@betterportal/auth-default 10.6.21 → 10.6.23

package/lib/social.js

@@ -0,0 +1,178 @@
+import * as oidc from "openid-client";
+import * as av from "anyvali";
+import { requireElevation } from "@betterportal/framework";
+import { AuthError, secretHash } from "./identity.js";
+import { publishSession } from "./account.js";
+const TenantIdSchema = av.string().format("uuid");
+const ConnectionsSchema = av.array(av.object({
+    id: av.string().minLength(1), kind: av.enum_(["google", "microsoft", "github"]),
+    clientId: av.string().minLength(1), clientSecret: av.string().minLength(1), tenantId: av.optional(TenantIdSchema)
+})).maxItems(20);
+export function socialConnections(runtime, scope) {
+    return parseSocialConnections(runtime.configuration(scope).socialConnections);
+}
+export function parseSocialConnections(configured) {
+    if (configured === undefined || configured === "")
+        return [];
+    let value;
+    try {
+        value = typeof configured === "string" ? JSON.parse(configured) : configured;
+    }
+    catch {
+        throw new AuthError("Social connections must be a valid JSON array.", 503);
+    }
+    const result = ConnectionsSchema.safeParse(value);
+    if (!result.success)
+        throw new AuthError("Invalid social connection configuration. Check provider types and required credentials.", 503);
+    const list = result.data;
+    if (new Set(list.map(c => c.id)).size !== list.length)
+        throw new AuthError("Duplicate social connection ID.", 503);
+    if (list.some(c => c.kind === "microsoft" && !c.tenantId))
+        throw new AuthError("Microsoft requires an explicit directory tenant ID.", 503);
+    return list;
+}
+async function discover(c) {
+    if (c.kind === "microsoft" && !TenantIdSchema.safeParse(c.tenantId).success)
+        throw new AuthError("Microsoft requires an explicit directory tenant ID.", 503);
+    return oidc.discovery(new URL(c.kind === "google" ? "https://accounts.google.com" : `https://login.microsoftonline.com/${c.tenantId}/v2.0`), c.clientId, c.clientSecret);
+}
+export const socialAdapter = {
+    async authorize(connection, parameters) {
+        if (connection.kind !== "github")
+            return oidc.buildAuthorizationUrl(await discover(connection), { ...parameters, scope: "openid profile email", prompt: "select_account" }).href;
+        const url = new URL("https://github.com/login/oauth/authorize");
+        for (const [key, value] of Object.entries({ ...parameters, scope: "read:user user:email" }))
+            url.searchParams.set(key, value);
+        return url.href;
+    },
+    async exchange(connection, callback, checks) {
+        if (connection.kind !== "github") {
+            const token = await oidc.authorizationCodeGrant(await discover(connection), callback, { pkceCodeVerifier: checks.verifier, expectedState: checks.state, expectedNonce: checks.nonce, idTokenExpected: true });
+            const claims = token.claims();
+            if (!claims)
+                throw new AuthError("Provider identity unavailable.");
+            return { issuer: claims.iss, subject: claims.sub, email: typeof claims.email === "string" ? claims.email : undefined, emailVerified: claims.email_verified === true, name: typeof claims.name === "string" ? claims.name : undefined };
+        }
+        const response = await fetch("https://github.com/login/oauth/access_token", { method: "POST", redirect: "error", signal: AbortSignal.timeout(15000), headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ client_id: connection.clientId, client_secret: connection.clientSecret, code: callback.searchParams.get("code") ?? "", code_verifier: checks.verifier, redirect_uri: checks.redirectUri }) });
+        const token = await response.json();
+        if (!response.ok || !token.access_token)
+            throw new AuthError("Provider rejected sign-in.");
+        const headers = { Authorization: `Bearer ${token.access_token}`, Accept: "application/vnd.github+json", "User-Agent": "BetterPortal" };
+        const [profileResponse, emailResponse] = await Promise.all([fetch("https://api.github.com/user", { headers, signal: AbortSignal.timeout(10000), redirect: "error" }), fetch("https://api.github.com/user/emails", { headers, signal: AbortSignal.timeout(10000), redirect: "error" })]);
+        if (!profileResponse.ok || !emailResponse.ok)
+            throw new AuthError("Provider profile unavailable.");
+        const profile = await profileResponse.json();
+        const emails = await emailResponse.json();
+        const email = emails.find(e => e.primary && e.verified) ?? emails.find(e => e.verified);
+        if (!profile.id)
+            throw new AuthError("Provider subject unavailable.");
+        return { issuer: "https://github.com", subject: String(profile.id), email: email?.email, emailVerified: !!email, name: profile.name ?? profile.login };
+    }
+};
+export async function socialPost(ctx) {
+    const runtime = ctx.plugin.runtime;
+    const identity = runtime.identity;
+    const scope = { tenantId: ctx.tenant.id, appId: ctx.app.id };
+    const policy = await runtime.policy(scope);
+    const body = ctx.request;
+    const connections = socialConnections(runtime, scope);
+    const event = ctx.rawEvent;
+    const origin = event.req.headers.get("origin") ?? event.url.origin;
+    if (body.action === "start" || body.action === "link") {
+        const connection = connections.find(c => c.id === body.connection);
+        if (!connection)
+            throw new AuthError("Connection unavailable.");
+        if (body.action === "link")
+            requireElevation(ctx.user, { minimum: "confirm", maxAgeSeconds: 300 });
+        const redirectUri = ctx.uiRouteUrl?.("social.index", { absolute: true });
+        if (!redirectUri || new URL(redirectUri).origin !== origin)
+            throw new AuthError("Mount the social sign-in page in this app and register its redirect URL.", 503);
+        await identity.rateLimit(scope, "social", "app", 100, 600);
+        const verifier = oidc.randomPKCECodeVerifier();
+        const nonce = oidc.randomNonce();
+        const ticket = await identity.storage.transaction(scope, async (tx) => {
+            if (body.action === "link") {
+                const user = await tx.get("user", ctx.user.sub, { tenantId: scope.tenantId, appId: policy.isolation === "app" ? scope.appId : "" });
+                if (!user?.enabled)
+                    throw new AuthError("Account unavailable.", 401);
+                await identity.assertActiveSession(tx, scope, ctx.user, user);
+            }
+            // Redirecting discards the in-memory elevated JWT. Bind the approved link
+            // to its app session so the ordinary token can finish after returning.
+            return identity.challengeInTransaction(tx, scope, "social", { connectionId: connection.id, configHash: secretHash(JSON.stringify(connection)), verifier: identity.cipher.encrypt(verifier), nonce, redirectUri, origin, linkUserId: body.action === "link" ? ctx.user.sub : null, linkSessionId: body.action === "link" ? ctx.user.sessionId : null, linkVersion: body.action === "link" ? ctx.user.sessionVersion : null });
+        });
+        const authorizationUrl = await socialAdapter.authorize(connection, { client_id: connection.clientId, redirect_uri: redirectUri, response_type: "code", state: ticket.id, nonce, code_challenge: await oidc.calculatePKCECodeChallenge(verifier), code_challenge_method: "S256" });
+        return { status: "ok", ...ticket, authorizationUrl };
+    }
+    if (body.action !== "complete")
+        throw new AuthError("Unknown social action.");
+    const validate = async (challenge, tx) => {
+        const data = challenge.data;
+        const connection = socialConnections(runtime, scope).find(c => c.id === data.connectionId);
+        if (!connection || data.configHash !== secretHash(JSON.stringify(connection)) || data.origin !== origin)
+            throw new AuthError("Sign-in configuration changed. Start again.");
+        const dir = { tenantId: scope.tenantId, appId: policy.isolation === "app" ? scope.appId : "" };
+        let linkingUser;
+        if (data.linkUserId) {
+            if (!ctx.user || ctx.user.sub !== data.linkUserId || ctx.user.sessionId !== data.linkSessionId || ctx.user.sessionVersion !== data.linkVersion)
+                throw new AuthError("Sign in again before linking.", 401);
+            linkingUser = await tx.get("user", ctx.user.sub, dir);
+            if (!linkingUser?.enabled)
+                throw new AuthError("Account unavailable.", 401);
+            await identity.assertActiveSession(tx, scope, ctx.user, linkingUser);
+        }
+        return { connection, linkingUser, dir };
+    };
+    const result = await identity.consumeWithPreparation(scope, "social", String(body.id), String(body.secret), async (challenge) => {
+        const { connection } = await identity.storage.transaction(scope, tx => validate(challenge, tx));
+        const data = challenge.data;
+        const callback = new URL(String(data.redirectUri));
+        callback.searchParams.set("code", String(body.code));
+        callback.searchParams.set("state", challenge.id);
+        try {
+            return await socialAdapter.exchange(connection, callback, { verifier: identity.cipher.decrypt(String(data.verifier)), nonce: String(data.nonce), state: challenge.id, redirectUri: String(data.redirectUri) });
+        }
+        catch (error) {
+            if (error instanceof AuthError)
+                throw error;
+            throw new AuthError("Provider sign-in failed. Start again.", 502);
+        }
+    }, async (challenge, tx, external) => {
+        const { connection, linkingUser, dir } = await validate(challenge, tx);
+        const id = secretHash(JSON.stringify([connection.kind, external.issuer, external.subject]));
+        const linked = await tx.get("external", id, dir);
+        if (linkingUser) {
+            const user = linkingUser;
+            if (linked && linked.userId !== user.id)
+                throw new AuthError("Identity already linked or unavailable.");
+            await tx.put("external", dir, { id, userId: user.id, issuer: external.issuer, subject: external.subject, provider: connection.kind });
+            await identity.audit(tx, scope, user.id, "identity.linked");
+            return { linked: true, user };
+        }
+        let user = linked ? await tx.get("user", String(linked.userId), dir) : undefined;
+        if (!linked) {
+            if (policy.registration !== "public")
+                throw new AuthError("Accept an invitation or sign in to link this provider first.", 403);
+            if (!external.email || !external.emailVerified)
+                throw new AuthError("This provider did not verify an email address. Register with email first, then link the provider.");
+            // Email equality is never proof that two identities should be linked.
+            user = await identity.createInTransaction(tx, scope, policy, { username: external.email, email: external.email, name: external.name, verified: true });
+            await tx.put("external", dir, { id, userId: user.id, issuer: external.issuer, subject: external.subject, provider: connection.kind });
+        }
+        if (!user?.enabled)
+            throw new AuthError("Account unavailable.", 403);
+        return { linked: false, user };
+    });
+    if (result.linked)
+        return { status: "ok", message: "Provider linked to your account." };
+    const hasFactors = await runtime.factors.hasFactors(result.user);
+    const roles = await identity.storage.transaction(scope, tx => identity.roles(tx, scope, result.user, policy));
+    if (hasFactors || policy.requireMfa || roles.includes("*")) {
+        const prepared = await runtime.factors.prepare(result.user, origin, !hasFactors);
+        const ticket = await identity.challenge(scope, "login", { version: result.user.refreshVersion, factor: prepared.private }, result.user.id);
+        return { status: "ok", challenge: { ...ticket, ...prepared.public }, accountUrl: ctx.routeUrl?.("account.index", { absolute: true }) ?? "/account" };
+    }
+    publishSession(ctx, await identity.issueSession(scope, policy, result.user, runtime.tokenIssuer, runtime.refreshTokenSeconds));
+    return { status: "ok", message: "Signed in.", next: "/" };
+}
+//# sourceMappingURL=social.js.map

package/lib/social.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"social.js","sourceRoot":"","sources":["../src/social.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAA6C,MAAM,yBAAyB,CAAC;AACtG,OAAO,EAAE,SAAS,EAAE,UAAU,EAA6B,MAAM,eAAe,CAAC;AAGjF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI9C,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAClD,MAAM,iBAAiB,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;IACxF,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;CAClH,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAOjB,MAAM,UAAU,iBAAiB,CAAC,OAAoB,EAAE,KAA0C;IAChG,OAAO,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAChF,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,UAAmB;IACxD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC7D,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAAC,CAAC;IACrF,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IACrF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,yFAAyF,EAAE,GAAG,CAAC,CAAC;IACzI,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACnH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,qDAAqD,EAAE,GAAG,CAAC,CAAC;IAC3I,OAAO,IAAI,CAAC;AACd,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,CAAmB;IACzC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,qDAAqD,EAAE,GAAG,CAAC,CAAC;IAC7J,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,QAAQ,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;AAC3K,CAAC;AACD,MAAM,CAAC,MAAM,aAAa,GAA4B;IACpD,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU;QACpC,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC;QACjL,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9H,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM;QACzC,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9M,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACzO,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7c,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA+B,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;QACvI,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACxR,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAoD,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAmE,CAAC;QAC3G,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;IACzJ,CAAC;CACF,CAAC;AACF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAC,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAAC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChL,MAAM,IAAI,GAAG,GAAG,CAAC,OAA8B,CAAC;IAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,GAAG,CAAC,QAAsC,CAAC;IAAC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;IAC7H,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;QACnG,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,0EAA0E,EAAE,GAAG,CAAC,CAAC;QACjK,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAAC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAClE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,GAAG,CAAC,IAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3I,IAAI,CAAC,IAAI,EAAE,OAAO;oBAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;gBACrE,MAAM,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAK,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,OAAO,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACla,CAAC,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC;QAClR,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,KAAK,EAAE,SAAoB,EAAE,EAAmB,EAAE,EAAE;QACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;QACxH,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;QAC5K,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/F,IAAI,WAA6B,CAAC;QAClC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YAC1M,WAAW,GAAG,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5D,IAAI,CAAC,WAAW,EAAE,OAAO;gBAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;YAC5E,MAAM,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAC,SAAS,EAAC,EAAE;QAC5H,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3J,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;QACnC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,WAAW,CAAC;YACzB,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACxG,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACtI,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,8DAA8D,EAAE,GAAG,CAAC,CAAC;YAC/H,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,MAAM,IAAI,SAAS,CAAC,mGAAmG,CAAC,CAAC;YACzK,sEAAsE;YACtE,IAAI,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACvJ,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IACxF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9G,IAAI,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3I,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,UAAU,EAAgB,CAAC;IACrK,CAAC;IACD,cAAc,CAAC,GAAG,EAAE,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC/H,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC5D,CAAC"}

package/lib/storage.d.ts

@@ -0,0 +1,72 @@
+export interface Scope {
+    tenantId: string;
+    appId: string;
+}
+export interface RecordValue {
+    id: string;
+    [key: string]: unknown;
+}
+export interface StoredRecord {
+    kind: string;
+    scope: Scope;
+    value: RecordValue;
+}
+interface PageOptions {
+    after?: string;
+    limit?: number;
+    descending?: boolean;
+}
+export interface AuthTransaction {
+    get<T extends RecordValue>(kind: string, id: string, scope: Scope): Promise<T | undefined>;
+    list<T extends RecordValue>(kind: string, scope?: Scope): Promise<T[]>;
+    page<T extends RecordValue>(kind: string, scope: Scope, options?: PageOptions): Promise<T[]>;
+    pruneSessions(scope: Scope, now: number): Promise<void>;
+    activeSessions<T extends RecordValue>(scope: Scope, userId: string, now: number, options?: PageOptions): Promise<T[]>;
+    failedMail<T extends RecordValue>(scope: Scope, options?: PageOptions): Promise<T[]>;
+    dueMail<T extends RecordValue>(now: number, limit: number): Promise<T[]>;
+    put(kind: string, scope: Scope, value: RecordValue): Promise<void>;
+    remove(kind: string, id: string, scope: Scope): Promise<void>;
+}
+export interface AuthStorage {
+    readonly mode: "simple" | "advanced";
+    transaction<T>(scope: Scope, work: (tx: AuthTransaction) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+interface FileData {
+    version: 2;
+    records: StoredRecord[];
+}
+/** Atomic replace includes a directory fsync so a completed write survives restart. */
+export declare function atomicWrite(path: string, data: unknown): void;
+export declare class JsonAuthStorage implements AuthStorage {
+    readonly path: string;
+    readonly mode: "simple";
+    private data;
+    private tail;
+    private readonly release;
+    private closed;
+    private closing;
+    constructor(path: string);
+    transaction<T>(_scope: Scope, work: (tx: AuthTransaction) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+export declare class PostgresAuthStorage implements AuthStorage {
+    readonly installationId: string;
+    readonly mode: "advanced";
+    private readonly pool;
+    constructor(connectionString: string, installationId: string);
+    initialize(): Promise<void>;
+    transaction<T>(scope: Scope, work: (tx: AuthTransaction) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+/** Import only known legacy fields. Unknown schema versions never trigger a destructive fallback. */
+export declare function importLegacy(raw: unknown, appIds: Record<string, string[]>): FileData;
+export declare function openAuthStorage(options: {
+    mode: "simple" | "advanced";
+    path: string;
+    connectionString?: string;
+    installationId: string;
+    appIds: Record<string, string[]>;
+}): Promise<AuthStorage>;
+export {};
+//# sourceMappingURL=storage.d.ts.map

package/lib/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,KAAK;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC1D,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE;AACnE,MAAM,WAAW,YAAY;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE;AAChF,UAAU,WAAW;IAAG,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE;AAC9E,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,CAAC,SAAS,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,SAAS,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,SAAS,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,CAAC,SAAS,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACtH,UAAU,CAAC,CAAC,SAAS,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC,SAAS,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AACD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IACrC,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AACD,UAAU,QAAQ;IAAG,OAAO,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,YAAY,EAAE,CAAA;CAAE;AAI1D,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAQ7D;AAuDD,qBAAa,eAAgB,YAAW,WAAW;IAQrC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAPjC,QAAQ,CAAC,IAAI,EAAG,QAAQ,CAAU;IAClC,OAAO,CAAC,IAAI,CAAW;IACvB,OAAO,CAAC,IAAI,CAAuC;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;gBAEH,IAAI,EAAE,MAAM;IAUjC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAqC9E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAC7B;AA4CD,qBAAa,mBAAoB,YAAW,WAAW;IAGf,QAAQ,CAAC,cAAc,EAAE,MAAM;IAFrE,QAAQ,CAAC,IAAI,EAAG,UAAU,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;gBAChB,gBAAgB,EAAE,MAAM,EAAW,cAAc,EAAE,MAAM;IAI/D,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB3B,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAWnF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAC7B;AAED,qGAAqG;AACrG,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,CA2CrF;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAyDvM"}