    )\n    if (\n      !payload.iss.endsWith('#atproto_labeler') ||\n      payload.lxm !== undefined\n    ) {\n      // @TODO currently permissive of labelers who dont set lxm yet.\n      // we'll allow ozone self-hosters to upgrade before removing this condition.\n      assertLxmCheck()\n    }\n\n    return {\n      iss: payload.iss as (DidString | `${DidString}#${string}`) &\n        (TOptions extends { iss: ReadonlyArray<infer I> } ? I : unknown),\n      aud: payload.aud as string &\n        (TOptions extends { aud: infer A extends string } ? A : unknown),\n    }\n  }\n\n  isModService(iss: string): iss is DidString | `${DidString}#atproto_labeler` {\n    return [\n      this.modServiceDid,\n      `${this.modServiceDid}#atproto_labeler`,\n    ].includes(iss)\n  }\n\n  nullCreds(): NullOutput {\n    return {\n      credentials: {\n        type: 'none',\n        iss: null,\n      },\n    }\n  }\n\n  parseCreds(\n    creds: StandardOutput | RoleOutput | ModServiceOutput | NullOutput,\n  ) {\n    const viewer =\n      creds.credentials.type === 'standard' ? creds.credentials.iss : null\n    const includeTakedownsAnd3pBlocks =\n      (creds.credentials.type === 'role' && creds.credentials.admin) ||\n      creds.credentials.type === 'mod_service' ||\n      (creds.credentials.type === 'standard' &&\n        this.isModService(creds.credentials.iss))\n    const canPerformTakedown =\n      (creds.credentials.type === 'role' && creds.credentials.admin) ||\n      creds.credentials.type === 'mod_service'\n    const isModService =\n      creds.credentials.type === 'mod_service' ||\n      (creds.credentials.type === 'standard' &&\n        this.isModService(creds.credentials.iss))\n\n    return {\n      viewer,\n      includeTakedowns: includeTakedownsAnd3pBlocks,\n      include3pBlocks: includeTakedownsAnd3pBlocks,\n      canPerformTakedown,\n      isModService,\n      skipViewerBlocks: isModService && viewer !== null,\n    }\n  }\n}\n\n// HELPERS\n// ---------\n\nconst BEARER = 'Bearer '\nconst BASIC = 'Basic '\n\nconst isBearerToken = (req: express.Request): boolean => {\n  return req.headers.authorization?.startsWith(BEARER) ?? false\n}\n\nconst isBasicToken = (req: express.Request): boolean => {\n  return req.headers.authorization?.startsWith(BASIC) ?? false\n}\n\nconst bearerTokenFromReq = (req: express.Request) => {\n  const header = req.headers.authorization || ''\n  if (!header.startsWith(BEARER)) return null\n  return header.slice(BEARER.length).trim()\n}\n\nexport const parseBasicAuth = (\n  token: string,\n): { username: string; password: string } | null => {\n  if (!token.startsWith(BASIC)) return null\n  const b64 = token.slice(BASIC.length)\n  let parsed: string[]\n  try {\n    parsed = ui8.toString(ui8.fromString(b64, 'base64pad'), 'utf8').split(':')\n  } catch (err) {\n    return null\n  }\n  const [username, password] = parsed\n  if (!username || !password) return null\n  return { username, password }\n}\n\nexport const buildBasicAuth = (username: string, password: string): string => {\n  return (\n    BASIC +\n    ui8.toString(ui8.fromString(`${username}:${password}`, 'utf8'), 'base64pad')\n  )\n}\n\nconst createSecp256k1KeyObject = (\n  publicKey: Uint8Array | string,\n): KeyObject => {\n  // accepts compressed or uncompressed keys; validates the point is on-curve\n  const point = secp256k1.ProjectivePoint.fromHex(publicKey).toRawBytes(false)\n  return crypto.createPublicKey({\n    format: 'jwk',\n    key: {\n      kty: 'EC',\n      crv: 'secp256k1',\n      x: ui8.toString(point.subarray(1, 33), 'base64url'),\n      y: ui8.toString(point.subarray(33, 65), 'base64url'),\n    },\n  })\n}\n\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n  return createSecp256k1KeyObject(publicKeyHex)\n}\n\nconst verifySig = (\n  publicKey: Uint8Array,\n  data: Uint8Array,\n  sig: Uint8Array,\n) => {\n  const key = createSecp256k1KeyObject(publicKey)\n\n  return crypto.verify(\n    'sha256',\n    data,\n    {\n      key,\n      dsaEncoding: 'ieee-p1363',\n    },\n    sig,\n  )\n}\n\nexport const verifySignatureWithKey: VerifySignatureWithKeyFn = async (\n  didKey: string,\n  msgBytes: Uint8Array,\n  sigBytes: Uint8Array,\n  alg: string,\n) => {\n  if (alg === SECP256K1_JWT_ALG) {\n    const parsed = parseDidKey(didKey)\n    if (alg !== parsed.jwtAlg) {\n      throw new Error(`Expected key alg ${alg}, got ${parsed.jwtAlg}`)\n    }\n\n    return verifySig(parsed.keyBytes, msgBytes, sigBytes)\n  }\n\n  return cryptoVerifySignatureWithKey(didKey, msgBytes, sigBytes, alg)\n}\n"]}
+{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAkB,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,GAAG,MAAM,aAAa,CAAA;AAClC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAChE,OAAO,EAAkB,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EACL,iBAAiB,EAEjB,4BAA4B,EAC5B,YAAY,EACZ,SAAS,IAAI,gBAAgB,GAC9B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,IAAI,EAEJ,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAY9B,MAAM,CAAN,IAAY,UAIX;AAJD,WAAY,UAAU;IACpB,6CAAK,CAAA;IACL,iDAAO,CAAA;IACP,iDAAO,CAAA;AACT,CAAC,EAJW,UAAU,KAAV,UAAU,QAIrB;AAiCD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,oBAAoB;IACpB,qBAAqB;IACrB,+BAA+B;CAChC,CAAC,CAAA;AAWF,MAAM,OAAO,YAAY;IAQvB,YACS,SAA0B,EACjC,IAAsB;QADf,cAAS,GAAT,SAAS,CAAiB;QAcnC,0CAA0C;QAC1C,kCAA6B,GAC3B,CAAC,IAAsB,EAAE,EAAE,CAC3B,KAAK,EAAE,GAAW,EAAwC,EAAE;YAC1D,6DAA6D;YAC7D,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;gBACvB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;gBAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAA;gBAC3C,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;oBACxC,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;gBAChD,CAAC;gBACD,OAAO;oBACL,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE;iBAC5C,CAAA;YACH,CAAC;iBAAM,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,mFAAmF;gBACnF,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBACpE,IAAI,MAAM,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,CAAC;gBACD,IAAI,MAAM,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC7B,qHAAqH;oBACrH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;wBACtB,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;oBAChE,CAAC;oBACD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;gBAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;oBACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,GAAG,EAAE,IAAI;oBACT,GAAG,EAAE,IAAI;iBACV,CAAC,CAAA;gBACF,IACE,CAAC,IAAI,CAAC,YAAY;oBAClB,CAAE,IAAI,CAAC,oBAAoC,CAAC,GAAG,CAAC,GAAG,CAAC,EACpD,CAAC;oBACD,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;gBACH,CAAC;gBACD,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,UAAU;wBAChB,GAAG;wBACH,GAAG;qBACJ;iBACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,SAAS,EAAE,CAAA;YACzB,CAAC;QACH,CAAC,CAAA;QAEH,qBAAgB,GACd,IAAI,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAA;QAExC,aAAQ,GAAG,KAAK,EAAE,GAAW,EAA2B,EAAE;YACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YAC/C,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvC,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;YACvD,CAAC;YACD,OAAO,MAAwB,CAAA;QACjC,CAAC,CAAA;QAED,SAAI,GAAG,CAAC,GAAW,EAAc,EAAE;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtC,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YACD,OAAO;gBACL,WAAW,EAAE;oBACX,GAAG,KAAK;oBACR,IAAI,EAAE,MAAM;iBACb;aACF,CAAA;QACH,CAAC,CAAA;QAED,mBAAc,GAAG,KAAK,EACpB,GAAW,EAC2B,EAAE;YACxC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACvB,CAAC;QACH,CAAC,CAAA;QAED,2BAAsB,GAAG,KAAK,EAC5B,GAAW,EACwC,EAAE;YACrD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;oBACtC,OAAO;wBACL,WAAW,EAAE;4BACX,GAAG,KAAK;4BACR,IAAI,EAAE,MAAM;yBACb;qBACF,CAAA;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;oBAC/C,OAAO,IAAI,CAAC,SAAS,EAAE,CAAA;gBACzB,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,iBAAiB,EAAE,CAAA;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC,CAAA;QAED,wFAAwF;QACxF,6FAA6F;QAC7F,iEAAiE;QACjE,oBAAe,GAAG,KAAK,EAAE,MAAc,EAA2B,EAAE;YAClE,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;YACvD,CAAC;YAED,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC/B,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAChE,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,IAAI;iBACnB,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,CAAC;iBAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,iBAAiB,EAAE,CAAC;oBACxC,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAA;gBAClE,CAAC;gBACD,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,cAAc,CACf,CAAA;YACH,CAAC,CAAC,CAAA;YAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAA;YAC5C,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC/B,wDAAwD;gBACxD,8CAA8C;gBAC9C,MAAM,IAAI,iBAAiB,CACzB,qCAAqC,EACrC,cAAc,CACf,CAAA;YACH,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAChE,CAAC;iBAAM,IACL,OAAO,GAAG,KAAK,QAAQ;gBACvB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC3B,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC9B,CAAC;gBACD,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;YAC9D,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAChE,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,UAAU;oBAChB,GAAG,EAAE,IAAI,CAAC,MAAM;oBAChB,GAAG,EAAE,GAA2C;iBACjD;aACF,CAAA;QACH,CAAC,CAAA;QAED,eAAU,GAAG,KAAK,EAAE,MAAc,EAA2B,EAAE;YAC7D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,iBAAiB,CAAC,sCAAsC,CAAC,CAAA;YACrE,CAAC;YACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC5C,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI;iBAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE;gBACnC,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,IAAI,CAAC,MAAM;gBACrB,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACtC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE;gBACV,MAAM,IAAI,iBAAiB,CACzB,iCAAiC,EACjC,cAAc,CACf,CAAA;YACH,CAAC,CAAC,CAAA;YACJ,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM;gBAC3B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EACzB,CAAC;gBACD,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAA;YACpE,CAAC;YACD,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,UAAU;oBAChB,GAAG,EAAE,IAAI,CAAC,MAAM;oBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAED,eAAU,GAAG,KAAK,EAAE,MAAc,EAA6B,EAAE;YAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE;gBACvD,GAAG,EAAE,IAAI,CAAC,MAAM;gBAChB,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,aAAa,kBAAkB,CAAC;aACnE,CAAC,CAAA;YACF,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAA;QAC3D,CAAC,CAAA;QAED,qBAAgB,GAAG,KAAK,EACtB,MAAc,EAC0B,EAAE;YAC1C,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAChC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC,CAAA;QAxOC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,oBAAoB,GAAG,IAAI,GAAG,CAAC;YAClC,IAAI,CAAC,MAAM;YACX,GAAG,IAAI,CAAC,qBAAqB;SAC9B,CAAC,CAAA;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;QACvC,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5C,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAA;QACrD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;IACvC,CAAC;IAiOD,cAAc,CAAC,GAAoB;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;QAC9D,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,CAAA;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QAC3E,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;QACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACvC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAMpB,MAAc,EAAE,IAAc;QAC9B,MAAM,aAAa,GAAG,KAAK,EACzB,GAAW,EACX,aAAsB,EACL,EAAE;YACnB,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;YACjD,CAAC;YAED,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,IAAI,QAAkC,CAAA;YACtC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;gBACjD,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;YACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;YACnD,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAA;QACD,MAAM,cAAc,GAAG,GAAG,EAAE;YAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpC,IACE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,EACvC,CAAC;gBACD,MAAM,IAAI,iBAAiB,CACzB,OAAO,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,CAAC,+CAA+C,GAAG,EAAE;oBACtD,CAAC,CAAC,mDAAmD,GAAG,EAAE,EAC5D,qBAAqB,CACtB,CAAA;YACH,CAAC;QACH,CAAC,CAAA;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QACD,iGAAiG;QACjG,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,MAAM,EACN,IAAI,CAAC,GAAG,EACR,IAAI,EACJ,aAAa,EACb,sBAAsB,CACvB,CAAA;QACD,IACE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACzC,OAAO,CAAC,GAAG,KAAK,SAAS,EACzB,CAAC;YACD,+DAA+D;YAC/D,4EAA4E;YAC5E,cAAc,EAAE,CAAA;QAClB,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GACqD;YAClE,GAAG,EAAE,OAAO,CAAC,GACqD;SACnE,CAAA;IACH,CAAC;IAED,YAAY,CAAC,GAAW;QACtB,OAAO;YACL,IAAI,CAAC,aAAa;YAClB,GAAG,IAAI,CAAC,aAAa,kBAAkB;SACxC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC;IAED,SAAS;QACP,OAAO;YACL,WAAW,EAAE;gBACX,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,IAAI;aACV;SACF,CAAA;IACH,CAAC;IAED,UAAU,CACR,KAAkE;QAElE,MAAM,MAAM,GACV,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QACtE,MAAM,2BAA2B,GAC/B,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa;YACxC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU;gBACpC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QAC7C,MAAM,kBAAkB,GACtB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,CAAA;QAC1C,MAAM,YAAY,GAChB,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa;YACxC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU;gBACpC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QAE7C,OAAO;YACL,MAAM;YACN,gBAAgB,EAAE,2BAA2B;YAC7C,eAAe,EAAE,2BAA2B;YAC5C,kBAAkB;YAClB,YAAY;YACZ,gBAAgB,EAAE,YAAY,IAAI,MAAM,KAAK,IAAI;SAClD,CAAA;IACH,CAAC;CACF;AAED,UAAU;AACV,YAAY;AAEZ,MAAM,MAAM,GAAG,SAAS,CAAA;AACxB,MAAM,KAAK,GAAG,QAAQ,CAAA;AAEtB,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAW,EAAE;IACtD,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;AAC/D,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAW,EAAE;IACrD,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;AAC9D,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;AAC3C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAa,EACkC,EAAE;IACjD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,MAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAAA;IACnC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAU,EAAE;IAC3E,OAAO,CACL,KAAK;QACL,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,CAC7E,CAAA;AACH,CAAC,CAAA;AAED,MAAM,wBAAwB,GAAG,CAC/B,SAA8B,EACnB,EAAE;IACb,2EAA2E;IAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC5E,OAAO,MAAM,CAAC,eAAe,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,GAAG,EAAE;YACH,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,WAAW;YAChB,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC;YACnD,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC;SACrD;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,OAAO,wBAAwB,CAAC,YAAY,CAAC,CAAA;AAC/C,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAChB,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,EAAE;IACF,MAAM,GAAG,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAA;IAE/C,OAAO,MAAM,CAAC,MAAM,CAClB,QAAQ,EACR,IAAI,EACJ;QACE,GAAG;QACH,WAAW,EAAE,YAAY;KAC1B,EACD,GAAG,CACJ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAA6B,KAAK,EACnE,MAAc,EACd,QAAoB,EACpB,QAAoB,EACpB,GAAW,EACX,EAAE;IACF,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACvD,CAAC;IAED,OAAO,4BAA4B,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;AACtE,CAAC,CAAA","sourcesContent":["import crypto, { type KeyObject } from 'node:crypto'\nimport { secp256k1 } from '@noble/curves/secp256k1'\nimport type express from 'express'\nimport * as jose from 'jose'\nimport * as ui8 from 'uint8arrays'\nimport { SECP256K1_JWT_ALG, parseDidKey } from '@atproto/crypto'\nimport { type DidString, isDidString } from '@atproto/lex'\nimport {\n  AuthRequiredError,\n  type VerifySignatureWithKeyFn,\n  cryptoVerifySignatureWithKey,\n  parseReqNsid,\n  verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport {\n  Code,\n  type DataPlaneClient,\n  getKeyAsDidKey,\n  isDataplaneError,\n  unpackIdentityKeys,\n} from './data-plane/index.js'\nimport type { GetIdentityByDidResponse } from './proto/bsky_pb.js'\n\ntype ReqCtx = {\n  req: express.Request\n}\n\ntype StandardAuthOpts = {\n  skipAudCheck?: boolean\n  lxmCheck?: (method?: string) => boolean\n}\n\nexport enum RoleStatus {\n  Valid,\n  Invalid,\n  Missing,\n}\n\ntype NullOutput = {\n  credentials: {\n    type: 'none'\n    iss: null\n  }\n}\n\ntype StandardOutput = {\n  credentials: {\n    type: 'standard'\n    /** @note we don't validate this to be a {@link DidString} (we might want to in the future) */\n    aud: string\n    iss: DidString | `${DidString}#${string}`\n  }\n}\n\ntype RoleOutput = {\n  credentials: {\n    type: 'role'\n    admin: boolean\n  }\n}\n\ntype ModServiceOutput = {\n  credentials: {\n    type: 'mod_service'\n    aud: DidString\n    iss: DidString | `${DidString}#${string}`\n  }\n}\n\nconst ALLOWED_AUTH_SCOPES = new Set([\n  'com.atproto.access',\n  'com.atproto.appPass',\n  'com.atproto.appPassPrivileged',\n])\n\nexport type AuthVerifierOpts = {\n  ownDid: DidString\n  alternateAudienceDids: DidString[]\n  modServiceDid: DidString\n  adminPasses: string[]\n  entrywayJwtPublicKey?: KeyObject\n  bffJwtSecret?: Uint8Array\n}\n\nexport class AuthVerifier {\n  public ownDid: DidString\n  public standardAudienceDids: Set<DidString>\n  public modServiceDid: DidString\n  private adminPasses: Set<string>\n  private entrywayJwtPublicKey?: KeyObject\n  private bffJwtSecret?: Uint8Array\n\n  constructor(\n    public dataplane: DataPlaneClient,\n    opts: AuthVerifierOpts,\n  ) {\n    this.ownDid = opts.ownDid\n    this.standardAudienceDids = new Set([\n      opts.ownDid,\n      ...opts.alternateAudienceDids,\n    ])\n    this.modServiceDid = opts.modServiceDid\n    this.adminPasses = new Set(opts.adminPasses)\n    this.entrywayJwtPublicKey = opts.entrywayJwtPublicKey\n    this.bffJwtSecret = opts.bffJwtSecret\n  }\n\n  // verifiers (arrow fns to preserve scope)\n  standardOptionalParameterized =\n    (opts: StandardAuthOpts) =>\n    async (ctx: ReqCtx): Promise<StandardOutput | NullOutput> => {\n      // @TODO remove! basic auth + did supported just for testing.\n      if (isBasicToken(ctx.req)) {\n        const aud = this.ownDid\n        const iss = ctx.req.headers['appview-as-did']\n        if (typeof iss !== 'string' || !isDidString(iss)) {\n          throw new AuthRequiredError('bad issuer')\n        }\n        if (!this.parseRoleCreds(ctx.req).admin) {\n          throw new AuthRequiredError('bad credentials')\n        }\n        return {\n          credentials: { type: 'standard', iss, aud },\n        }\n      } else if (isBearerToken(ctx.req)) {\n        // @NOTE temporarily accept entryway session tokens to shed load from PDS instances\n        const token = bearerTokenFromReq(ctx.req)\n        const header = token ? jose.decodeProtectedHeader(token) : undefined\n        if (header?.typ === 'bff+jwt') {\n          return this.bffSession(ctx)\n        }\n        if (header?.typ === 'at+jwt') {\n          // we should never use entryway session tokens in the case of flexible auth audiences (namely in the case of getFeed)\n          if (opts.skipAudCheck) {\n            throw new AuthRequiredError('Malformed token', 'InvalidToken')\n          }\n          return this.entrywaySession(ctx)\n        }\n\n        const { iss, aud } = await this.verifyServiceJwt(ctx, {\n          lxmCheck: opts.lxmCheck,\n          iss: null,\n          aud: null,\n        })\n        if (\n          !opts.skipAudCheck &&\n          !(this.standardAudienceDids as Set<string>).has(aud)\n        ) {\n          throw new AuthRequiredError(\n            'jwt audience does not match service did',\n            'BadJwtAudience',\n          )\n        }\n        return {\n          credentials: {\n            type: 'standard',\n            iss,\n            aud,\n          },\n        }\n      } else {\n        return this.nullCreds()\n      }\n    }\n\n  standardOptional: (ctx: ReqCtx) => Promise<StandardOutput | NullOutput> =\n    this.standardOptionalParameterized({})\n\n  standard = async (ctx: ReqCtx): Promise<StandardOutput> => {\n    const output = await this.standardOptional(ctx)\n    if (output.credentials.type === 'none') {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n    return output as StandardOutput\n  }\n\n  role = (ctx: ReqCtx): RoleOutput => {\n    const creds = this.parseRoleCreds(ctx.req)\n    if (creds.status !== RoleStatus.Valid) {\n      throw new AuthRequiredError()\n    }\n    return {\n      credentials: {\n        ...creds,\n        type: 'role',\n      },\n    }\n  }\n\n  standardOrRole = async (\n    ctx: ReqCtx,\n  ): Promise<StandardOutput | RoleOutput> => {\n    if (isBearerToken(ctx.req)) {\n      return this.standard(ctx)\n    } else {\n      return this.role(ctx)\n    }\n  }\n\n  optionalStandardOrRole = async (\n    ctx: ReqCtx,\n  ): Promise<StandardOutput | RoleOutput | NullOutput> => {\n    if (isBearerToken(ctx.req)) {\n      return await this.standard(ctx)\n    } else {\n      const creds = this.parseRoleCreds(ctx.req)\n      if (creds.status === RoleStatus.Valid) {\n        return {\n          credentials: {\n            ...creds,\n            type: 'role',\n          },\n        }\n      } else if (creds.status === RoleStatus.Missing) {\n        return this.nullCreds()\n      } else {\n        throw new AuthRequiredError()\n      }\n    }\n  }\n\n  // @NOTE this auth verifier method is not recommended to be implemented by most appviews\n  // this is a short term fix to remove proxy load from Bluesky's PDS and in line with possible\n  // future plans to have the client talk directly with the appview\n  entrywaySession = async (reqCtx: ReqCtx): Promise<StandardOutput> => {\n    const token = bearerTokenFromReq(reqCtx.req)\n    if (!token) {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n\n    // if entryway jwt key not configured then do not parsed these tokens\n    if (!this.entrywayJwtPublicKey) {\n      throw new AuthRequiredError('Malformed token', 'InvalidToken')\n    }\n\n    const res = await jose\n      .jwtVerify(token, this.entrywayJwtPublicKey)\n      .catch((err) => {\n        if (err?.['code'] === 'ERR_JWT_EXPIRED') {\n          throw new AuthRequiredError('Token has expired', 'ExpiredToken')\n        }\n        throw new AuthRequiredError(\n          'Token could not be verified',\n          'InvalidToken',\n        )\n      })\n\n    const { sub, aud, scope, cnf } = res.payload\n    if (typeof cnf !== 'undefined') {\n      // Proof-of-Possession (PoP) tokens are not allowed here\n      // https://www.rfc-editor.org/rfc/rfc7800.html\n      throw new AuthRequiredError(\n        'Malformed token: DPoP not supported',\n        'InvalidToken',\n      )\n    }\n    if (typeof sub !== 'string' || !sub.startsWith('did:')) {\n      throw new AuthRequiredError('Malformed token', 'InvalidToken')\n    } else if (\n      typeof aud !== 'string' ||\n      !aud.startsWith('did:web:') ||\n      !aud.endsWith('.bsky.network')\n    ) {\n      throw new AuthRequiredError('Bad token aud', 'InvalidToken')\n    } else if (typeof scope !== 'string' || !ALLOWED_AUTH_SCOPES.has(scope)) {\n      throw new AuthRequiredError('Bad token scope', 'InvalidToken')\n    }\n\n    return {\n      credentials: {\n        type: 'standard',\n        aud: this.ownDid,\n        iss: sub as DidString | `${DidString}#${string}`,\n      },\n    }\n  }\n\n  bffSession = async (reqCtx: ReqCtx): Promise<StandardOutput> => {\n    if (!this.bffJwtSecret) {\n      throw new AuthRequiredError('BFF authentication is not configured')\n    }\n    const token = bearerTokenFromReq(reqCtx.req)\n    if (!token) throw new AuthRequiredError(undefined, 'AuthMissing')\n\n    const { payload } = await jose\n      .jwtVerify(token, this.bffJwtSecret, {\n        algorithms: ['HS256'],\n        audience: this.ownDid,\n        requiredClaims: ['aud', 'exp', 'sub'],\n      })\n      .catch(() => {\n        throw new AuthRequiredError(\n          'BFF token could not be verified',\n          'InvalidToken',\n        )\n      })\n    if (\n      payload.aud !== this.ownDid ||\n      typeof payload.sub !== 'string' ||\n      !isDidString(payload.sub)\n    ) {\n      throw new AuthRequiredError('Malformed BFF token', 'InvalidToken')\n    }\n    return {\n      credentials: {\n        type: 'standard',\n        aud: this.ownDid,\n        iss: payload.sub,\n      },\n    }\n  }\n\n  modService = async (reqCtx: ReqCtx): Promise<ModServiceOutput> => {\n    const { iss, aud } = await this.verifyServiceJwt(reqCtx, {\n      aud: this.ownDid,\n      iss: [this.modServiceDid, `${this.modServiceDid}#atproto_labeler`],\n    })\n    return { credentials: { type: 'mod_service', aud, iss } }\n  }\n\n  roleOrModService = async (\n    reqCtx: ReqCtx,\n  ): Promise<RoleOutput | ModServiceOutput> => {\n    if (isBearerToken(reqCtx.req)) {\n      return this.modService(reqCtx)\n    } else {\n      return this.role(reqCtx)\n    }\n  }\n\n  parseRoleCreds(req: express.Request) {\n    const parsed = parseBasicAuth(req.headers.authorization || '')\n    const { Missing, Valid, Invalid } = RoleStatus\n    if (!parsed) {\n      return { status: Missing, admin: false, moderator: false, triage: false }\n    }\n    const { username, password } = parsed\n    if (username === 'admin' && this.adminPasses.has(password)) {\n      return { status: Valid, admin: true }\n    }\n    return { status: Invalid, admin: false }\n  }\n\n  async verifyServiceJwt<\n    TOptions extends {\n      iss: string[] | null\n      aud: string | null\n      lxmCheck?: (method?: string) => boolean\n    },\n  >(reqCtx: ReqCtx, opts: TOptions) {\n    const getSigningKey = async (\n      iss: string,\n      _forceRefresh: boolean, // @TODO consider propagating to dataplane\n    ): Promise<string> => {\n      if (opts.iss !== null && !opts.iss.includes(iss)) {\n        throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n      }\n      const [did, serviceId] = iss.split('#')\n      if (!isDidString(did)) {\n        throw new AuthRequiredError('identity unknown')\n      }\n\n      const keyId =\n        serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n      let identity: GetIdentityByDidResponse\n      try {\n        identity = await this.dataplane.getIdentityByDid({ did })\n      } catch (err) {\n        if (isDataplaneError(err, Code.NotFound)) {\n          throw new AuthRequiredError('identity unknown')\n        }\n        throw err\n      }\n      const keys = unpackIdentityKeys(identity.keys)\n      const didKey = getKeyAsDidKey(keys, { id: keyId })\n      if (!didKey) {\n        throw new AuthRequiredError('missing or bad key')\n      }\n      return didKey\n    }\n    const assertLxmCheck = () => {\n      const lxm = parseReqNsid(reqCtx.req)\n      if (\n        (opts.lxmCheck && !opts.lxmCheck(payload.lxm)) ||\n        (!opts.lxmCheck && payload.lxm !== lxm)\n      ) {\n        throw new AuthRequiredError(\n          payload.lxm !== undefined\n            ? `bad jwt lexicon method (\"lxm\"). must match: ${lxm}`\n            : `missing jwt lexicon method (\"lxm\"). must match: ${lxm}`,\n          'BadJwtLexiconMethod',\n        )\n      }\n    }\n\n    const jwtStr = bearerTokenFromReq(reqCtx.req)\n    if (!jwtStr) {\n      throw new AuthRequiredError('missing jwt', 'MissingJwt')\n    }\n    // if validating additional scopes, skip scope check in initial validation & follow up afterwards\n    const payload = await verifyServiceJwt(\n      jwtStr,\n      opts.aud,\n      null,\n      getSigningKey,\n      verifySignatureWithKey,\n    )\n    if (\n      !payload.iss.endsWith('#atproto_labeler') ||\n      payload.lxm !== undefined\n    ) {\n      // @TODO currently permissive of labelers who dont set lxm yet.\n      // we'll allow ozone self-hosters to upgrade before removing this condition.\n      assertLxmCheck()\n    }\n\n    return {\n      iss: payload.iss as (DidString | `${DidString}#${string}`) &\n        (TOptions extends { iss: ReadonlyArray<infer I> } ? I : unknown),\n      aud: payload.aud as string &\n        (TOptions extends { aud: infer A extends string } ? A : unknown),\n    }\n  }\n\n  isModService(iss: string): iss is DidString | `${DidString}#atproto_labeler` {\n    return [\n      this.modServiceDid,\n      `${this.modServiceDid}#atproto_labeler`,\n    ].includes(iss)\n  }\n\n  nullCreds(): NullOutput {\n    return {\n      credentials: {\n        type: 'none',\n        iss: null,\n      },\n    }\n  }\n\n  parseCreds(\n    creds: StandardOutput | RoleOutput | ModServiceOutput | NullOutput,\n  ) {\n    const viewer =\n      creds.credentials.type === 'standard' ? creds.credentials.iss : null\n    const includeTakedownsAnd3pBlocks =\n      (creds.credentials.type === 'role' && creds.credentials.admin) ||\n      creds.credentials.type === 'mod_service' ||\n      (creds.credentials.type === 'standard' &&\n        this.isModService(creds.credentials.iss))\n    const canPerformTakedown =\n      (creds.credentials.type === 'role' && creds.credentials.admin) ||\n      creds.credentials.type === 'mod_service'\n    const isModService =\n      creds.credentials.type === 'mod_service' ||\n      (creds.credentials.type === 'standard' &&\n        this.isModService(creds.credentials.iss))\n\n    return {\n      viewer,\n      includeTakedowns: includeTakedownsAnd3pBlocks,\n      include3pBlocks: includeTakedownsAnd3pBlocks,\n      canPerformTakedown,\n      isModService,\n      skipViewerBlocks: isModService && viewer !== null,\n    }\n  }\n}\n\n// HELPERS\n// ---------\n\nconst BEARER = 'Bearer '\nconst BASIC = 'Basic '\n\nconst isBearerToken = (req: express.Request): boolean => {\n  return req.headers.authorization?.startsWith(BEARER) ?? false\n}\n\nconst isBasicToken = (req: express.Request): boolean => {\n  return req.headers.authorization?.startsWith(BASIC) ?? false\n}\n\nconst bearerTokenFromReq = (req: express.Request) => {\n  const header = req.headers.authorization || ''\n  if (!header.startsWith(BEARER)) return null\n  return header.slice(BEARER.length).trim()\n}\n\nexport const parseBasicAuth = (\n  token: string,\n): { username: string; password: string } | null => {\n  if (!token.startsWith(BASIC)) return null\n  const b64 = token.slice(BASIC.length)\n  let parsed: string[]\n  try {\n    parsed = ui8.toString(ui8.fromString(b64, 'base64pad'), 'utf8').split(':')\n  } catch (err) {\n    return null\n  }\n  const [username, password] = parsed\n  if (!username || !password) return null\n  return { username, password }\n}\n\nexport const buildBasicAuth = (username: string, password: string): string => {\n  return (\n    BASIC +\n    ui8.toString(ui8.fromString(`${username}:${password}`, 'utf8'), 'base64pad')\n  )\n}\n\nconst createSecp256k1KeyObject = (\n  publicKey: Uint8Array | string,\n): KeyObject => {\n  // accepts compressed or uncompressed keys; validates the point is on-curve\n  const point = secp256k1.ProjectivePoint.fromHex(publicKey).toRawBytes(false)\n  return crypto.createPublicKey({\n    format: 'jwk',\n    key: {\n      kty: 'EC',\n      crv: 'secp256k1',\n      x: ui8.toString(point.subarray(1, 33), 'base64url'),\n      y: ui8.toString(point.subarray(33, 65), 'base64url'),\n    },\n  })\n}\n\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n  return createSecp256k1KeyObject(publicKeyHex)\n}\n\nconst verifySig = (\n  publicKey: Uint8Array,\n  data: Uint8Array,\n  sig: Uint8Array,\n) => {\n  const key = createSecp256k1KeyObject(publicKey)\n\n  return crypto.verify(\n    'sha256',\n    data,\n    {\n      key,\n      dsaEncoding: 'ieee-p1363',\n    },\n    sig,\n  )\n}\n\nexport const verifySignatureWithKey: VerifySignatureWithKeyFn = async (\n  didKey: string,\n  msgBytes: Uint8Array,\n  sigBytes: Uint8Array,\n  alg: string,\n) => {\n  if (alg === SECP256K1_JWT_ALG) {\n    const parsed = parseDidKey(didKey)\n    if (alg !== parsed.jwtAlg) {\n      throw new Error(`Expected key alg ${alg}, got ${parsed.jwtAlg}`)\n    }\n\n    return verifySig(parsed.keyBytes, msgBytes, sigBytes)\n  }\n\n  return cryptoVerifySignatureWithKey(didKey, msgBytes, sigBytes, alg)\n}\n"]}

package/dist/config.d.ts

@@ -36,6 +36,7 @@ export interface ServerConfigValues {
     serverDid: DidString;
     alternateAudienceDids: DidString[];
     entrywayJwtPublicKeyHex?: string;
+    bffJwtSecret?: string;
     liveNowConfig?: LiveNowConfig;
     etcdHosts: string[];
     dataplaneUrls: string[];
@@ -131,6 +132,7 @@ export declare class ServerConfig {
     get serverDid(): `did:${string}:${string}`;
     get alternateAudienceDids(): `did:${string}:${string}`[];
     get entrywayJwtPublicKeyHex(): string | undefined;
+    get bffJwtSecret(): string | undefined;
     get liveNowConfig(): LiveNowConfig | undefined;
     get etcdHosts(): string[];
     get dataplaneUrlsEtcdKeyPrefix(): string | undefined;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAAe,MAAM,cAAc,CAAA;AAG1D,KAAK,aAAa,GAAG;IACnB,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB,EAAE,CAAA;AAEH,MAAM,MAAM,wBAAwB,GAAG,aAAa,GAAG,cAAc,CAAA;AAErE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAC1B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,wBAAwB,EAAE,MAAM,CAAA;IAChC;;OAEG;IACH,yBAAyB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IAEjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,SAAS,CAAA;IACpB,qBAAqB,EAAE,SAAS,EAAE,CAAA;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,oBAAoB,CAAC,EAAE,KAAK,GAAG,GAAG,CAAA;IAClC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,KAAK,GAAG,GAAG,CAAA;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kBAAkB,CAAC,EAAE,KAAK,GAAG,GAAG,CAAA;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kBAAkB,CAAC,EAAE,KAAK,GAAG,GAAG,CAAA;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAA;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,SAAS,CAAA;IAC1B,iBAAiB,CAAC,EAAE,SAAS,CAAA;IAC7B,qBAAqB,CAAC,EAAE,SAAS,CAAA;IACjC,eAAe,CAAC,EAAE,SAAS,CAAA;IAC3B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACjC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,2BAA2B,CAAC,EAAE,MAAM,CAAA;IAEpC,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IAEnC,aAAa,EAAE,SAAS,CAAA;IACxB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAA;IAClC,cAAc,CAAC,EAAE,IAAI,CAAA;IAErB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC/B,iBAAiB,EAAE,MAAM,CAAA;IACzB,uBAAuB,EAAE,MAAM,CAAA;IAE/B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,uBAAuB,EAAE,MAAM,CAAA;IAC/B,4CAA4C,EAAE,MAAM,CAAA;IAEpD,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,GAAG,CAAC,EAAE,SAAS,CAAA;IACf,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC;AAED,qBAAa,YAAY;IAEX,OAAO,CAAC,GAAG;IADvB,OAAO,CAAC,YAAY,CAAC,CAAQ;IAC7B,YAAoB,GAAG,EAAE,kBAAkB,EAAI;IAE/C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,gBAoYrD;IAED,UAAU,CAAC,IAAI,EAAE,MAAM,QAMtB;IAED,IAAI,OAAO,uBAEV;IAED,IAAI,SAAS,YAEZ;IAED,IAAI,IAAI,uBAEP;IAED,IAAI,SAAS,uBAEZ;IAED,IAAI,SAAS,8BAEZ;IAED,IAAI,qBAAqB,gCAExB;IAED,IAAI,uBAAuB,uBAE1B;IAED,IAAI,aAAa,8BAEhB;IAED,IAAI,SAAS,aAEZ;IAED,IAAI,0BAA0B,uBAE7B;IAED,IAAI,aAAa,aAEhB;IAED,IAAI,oBAAoB,4BAEvB;IAED,IAAI,qBAAqB,wBAExB;IAED,IAAI,QAAQ,WAEX;IAED,IAAI,WAAW,uBAEd;IAED,IAAI,gBAAgB,4BAEnB;IAED,IAAI,iBAAiB,wBAEpB;IAED,IAAI,UAAU,uBAEb;IAED,IAAI,aAAa,uBAEhB;IAED,IAAI,kBAAkB,4BAErB;IAED,IAAI,mBAAmB,wBAEtB;IAED,IAAI,UAAU,uBAEb;IACD,IAAI,aAAa,uBAEhB;IACD,IAAI,kBAAkB,4BAErB;IACD,IAAI,mBAAmB,wBAEtB;IAED,IAAI,SAAS,uBAEZ;IAED,IAAI,cAAc,gBAEjB;IAED,IAAI,iBAAiB,gBAEpB;IAED,IAAI,cAAc,uBAEjB;IAED,IAAI,iBAAiB,uBAEpB;IAED,IAAI,2BAA2B,uBAE9B;IAED,IAAI,SAAS,uBAEZ;IAED,IAAI,YAAY,uBAEf;IAED,IAAI,OAAO,uBAEV;IAED,IAAI,cAAc,0CAEjB;IAED,IAAI,iBAAiB,0CAEpB;IAED,IAAI,qBAAqB,0CAExB;IAED,IAAI,eAAe,0CAElB;IAED,IAAI,eAAe,gBAElB;IAED,IAAI,UAAU,uBAEb;IAED,IAAI,YAAY,4BAEf;IAED,IAAI,cAAc,uBAEjB;IAED,IAAI,mBAAmB,4BAEtB;IAED,IAAI,sBAAsB,WAEzB;IAED,IAAI,MAAM,uBAET;IAED,IAAI,uBAAuB,uBAE1B;IAED,IAAI,wBAAwB,uBAE3B;IAED,IAAI,sBAAsB,uBAEzB;IAED,IAAI,2BAA2B,uBAE9B;IAED,IAAI,SAAS,WAEZ;IAED,IAAI,wBAAwB,yBAE3B;IAED,IAAI,cAAc,aAEjB;IAED,IAAI,aAAa,8BAEhB;IAED,IAAI,oBAAoB,IAC0B,SAAS,EAAE,CAC5D;IAED,IAAI,iBAAiB,uBAEpB;IAED,IAAI,0BAA0B,uBAE7B;IAED,IAAI,iBAAiB,uBAEpB;IAED,IAAI,mBAAmB,uBAEtB;IAED,IAAI,yBAAyB,wBAE5B;IAED,IAAI,aAAa,wBAEhB;IAED,IAAI,cAAc,qBAEjB;IAED,IAAI,aAAa,gBAEhB;IAED,IAAI,cAAc,uBAEjB;IAED,IAAI,cAAc,uBAEjB;IAED,IAAI,gBAAgB,WAEnB;IAED,IAAI,cAAc,gBAEjB;IAED,IAAI,kBAAkB,gBAErB;IAED,IAAI,iBAAiB,WAEpB;IAED,IAAI,uBAAuB,WAE1B;IAED,IAAI,oBAAoB,WAEvB;IAED,IAAI,wBAAwB,IAAI,wBAAwB,CAEvD;IAED,IAAI,0BAA0B,IAAI,MAAM,CAEvC;IAED,IAAI,0BAA0B,IAAI,MAAM,CAEvC;IAED,IAAI,uBAAuB,IAAI,MAAM,CAEpC;IAED,IAAI,4CAA4C,IAAI,MAAM,CAEzD;IAED,IAAI,qBAAqB,IAAI,OAAO,CAEnC;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,IAAI,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAE5C;IAED,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,IAAI,qBAAqB,IAAI,OAAO,CAEnC;IAED,IAAI,GAAG,0BAEN;IAED,IAAI,qBAAqB,gBAExB;IAED,IAAI,WAAW,WAEd;IAED,IAAI,sBAAsB,uBAEzB;IAED,IAAI,0BAA0B,aAE7B;CACF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAAe,MAAM,cAAc,CAAA;AAG1D,KAAK,aAAa,GAAG;IACnB,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB,EAAE,CAAA;AAEH,MAAM,MAAM,wBAAwB,GAAG,aAAa,GAAG,cAAc,CAAA;AAErE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAC1B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,wBAAwB,EAAE,MAAM,CAAA;IAChC;;OAEG;IACH,yBAAyB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IAEjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,SAAS,CAAA;IACpB,qBAAqB,EAAE,SAAS,EAAE,CAAA;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,oBAAoB,CAAC,EAAE,KAAK,GAAG,GAAG,CAAA;IAClC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,KAAK,GAAG,GAAG,CAAA;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kBAAkB,CAAC,EAAE,KAAK,GAAG,GAAG,CAAA;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kBAAkB,CAAC,EAAE,KAAK,GAAG,GAAG,CAAA;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAA;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,SAAS,CAAA;IAC1B,iBAAiB,CAAC,EAAE,SAAS,CAAA;IAC7B,qBAAqB,CAAC,EAAE,SAAS,CAAA;IACjC,eAAe,CAAC,EAAE,SAAS,CAAA;IAC3B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACjC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,2BAA2B,CAAC,EAAE,MAAM,CAAA;IAEpC,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IAEnC,aAAa,EAAE,SAAS,CAAA;IACxB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAA;IAClC,cAAc,CAAC,EAAE,IAAI,CAAA;IAErB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC/B,iBAAiB,EAAE,MAAM,CAAA;IACzB,uBAAuB,EAAE,MAAM,CAAA;IAE/B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,uBAAuB,EAAE,MAAM,CAAA;IAC/B,4CAA4C,EAAE,MAAM,CAAA;IAEpD,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,GAAG,CAAC,EAAE,SAAS,CAAA;IACf,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC;AAED,qBAAa,YAAY;IAEX,OAAO,CAAC,GAAG;IADvB,OAAO,CAAC,YAAY,CAAC,CAAQ;IAC7B,YAAoB,GAAG,EAAE,kBAAkB,EAM1C;IAED,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,gBAsYrD;IAED,UAAU,CAAC,IAAI,EAAE,MAAM,QAMtB;IAED,IAAI,OAAO,uBAEV;IAED,IAAI,SAAS,YAEZ;IAED,IAAI,IAAI,uBAEP;IAED,IAAI,SAAS,uBAEZ;IAED,IAAI,SAAS,8BAEZ;IAED,IAAI,qBAAqB,gCAExB;IAED,IAAI,uBAAuB,uBAE1B;IAED,IAAI,YAAY,uBAEf;IAED,IAAI,aAAa,8BAEhB;IAED,IAAI,SAAS,aAEZ;IAED,IAAI,0BAA0B,uBAE7B;IAED,IAAI,aAAa,aAEhB;IAED,IAAI,oBAAoB,4BAEvB;IAED,IAAI,qBAAqB,wBAExB;IAED,IAAI,QAAQ,WAEX;IAED,IAAI,WAAW,uBAEd;IAED,IAAI,gBAAgB,4BAEnB;IAED,IAAI,iBAAiB,wBAEpB;IAED,IAAI,UAAU,uBAEb;IAED,IAAI,aAAa,uBAEhB;IAED,IAAI,kBAAkB,4BAErB;IAED,IAAI,mBAAmB,wBAEtB;IAED,IAAI,UAAU,uBAEb;IACD,IAAI,aAAa,uBAEhB;IACD,IAAI,kBAAkB,4BAErB;IACD,IAAI,mBAAmB,wBAEtB;IAED,IAAI,SAAS,uBAEZ;IAED,IAAI,cAAc,gBAEjB;IAED,IAAI,iBAAiB,gBAEpB;IAED,IAAI,cAAc,uBAEjB;IAED,IAAI,iBAAiB,uBAEpB;IAED,IAAI,2BAA2B,uBAE9B;IAED,IAAI,SAAS,uBAEZ;IAED,IAAI,YAAY,uBAEf;IAED,IAAI,OAAO,uBAEV;IAED,IAAI,cAAc,0CAEjB;IAED,IAAI,iBAAiB,0CAEpB;IAED,IAAI,qBAAqB,0CAExB;IAED,IAAI,eAAe,0CAElB;IAED,IAAI,eAAe,gBAElB;IAED,IAAI,UAAU,uBAEb;IAED,IAAI,YAAY,4BAEf;IAED,IAAI,cAAc,uBAEjB;IAED,IAAI,mBAAmB,4BAEtB;IAED,IAAI,sBAAsB,WAEzB;IAED,IAAI,MAAM,uBAET;IAED,IAAI,uBAAuB,uBAE1B;IAED,IAAI,wBAAwB,uBAE3B;IAED,IAAI,sBAAsB,uBAEzB;IAED,IAAI,2BAA2B,uBAE9B;IAED,IAAI,SAAS,WAEZ;IAED,IAAI,wBAAwB,yBAE3B;IAED,IAAI,cAAc,aAEjB;IAED,IAAI,aAAa,8BAEhB;IAED,IAAI,oBAAoB,IAC0B,SAAS,EAAE,CAC5D;IAED,IAAI,iBAAiB,uBAEpB;IAED,IAAI,0BAA0B,uBAE7B;IAED,IAAI,iBAAiB,uBAEpB;IAED,IAAI,mBAAmB,uBAEtB;IAED,IAAI,yBAAyB,wBAE5B;IAED,IAAI,aAAa,wBAEhB;IAED,IAAI,cAAc,qBAEjB;IAED,IAAI,aAAa,gBAEhB;IAED,IAAI,cAAc,uBAEjB;IAED,IAAI,cAAc,uBAEjB;IAED,IAAI,gBAAgB,WAEnB;IAED,IAAI,cAAc,gBAEjB;IAED,IAAI,kBAAkB,gBAErB;IAED,IAAI,iBAAiB,WAEpB;IAED,IAAI,uBAAuB,WAE1B;IAED,IAAI,oBAAoB,WAEvB;IAED,IAAI,wBAAwB,IAAI,wBAAwB,CAEvD;IAED,IAAI,0BAA0B,IAAI,MAAM,CAEvC;IAED,IAAI,0BAA0B,IAAI,MAAM,CAEvC;IAED,IAAI,uBAAuB,IAAI,MAAM,CAEpC;IAED,IAAI,4CAA4C,IAAI,MAAM,CAEzD;IAED,IAAI,qBAAqB,IAAI,OAAO,CAEnC;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,IAAI,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAE5C;IAED,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,IAAI,qBAAqB,IAAI,OAAO,CAEnC;IAED,IAAI,GAAG,0BAEN;IAED,IAAI,qBAAqB,gBAExB;IAED,IAAI,WAAW,WAEd;IAED,IAAI,sBAAsB,uBAEzB;IAED,IAAI,0BAA0B,aAE7B;CACF"}

package/dist/config.js

@@ -5,6 +5,8 @@ import { subLogger as log } from './logger.js';
 export class ServerConfig {
     constructor(cfg) {
         this.cfg = cfg;
+        assert(cfg.bffJwtSecret == null ||
+            Buffer.byteLength(cfg.bffJwtSecret, 'utf8') >= 32, 'BSKY_BFF_JWT_SECRET must be generated from at least 32 random bytes (minimum key length: 32 bytes)');
     }
     static readEnv(overrides) {
         const version = process.env.BSKY_VERSION || undefined;
@@ -20,6 +22,7 @@ export class ServerConfig {
         const alternateAudienceDids = envList(process.env.BSKY_ALT_AUDIENCE_DIDS);
         assert(alternateAudienceDids.every(isDidString));
         const entrywayJwtPublicKeyHex = process.env.BSKY_ENTRYWAY_JWT_PUBLIC_KEY_HEX || undefined;
+        const bffJwtSecret = process.env.BSKY_BFF_JWT_SECRET || undefined;
         let liveNowConfig;
         if (process.env.BSKY_LIVE_NOW_CONFIG) {
             try {
@@ -224,6 +227,7 @@ export class ServerConfig {
             serverDid,
             alternateAudienceDids,
             entrywayJwtPublicKeyHex,
+            bffJwtSecret,
             liveNowConfig,
             etcdHosts,
             dataplaneUrls,
@@ -333,6 +337,9 @@ export class ServerConfig {
     get entrywayJwtPublicKeyHex() {
         return this.cfg.entrywayJwtPublicKeyHex;
     }
+    get bffJwtSecret() {
+        return this.cfg.bffJwtSecret;
+    }
     get liveNowConfig() {
         return this.cfg.liveNowConfig;
     }

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAkB,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,SAAS,IAAI,GAAG,EAAE,MAAM,aAAa,CAAA;AAsI9C,MAAM,OAAO,YAAY;IAEvB,YAAoB,GAAuB;mBAAvB,GAAG;IAAuB,CAAC;IAE/C,MAAM,CAAC,OAAO,CAAC,SAAuC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,SAAS,CAAA;QACrD,MAAM,SAAS;QACb,qGAAqG;QACrG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAA;QAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAAA;QAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,kBAAkB,CAAA;QACnE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,uBAAuB,CAAA;QACzE,MAAM,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;QACzE,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QAChD,MAAM,uBAAuB,GAC3B,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,SAAS,CAAA;QAC3D,IAAI,aAAwC,CAAA;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;gBAC3D,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5B,aAAa,GAAG,MAAM,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;gBAC7D,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;QACD,MAAM,wBAAwB,GAAG,OAAO,CACtC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAC5C,CAAA;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;QAC5E,sBAAsB;QACtB,MAAM,SAAS,GACb,SAAS,EAAE,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAC9D,uDAAuD;QACvD,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAA;QAC3E,uDAAuD;QACvD,MAAM,wBAAwB,GAC5B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAA;QAC9C,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACzD,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,eAAe;YAC3B,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAChC,SAAS,CAAA;QACX,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAA;QAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAC/C,CAAA;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS,CAAA;QACpE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,SAAS,CAAA;QAC3E,MAAM,2BAA2B,GAC/B,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,SAAS,CAAA;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAAA;QAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS,CAAA;QACtD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS,CAAA;QACrE,MAAM,CAAC,cAAc,IAAI,IAAI,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC,CAAA;QAC7D,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,SAAS,CAAA;QAC3E,MAAM,CAAC,iBAAiB,IAAI,IAAI,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAA;QACnE,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,SAAS,CAAA;QACxD,MAAM,CAAC,qBAAqB,IAAI,IAAI,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAA;QAC3E,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAA;QACvE,MAAM,CAAC,eAAe,IAAI,IAAI,IAAI,WAAW,CAAC,eAAe,CAAC,CAAC,CAAA;QAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAC3D,CAAA;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAA;QAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAA;QACtE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS,CAAA;QACrE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CACjD,CAAA;QACD,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B;YACvE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,EAAE,EAAE,CAAC;YAChE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;QACd,MAAM,aAAa,GACjB,SAAS,EAAE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QACtE,MAAM,0BAA0B,GAC9B,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,SAAS,CAAA;QAC9D,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,GAAG,CAAA;QAC3E,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,MAAM,CAAA;QACtD,MAAM,CACJ,CAAC,0BAA0B,IAAI,SAAS,CAAC,MAAM,EAC/C,iFAAiF,CAClF,CAAA;QACD,MAAM,CACJ,aAAa,CAAC,MAAM,IAAI,0BAA0B,EAClD,0DAA0D,CAC3D,CAAA;QACD,MAAM,CAAC,oBAAoB,KAAK,KAAK,IAAI,oBAAoB,KAAK,GAAG,CAAC,CAAA;QACtE,MAAM,oBAAoB,GAAG,OAAO,CAClC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CACzC,CAAA;QACD,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,CAAA;QACxD,MAAM,CAAC,QAAQ,CAAC,CAAA;QAChB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAA;QAC/D,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,GAAG,CAAA;QACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,MAAM,CAAA;QAC1E,MAAM,CAAC,gBAAgB,KAAK,KAAK,IAAI,gBAAgB,KAAK,GAAG,CAAC,CAAA;QAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS,CAAA;QAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS,CAAA;QACnE,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAA;QACvE,MAAM,mBAAmB,GACvB,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAA;QACpD,MAAM,CAAC,kBAAkB,KAAK,KAAK,IAAI,kBAAkB,KAAK,GAAG,CAAC,CAAA;QAClE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS,CAAA;QAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS,CAAA;QACnE,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAA;QACvE,MAAM,mBAAmB,GACvB,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAA;QACpD,MAAM,CAAC,kBAAkB,KAAK,KAAK,IAAI,kBAAkB,KAAK,GAAG,CAAC,CAAA;QAClE,MAAM,0BAA0B,GAAG,OAAO,CACxC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAC/C;aACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC,CAAA;QAClB,MAAM,sBAAsB,GAC1B,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,SAAS,CAAA;QAC1D,yGAAyG;QACzG,MAAM,2BAA2B,GAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,SAAS,CAAA;QAC/D,MAAM,CACJ,CAAC,sBAAsB,IAAI,2BAA2B,EACtD,iEAAiE,CAClE,CAAA;QACD,MAAM,cAAc,GAAG,OAAO,CAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CACpE,CAAA;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;QACjD,MAAM,CAAC,aAAa,IAAI,IAAI,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC,CAAA;QAE3D,MAAM,0BAA0B,GAC9B,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,SAAS,CAAA;QAC7D,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,SAAS,CAAA;QAC3E,MAAM,mBAAmB,GACvB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;YAC7B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,SAAS,CAAA;QACzD,MAAM,yBAAyB,GAC7B,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,MAAM,CAAA;QAC1D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAA;QAChE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB;YACtD,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,CACJ,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,EACnD,+BAA+B,CAChC,CAAA;QACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAA;QACxE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB;YACtD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,CAAC;YACvD,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB;YACtD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,CAAC;YACvD,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB;YAC1D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,EAAE,EAAE,CAAC;YACzD,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAA;QAC1E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAChD,CAAA;QACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAA;QACpE,MAAM,uBAAuB,GAC3B,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,CAAA;QAEnD,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B;YAClE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,EAAE,EAAE,CAAC;YAC7D,CAAC,CAAC,CAAC,CAAA;QACL,MAAM,wBAAwB,GAC5B,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,cAAc;YAC5D,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,aAAa,CAAA;QACnB,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG;aAC3C,mCAAmC;YACpC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,EAAE,CAAC;YAC/D,CAAC,CAAC,GAAG,CAAA;QACP,MAAM,CACJ,MAAM,CAAC,SAAS,CAAC,0BAA0B,CAAC,EAC5C,6CAA6C,CAC9C,CAAA;QACD,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG;aAC3C,mCAAmC;YACpC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,EAAE,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,CACJ,MAAM,CAAC,SAAS,CAAC,0BAA0B,CAAC,EAC5C,6CAA6C,CAC9C,CAAA;QACD,MAAM,CACJ,0BAA0B,IAAI,0BAA0B,EACxD,uEAAuE,CACxE,CAAA;QACD,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B;YACzE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,EAAE,CAAC;YAC3D,CAAC,CAAC,CAAC,CAAA;QACL,MAAM,CACJ,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,EACzC,yCAAyC,CAC1C,CAAA;QACD,MAAM,4CAA4C,GAAG,OAAO,CAAC,GAAG;aAC7D,wDAAwD;YACzD,CAAC,CAAC,QAAQ,CACN,OAAO,CAAC,GAAG,CAAC,wDAAwD,EACpE,EAAE,CACH;YACH,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,CACJ,MAAM,CAAC,SAAS,CAAC,4CAA4C,CAAC,EAC9D,kEAAkE,CACnE,CAAA;QAED,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B;YACpE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM;YACrD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,CAAA;QACrE,MAAM,mBAAmB,GACvB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QACzE,MAAM,mBAAmB,GACvB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QACzE,MAAM,gBAAgB,GACpB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QACtE,MAAM,oBAAoB,GACxB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QAC3E,MAAM,eAAe,GACnB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QACrE,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM,CAAA;QAErD,IAAI,GAA0B,CAAA;QAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;QAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACpD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;QACtD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;QAClD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;QACxD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACpD,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;QACtE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;QAC5D,MAAM,2BAA2B,GAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAA;QAClD,MAAM,4BAA4B,GAChC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAA;QACnD,IACE,SAAS;YACT,YAAY;YACZ,aAAa;YACb,WAAW;YACX,cAAc;YACd,YAAY;YACZ,qBAAqB;YACrB,gBAAgB;YAChB,2BAA2B;YAC3B,4BAA4B,EAC5B,CAAC;YACD,MAAM,CACJ,YAAY;gBACV,aAAa;gBACb,WAAW;gBACX,cAAc;gBACd,YAAY;gBACZ,qBAAqB;gBACrB,gBAAgB;gBAChB,SAAS;gBACT,2BAA2B;gBAC3B,4BAA4B,EAC9B,0DAA0D,CAC3D,CAAA;YACD,GAAG,GAAG;gBACJ,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,YAAY;gBACvB,UAAU,EAAE,aAAa;gBACzB,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE,cAAc;gBAC3B,SAAS,EAAE,YAAY;gBACvB,kBAAkB,EAAE,qBAAqB;gBACzC,aAAa,EAAE,gBAAgB;gBAC/B,wBAAwB,EAAE,2BAA2B;gBACrD,yBAAyB,EAAE,4BAA4B;aACxD,CAAA;QACH,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACnC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CACnD,CAAA;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC/C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;YACnD,CAAC,CAAC,GAAG,CAAA;QAEP,MAAM,sBAAsB,GAC1B,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,SAAS,CAAA;QAEzD,OAAO,IAAI,YAAY,CAAC;YACtB,OAAO;YACP,SAAS;YACT,IAAI;YACJ,SAAS;YACT,SAAS;YACT,qBAAqB;YACrB,uBAAuB;YACvB,aAAa;YACb,SAAS;YACT,aAAa;YACb,0BAA0B;YAC1B,oBAAoB;YACpB,qBAAqB;YACrB,SAAS;YACT,cAAc;YACd,iBAAiB;YACjB,cAAc;YACd,iBAAiB;YACjB,2BAA2B;YAC3B,SAAS;YACT,YAAY;YACZ,OAAO;YACP,cAAc;YACd,iBAAiB;YACjB,qBAAqB;YACrB,eAAe;YACf,eAAe;YACf,UAAU;YACV,YAAY;YACZ,cAAc;YACd,mBAAmB;YACnB,sBAAsB;YACtB,SAAS;YACT,oBAAoB;YACpB,wBAAwB;YACxB,MAAM;YACN,uBAAuB;YACvB,wBAAwB;YACxB,iBAAiB;YACjB,QAAQ;YACR,WAAW;YACX,gBAAgB;YAChB,iBAAiB;YACjB,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,mBAAmB;YACnB,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,mBAAmB;YACnB,0BAA0B;YAC1B,sBAAsB;YACtB,2BAA2B;YAC3B,cAAc;YACd,aAAa;YACb,0BAA0B;YAC1B,iBAAiB;YACjB,mBAAmB;YACnB,yBAAyB;YACzB,aAAa;YACb,cAAc;YACd,aAAa;YACb,cAAc;YACd,cAAc;YACd,gBAAgB;YAChB,cAAc;YACd,kBAAkB;YAClB,iBAAiB;YACjB,uBAAuB;YACvB,oBAAoB;YACpB,wBAAwB;YACxB,0BAA0B;YAC1B,0BAA0B;YAC1B,uBAAuB;YACvB,4CAA4C;YAC5C,qBAAqB;YACrB,eAAe;YACf,mBAAmB;YACnB,mBAAmB;YACnB,gBAAgB;YAChB,oBAAoB;YACpB,eAAe;YACf,qBAAqB;YACrB,GAAG;YACH,qBAAqB;YACrB,WAAW;YACX,sBAAsB;YACtB,GAAG,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC;SACpC,CAAC,CAAA;IACJ,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,MAAM,CACJ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,EACxC,4BAA4B,CAC7B,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAA;IACzB,CAAC;IAED,IAAI,SAAS;QACX,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC7B,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAA;IAC3C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAA;IACvC,CAAC;IAED,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACzC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC5C,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAA;IACtC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAA;IACvC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAA;IAC1B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAA;IAC7B,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAA;IAClC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAA;IAC5B,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACpC,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IACD,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACpC,CAAC;IACD,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,2BAA2B;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAA;IAC7C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAA;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAA;IACzB,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAA;IACvC,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAA;IACjC,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAA;IACjC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAA;IAC5B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAA;IAC9B,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAA;IACxC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAA;IACxB,CAAC;IAED,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACzC,CAAC;IAED,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAA;IAC1C,CAAC;IAED,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAA;IACxC,CAAC;IAED,IAAI,2BAA2B;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAA;IAC7C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAA;IAC1C,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAgB,CAAA;IAC7D,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC5C,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,yBAAyB;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAA;IAC3C,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAA;IAClC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACpC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACzC,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,CAAA;IAC3C,CAAC;IAED,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,IAAI,aAAa,CAAA;IAC3D,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC5C,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC5C,CAAC;IAED,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACzC,CAAC;IAED,IAAI,4CAA4C;QAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,4CAA4C,CAAA;IAC9D,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,KAAK,CAAA;IAChD,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,KAAK,CAAA;IAC1C,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAA;IAC7C,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAA;IAC1C,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,OAAO;IAClE,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAA;IAC/C,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACrB,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAA;IACvC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAA;IAC7B,CAAC;IAED,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAA;IACxC,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAA;IAClD,CAAC;CACF;AAED,SAAS,OAAO,CAAC,GAAuB;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,IAAS;IAChC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,CACR,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACb,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YACrB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAClE,CACF,CAAA;AACH,CAAC","sourcesContent":["import assert from 'node:assert'\nimport { SECOND, noUndefinedVals } from '@atproto/common'\nimport { type DidString, isDidString } from '@atproto/lex'\nimport { subLogger as log } from './logger.js'\n\ntype LiveNowConfig = {\n  did: DidString\n  domains: string[]\n}[]\n\nexport type NotificationsV2Algorithm = 'algoGravity' | 'algoLookback'\n\nexport interface KwsConfig {\n  apiKey: string\n  apiOrigin: string\n  authOrigin: string\n  clientId: string\n  redirectUrl: string\n  userAgent: string\n  /**\n   * V1 secret used to validate `adult-verifieid` redirects\n   */\n  verificationSecret: string\n  /**\n   * V1 secret used to validate `adult-verified` webhooks\n   */\n  webhookSecret: string\n  /**\n   * V2 secret used to validate `age-verified` webhooks\n   */\n  ageVerifiedWebhookSecret: string\n  /**\n   * V2 secret used to validate `age-verified` redirects\n   */\n  ageVerifiedRedirectSecret: string\n}\n\nexport interface ServerConfigValues {\n  // service\n  version?: string\n  debugMode?: boolean\n  port?: number\n  publicUrl?: string\n  serverDid: DidString\n  alternateAudienceDids: DidString[]\n  entrywayJwtPublicKeyHex?: string\n  liveNowConfig?: LiveNowConfig\n  // external services\n  etcdHosts: string[]\n  dataplaneUrls: string[]\n  dataplaneUrlsEtcdKeyPrefix?: string\n  dataplaneHttpVersion?: '1.1' | '2'\n  dataplaneIgnoreBadTls?: boolean\n  bsyncUrl: string\n  bsyncApiKey?: string\n  bsyncHttpVersion?: '1.1' | '2'\n  bsyncIgnoreBadTls?: boolean\n  courierUrl?: string\n  courierApiKey?: string\n  courierHttpVersion?: '1.1' | '2'\n  courierIgnoreBadTls?: boolean\n  rolodexUrl?: string\n  rolodexApiKey?: string\n  rolodexHttpVersion?: '1.1' | '2'\n  rolodexIgnoreBadTls?: boolean\n  externalRecordsSafeDomains?: string[]\n  searchUrl?: string\n  searchTagsHide: Set<string>\n  searchTagsHideAll: Set<string>\n  suggestionsUrl?: string\n  suggestionsApiKey?: string\n  atmosphereExploreTabService?: string\n  topicsUrl?: string\n  topicsApiKey?: string\n  irisUrl?: string\n  irisServiceDid?: DidString\n  seemoreServiceDid?: DidString\n  irisStagingServiceDid?: DidString\n  trendingFeedDid?: DidString\n  bskyFeedgenDids: Set<string>\n  irisApiKey?: string\n  irisFeedUris?: Set<string> // allowlist iris may serve instead of seeemore; whats-hot is gated by `iris:feed:enable`, other feeds by their per-rkey `iris:feed:<rkey>:enable` gate\n  irisStagingUrl?: string\n  irisStagingFeedUris?: Set<string> // serve via iris staging instead of the registered feed generator\n  feedGenSkeletonTimeout: number\n  cdnUrl?: string\n  videoPlaylistUrlPattern?: string\n  videoThumbnailUrlPattern?: string\n  blobRateLimitBypassKey?: string\n  blobRateLimitBypassHostname?: string\n  // identity\n  didPlcUrl: string\n  handleResolveNameservers?: string[]\n  // moderation and administration\n  modServiceDid: DidString\n  adminPasswords: string[]\n  labelsFromIssuerDids?: DidString[]\n  indexedAtEpoch?: Date\n  // misc/dev\n  blobCacheLocation?: string\n  eventProxyTrackingEndpoint?: string\n  growthBookApiHost?: string\n  growthBookClientKey?: string\n  // threads\n  bigThreadUris: Set<string>\n  bigThreadDepth?: number\n  maxThreadDepth?: number\n  maxThreadParents: number\n  threadTagsHide: Set<string>\n  threadTagsBumpDown: Set<string>\n  visibilityTagHide: string\n  visibilityTagRankPrefix: string\n  // notifications\n  notificationsDelayMs?: number\n  notificationsV2Algorithm?: NotificationsV2Algorithm\n  notificationsV2MinRawLimit: number\n  notificationsV2MaxRawItems: number\n  notificationsV2MaxReads: number\n  notificationsV2MaxGroupItemsWithRelatedViews: number\n  // client config\n  clientCheckEmailConfirmed?: boolean\n  topicsEnabled?: boolean\n  // http proxy agent\n  disableSsrfProtection?: boolean\n  proxyAllowHTTP2?: boolean\n  proxyConnectTimeout?: number\n  proxyHeadersTimeout?: number\n  proxyBodyTimeout?: number\n  proxyMaxResponseSize?: number\n  proxyMaxRetries?: number\n  proxyPreferCompressed?: boolean\n  kws?: KwsConfig\n  debugFieldAllowedDids: Set<string>\n  draftsLimit: number\n  searchV2OverrideHeader?: string\n}\n\nexport class ServerConfig {\n  private assignedPort?: number\n  constructor(private cfg: ServerConfigValues) {}\n\n  static readEnv(overrides?: Partial<ServerConfigValues>) {\n    const version = process.env.BSKY_VERSION || undefined\n    const debugMode =\n      // Because security related features are disabled in development mode, this requires explicit opt-in.\n      process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test'\n    const publicUrl = process.env.BSKY_PUBLIC_URL || undefined\n    const serverDid = process.env.BSKY_SERVER_DID || 'did:example:test'\n    assert(isDidString(serverDid))\n    const envPort = parseInt(process.env.BSKY_PORT || '', 10)\n    const port = isNaN(envPort) ? 2584 : envPort\n    const didPlcUrl = process.env.BSKY_DID_PLC_URL || 'http://localhost:2582'\n    const alternateAudienceDids = envList(process.env.BSKY_ALT_AUDIENCE_DIDS)\n    assert(alternateAudienceDids.every(isDidString))\n    const entrywayJwtPublicKeyHex =\n      process.env.BSKY_ENTRYWAY_JWT_PUBLIC_KEY_HEX || undefined\n    let liveNowConfig: LiveNowConfig | undefined\n    if (process.env.BSKY_LIVE_NOW_CONFIG) {\n      try {\n        const parsed = JSON.parse(process.env.BSKY_LIVE_NOW_CONFIG)\n        if (isLiveNowConfig(parsed)) {\n          liveNowConfig = parsed\n        } else {\n          throw new Error('Live Now config failed format validation')\n        }\n      } catch (err) {\n        log.error({ err }, 'Invalid BSKY_LIVE_NOW_CONFIG')\n      }\n    }\n    const handleResolveNameservers = envList(\n      process.env.BSKY_HANDLE_RESOLVE_NAMESERVERS,\n    )\n    const cdnUrl = process.env.BSKY_CDN_URL || process.env.BSKY_IMG_URI_ENDPOINT\n    // Values 0 through 16\n    const etcdHosts =\n      overrides?.etcdHosts ?? envList(process.env.BSKY_ETCD_HOSTS)\n    // e.g. https://video.invalid/watch/%s/%s/playlist.m3u8\n    const videoPlaylistUrlPattern = process.env.BSKY_VIDEO_PLAYLIST_URL_PATTERN\n    // e.g. https://video.invalid/watch/%s/%s/thumbnail.jpg\n    const videoThumbnailUrlPattern =\n      process.env.BSKY_VIDEO_THUMBNAIL_URL_PATTERN\n    const blobCacheLocation = process.env.BSKY_BLOB_CACHE_LOC\n    const searchUrl =\n      process.env.BSKY_SEARCH_URL ||\n      process.env.BSKY_SEARCH_ENDPOINT ||\n      undefined\n    const searchTagsHide = new Set(envList(process.env.BSKY_SEARCH_TAGS_HIDE))\n    const searchTagsHideAll = new Set(\n      envList(process.env.BSKY_SEARCH_TAGS_HIDE_ALL),\n    )\n    const suggestionsUrl = process.env.BSKY_SUGGESTIONS_URL || undefined\n    const suggestionsApiKey = process.env.BSKY_SUGGESTIONS_API_KEY || undefined\n    const atmosphereExploreTabService =\n      process.env.BSKY_ATMOSPHERE_EXPLORE_TAB_SERVICE || undefined\n    const topicsUrl = process.env.BSKY_TOPICS_URL || undefined\n    const topicsApiKey = process.env.BSKY_TOPICS_API_KEY\n    const irisUrl = process.env.BSKY_IRIS_URL || undefined\n    const irisServiceDid = process.env.BSKY_IRIS_SERVICE_DID || undefined\n    assert(irisServiceDid == null || isDidString(irisServiceDid))\n    const seemoreServiceDid = process.env.BSKY_SEEMORE_SERVICE_DID || undefined\n    assert(seemoreServiceDid == null || isDidString(seemoreServiceDid))\n    const irisStagingServiceDid =\n      process.env.BSKY_IRIS_STAGING_SERVICE_DID || undefined\n    assert(irisStagingServiceDid == null || isDidString(irisStagingServiceDid))\n    const trendingFeedDid = process.env.BSKY_TRENDING_FEED_DID || undefined\n    assert(trendingFeedDid == null || isDidString(trendingFeedDid))\n    const bskyFeedgenDids = new Set(\n      envList(process.env.BSKY_FEEDGEN_DIDS).filter(isDidString),\n    )\n    const irisApiKey = process.env.BSKY_IRIS_API_KEY || undefined\n    const irisFeedUris = new Set(envList(process.env.BSKY_IRIS_FEED_URIS))\n    const irisStagingUrl = process.env.BSKY_IRIS_STAGING_URL || undefined\n    const irisStagingFeedUris = new Set(\n      envList(process.env.BSKY_IRIS_STAGING_FEED_URIS),\n    )\n    const feedGenSkeletonTimeout = process.env.BSKY_FEED_GEN_SKELETON_TIMEOUT\n      ? parseInt(process.env.BSKY_FEED_GEN_SKELETON_TIMEOUT || '', 10)\n      : 5 * SECOND\n    const dataplaneUrls =\n      overrides?.dataplaneUrls ?? envList(process.env.BSKY_DATAPLANE_URLS)\n    const dataplaneUrlsEtcdKeyPrefix =\n      process.env.BSKY_DATAPLANE_URLS_ETCD_KEY_PREFIX || undefined\n    const dataplaneHttpVersion = process.env.BSKY_DATAPLANE_HTTP_VERSION || '2'\n    const dataplaneIgnoreBadTls =\n      process.env.BSKY_DATAPLANE_IGNORE_BAD_TLS === 'true'\n    assert(\n      !dataplaneUrlsEtcdKeyPrefix || etcdHosts.length,\n      'etcd prefix for dataplane urls may only be configured when there are etcd hosts',\n    )\n    assert(\n      dataplaneUrls.length || dataplaneUrlsEtcdKeyPrefix,\n      'dataplane urls are not configured directly nor with etcd',\n    )\n    assert(dataplaneHttpVersion === '1.1' || dataplaneHttpVersion === '2')\n    const labelsFromIssuerDids = envList(\n      process.env.BSKY_LABELS_FROM_ISSUER_DIDS,\n    )\n    assert(labelsFromIssuerDids.every(isDidString))\n    const bsyncUrl = process.env.BSKY_BSYNC_URL || undefined\n    assert(bsyncUrl)\n    const bsyncApiKey = process.env.BSKY_BSYNC_API_KEY || undefined\n    const bsyncHttpVersion = process.env.BSKY_BSYNC_HTTP_VERSION || '2'\n    const bsyncIgnoreBadTls = process.env.BSKY_BSYNC_IGNORE_BAD_TLS === 'true'\n    assert(bsyncHttpVersion === '1.1' || bsyncHttpVersion === '2')\n    const courierUrl = process.env.BSKY_COURIER_URL || undefined\n    const courierApiKey = process.env.BSKY_COURIER_API_KEY || undefined\n    const courierHttpVersion = process.env.BSKY_COURIER_HTTP_VERSION || '2'\n    const courierIgnoreBadTls =\n      process.env.BSKY_COURIER_IGNORE_BAD_TLS === 'true'\n    assert(courierHttpVersion === '1.1' || courierHttpVersion === '2')\n    const rolodexUrl = process.env.BSKY_ROLODEX_URL || undefined\n    const rolodexApiKey = process.env.BSKY_ROLODEX_API_KEY || undefined\n    const rolodexHttpVersion = process.env.BSKY_ROLODEX_HTTP_VERSION || '2'\n    const rolodexIgnoreBadTls =\n      process.env.BSKY_ROLODEX_IGNORE_BAD_TLS === 'true'\n    assert(rolodexHttpVersion === '1.1' || rolodexHttpVersion === '2')\n    const externalRecordsSafeDomains = envList(\n      process.env.BSKY_EXTERNAL_RECORDS_SAFE_DOMAINS,\n    )\n      .map((value) => value.trim())\n      .filter(Boolean)\n    const blobRateLimitBypassKey =\n      process.env.BSKY_BLOB_RATE_LIMIT_BYPASS_KEY || undefined\n    // single domain would be e.g. \"mypds.com\", subdomains are supported with a leading dot e.g. \".mypds.com\"\n    const blobRateLimitBypassHostname =\n      process.env.BSKY_BLOB_RATE_LIMIT_BYPASS_HOSTNAME || undefined\n    assert(\n      !blobRateLimitBypassKey || blobRateLimitBypassHostname,\n      'must specify a hostname when using a blob rate limit bypass key',\n    )\n    const adminPasswords = envList(\n      process.env.BSKY_ADMIN_PASSWORDS || process.env.BSKY_ADMIN_PASSWORD,\n    )\n    const modServiceDid = process.env.MOD_SERVICE_DID\n    assert(modServiceDid != null && isDidString(modServiceDid))\n\n    const eventProxyTrackingEndpoint =\n      process.env.BSKY_EVENT_PROXY_TRACKING_ENDPOINT || undefined\n    const growthBookApiHost = process.env.BSKY_GROWTHBOOK_API_HOST || undefined\n    const growthBookClientKey =\n      process.env.NODE_ENV === 'test'\n        ? 'secret-key'\n        : process.env.BSKY_GROWTHBOOK_CLIENT_KEY || undefined\n    const clientCheckEmailConfirmed =\n      process.env.BSKY_CLIENT_CHECK_EMAIL_CONFIRMED === 'true'\n    const topicsEnabled = process.env.BSKY_TOPICS_ENABLED === 'true'\n    const indexedAtEpoch = process.env.BSKY_INDEXED_AT_EPOCH\n      ? new Date(process.env.BSKY_INDEXED_AT_EPOCH)\n      : undefined\n    assert(\n      !indexedAtEpoch || !isNaN(indexedAtEpoch.getTime()),\n      'invalid BSKY_INDEXED_AT_EPOCH',\n    )\n    const bigThreadUris = new Set(envList(process.env.BSKY_BIG_THREAD_URIS))\n    const bigThreadDepth = process.env.BSKY_BIG_THREAD_DEPTH\n      ? parseInt(process.env.BSKY_BIG_THREAD_DEPTH || '', 10)\n      : undefined\n    const maxThreadDepth = process.env.BSKY_MAX_THREAD_DEPTH\n      ? parseInt(process.env.BSKY_MAX_THREAD_DEPTH || '', 10)\n      : undefined\n    const maxThreadParents = process.env.BSKY_MAX_THREAD_PARENTS\n      ? parseInt(process.env.BSKY_MAX_THREAD_PARENTS || '', 10)\n      : 50\n    const threadTagsHide = new Set(envList(process.env.BSKY_THREAD_TAGS_HIDE))\n    const threadTagsBumpDown = new Set(\n      envList(process.env.BSKY_THREAD_TAGS_BUMP_DOWN),\n    )\n    const visibilityTagHide = process.env.BSKY_VISIBILITY_TAG_HIDE || ''\n    const visibilityTagRankPrefix =\n      process.env.BSKY_VISIBILITY_TAG_RANK_PREFIX || ''\n\n    const notificationsDelayMs = process.env.BSKY_NOTIFICATIONS_DELAY_MS\n      ? parseInt(process.env.BSKY_NOTIFICATIONS_DELAY_MS || '', 10)\n      : 0\n    const notificationsV2Algorithm =\n      process.env.BSKY_NOTIFICATIONS_V2_ALGORITHM === 'algoLookback'\n        ? 'algoLookback'\n        : 'algoGravity'\n    const notificationsV2MinRawLimit = process.env\n      .BSKY_NOTIFICATIONS_V2_MIN_RAW_LIMIT\n      ? parseInt(process.env.BSKY_NOTIFICATIONS_V2_MIN_RAW_LIMIT, 10)\n      : 300\n    assert(\n      Number.isInteger(notificationsV2MinRawLimit),\n      'invalid BSKY_NOTIFICATIONS_V2_MIN_RAW_LIMIT',\n    )\n    const notificationsV2MaxRawItems = process.env\n      .BSKY_NOTIFICATIONS_V2_MAX_RAW_ITEMS\n      ? parseInt(process.env.BSKY_NOTIFICATIONS_V2_MAX_RAW_ITEMS, 10)\n      : 3000\n    assert(\n      Number.isInteger(notificationsV2MaxRawItems),\n      'invalid BSKY_NOTIFICATIONS_V2_MAX_RAW_ITEMS',\n    )\n    assert(\n      notificationsV2MinRawLimit <= notificationsV2MaxRawItems,\n      'notificationsV2MinRawLimit must not exceed notificationsV2MaxRawItems',\n    )\n    const notificationsV2MaxReads = process.env.BSKY_NOTIFICATIONS_V2_MAX_READS\n      ? parseInt(process.env.BSKY_NOTIFICATIONS_V2_MAX_READS, 10)\n      : 3\n    assert(\n      Number.isInteger(notificationsV2MaxReads),\n      'invalid BSKY_NOTIFICATIONS_V2_MAX_READS',\n    )\n    const notificationsV2MaxGroupItemsWithRelatedViews = process.env\n      .BSKY_NOTIFICATIONS_V2_MAX_GROUP_ITEMS_WITH_RELATED_VIEWS\n      ? parseInt(\n          process.env.BSKY_NOTIFICATIONS_V2_MAX_GROUP_ITEMS_WITH_RELATED_VIEWS,\n          10,\n        )\n      : 10\n    assert(\n      Number.isInteger(notificationsV2MaxGroupItemsWithRelatedViews),\n      'invalid BSKY_NOTIFICATIONS_V2_MAX_GROUP_ITEMS_WITH_RELATED_VIEWS',\n    )\n\n    const disableSsrfProtection = process.env.BSKY_DISABLE_SSRF_PROTECTION\n      ? process.env.BSKY_DISABLE_SSRF_PROTECTION === 'true'\n      : debugMode\n\n    const proxyAllowHTTP2 = process.env.BSKY_PROXY_ALLOW_HTTP2 === 'true'\n    const proxyConnectTimeout =\n      parseInt(process.env.BSKY_PROXY_CONNECT_TIMEOUT || '', 10) || undefined\n    const proxyHeadersTimeout =\n      parseInt(process.env.BSKY_PROXY_HEADERS_TIMEOUT || '', 10) || undefined\n    const proxyBodyTimeout =\n      parseInt(process.env.BSKY_PROXY_BODY_TIMEOUT || '', 10) || undefined\n    const proxyMaxResponseSize =\n      parseInt(process.env.BSKY_PROXY_MAX_RESPONSE_SIZE || '', 10) || undefined\n    const proxyMaxRetries =\n      parseInt(process.env.BSKY_PROXY_MAX_RETRIES || '', 10) || undefined\n    const proxyPreferCompressed =\n      process.env.BSKY_PROXY_PREFER_COMPRESSED === 'true'\n\n    let kws: KwsConfig | undefined\n    const kwsApiKey = process.env.BSKY_KWS_API_KEY\n    const kwsApiOrigin = process.env.BSKY_KWS_API_ORIGIN\n    const kwsAuthOrigin = process.env.BSKY_KWS_AUTH_ORIGIN\n    const kwsClientId = process.env.BSKY_KWS_CLIENT_ID\n    const kwsRedirectUrl = process.env.BSKY_KWS_REDIRECT_URL\n    const kwsUserAgent = process.env.BSKY_KWS_USER_AGENT\n    const kwsVerificationSecret = process.env.BSKY_KWS_VERIFICATION_SECRET\n    const kwsWebhookSecret = process.env.BSKY_KWS_WEBHOOK_SECRET\n    const kwsAgeVerifiedWebhookSecret =\n      process.env.BSKY_KWS_AGE_VERIFIED_WEBHOOK_SECRET\n    const kwsAgeVerifiedRedirectSecret =\n      process.env.BSKY_KWS_AGE_VERIFIED_REDIRECT_SECRET\n    if (\n      kwsApiKey ||\n      kwsApiOrigin ||\n      kwsAuthOrigin ||\n      kwsClientId ||\n      kwsRedirectUrl ||\n      kwsUserAgent ||\n      kwsVerificationSecret ||\n      kwsWebhookSecret ||\n      kwsAgeVerifiedWebhookSecret ||\n      kwsAgeVerifiedRedirectSecret\n    ) {\n      assert(\n        kwsApiOrigin &&\n          kwsAuthOrigin &&\n          kwsClientId &&\n          kwsRedirectUrl &&\n          kwsUserAgent &&\n          kwsVerificationSecret &&\n          kwsWebhookSecret &&\n          kwsApiKey &&\n          kwsAgeVerifiedWebhookSecret &&\n          kwsAgeVerifiedRedirectSecret,\n        'all KWS environment variables must be set if any are set',\n      )\n      kws = {\n        apiKey: kwsApiKey,\n        apiOrigin: kwsApiOrigin,\n        authOrigin: kwsAuthOrigin,\n        clientId: kwsClientId,\n        redirectUrl: kwsRedirectUrl,\n        userAgent: kwsUserAgent,\n        verificationSecret: kwsVerificationSecret,\n        webhookSecret: kwsWebhookSecret,\n        ageVerifiedWebhookSecret: kwsAgeVerifiedWebhookSecret,\n        ageVerifiedRedirectSecret: kwsAgeVerifiedRedirectSecret,\n      }\n    }\n\n    const debugFieldAllowedDids = new Set(\n      envList(process.env.BSKY_DEBUG_FIELD_ALLOWED_DIDS),\n    )\n\n    const draftsLimit = process.env.BSKY_DRAFTS_LIMIT\n      ? parseInt(process.env.BSKY_DRAFTS_LIMIT || '', 10)\n      : 500\n\n    const searchV2OverrideHeader =\n      process.env.BSKY_SEARCH_V2_OVERRIDE_HEADER || undefined\n\n    return new ServerConfig({\n      version,\n      debugMode,\n      port,\n      publicUrl,\n      serverDid,\n      alternateAudienceDids,\n      entrywayJwtPublicKeyHex,\n      liveNowConfig,\n      etcdHosts,\n      dataplaneUrls,\n      dataplaneUrlsEtcdKeyPrefix,\n      dataplaneHttpVersion,\n      dataplaneIgnoreBadTls,\n      searchUrl,\n      searchTagsHide,\n      searchTagsHideAll,\n      suggestionsUrl,\n      suggestionsApiKey,\n      atmosphereExploreTabService,\n      topicsUrl,\n      topicsApiKey,\n      irisUrl,\n      irisServiceDid,\n      seemoreServiceDid,\n      irisStagingServiceDid,\n      trendingFeedDid,\n      bskyFeedgenDids,\n      irisApiKey,\n      irisFeedUris,\n      irisStagingUrl,\n      irisStagingFeedUris,\n      feedGenSkeletonTimeout,\n      didPlcUrl,\n      labelsFromIssuerDids,\n      handleResolveNameservers,\n      cdnUrl,\n      videoPlaylistUrlPattern,\n      videoThumbnailUrlPattern,\n      blobCacheLocation,\n      bsyncUrl,\n      bsyncApiKey,\n      bsyncHttpVersion,\n      bsyncIgnoreBadTls,\n      courierUrl,\n      courierApiKey,\n      courierHttpVersion,\n      courierIgnoreBadTls,\n      rolodexUrl,\n      rolodexApiKey,\n      rolodexHttpVersion,\n      rolodexIgnoreBadTls,\n      externalRecordsSafeDomains,\n      blobRateLimitBypassKey,\n      blobRateLimitBypassHostname,\n      adminPasswords,\n      modServiceDid,\n      eventProxyTrackingEndpoint,\n      growthBookApiHost,\n      growthBookClientKey,\n      clientCheckEmailConfirmed,\n      topicsEnabled,\n      indexedAtEpoch,\n      bigThreadUris,\n      bigThreadDepth,\n      maxThreadDepth,\n      maxThreadParents,\n      threadTagsHide,\n      threadTagsBumpDown,\n      visibilityTagHide,\n      visibilityTagRankPrefix,\n      notificationsDelayMs,\n      notificationsV2Algorithm,\n      notificationsV2MinRawLimit,\n      notificationsV2MaxRawItems,\n      notificationsV2MaxReads,\n      notificationsV2MaxGroupItemsWithRelatedViews,\n      disableSsrfProtection,\n      proxyAllowHTTP2,\n      proxyConnectTimeout,\n      proxyHeadersTimeout,\n      proxyBodyTimeout,\n      proxyMaxResponseSize,\n      proxyMaxRetries,\n      proxyPreferCompressed,\n      kws,\n      debugFieldAllowedDids,\n      draftsLimit,\n      searchV2OverrideHeader,\n      ...noUndefinedVals(overrides ?? {}),\n    })\n  }\n\n  assignPort(port: number) {\n    assert(\n      !this.cfg.port || this.cfg.port === port,\n      'Conflicting port in config',\n    )\n    this.assignedPort = port\n  }\n\n  get version() {\n    return this.cfg.version\n  }\n\n  get debugMode() {\n    return !!this.cfg.debugMode\n  }\n\n  get port() {\n    return this.assignedPort || this.cfg.port\n  }\n\n  get publicUrl() {\n    return this.cfg.publicUrl\n  }\n\n  get serverDid() {\n    return this.cfg.serverDid\n  }\n\n  get alternateAudienceDids() {\n    return this.cfg.alternateAudienceDids\n  }\n\n  get entrywayJwtPublicKeyHex() {\n    return this.cfg.entrywayJwtPublicKeyHex\n  }\n\n  get liveNowConfig() {\n    return this.cfg.liveNowConfig\n  }\n\n  get etcdHosts() {\n    return this.cfg.etcdHosts\n  }\n\n  get dataplaneUrlsEtcdKeyPrefix() {\n    return this.cfg.dataplaneUrlsEtcdKeyPrefix\n  }\n\n  get dataplaneUrls() {\n    return this.cfg.dataplaneUrls\n  }\n\n  get dataplaneHttpVersion() {\n    return this.cfg.dataplaneHttpVersion\n  }\n\n  get dataplaneIgnoreBadTls() {\n    return this.cfg.dataplaneIgnoreBadTls\n  }\n\n  get bsyncUrl() {\n    return this.cfg.bsyncUrl\n  }\n\n  get bsyncApiKey() {\n    return this.cfg.bsyncApiKey\n  }\n\n  get bsyncHttpVersion() {\n    return this.cfg.bsyncHttpVersion\n  }\n\n  get bsyncIgnoreBadTls() {\n    return this.cfg.bsyncIgnoreBadTls\n  }\n\n  get courierUrl() {\n    return this.cfg.courierUrl\n  }\n\n  get courierApiKey() {\n    return this.cfg.courierApiKey\n  }\n\n  get courierHttpVersion() {\n    return this.cfg.courierHttpVersion\n  }\n\n  get courierIgnoreBadTls() {\n    return this.cfg.courierIgnoreBadTls\n  }\n\n  get rolodexUrl() {\n    return this.cfg.rolodexUrl\n  }\n  get rolodexApiKey() {\n    return this.cfg.rolodexApiKey\n  }\n  get rolodexHttpVersion() {\n    return this.cfg.rolodexHttpVersion\n  }\n  get rolodexIgnoreBadTls() {\n    return this.cfg.rolodexIgnoreBadTls\n  }\n\n  get searchUrl() {\n    return this.cfg.searchUrl\n  }\n\n  get searchTagsHide() {\n    return this.cfg.searchTagsHide\n  }\n\n  get searchTagsHideAll() {\n    return this.cfg.searchTagsHideAll\n  }\n\n  get suggestionsUrl() {\n    return this.cfg.suggestionsUrl\n  }\n\n  get suggestionsApiKey() {\n    return this.cfg.suggestionsApiKey\n  }\n\n  get atmosphereExploreTabService() {\n    return this.cfg.atmosphereExploreTabService\n  }\n\n  get topicsUrl() {\n    return this.cfg.topicsUrl\n  }\n\n  get topicsApiKey() {\n    return this.cfg.topicsApiKey\n  }\n\n  get irisUrl() {\n    return this.cfg.irisUrl\n  }\n\n  get irisServiceDid() {\n    return this.cfg.irisServiceDid\n  }\n\n  get seemoreServiceDid() {\n    return this.cfg.seemoreServiceDid\n  }\n\n  get irisStagingServiceDid() {\n    return this.cfg.irisStagingServiceDid\n  }\n\n  get trendingFeedDid() {\n    return this.cfg.trendingFeedDid\n  }\n\n  get bskyFeedgenDids() {\n    return this.cfg.bskyFeedgenDids\n  }\n\n  get irisApiKey() {\n    return this.cfg.irisApiKey\n  }\n\n  get irisFeedUris() {\n    return this.cfg.irisFeedUris\n  }\n\n  get irisStagingUrl() {\n    return this.cfg.irisStagingUrl\n  }\n\n  get irisStagingFeedUris() {\n    return this.cfg.irisStagingFeedUris\n  }\n\n  get feedGenSkeletonTimeout() {\n    return this.cfg.feedGenSkeletonTimeout\n  }\n\n  get cdnUrl() {\n    return this.cfg.cdnUrl\n  }\n\n  get videoPlaylistUrlPattern() {\n    return this.cfg.videoPlaylistUrlPattern\n  }\n\n  get videoThumbnailUrlPattern() {\n    return this.cfg.videoThumbnailUrlPattern\n  }\n\n  get blobRateLimitBypassKey() {\n    return this.cfg.blobRateLimitBypassKey\n  }\n\n  get blobRateLimitBypassHostname() {\n    return this.cfg.blobRateLimitBypassHostname\n  }\n\n  get didPlcUrl() {\n    return this.cfg.didPlcUrl\n  }\n\n  get handleResolveNameservers() {\n    return this.cfg.handleResolveNameservers\n  }\n\n  get adminPasswords() {\n    return this.cfg.adminPasswords\n  }\n\n  get modServiceDid() {\n    return this.cfg.modServiceDid\n  }\n\n  get labelsFromIssuerDids() {\n    return (this.cfg.labelsFromIssuerDids ?? []) as DidString[]\n  }\n\n  get blobCacheLocation() {\n    return this.cfg.blobCacheLocation\n  }\n\n  get eventProxyTrackingEndpoint() {\n    return this.cfg.eventProxyTrackingEndpoint\n  }\n\n  get growthBookApiHost() {\n    return this.cfg.growthBookApiHost\n  }\n\n  get growthBookClientKey() {\n    return this.cfg.growthBookClientKey\n  }\n\n  get clientCheckEmailConfirmed() {\n    return this.cfg.clientCheckEmailConfirmed\n  }\n\n  get topicsEnabled() {\n    return this.cfg.topicsEnabled\n  }\n\n  get indexedAtEpoch() {\n    return this.cfg.indexedAtEpoch\n  }\n\n  get bigThreadUris() {\n    return this.cfg.bigThreadUris\n  }\n\n  get bigThreadDepth() {\n    return this.cfg.bigThreadDepth\n  }\n\n  get maxThreadDepth() {\n    return this.cfg.maxThreadDepth\n  }\n\n  get maxThreadParents() {\n    return this.cfg.maxThreadParents\n  }\n\n  get threadTagsHide() {\n    return this.cfg.threadTagsHide\n  }\n\n  get threadTagsBumpDown() {\n    return this.cfg.threadTagsBumpDown\n  }\n\n  get visibilityTagHide() {\n    return this.cfg.visibilityTagHide\n  }\n\n  get visibilityTagRankPrefix() {\n    return this.cfg.visibilityTagRankPrefix\n  }\n\n  get notificationsDelayMs() {\n    return this.cfg.notificationsDelayMs ?? 0\n  }\n\n  get notificationsV2Algorithm(): NotificationsV2Algorithm {\n    return this.cfg.notificationsV2Algorithm ?? 'algoGravity'\n  }\n\n  get notificationsV2MinRawLimit(): number {\n    return this.cfg.notificationsV2MinRawLimit\n  }\n\n  get notificationsV2MaxRawItems(): number {\n    return this.cfg.notificationsV2MaxRawItems\n  }\n\n  get notificationsV2MaxReads(): number {\n    return this.cfg.notificationsV2MaxReads\n  }\n\n  get notificationsV2MaxGroupItemsWithRelatedViews(): number {\n    return this.cfg.notificationsV2MaxGroupItemsWithRelatedViews\n  }\n\n  get disableSsrfProtection(): boolean {\n    return this.cfg.disableSsrfProtection ?? false\n  }\n\n  get proxyAllowHTTP2(): boolean {\n    return this.cfg.proxyAllowHTTP2 ?? false\n  }\n\n  get proxyConnectTimeout(): number | undefined {\n    return this.cfg.proxyConnectTimeout\n  }\n\n  get proxyHeadersTimeout(): number {\n    return this.cfg.proxyHeadersTimeout ?? 30e3\n  }\n\n  get proxyBodyTimeout(): number {\n    return this.cfg.proxyBodyTimeout ?? 30e3\n  }\n\n  get proxyMaxResponseSize(): number {\n    return this.cfg.proxyMaxResponseSize ?? 10 * 1024 * 1024 // 10mb\n  }\n\n  get proxyMaxRetries(): number {\n    return this.cfg.proxyMaxRetries ?? 3\n  }\n\n  get proxyPreferCompressed(): boolean {\n    return this.cfg.proxyPreferCompressed ?? true\n  }\n\n  get kws() {\n    return this.cfg.kws\n  }\n\n  get debugFieldAllowedDids() {\n    return this.cfg.debugFieldAllowedDids\n  }\n\n  get draftsLimit() {\n    return this.cfg.draftsLimit\n  }\n\n  get searchV2OverrideHeader() {\n    return this.cfg.searchV2OverrideHeader\n  }\n\n  get externalRecordsSafeDomains() {\n    return this.cfg.externalRecordsSafeDomains ?? []\n  }\n}\n\nfunction envList(str: string | undefined): string[] {\n  if (str === undefined || str.length === 0) return []\n  return str.split(',')\n}\n\nfunction isLiveNowConfig(data: any): data is LiveNowConfig {\n  return (\n    Array.isArray(data) &&\n    data.every(\n      (item) =>\n        typeof item === 'object' &&\n        item !== null &&\n        typeof item.did === 'string' &&\n        isDidString(item.did) &&\n        Array.isArray(item.domains) &&\n        item.domains.every((domain: any) => typeof domain === 'string'),\n    )\n  )\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAkB,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,SAAS,IAAI,GAAG,EAAE,MAAM,aAAa,CAAA;AAuI9C,MAAM,OAAO,YAAY;IAEvB,YAAoB,GAAuB;mBAAvB,GAAG;QACrB,MAAM,CACJ,GAAG,CAAC,YAAY,IAAI,IAAI;YACtB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,EACnD,oGAAoG,CACrG,CAAA;IACH,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,SAAuC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,SAAS,CAAA;QACrD,MAAM,SAAS;QACb,qGAAqG;QACrG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAA;QAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAAA;QAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,kBAAkB,CAAA;QACnE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,uBAAuB,CAAA;QACzE,MAAM,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;QACzE,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QAChD,MAAM,uBAAuB,GAC3B,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,SAAS,CAAA;QAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,SAAS,CAAA;QACjE,IAAI,aAAwC,CAAA;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;gBAC3D,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5B,aAAa,GAAG,MAAM,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;gBAC7D,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;QACD,MAAM,wBAAwB,GAAG,OAAO,CACtC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAC5C,CAAA;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;QAC5E,sBAAsB;QACtB,MAAM,SAAS,GACb,SAAS,EAAE,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAC9D,uDAAuD;QACvD,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAA;QAC3E,uDAAuD;QACvD,MAAM,wBAAwB,GAC5B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAA;QAC9C,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACzD,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,eAAe;YAC3B,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAChC,SAAS,CAAA;QACX,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAA;QAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAC/C,CAAA;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS,CAAA;QACpE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,SAAS,CAAA;QAC3E,MAAM,2BAA2B,GAC/B,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,SAAS,CAAA;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAAA;QAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS,CAAA;QACtD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS,CAAA;QACrE,MAAM,CAAC,cAAc,IAAI,IAAI,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC,CAAA;QAC7D,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,SAAS,CAAA;QAC3E,MAAM,CAAC,iBAAiB,IAAI,IAAI,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAA;QACnE,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,SAAS,CAAA;QACxD,MAAM,CAAC,qBAAqB,IAAI,IAAI,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAA;QAC3E,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAA;QACvE,MAAM,CAAC,eAAe,IAAI,IAAI,IAAI,WAAW,CAAC,eAAe,CAAC,CAAC,CAAA;QAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAC3D,CAAA;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAA;QAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAA;QACtE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS,CAAA;QACrE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CACjD,CAAA;QACD,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B;YACvE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,EAAE,EAAE,CAAC;YAChE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;QACd,MAAM,aAAa,GACjB,SAAS,EAAE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QACtE,MAAM,0BAA0B,GAC9B,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,SAAS,CAAA;QAC9D,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,GAAG,CAAA;QAC3E,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,MAAM,CAAA;QACtD,MAAM,CACJ,CAAC,0BAA0B,IAAI,SAAS,CAAC,MAAM,EAC/C,iFAAiF,CAClF,CAAA;QACD,MAAM,CACJ,aAAa,CAAC,MAAM,IAAI,0BAA0B,EAClD,0DAA0D,CAC3D,CAAA;QACD,MAAM,CAAC,oBAAoB,KAAK,KAAK,IAAI,oBAAoB,KAAK,GAAG,CAAC,CAAA;QACtE,MAAM,oBAAoB,GAAG,OAAO,CAClC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CACzC,CAAA;QACD,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,CAAA;QACxD,MAAM,CAAC,QAAQ,CAAC,CAAA;QAChB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAA;QAC/D,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,GAAG,CAAA;QACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,MAAM,CAAA;QAC1E,MAAM,CAAC,gBAAgB,KAAK,KAAK,IAAI,gBAAgB,KAAK,GAAG,CAAC,CAAA;QAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS,CAAA;QAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS,CAAA;QACnE,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAA;QACvE,MAAM,mBAAmB,GACvB,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAA;QACpD,MAAM,CAAC,kBAAkB,KAAK,KAAK,IAAI,kBAAkB,KAAK,GAAG,CAAC,CAAA;QAClE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS,CAAA;QAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS,CAAA;QACnE,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAA;QACvE,MAAM,mBAAmB,GACvB,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAA;QACpD,MAAM,CAAC,kBAAkB,KAAK,KAAK,IAAI,kBAAkB,KAAK,GAAG,CAAC,CAAA;QAClE,MAAM,0BAA0B,GAAG,OAAO,CACxC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAC/C;aACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC,CAAA;QAClB,MAAM,sBAAsB,GAC1B,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,SAAS,CAAA;QAC1D,yGAAyG;QACzG,MAAM,2BAA2B,GAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,SAAS,CAAA;QAC/D,MAAM,CACJ,CAAC,sBAAsB,IAAI,2BAA2B,EACtD,iEAAiE,CAClE,CAAA;QACD,MAAM,cAAc,GAAG,OAAO,CAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CACpE,CAAA;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;QACjD,MAAM,CAAC,aAAa,IAAI,IAAI,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC,CAAA;QAE3D,MAAM,0BAA0B,GAC9B,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,SAAS,CAAA;QAC7D,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,SAAS,CAAA;QAC3E,MAAM,mBAAmB,GACvB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;YAC7B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,SAAS,CAAA;QACzD,MAAM,yBAAyB,GAC7B,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,MAAM,CAAA;QAC1D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAA;QAChE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB;YACtD,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,CACJ,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,EACnD,+BAA+B,CAChC,CAAA;QACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAA;QACxE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB;YACtD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,CAAC;YACvD,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB;YACtD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,CAAC;YACvD,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB;YAC1D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,EAAE,EAAE,CAAC;YACzD,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAA;QAC1E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAChD,CAAA;QACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAA;QACpE,MAAM,uBAAuB,GAC3B,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,CAAA;QAEnD,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B;YAClE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,EAAE,EAAE,CAAC;YAC7D,CAAC,CAAC,CAAC,CAAA;QACL,MAAM,wBAAwB,GAC5B,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,cAAc;YAC5D,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,aAAa,CAAA;QACnB,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG;aAC3C,mCAAmC;YACpC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,EAAE,CAAC;YAC/D,CAAC,CAAC,GAAG,CAAA;QACP,MAAM,CACJ,MAAM,CAAC,SAAS,CAAC,0BAA0B,CAAC,EAC5C,6CAA6C,CAC9C,CAAA;QACD,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG;aAC3C,mCAAmC;YACpC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,EAAE,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,CACJ,MAAM,CAAC,SAAS,CAAC,0BAA0B,CAAC,EAC5C,6CAA6C,CAC9C,CAAA;QACD,MAAM,CACJ,0BAA0B,IAAI,0BAA0B,EACxD,uEAAuE,CACxE,CAAA;QACD,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B;YACzE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,EAAE,CAAC;YAC3D,CAAC,CAAC,CAAC,CAAA;QACL,MAAM,CACJ,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,EACzC,yCAAyC,CAC1C,CAAA;QACD,MAAM,4CAA4C,GAAG,OAAO,CAAC,GAAG;aAC7D,wDAAwD;YACzD,CAAC,CAAC,QAAQ,CACN,OAAO,CAAC,GAAG,CAAC,wDAAwD,EACpE,EAAE,CACH;YACH,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,CACJ,MAAM,CAAC,SAAS,CAAC,4CAA4C,CAAC,EAC9D,kEAAkE,CACnE,CAAA;QAED,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B;YACpE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM;YACrD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,CAAA;QACrE,MAAM,mBAAmB,GACvB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QACzE,MAAM,mBAAmB,GACvB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QACzE,MAAM,gBAAgB,GACpB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QACtE,MAAM,oBAAoB,GACxB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QAC3E,MAAM,eAAe,GACnB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;QACrE,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM,CAAA;QAErD,IAAI,GAA0B,CAAA;QAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;QAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACpD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;QACtD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;QAClD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;QACxD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACpD,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;QACtE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;QAC5D,MAAM,2BAA2B,GAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAA;QAClD,MAAM,4BAA4B,GAChC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAA;QACnD,IACE,SAAS;YACT,YAAY;YACZ,aAAa;YACb,WAAW;YACX,cAAc;YACd,YAAY;YACZ,qBAAqB;YACrB,gBAAgB;YAChB,2BAA2B;YAC3B,4BAA4B,EAC5B,CAAC;YACD,MAAM,CACJ,YAAY;gBACV,aAAa;gBACb,WAAW;gBACX,cAAc;gBACd,YAAY;gBACZ,qBAAqB;gBACrB,gBAAgB;gBAChB,SAAS;gBACT,2BAA2B;gBAC3B,4BAA4B,EAC9B,0DAA0D,CAC3D,CAAA;YACD,GAAG,GAAG;gBACJ,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,YAAY;gBACvB,UAAU,EAAE,aAAa;gBACzB,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE,cAAc;gBAC3B,SAAS,EAAE,YAAY;gBACvB,kBAAkB,EAAE,qBAAqB;gBACzC,aAAa,EAAE,gBAAgB;gBAC/B,wBAAwB,EAAE,2BAA2B;gBACrD,yBAAyB,EAAE,4BAA4B;aACxD,CAAA;QACH,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACnC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CACnD,CAAA;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC/C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;YACnD,CAAC,CAAC,GAAG,CAAA;QAEP,MAAM,sBAAsB,GAC1B,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,SAAS,CAAA;QAEzD,OAAO,IAAI,YAAY,CAAC;YACtB,OAAO;YACP,SAAS;YACT,IAAI;YACJ,SAAS;YACT,SAAS;YACT,qBAAqB;YACrB,uBAAuB;YACvB,YAAY;YACZ,aAAa;YACb,SAAS;YACT,aAAa;YACb,0BAA0B;YAC1B,oBAAoB;YACpB,qBAAqB;YACrB,SAAS;YACT,cAAc;YACd,iBAAiB;YACjB,cAAc;YACd,iBAAiB;YACjB,2BAA2B;YAC3B,SAAS;YACT,YAAY;YACZ,OAAO;YACP,cAAc;YACd,iBAAiB;YACjB,qBAAqB;YACrB,eAAe;YACf,eAAe;YACf,UAAU;YACV,YAAY;YACZ,cAAc;YACd,mBAAmB;YACnB,sBAAsB;YACtB,SAAS;YACT,oBAAoB;YACpB,wBAAwB;YACxB,MAAM;YACN,uBAAuB;YACvB,wBAAwB;YACxB,iBAAiB;YACjB,QAAQ;YACR,WAAW;YACX,gBAAgB;YAChB,iBAAiB;YACjB,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,mBAAmB;YACnB,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,mBAAmB;YACnB,0BAA0B;YAC1B,sBAAsB;YACtB,2BAA2B;YAC3B,cAAc;YACd,aAAa;YACb,0BAA0B;YAC1B,iBAAiB;YACjB,mBAAmB;YACnB,yBAAyB;YACzB,aAAa;YACb,cAAc;YACd,aAAa;YACb,cAAc;YACd,cAAc;YACd,gBAAgB;YAChB,cAAc;YACd,kBAAkB;YAClB,iBAAiB;YACjB,uBAAuB;YACvB,oBAAoB;YACpB,wBAAwB;YACxB,0BAA0B;YAC1B,0BAA0B;YAC1B,uBAAuB;YACvB,4CAA4C;YAC5C,qBAAqB;YACrB,eAAe;YACf,mBAAmB;YACnB,mBAAmB;YACnB,gBAAgB;YAChB,oBAAoB;YACpB,eAAe;YACf,qBAAqB;YACrB,GAAG;YACH,qBAAqB;YACrB,WAAW;YACX,sBAAsB;YACtB,GAAG,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC;SACpC,CAAC,CAAA;IACJ,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,MAAM,CACJ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,EACxC,4BAA4B,CAC7B,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAA;IACzB,CAAC;IAED,IAAI,SAAS;QACX,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC7B,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAA;IAC3C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAA;IACvC,CAAC;IAED,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACzC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAA;IAC9B,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC5C,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAA;IACtC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAA;IACvC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAA;IAC1B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAA;IAC7B,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAA;IAClC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAA;IAC5B,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACpC,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IACD,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACpC,CAAC;IACD,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,2BAA2B;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAA;IAC7C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAA;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAA;IACzB,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAA;IACvC,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAA;IACjC,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAA;IACjC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAA;IAC5B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAA;IAC9B,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAA;IACxC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAA;IACxB,CAAC;IAED,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACzC,CAAC;IAED,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAA;IAC1C,CAAC;IAED,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAA;IACxC,CAAC;IAED,IAAI,2BAA2B;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAA;IAC7C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAA;IAC3B,CAAC;IAED,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAA;IAC1C,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAgB,CAAA;IAC7D,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC5C,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,yBAAyB;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAA;IAC3C,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAA;IAClC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;IAChC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACpC,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACnC,CAAC;IAED,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACzC,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,CAAA;IAC3C,CAAC;IAED,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,IAAI,aAAa,CAAA;IAC3D,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC5C,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC5C,CAAC;IAED,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACzC,CAAC;IAED,IAAI,4CAA4C;QAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,4CAA4C,CAAA;IAC9D,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,KAAK,CAAA;IAChD,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,KAAK,CAAA;IAC1C,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACrC,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAA;IAC7C,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAA;IAC1C,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,OAAO;IAClE,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAA;IAC/C,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACrB,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAA;IACvC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAA;IAC7B,CAAC;IAED,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAA;IACxC,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAA;IAClD,CAAC;CACF;AAED,SAAS,OAAO,CAAC,GAAuB;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,IAAS;IAChC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,CACR,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACb,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YACrB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAClE,CACF,CAAA;AACH,CAAC","sourcesContent":["import assert from 'node:assert'\nimport { SECOND, noUndefinedVals } from '@atproto/common'\nimport { type DidString, isDidString } from '@atproto/lex'\nimport { subLogger as log } from './logger.js'\n\ntype LiveNowConfig = {\n  did: DidString\n  domains: string[]\n}[]\n\nexport type NotificationsV2Algorithm = 'algoGravity' | 'algoLookback'\n\nexport interface KwsConfig {\n  apiKey: string\n  apiOrigin: string\n  authOrigin: string\n  clientId: string\n  redirectUrl: string\n  userAgent: string\n  /**\n   * V1 secret used to validate `adult-verifieid` redirects\n   */\n  verificationSecret: string\n  /**\n   * V1 secret used to validate `adult-verified` webhooks\n   */\n  webhookSecret: string\n  /**\n   * V2 secret used to validate `age-verified` webhooks\n   */\n  ageVerifiedWebhookSecret: string\n  /**\n   * V2 secret used to validate `age-verified` redirects\n   */\n  ageVerifiedRedirectSecret: string\n}\n\nexport interface ServerConfigValues {\n  // service\n  version?: string\n  debugMode?: boolean\n  port?: number\n  publicUrl?: string\n  serverDid: DidString\n  alternateAudienceDids: DidString[]\n  entrywayJwtPublicKeyHex?: string\n  bffJwtSecret?: string\n  liveNowConfig?: LiveNowConfig\n  // external services\n  etcdHosts: string[]\n  dataplaneUrls: string[]\n  dataplaneUrlsEtcdKeyPrefix?: string\n  dataplaneHttpVersion?: '1.1' | '2'\n  dataplaneIgnoreBadTls?: boolean\n  bsyncUrl: string\n  bsyncApiKey?: string\n  bsyncHttpVersion?: '1.1' | '2'\n  bsyncIgnoreBadTls?: boolean\n  courierUrl?: string\n  courierApiKey?: string\n  courierHttpVersion?: '1.1' | '2'\n  courierIgnoreBadTls?: boolean\n  rolodexUrl?: string\n  rolodexApiKey?: string\n  rolodexHttpVersion?: '1.1' | '2'\n  rolodexIgnoreBadTls?: boolean\n  externalRecordsSafeDomains?: string[]\n  searchUrl?: string\n  searchTagsHide: Set<string>\n  searchTagsHideAll: Set<string>\n  suggestionsUrl?: string\n  suggestionsApiKey?: string\n  atmosphereExploreTabService?: string\n  topicsUrl?: string\n  topicsApiKey?: string\n  irisUrl?: string\n  irisServiceDid?: DidString\n  seemoreServiceDid?: DidString\n  irisStagingServiceDid?: DidString\n  trendingFeedDid?: DidString\n  bskyFeedgenDids: Set<string>\n  irisApiKey?: string\n  irisFeedUris?: Set<string> // allowlist iris may serve instead of seeemore; whats-hot is gated by `iris:feed:enable`, other feeds by their per-rkey `iris:feed:<rkey>:enable` gate\n  irisStagingUrl?: string\n  irisStagingFeedUris?: Set<string> // serve via iris staging instead of the registered feed generator\n  feedGenSkeletonTimeout: number\n  cdnUrl?: string\n  videoPlaylistUrlPattern?: string\n  videoThumbnailUrlPattern?: string\n  blobRateLimitBypassKey?: string\n  blobRateLimitBypassHostname?: string\n  // identity\n  didPlcUrl: string\n  handleResolveNameservers?: string[]\n  // moderation and administration\n  modServiceDid: DidString\n  adminPasswords: string[]\n  labelsFromIssuerDids?: DidString[]\n  indexedAtEpoch?: Date\n  // misc/dev\n  blobCacheLocation?: string\n  eventProxyTrackingEndpoint?: string\n  growthBookApiHost?: string\n  growthBookClientKey?: string\n  // threads\n  bigThreadUris: Set<string>\n  bigThreadDepth?: number\n  maxThreadDepth?: number\n  maxThreadParents: number\n  threadTagsHide: Set<string>\n  threadTagsBumpDown: Set<string>\n  visibilityTagHide: string\n  visibilityTagRankPrefix: string\n  // notifications\n  notificationsDelayMs?: number\n  notificationsV2Algorithm?: NotificationsV2Algorithm\n  notificationsV2MinRawLimit: number\n  notificationsV2MaxRawItems: number\n  notificationsV2MaxReads: number\n  notificationsV2MaxGroupItemsWithRelatedViews: number\n  // client config\n  clientCheckEmailConfirmed?: boolean\n  topicsEnabled?: boolean\n  // http proxy agent\n  disableSsrfProtection?: boolean\n  proxyAllowHTTP2?: boolean\n  proxyConnectTimeout?: number\n  proxyHeadersTimeout?: number\n  proxyBodyTimeout?: number\n  proxyMaxResponseSize?: number\n  proxyMaxRetries?: number\n  proxyPreferCompressed?: boolean\n  kws?: KwsConfig\n  debugFieldAllowedDids: Set<string>\n  draftsLimit: number\n  searchV2OverrideHeader?: string\n}\n\nexport class ServerConfig {\n  private assignedPort?: number\n  constructor(private cfg: ServerConfigValues) {\n    assert(\n      cfg.bffJwtSecret == null ||\n        Buffer.byteLength(cfg.bffJwtSecret, 'utf8') >= 32,\n      'BSKY_BFF_JWT_SECRET must be generated from at least 32 random bytes (minimum key length: 32 bytes)',\n    )\n  }\n\n  static readEnv(overrides?: Partial<ServerConfigValues>) {\n    const version = process.env.BSKY_VERSION || undefined\n    const debugMode =\n      // Because security related features are disabled in development mode, this requires explicit opt-in.\n      process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test'\n    const publicUrl = process.env.BSKY_PUBLIC_URL || undefined\n    const serverDid = process.env.BSKY_SERVER_DID || 'did:example:test'\n    assert(isDidString(serverDid))\n    const envPort = parseInt(process.env.BSKY_PORT || '', 10)\n    const port = isNaN(envPort) ? 2584 : envPort\n    const didPlcUrl = process.env.BSKY_DID_PLC_URL || 'http://localhost:2582'\n    const alternateAudienceDids = envList(process.env.BSKY_ALT_AUDIENCE_DIDS)\n    assert(alternateAudienceDids.every(isDidString))\n    const entrywayJwtPublicKeyHex =\n      process.env.BSKY_ENTRYWAY_JWT_PUBLIC_KEY_HEX || undefined\n    const bffJwtSecret = process.env.BSKY_BFF_JWT_SECRET || undefined\n    let liveNowConfig: LiveNowConfig | undefined\n    if (process.env.BSKY_LIVE_NOW_CONFIG) {\n      try {\n        const parsed = JSON.parse(process.env.BSKY_LIVE_NOW_CONFIG)\n        if (isLiveNowConfig(parsed)) {\n          liveNowConfig = parsed\n        } else {\n          throw new Error('Live Now config failed format validation')\n        }\n      } catch (err) {\n        log.error({ err }, 'Invalid BSKY_LIVE_NOW_CONFIG')\n      }\n    }\n    const handleResolveNameservers = envList(\n      process.env.BSKY_HANDLE_RESOLVE_NAMESERVERS,\n    )\n    const cdnUrl = process.env.BSKY_CDN_URL || process.env.BSKY_IMG_URI_ENDPOINT\n    // Values 0 through 16\n    const etcdHosts =\n      overrides?.etcdHosts ?? envList(process.env.BSKY_ETCD_HOSTS)\n    // e.g. https://video.invalid/watch/%s/%s/playlist.m3u8\n    const videoPlaylistUrlPattern = process.env.BSKY_VIDEO_PLAYLIST_URL_PATTERN\n    // e.g. https://video.invalid/watch/%s/%s/thumbnail.jpg\n    const videoThumbnailUrlPattern =\n      process.env.BSKY_VIDEO_THUMBNAIL_URL_PATTERN\n    const blobCacheLocation = process.env.BSKY_BLOB_CACHE_LOC\n    const searchUrl =\n      process.env.BSKY_SEARCH_URL ||\n      process.env.BSKY_SEARCH_ENDPOINT ||\n      undefined\n    const searchTagsHide = new Set(envList(process.env.BSKY_SEARCH_TAGS_HIDE))\n    const searchTagsHideAll = new Set(\n      envList(process.env.BSKY_SEARCH_TAGS_HIDE_ALL),\n    )\n    const suggestionsUrl = process.env.BSKY_SUGGESTIONS_URL || undefined\n    const suggestionsApiKey = process.env.BSKY_SUGGESTIONS_API_KEY || undefined\n    const atmosphereExploreTabService =\n      process.env.BSKY_ATMOSPHERE_EXPLORE_TAB_SERVICE || undefined\n    const topicsUrl = process.env.BSKY_TOPICS_URL || undefined\n    const topicsApiKey = process.env.BSKY_TOPICS_API_KEY\n    const irisUrl = process.env.BSKY_IRIS_URL || undefined\n    const irisServiceDid = process.env.BSKY_IRIS_SERVICE_DID || undefined\n    assert(irisServiceDid == null || isDidString(irisServiceDid))\n    const seemoreServiceDid = process.env.BSKY_SEEMORE_SERVICE_DID || undefined\n    assert(seemoreServiceDid == null || isDidString(seemoreServiceDid))\n    const irisStagingServiceDid =\n      process.env.BSKY_IRIS_STAGING_SERVICE_DID || undefined\n    assert(irisStagingServiceDid == null || isDidString(irisStagingServiceDid))\n    const trendingFeedDid = process.env.BSKY_TRENDING_FEED_DID || undefined\n    assert(trendingFeedDid == null || isDidString(trendingFeedDid))\n    const bskyFeedgenDids = new Set(\n      envList(process.env.BSKY_FEEDGEN_DIDS).filter(isDidString),\n    )\n    const irisApiKey = process.env.BSKY_IRIS_API_KEY || undefined\n    const irisFeedUris = new Set(envList(process.env.BSKY_IRIS_FEED_URIS))\n    const irisStagingUrl = process.env.BSKY_IRIS_STAGING_URL || undefined\n    const irisStagingFeedUris = new Set(\n      envList(process.env.BSKY_IRIS_STAGING_FEED_URIS),\n    )\n    const feedGenSkeletonTimeout = process.env.BSKY_FEED_GEN_SKELETON_TIMEOUT\n      ? parseInt(process.env.BSKY_FEED_GEN_SKELETON_TIMEOUT || '', 10)\n      : 5 * SECOND\n    const dataplaneUrls =\n      overrides?.dataplaneUrls ?? envList(process.env.BSKY_DATAPLANE_URLS)\n    const dataplaneUrlsEtcdKeyPrefix =\n      process.env.BSKY_DATAPLANE_URLS_ETCD_KEY_PREFIX || undefined\n    const dataplaneHttpVersion = process.env.BSKY_DATAPLANE_HTTP_VERSION || '2'\n    const dataplaneIgnoreBadTls =\n      process.env.BSKY_DATAPLANE_IGNORE_BAD_TLS === 'true'\n    assert(\n      !dataplaneUrlsEtcdKeyPrefix || etcdHosts.length,\n      'etcd prefix for dataplane urls may only be configured when there are etcd hosts',\n    )\n    assert(\n      dataplaneUrls.length || dataplaneUrlsEtcdKeyPrefix,\n      'dataplane urls are not configured directly nor with etcd',\n    )\n    assert(dataplaneHttpVersion === '1.1' || dataplaneHttpVersion === '2')\n    const labelsFromIssuerDids = envList(\n      process.env.BSKY_LABELS_FROM_ISSUER_DIDS,\n    )\n    assert(labelsFromIssuerDids.every(isDidString))\n    const bsyncUrl = process.env.BSKY_BSYNC_URL || undefined\n    assert(bsyncUrl)\n    const bsyncApiKey = process.env.BSKY_BSYNC_API_KEY || undefined\n    const bsyncHttpVersion = process.env.BSKY_BSYNC_HTTP_VERSION || '2'\n    const bsyncIgnoreBadTls = process.env.BSKY_BSYNC_IGNORE_BAD_TLS === 'true'\n    assert(bsyncHttpVersion === '1.1' || bsyncHttpVersion === '2')\n    const courierUrl = process.env.BSKY_COURIER_URL || undefined\n    const courierApiKey = process.env.BSKY_COURIER_API_KEY || undefined\n    const courierHttpVersion = process.env.BSKY_COURIER_HTTP_VERSION || '2'\n    const courierIgnoreBadTls =\n      process.env.BSKY_COURIER_IGNORE_BAD_TLS === 'true'\n    assert(courierHttpVersion === '1.1' || courierHttpVersion === '2')\n    const rolodexUrl = process.env.BSKY_ROLODEX_URL || undefined\n    const rolodexApiKey = process.env.BSKY_ROLODEX_API_KEY || undefined\n    const rolodexHttpVersion = process.env.BSKY_ROLODEX_HTTP_VERSION || '2'\n    const rolodexIgnoreBadTls =\n      process.env.BSKY_ROLODEX_IGNORE_BAD_TLS === 'true'\n    assert(rolodexHttpVersion === '1.1' || rolodexHttpVersion === '2')\n    const externalRecordsSafeDomains = envList(\n      process.env.BSKY_EXTERNAL_RECORDS_SAFE_DOMAINS,\n    )\n      .map((value) => value.trim())\n      .filter(Boolean)\n    const blobRateLimitBypassKey =\n      process.env.BSKY_BLOB_RATE_LIMIT_BYPASS_KEY || undefined\n    // single domain would be e.g. \"mypds.com\", subdomains are supported with a leading dot e.g. \".mypds.com\"\n    const blobRateLimitBypassHostname =\n      process.env.BSKY_BLOB_RATE_LIMIT_BYPASS_HOSTNAME || undefined\n    assert(\n      !blobRateLimitBypassKey || blobRateLimitBypassHostname,\n      'must specify a hostname when using a blob rate limit bypass key',\n    )\n    const adminPasswords = envList(\n      process.env.BSKY_ADMIN_PASSWORDS || process.env.BSKY_ADMIN_PASSWORD,\n    )\n    const modServiceDid = process.env.MOD_SERVICE_DID\n    assert(modServiceDid != null && isDidString(modServiceDid))\n\n    const eventProxyTrackingEndpoint =\n      process.env.BSKY_EVENT_PROXY_TRACKING_ENDPOINT || undefined\n    const growthBookApiHost = process.env.BSKY_GROWTHBOOK_API_HOST || undefined\n    const growthBookClientKey =\n      process.env.NODE_ENV === 'test'\n        ? 'secret-key'\n        : process.env.BSKY_GROWTHBOOK_CLIENT_KEY || undefined\n    const clientCheckEmailConfirmed =\n      process.env.BSKY_CLIENT_CHECK_EMAIL_CONFIRMED === 'true'\n    const topicsEnabled = process.env.BSKY_TOPICS_ENABLED === 'true'\n    const indexedAtEpoch = process.env.BSKY_INDEXED_AT_EPOCH\n      ? new Date(process.env.BSKY_INDEXED_AT_EPOCH)\n      : undefined\n    assert(\n      !indexedAtEpoch || !isNaN(indexedAtEpoch.getTime()),\n      'invalid BSKY_INDEXED_AT_EPOCH',\n    )\n    const bigThreadUris = new Set(envList(process.env.BSKY_BIG_THREAD_URIS))\n    const bigThreadDepth = process.env.BSKY_BIG_THREAD_DEPTH\n      ? parseInt(process.env.BSKY_BIG_THREAD_DEPTH || '', 10)\n      : undefined\n    const maxThreadDepth = process.env.BSKY_MAX_THREAD_DEPTH\n      ? parseInt(process.env.BSKY_MAX_THREAD_DEPTH || '', 10)\n      : undefined\n    const maxThreadParents = process.env.BSKY_MAX_THREAD_PARENTS\n      ? parseInt(process.env.BSKY_MAX_THREAD_PARENTS || '', 10)\n      : 50\n    const threadTagsHide = new Set(envList(process.env.BSKY_THREAD_TAGS_HIDE))\n    const threadTagsBumpDown = new Set(\n      envList(process.env.BSKY_THREAD_TAGS_BUMP_DOWN),\n    )\n    const visibilityTagHide = process.env.BSKY_VISIBILITY_TAG_HIDE || ''\n    const visibilityTagRankPrefix =\n      process.env.BSKY_VISIBILITY_TAG_RANK_PREFIX || ''\n\n    const notificationsDelayMs = process.env.BSKY_NOTIFICATIONS_DELAY_MS\n      ? parseInt(process.env.BSKY_NOTIFICATIONS_DELAY_MS || '', 10)\n      : 0\n    const notificationsV2Algorithm =\n      process.env.BSKY_NOTIFICATIONS_V2_ALGORITHM === 'algoLookback'\n        ? 'algoLookback'\n        : 'algoGravity'\n    const notificationsV2MinRawLimit = process.env\n      .BSKY_NOTIFICATIONS_V2_MIN_RAW_LIMIT\n      ? parseInt(process.env.BSKY_NOTIFICATIONS_V2_MIN_RAW_LIMIT, 10)\n      : 300\n    assert(\n      Number.isInteger(notificationsV2MinRawLimit),\n      'invalid BSKY_NOTIFICATIONS_V2_MIN_RAW_LIMIT',\n    )\n    const notificationsV2MaxRawItems = process.env\n      .BSKY_NOTIFICATIONS_V2_MAX_RAW_ITEMS\n      ? parseInt(process.env.BSKY_NOTIFICATIONS_V2_MAX_RAW_ITEMS, 10)\n      : 3000\n    assert(\n      Number.isInteger(notificationsV2MaxRawItems),\n      'invalid BSKY_NOTIFICATIONS_V2_MAX_RAW_ITEMS',\n    )\n    assert(\n      notificationsV2MinRawLimit <= notificationsV2MaxRawItems,\n      'notificationsV2MinRawLimit must not exceed notificationsV2MaxRawItems',\n    )\n    const notificationsV2MaxReads = process.env.BSKY_NOTIFICATIONS_V2_MAX_READS\n      ? parseInt(process.env.BSKY_NOTIFICATIONS_V2_MAX_READS, 10)\n      : 3\n    assert(\n      Number.isInteger(notificationsV2MaxReads),\n      'invalid BSKY_NOTIFICATIONS_V2_MAX_READS',\n    )\n    const notificationsV2MaxGroupItemsWithRelatedViews = process.env\n      .BSKY_NOTIFICATIONS_V2_MAX_GROUP_ITEMS_WITH_RELATED_VIEWS\n      ? parseInt(\n          process.env.BSKY_NOTIFICATIONS_V2_MAX_GROUP_ITEMS_WITH_RELATED_VIEWS,\n          10,\n        )\n      : 10\n    assert(\n      Number.isInteger(notificationsV2MaxGroupItemsWithRelatedViews),\n      'invalid BSKY_NOTIFICATIONS_V2_MAX_GROUP_ITEMS_WITH_RELATED_VIEWS',\n    )\n\n    const disableSsrfProtection = process.env.BSKY_DISABLE_SSRF_PROTECTION\n      ? process.env.BSKY_DISABLE_SSRF_PROTECTION === 'true'\n      : debugMode\n\n    const proxyAllowHTTP2 = process.env.BSKY_PROXY_ALLOW_HTTP2 === 'true'\n    const proxyConnectTimeout =\n      parseInt(process.env.BSKY_PROXY_CONNECT_TIMEOUT || '', 10) || undefined\n    const proxyHeadersTimeout =\n      parseInt(process.env.BSKY_PROXY_HEADERS_TIMEOUT || '', 10) || undefined\n    const proxyBodyTimeout =\n      parseInt(process.env.BSKY_PROXY_BODY_TIMEOUT || '', 10) || undefined\n    const proxyMaxResponseSize =\n      parseInt(process.env.BSKY_PROXY_MAX_RESPONSE_SIZE || '', 10) || undefined\n    const proxyMaxRetries =\n      parseInt(process.env.BSKY_PROXY_MAX_RETRIES || '', 10) || undefined\n    const proxyPreferCompressed =\n      process.env.BSKY_PROXY_PREFER_COMPRESSED === 'true'\n\n    let kws: KwsConfig | undefined\n    const kwsApiKey = process.env.BSKY_KWS_API_KEY\n    const kwsApiOrigin = process.env.BSKY_KWS_API_ORIGIN\n    const kwsAuthOrigin = process.env.BSKY_KWS_AUTH_ORIGIN\n    const kwsClientId = process.env.BSKY_KWS_CLIENT_ID\n    const kwsRedirectUrl = process.env.BSKY_KWS_REDIRECT_URL\n    const kwsUserAgent = process.env.BSKY_KWS_USER_AGENT\n    const kwsVerificationSecret = process.env.BSKY_KWS_VERIFICATION_SECRET\n    const kwsWebhookSecret = process.env.BSKY_KWS_WEBHOOK_SECRET\n    const kwsAgeVerifiedWebhookSecret =\n      process.env.BSKY_KWS_AGE_VERIFIED_WEBHOOK_SECRET\n    const kwsAgeVerifiedRedirectSecret =\n      process.env.BSKY_KWS_AGE_VERIFIED_REDIRECT_SECRET\n    if (\n      kwsApiKey ||\n      kwsApiOrigin ||\n      kwsAuthOrigin ||\n      kwsClientId ||\n      kwsRedirectUrl ||\n      kwsUserAgent ||\n      kwsVerificationSecret ||\n      kwsWebhookSecret ||\n      kwsAgeVerifiedWebhookSecret ||\n      kwsAgeVerifiedRedirectSecret\n    ) {\n      assert(\n        kwsApiOrigin &&\n          kwsAuthOrigin &&\n          kwsClientId &&\n          kwsRedirectUrl &&\n          kwsUserAgent &&\n          kwsVerificationSecret &&\n          kwsWebhookSecret &&\n          kwsApiKey &&\n          kwsAgeVerifiedWebhookSecret &&\n          kwsAgeVerifiedRedirectSecret,\n        'all KWS environment variables must be set if any are set',\n      )\n      kws = {\n        apiKey: kwsApiKey,\n        apiOrigin: kwsApiOrigin,\n        authOrigin: kwsAuthOrigin,\n        clientId: kwsClientId,\n        redirectUrl: kwsRedirectUrl,\n        userAgent: kwsUserAgent,\n        verificationSecret: kwsVerificationSecret,\n        webhookSecret: kwsWebhookSecret,\n        ageVerifiedWebhookSecret: kwsAgeVerifiedWebhookSecret,\n        ageVerifiedRedirectSecret: kwsAgeVerifiedRedirectSecret,\n      }\n    }\n\n    const debugFieldAllowedDids = new Set(\n      envList(process.env.BSKY_DEBUG_FIELD_ALLOWED_DIDS),\n    )\n\n    const draftsLimit = process.env.BSKY_DRAFTS_LIMIT\n      ? parseInt(process.env.BSKY_DRAFTS_LIMIT || '', 10)\n      : 500\n\n    const searchV2OverrideHeader =\n      process.env.BSKY_SEARCH_V2_OVERRIDE_HEADER || undefined\n\n    return new ServerConfig({\n      version,\n      debugMode,\n      port,\n      publicUrl,\n      serverDid,\n      alternateAudienceDids,\n      entrywayJwtPublicKeyHex,\n      bffJwtSecret,\n      liveNowConfig,\n      etcdHosts,\n      dataplaneUrls,\n      dataplaneUrlsEtcdKeyPrefix,\n      dataplaneHttpVersion,\n      dataplaneIgnoreBadTls,\n      searchUrl,\n      searchTagsHide,\n      searchTagsHideAll,\n      suggestionsUrl,\n      suggestionsApiKey,\n      atmosphereExploreTabService,\n      topicsUrl,\n      topicsApiKey,\n      irisUrl,\n      irisServiceDid,\n      seemoreServiceDid,\n      irisStagingServiceDid,\n      trendingFeedDid,\n      bskyFeedgenDids,\n      irisApiKey,\n      irisFeedUris,\n      irisStagingUrl,\n      irisStagingFeedUris,\n      feedGenSkeletonTimeout,\n      didPlcUrl,\n      labelsFromIssuerDids,\n      handleResolveNameservers,\n      cdnUrl,\n      videoPlaylistUrlPattern,\n      videoThumbnailUrlPattern,\n      blobCacheLocation,\n      bsyncUrl,\n      bsyncApiKey,\n      bsyncHttpVersion,\n      bsyncIgnoreBadTls,\n      courierUrl,\n      courierApiKey,\n      courierHttpVersion,\n      courierIgnoreBadTls,\n      rolodexUrl,\n      rolodexApiKey,\n      rolodexHttpVersion,\n      rolodexIgnoreBadTls,\n      externalRecordsSafeDomains,\n      blobRateLimitBypassKey,\n      blobRateLimitBypassHostname,\n      adminPasswords,\n      modServiceDid,\n      eventProxyTrackingEndpoint,\n      growthBookApiHost,\n      growthBookClientKey,\n      clientCheckEmailConfirmed,\n      topicsEnabled,\n      indexedAtEpoch,\n      bigThreadUris,\n      bigThreadDepth,\n      maxThreadDepth,\n      maxThreadParents,\n      threadTagsHide,\n      threadTagsBumpDown,\n      visibilityTagHide,\n      visibilityTagRankPrefix,\n      notificationsDelayMs,\n      notificationsV2Algorithm,\n      notificationsV2MinRawLimit,\n      notificationsV2MaxRawItems,\n      notificationsV2MaxReads,\n      notificationsV2MaxGroupItemsWithRelatedViews,\n      disableSsrfProtection,\n      proxyAllowHTTP2,\n      proxyConnectTimeout,\n      proxyHeadersTimeout,\n      proxyBodyTimeout,\n      proxyMaxResponseSize,\n      proxyMaxRetries,\n      proxyPreferCompressed,\n      kws,\n      debugFieldAllowedDids,\n      draftsLimit,\n      searchV2OverrideHeader,\n      ...noUndefinedVals(overrides ?? {}),\n    })\n  }\n\n  assignPort(port: number) {\n    assert(\n      !this.cfg.port || this.cfg.port === port,\n      'Conflicting port in config',\n    )\n    this.assignedPort = port\n  }\n\n  get version() {\n    return this.cfg.version\n  }\n\n  get debugMode() {\n    return !!this.cfg.debugMode\n  }\n\n  get port() {\n    return this.assignedPort || this.cfg.port\n  }\n\n  get publicUrl() {\n    return this.cfg.publicUrl\n  }\n\n  get serverDid() {\n    return this.cfg.serverDid\n  }\n\n  get alternateAudienceDids() {\n    return this.cfg.alternateAudienceDids\n  }\n\n  get entrywayJwtPublicKeyHex() {\n    return this.cfg.entrywayJwtPublicKeyHex\n  }\n\n  get bffJwtSecret() {\n    return this.cfg.bffJwtSecret\n  }\n\n  get liveNowConfig() {\n    return this.cfg.liveNowConfig\n  }\n\n  get etcdHosts() {\n    return this.cfg.etcdHosts\n  }\n\n  get dataplaneUrlsEtcdKeyPrefix() {\n    return this.cfg.dataplaneUrlsEtcdKeyPrefix\n  }\n\n  get dataplaneUrls() {\n    return this.cfg.dataplaneUrls\n  }\n\n  get dataplaneHttpVersion() {\n    return this.cfg.dataplaneHttpVersion\n  }\n\n  get dataplaneIgnoreBadTls() {\n    return this.cfg.dataplaneIgnoreBadTls\n  }\n\n  get bsyncUrl() {\n    return this.cfg.bsyncUrl\n  }\n\n  get bsyncApiKey() {\n    return this.cfg.bsyncApiKey\n  }\n\n  get bsyncHttpVersion() {\n    return this.cfg.bsyncHttpVersion\n  }\n\n  get bsyncIgnoreBadTls() {\n    return this.cfg.bsyncIgnoreBadTls\n  }\n\n  get courierUrl() {\n    return this.cfg.courierUrl\n  }\n\n  get courierApiKey() {\n    return this.cfg.courierApiKey\n  }\n\n  get courierHttpVersion() {\n    return this.cfg.courierHttpVersion\n  }\n\n  get courierIgnoreBadTls() {\n    return this.cfg.courierIgnoreBadTls\n  }\n\n  get rolodexUrl() {\n    return this.cfg.rolodexUrl\n  }\n  get rolodexApiKey() {\n    return this.cfg.rolodexApiKey\n  }\n  get rolodexHttpVersion() {\n    return this.cfg.rolodexHttpVersion\n  }\n  get rolodexIgnoreBadTls() {\n    return this.cfg.rolodexIgnoreBadTls\n  }\n\n  get searchUrl() {\n    return this.cfg.searchUrl\n  }\n\n  get searchTagsHide() {\n    return this.cfg.searchTagsHide\n  }\n\n  get searchTagsHideAll() {\n    return this.cfg.searchTagsHideAll\n  }\n\n  get suggestionsUrl() {\n    return this.cfg.suggestionsUrl\n  }\n\n  get suggestionsApiKey() {\n    return this.cfg.suggestionsApiKey\n  }\n\n  get atmosphereExploreTabService() {\n    return this.cfg.atmosphereExploreTabService\n  }\n\n  get topicsUrl() {\n    return this.cfg.topicsUrl\n  }\n\n  get topicsApiKey() {\n    return this.cfg.topicsApiKey\n  }\n\n  get irisUrl() {\n    return this.cfg.irisUrl\n  }\n\n  get irisServiceDid() {\n    return this.cfg.irisServiceDid\n  }\n\n  get seemoreServiceDid() {\n    return this.cfg.seemoreServiceDid\n  }\n\n  get irisStagingServiceDid() {\n    return this.cfg.irisStagingServiceDid\n  }\n\n  get trendingFeedDid() {\n    return this.cfg.trendingFeedDid\n  }\n\n  get bskyFeedgenDids() {\n    return this.cfg.bskyFeedgenDids\n  }\n\n  get irisApiKey() {\n    return this.cfg.irisApiKey\n  }\n\n  get irisFeedUris() {\n    return this.cfg.irisFeedUris\n  }\n\n  get irisStagingUrl() {\n    return this.cfg.irisStagingUrl\n  }\n\n  get irisStagingFeedUris() {\n    return this.cfg.irisStagingFeedUris\n  }\n\n  get feedGenSkeletonTimeout() {\n    return this.cfg.feedGenSkeletonTimeout\n  }\n\n  get cdnUrl() {\n    return this.cfg.cdnUrl\n  }\n\n  get videoPlaylistUrlPattern() {\n    return this.cfg.videoPlaylistUrlPattern\n  }\n\n  get videoThumbnailUrlPattern() {\n    return this.cfg.videoThumbnailUrlPattern\n  }\n\n  get blobRateLimitBypassKey() {\n    return this.cfg.blobRateLimitBypassKey\n  }\n\n  get blobRateLimitBypassHostname() {\n    return this.cfg.blobRateLimitBypassHostname\n  }\n\n  get didPlcUrl() {\n    return this.cfg.didPlcUrl\n  }\n\n  get handleResolveNameservers() {\n    return this.cfg.handleResolveNameservers\n  }\n\n  get adminPasswords() {\n    return this.cfg.adminPasswords\n  }\n\n  get modServiceDid() {\n    return this.cfg.modServiceDid\n  }\n\n  get labelsFromIssuerDids() {\n    return (this.cfg.labelsFromIssuerDids ?? []) as DidString[]\n  }\n\n  get blobCacheLocation() {\n    return this.cfg.blobCacheLocation\n  }\n\n  get eventProxyTrackingEndpoint() {\n    return this.cfg.eventProxyTrackingEndpoint\n  }\n\n  get growthBookApiHost() {\n    return this.cfg.growthBookApiHost\n  }\n\n  get growthBookClientKey() {\n    return this.cfg.growthBookClientKey\n  }\n\n  get clientCheckEmailConfirmed() {\n    return this.cfg.clientCheckEmailConfirmed\n  }\n\n  get topicsEnabled() {\n    return this.cfg.topicsEnabled\n  }\n\n  get indexedAtEpoch() {\n    return this.cfg.indexedAtEpoch\n  }\n\n  get bigThreadUris() {\n    return this.cfg.bigThreadUris\n  }\n\n  get bigThreadDepth() {\n    return this.cfg.bigThreadDepth\n  }\n\n  get maxThreadDepth() {\n    return this.cfg.maxThreadDepth\n  }\n\n  get maxThreadParents() {\n    return this.cfg.maxThreadParents\n  }\n\n  get threadTagsHide() {\n    return this.cfg.threadTagsHide\n  }\n\n  get threadTagsBumpDown() {\n    return this.cfg.threadTagsBumpDown\n  }\n\n  get visibilityTagHide() {\n    return this.cfg.visibilityTagHide\n  }\n\n  get visibilityTagRankPrefix() {\n    return this.cfg.visibilityTagRankPrefix\n  }\n\n  get notificationsDelayMs() {\n    return this.cfg.notificationsDelayMs ?? 0\n  }\n\n  get notificationsV2Algorithm(): NotificationsV2Algorithm {\n    return this.cfg.notificationsV2Algorithm ?? 'algoGravity'\n  }\n\n  get notificationsV2MinRawLimit(): number {\n    return this.cfg.notificationsV2MinRawLimit\n  }\n\n  get notificationsV2MaxRawItems(): number {\n    return this.cfg.notificationsV2MaxRawItems\n  }\n\n  get notificationsV2MaxReads(): number {\n    return this.cfg.notificationsV2MaxReads\n  }\n\n  get notificationsV2MaxGroupItemsWithRelatedViews(): number {\n    return this.cfg.notificationsV2MaxGroupItemsWithRelatedViews\n  }\n\n  get disableSsrfProtection(): boolean {\n    return this.cfg.disableSsrfProtection ?? false\n  }\n\n  get proxyAllowHTTP2(): boolean {\n    return this.cfg.proxyAllowHTTP2 ?? false\n  }\n\n  get proxyConnectTimeout(): number | undefined {\n    return this.cfg.proxyConnectTimeout\n  }\n\n  get proxyHeadersTimeout(): number {\n    return this.cfg.proxyHeadersTimeout ?? 30e3\n  }\n\n  get proxyBodyTimeout(): number {\n    return this.cfg.proxyBodyTimeout ?? 30e3\n  }\n\n  get proxyMaxResponseSize(): number {\n    return this.cfg.proxyMaxResponseSize ?? 10 * 1024 * 1024 // 10mb\n  }\n\n  get proxyMaxRetries(): number {\n    return this.cfg.proxyMaxRetries ?? 3\n  }\n\n  get proxyPreferCompressed(): boolean {\n    return this.cfg.proxyPreferCompressed ?? true\n  }\n\n  get kws() {\n    return this.cfg.kws\n  }\n\n  get debugFieldAllowedDids() {\n    return this.cfg.debugFieldAllowedDids\n  }\n\n  get draftsLimit() {\n    return this.cfg.draftsLimit\n  }\n\n  get searchV2OverrideHeader() {\n    return this.cfg.searchV2OverrideHeader\n  }\n\n  get externalRecordsSafeDomains() {\n    return this.cfg.externalRecordsSafeDomains ?? []\n  }\n}\n\nfunction envList(str: string | undefined): string[] {\n  if (str === undefined || str.length === 0) return []\n  return str.split(',')\n}\n\nfunction isLiveNowConfig(data: any): data is LiveNowConfig {\n  return (\n    Array.isArray(data) &&\n    data.every(\n      (item) =>\n        typeof item === 'object' &&\n        item !== null &&\n        typeof item.did === 'string' &&\n        isDidString(item.did) &&\n        Array.isArray(item.domains) &&\n        item.domains.every((domain: any) => typeof domain === 'string'),\n    )\n  )\n}\n"]}

package/dist/feature-gates/gates.d.ts

@@ -20,10 +20,12 @@ export declare enum Gate {
     IrisFeedBskyTeamEnable = "iris:feed:bsky-team:enable",
     IrisFeedBestOfFollowsEnable = "iris:feed:best-of-follows:enable",
     IrisFeedFollowpicsEnable = "iris:feed:followpics:enable",
+    IrisFeedLoggedOutEnable = "iris:feed:logged_out:enable",
     KnownLikersFeedEnable = "known_likers:feed:enable",
     SuggestedFeedsV2Enable = "suggested_feeds_v2:enable",
     SuggestedStarterPacksV2Enable = "suggested_starter_packs_v2:enable",
     SuggestedStarterPacksOnboardingV2Enable = "suggested_starter_packs_onboarding_v2:enable",
+    AtmosphereExploreArticlesIrisEnable = "atmosphere_explore:articles:iris:enable",
     AATest = "aa-test-appview"
 }
 /**

package/dist/feature-gates/gates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../src/feature-gates/gates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,oBAAY,IAAI;IACd,4BAA4B,0CAA0C;IACtE,+BAA+B,wCAAwC;IACvE,oCAAoC,6CAA6C;IACjF,gCAAgC,wCAAwC;IACxE,8BAA8B,uCAAuC;IACrE,+BAA+B,wCAAwC;IACvE,8BAA8B,wCAAwC;IACtE,wBAAwB,gCAAgC;IACxD,cAAc,qBAAqB;IACnC,QAAQ,qBAAqB;IAC7B,yBAAyB,kCAAkC;IAC3D,qBAAqB,6BAA6B;IAClD,qBAAqB,6BAA6B;IAClD,sBAAsB,+BAA+B;IACrD,2BAA2B,qCAAqC;IAChE,wBAAwB,gCAAgC;IACxD,qBAAqB,6BAA6B;IAClD,sBAAsB,8BAA8B;IACpD,6BAA6B,sCAAsC;IACnE,uCAAuC,iDAAiD;IAGxF,MAAM,oBAAoB;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,GAAG,CAAC,IAAI,CAAe,CAAA"}
+{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../src/feature-gates/gates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,oBAAY,IAAI;IACd,4BAA4B,0CAA0C;IACtE,+BAA+B,wCAAwC;IACvE,oCAAoC,6CAA6C;IACjF,gCAAgC,wCAAwC;IACxE,8BAA8B,uCAAuC;IACrE,+BAA+B,wCAAwC;IACvE,8BAA8B,wCAAwC;IACtE,wBAAwB,gCAAgC;IACxD,cAAc,qBAAqB;IACnC,QAAQ,qBAAqB;IAC7B,yBAAyB,kCAAkC;IAC3D,qBAAqB,6BAA6B;IAClD,qBAAqB,6BAA6B;IAClD,sBAAsB,+BAA+B;IACrD,2BAA2B,qCAAqC;IAChE,wBAAwB,gCAAgC;IACxD,uBAAuB,gCAAgC;IACvD,qBAAqB,6BAA6B;IAClD,sBAAsB,8BAA8B;IACpD,6BAA6B,sCAAsC;IACnE,uCAAuC,iDAAiD;IACxF,mCAAmC,4CAA4C;IAG/E,MAAM,oBAAoB;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,GAAG,CAAC,IAAI,CAAe,CAAA"}

package/dist/feature-gates/gates.js

@@ -21,10 +21,12 @@ export var Gate;
     Gate["IrisFeedBskyTeamEnable"] = "iris:feed:bsky-team:enable";
     Gate["IrisFeedBestOfFollowsEnable"] = "iris:feed:best-of-follows:enable";
     Gate["IrisFeedFollowpicsEnable"] = "iris:feed:followpics:enable";
+    Gate["IrisFeedLoggedOutEnable"] = "iris:feed:logged_out:enable";
     Gate["KnownLikersFeedEnable"] = "known_likers:feed:enable";
     Gate["SuggestedFeedsV2Enable"] = "suggested_feeds_v2:enable";
     Gate["SuggestedStarterPacksV2Enable"] = "suggested_starter_packs_v2:enable";
     Gate["SuggestedStarterPacksOnboardingV2Enable"] = "suggested_starter_packs_onboarding_v2:enable";
+    Gate["AtmosphereExploreArticlesIrisEnable"] = "atmosphere_explore:articles:iris:enable";
     // temp
     Gate["AATest"] = "aa-test-appview";
 })(Gate || (Gate = {}));

package/dist/feature-gates/gates.js.map

@@ -1 +1 @@
-{"version":3,"file":"gates.js","sourceRoot":"","sources":["../../src/feature-gates/gates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAN,IAAY,IAwBX;AAxBD,WAAY,IAAI;IACd,8EAAsE,CAAA;IACtE,+EAAuE,CAAA;IACvE,yFAAiF,CAAA;IACjF,gFAAwE,CAAA;IACxE,6EAAqE,CAAA;IACrE,+EAAuE,CAAA;IACvE,8EAAsE,CAAA;IACtE,gEAAwD,CAAA;IACxD,2CAAmC,CAAA;IACnC,qCAA6B,CAAA;IAC7B,mEAA2D,CAAA;IAC3D,0DAAkD,CAAA;IAClD,0DAAkD,CAAA;IAClD,6DAAqD,CAAA;IACrD,wEAAgE,CAAA;IAChE,gEAAwD,CAAA;IACxD,0DAAkD,CAAA;IAClD,4DAAoD,CAAA;IACpD,2EAAmE,CAAA;IACnE,gGAAwF,CAAA;IAExF,OAAO;IACP,kCAA0B,CAAA;AAC5B,CAAC,EAxBW,IAAI,KAAJ,IAAI,QAwBf;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAc,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA","sourcesContent":["/**\n * Enum of all gates in the system. This should be the single source of truth\n * for all gates, and should be used in all places where gates are checked or\n * defined.\n */\nexport enum Gate {\n  SuggestedUsersDiscoverEnable = 'suggested_users:discover_agent:enable',\n  SuggestedUsersSocialProofEnable = 'suggested_users:social_proof:enable',\n  ThreadsReplyRankingExplorationEnable = 'threads:reply_ranking_exploration:enable',\n  SearchFilteringExplorationEnable = 'search:filtering_exploration:enable',\n  SuggestedUsersForExploreEnable = 'suggested_users:for_explore:enable',\n  SuggestedUsersForDiscoverEnable = 'suggested_users:for_discover:enable',\n  SuggestedUsersForSeeMoreEnable = 'suggested_users:for_see_more:enable',\n  SuggestedUsersIrisEnable = 'suggested_users:iris:enable',\n  SearchV2Enable = 'search:v2:enable',\n  IrisFeed = 'iris:feed:enable',\n  IrisFeedWithFriendsEnable = 'iris:feed:with-friends:enable',\n  IrisFeedThevidsEnable = 'iris:feed:thevids:enable',\n  IrisFeedMutualsEnable = 'iris:feed:mutuals:enable',\n  IrisFeedBskyTeamEnable = 'iris:feed:bsky-team:enable',\n  IrisFeedBestOfFollowsEnable = 'iris:feed:best-of-follows:enable',\n  IrisFeedFollowpicsEnable = 'iris:feed:followpics:enable',\n  KnownLikersFeedEnable = 'known_likers:feed:enable',\n  SuggestedFeedsV2Enable = 'suggested_feeds_v2:enable',\n  SuggestedStarterPacksV2Enable = 'suggested_starter_packs_v2:enable',\n  SuggestedStarterPacksOnboardingV2Enable = 'suggested_starter_packs_onboarding_v2:enable',\n\n  // temp\n  AATest = 'aa-test-appview',\n}\n\n/**\n * Set of gates that should be ignored when tracking gate evaluations for\n * analytics purposes. This is useful for gates that are not user-facing or are\n * overly noisy.\n */\nexport const IGNORE_METRICS_FOR_GATES: Set<Gate> = new Set([])\n"]}
+{"version":3,"file":"gates.js","sourceRoot":"","sources":["../../src/feature-gates/gates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAN,IAAY,IA0BX;AA1BD,WAAY,IAAI;IACd,8EAAsE,CAAA;IACtE,+EAAuE,CAAA;IACvE,yFAAiF,CAAA;IACjF,gFAAwE,CAAA;IACxE,6EAAqE,CAAA;IACrE,+EAAuE,CAAA;IACvE,8EAAsE,CAAA;IACtE,gEAAwD,CAAA;IACxD,2CAAmC,CAAA;IACnC,qCAA6B,CAAA;IAC7B,mEAA2D,CAAA;IAC3D,0DAAkD,CAAA;IAClD,0DAAkD,CAAA;IAClD,6DAAqD,CAAA;IACrD,wEAAgE,CAAA;IAChE,gEAAwD,CAAA;IACxD,+DAAuD,CAAA;IACvD,0DAAkD,CAAA;IAClD,4DAAoD,CAAA;IACpD,2EAAmE,CAAA;IACnE,gGAAwF,CAAA;IACxF,uFAA+E,CAAA;IAE/E,OAAO;IACP,kCAA0B,CAAA;AAC5B,CAAC,EA1BW,IAAI,KAAJ,IAAI,QA0Bf;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAc,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA","sourcesContent":["/**\n * Enum of all gates in the system. This should be the single source of truth\n * for all gates, and should be used in all places where gates are checked or\n * defined.\n */\nexport enum Gate {\n  SuggestedUsersDiscoverEnable = 'suggested_users:discover_agent:enable',\n  SuggestedUsersSocialProofEnable = 'suggested_users:social_proof:enable',\n  ThreadsReplyRankingExplorationEnable = 'threads:reply_ranking_exploration:enable',\n  SearchFilteringExplorationEnable = 'search:filtering_exploration:enable',\n  SuggestedUsersForExploreEnable = 'suggested_users:for_explore:enable',\n  SuggestedUsersForDiscoverEnable = 'suggested_users:for_discover:enable',\n  SuggestedUsersForSeeMoreEnable = 'suggested_users:for_see_more:enable',\n  SuggestedUsersIrisEnable = 'suggested_users:iris:enable',\n  SearchV2Enable = 'search:v2:enable',\n  IrisFeed = 'iris:feed:enable',\n  IrisFeedWithFriendsEnable = 'iris:feed:with-friends:enable',\n  IrisFeedThevidsEnable = 'iris:feed:thevids:enable',\n  IrisFeedMutualsEnable = 'iris:feed:mutuals:enable',\n  IrisFeedBskyTeamEnable = 'iris:feed:bsky-team:enable',\n  IrisFeedBestOfFollowsEnable = 'iris:feed:best-of-follows:enable',\n  IrisFeedFollowpicsEnable = 'iris:feed:followpics:enable',\n  IrisFeedLoggedOutEnable = 'iris:feed:logged_out:enable',\n  KnownLikersFeedEnable = 'known_likers:feed:enable',\n  SuggestedFeedsV2Enable = 'suggested_feeds_v2:enable',\n  SuggestedStarterPacksV2Enable = 'suggested_starter_packs_v2:enable',\n  SuggestedStarterPacksOnboardingV2Enable = 'suggested_starter_packs_onboarding_v2:enable',\n  AtmosphereExploreArticlesIrisEnable = 'atmosphere_explore:articles:iris:enable',\n\n  // temp\n  AATest = 'aa-test-appview',\n}\n\n/**\n * Set of gates that should be ignored when tracking gate evaluations for\n * analytics purposes. This is useful for gates that are not user-facing or are\n * overly noisy.\n */\nexport const IGNORE_METRICS_FOR_GATES: Set<Gate> = new Set([])\n"]}

package/dist/feature-gates/index.d.ts

@@ -1,6 +1,11 @@
 import type express from 'express';
 import { Gate } from './gates.js';
 import type { ScopedFeatureGatesClient, UserContext } from './types.js';
+/**
+ * These need to match what the client sends
+ */
+export declare const ANALYTICS_HEADER_DEVICE_ID = "x-atproto-device-id";
+export declare const ANALYTICS_HEADER_SESSION_ID = "x-atproto-session-id";
 export { type ScopedFeatureGatesClient } from './types.js';
 export declare class FeatureGatesClient {
     private config;

package/dist/feature-gates/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/feature-gates/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAElC,OAAO,EAAE,IAAI,EAA4B,MAAM,YAAY,CAAA;AAE3D,OAAO,KAAK,EAEV,wBAAwB,EACxB,WAAW,EACZ,MAAM,YAAY,CAAA;AA0BnB,OAAO,EAAE,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAE1D,qBAAa,kBAAkB;IAa3B,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAA0C;IACxD,OAAO,CAAC,eAAe,CAAwC;IAC/D,OAAO,CAAC,OAAO,CAAe;IAE9B;;;OAGG;IACH,IAAI,cAAO;IAEX,YACU,MAAM,EAAE;QACd,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;QAC5B,0BAA0B,CAAC,EAAE,MAAM,CAAA;KACpC,EAKF;IAEK,KAAK,kBA6FV;IAEK,OAAO,kBAQZ;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,kBAE1B;IAED;;;OAGG;IACH,OAAO,CAAC,UAAU;IAUlB,KAAK,CAAC,iBAAiB,EAAE,WAAW,GAAG,wBAAwB,CAoB9D;IAED;;;;;OAKG;IACH,2BAA2B,CAAC,EAC1B,MAAM,EACN,GAAG,GACJ,EAAE;QACD;;WAEG;QACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB;;WAEG;QACH,GAAG,EAAE,OAAO,CAAC,OAAO,CAAA;KACrB,GAAG,WAAW,CASd;CACF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/feature-gates/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAElC,OAAO,EAAE,IAAI,EAA4B,MAAM,YAAY,CAAA;AAE3D,OAAO,KAAK,EAEV,wBAAwB,EACxB,WAAW,EACZ,MAAM,YAAY,CAAA;AAoBnB;;GAEG;AACH,eAAO,MAAM,0BAA0B,wBAAwB,CAAA;AAC/D,eAAO,MAAM,2BAA2B,yBAAyB,CAAA;AAEjE,OAAO,EAAE,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAE1D,qBAAa,kBAAkB;IAa3B,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAA0C;IACxD,OAAO,CAAC,eAAe,CAAwC;IAC/D,OAAO,CAAC,OAAO,CAAe;IAE9B;;;OAGG;IACH,IAAI,cAAO;IAEX,YACU,MAAM,EAAE;QACd,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;QAC5B,0BAA0B,CAAC,EAAE,MAAM,CAAA;KACpC,EAKF;IAEK,KAAK,kBA6FV;IAEK,OAAO,kBAQZ;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,kBAE1B;IAED;;;OAGG;IACH,OAAO,CAAC,UAAU;IAUlB,KAAK,CAAC,iBAAiB,EAAE,WAAW,GAAG,wBAAwB,CAoB9D;IAED;;;;;OAKG;IACH,2BAA2B,CAAC,EAC1B,MAAM,EACN,GAAG,GACJ,EAAE;QACD;;WAEG;QACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB;;WAEG;QACH,GAAG,EAAE,OAAO,CAAC,OAAO,CAAA;KACrB,GAAG,WAAW,CASd;CACF"}

package/dist/feature-gates/index.js

@@ -16,8 +16,8 @@ const REFETCH_INTERVAL = 60e3; // 1 minute
 /**
  * These need to match what the client sends
  */
-const ANALYTICS_HEADER_DEVICE_ID = 'x-atproto-device-id';
-const ANALYTICS_HEADER_SESSION_ID = 'x-atproto-session-id';
+export const ANALYTICS_HEADER_DEVICE_ID = 'x-atproto-device-id';
+export const ANALYTICS_HEADER_SESSION_ID = 'x-atproto-session-id';
 export {} from './types.js';
 export class FeatureGatesClient {
     constructor(config) {