@boopkit/cap-oauth-server 0.1.0

package/dist/discovery.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The two `.well-known` discovery documents.
+ *
+ * ## Computed, never read off disk
+ *
+ * The donor controller (`paywalls-site/src/controllers/wellknownController.ts`)
+ * serves these by joining `req.params.resource` onto a fixed prefix and
+ * compiling whatever file it lands on. Two properties of that are wrong for a
+ * shipped package rather than for paywalls, and the findings name both:
+ *
+ *   1. `req.params.resource` reaches `path.join` without `..` being stripped.
+ *      Paywalls is saved by there being nothing outside the prefix it would
+ *      serve, which is a fact about its filesystem, not a property of its code.
+ *   2. The prefix is relative to the process working directory, which is fine
+ *      for an application and fragile for a capability whose files may be
+ *      scaffolded or may sit in `node_modules`.
+ *
+ * Neither applies here, because these documents are **computed from
+ * configuration** by the functions below. There is no path, so there is nothing
+ * to traverse, and there is no working directory to be wrong about.
+ *
+ * ## And why the values are all fresh
+ *
+ * The donor's documents do not survive at all. Its authorization-server
+ * document advertises `grant_types_supported: ["refresh_token"]` and nothing
+ * else, has no `code_challenge_methods_supported`, no
+ * `client_id_metadata_document_supported`, and points `authorization_endpoint`
+ * at a POST endpoint authenticated by an API key. Its protected-resource
+ * document sets `resource` to the bare host rather than to the protected
+ * endpoint URL, which is the one thing the Claude ecosystem checklist says must
+ * match exactly as clients enter it.
+ */
+export interface DiscoveryConfig {
+    /** The authorization server's issuer identifier — an https origin, no path. */
+    issuer: string;
+    /**
+     * The protected resource's URL, as clients enter it.
+     *
+     * This is *not* the issuer. A client that connects to `https://app/api/mcp`
+     * needs to read that exact string back, so this is configured rather than
+     * derived, and the derivation the scaffold offers is a default rather than a
+     * rule.
+     */
+    resource: string;
+    /** Scopes this server will issue. `offline_access` earns the refresh token. */
+    scopesSupported: string[];
+    /**
+     * Whether the device-code grant is mounted.
+     *
+     * When it is off the grant type is **absent** from `grant_types_supported`,
+     * rather than advertised against an endpoint that answers 404. Discovery
+     * metadata is a contract: a client that read the metadata treats a 404 as a
+     * server fault rather than as an unsupported feature. The flag gates the
+     * mount and this field from one value, so the two cannot drift.
+     *
+     * Slice 1 has no device endpoints, so the scaffold passes `false`.
+     */
+    deviceCodeEnabled?: boolean;
+    /** Optional human-facing documentation URL, echoed into both documents. */
+    documentationUri?: string;
+}
+/** Only S256. `plain` is not a PKCE method, it is the absence of one. */
+export declare const CODE_CHALLENGE_METHODS_SUPPORTED: readonly ["S256"];
+/** RFC 8628's grant type, named once so the metadata and the mount agree. */
+export declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/** What a boop app can meaningfully scope, before an operator narrows it. */
+export declare const DEFAULT_SCOPES_SUPPORTED: string[];
+/** One hour, matching the donor's `Cache-Control` and the ecosystem's habit. */
+export declare const DISCOVERY_MAX_AGE_SECONDS = 3600;
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    revocation_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    scopes_supported: string[];
+    client_id_metadata_document_supported: boolean;
+    service_documentation?: string;
+}
+/** RFC 8414, plus the CIMD field the Claude ecosystem reads. */
+export declare function buildAuthorizationServerMetadata(config: DiscoveryConfig): AuthorizationServerMetadata;
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported: string[];
+    resource_documentation?: string;
+}
+/** RFC 9728. */
+export declare function buildProtectedResourceMetadata(config: DiscoveryConfig): ProtectedResourceMetadata;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,mBAAoB,CAAC;AAElE,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AAErF,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,UAAyC,CAAC;AAE/E,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAO9C,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qCAAqC,EAAE,OAAO,CAAC;IAC/C,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,gEAAgE;AAChE,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,eAAe,GACtB,2BAA2B,CAiC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,gBAAgB;AAChB,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,eAAe,GACtB,yBAAyB,CAe3B"}

package/dist/discovery.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * The two `.well-known` discovery documents.
+ *
+ * ## Computed, never read off disk
+ *
+ * The donor controller (`paywalls-site/src/controllers/wellknownController.ts`)
+ * serves these by joining `req.params.resource` onto a fixed prefix and
+ * compiling whatever file it lands on. Two properties of that are wrong for a
+ * shipped package rather than for paywalls, and the findings name both:
+ *
+ *   1. `req.params.resource` reaches `path.join` without `..` being stripped.
+ *      Paywalls is saved by there being nothing outside the prefix it would
+ *      serve, which is a fact about its filesystem, not a property of its code.
+ *   2. The prefix is relative to the process working directory, which is fine
+ *      for an application and fragile for a capability whose files may be
+ *      scaffolded or may sit in `node_modules`.
+ *
+ * Neither applies here, because these documents are **computed from
+ * configuration** by the functions below. There is no path, so there is nothing
+ * to traverse, and there is no working directory to be wrong about.
+ *
+ * ## And why the values are all fresh
+ *
+ * The donor's documents do not survive at all. Its authorization-server
+ * document advertises `grant_types_supported: ["refresh_token"]` and nothing
+ * else, has no `code_challenge_methods_supported`, no
+ * `client_id_metadata_document_supported`, and points `authorization_endpoint`
+ * at a POST endpoint authenticated by an API key. Its protected-resource
+ * document sets `resource` to the bare host rather than to the protected
+ * endpoint URL, which is the one thing the Claude ecosystem checklist says must
+ * match exactly as clients enter it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DISCOVERY_MAX_AGE_SECONDS = exports.DEFAULT_SCOPES_SUPPORTED = exports.DEVICE_CODE_GRANT_TYPE = exports.CODE_CHALLENGE_METHODS_SUPPORTED = void 0;
+exports.buildAuthorizationServerMetadata = buildAuthorizationServerMetadata;
+exports.buildProtectedResourceMetadata = buildProtectedResourceMetadata;
+/** Only S256. `plain` is not a PKCE method, it is the absence of one. */
+exports.CODE_CHALLENGE_METHODS_SUPPORTED = ['S256'];
+/** RFC 8628's grant type, named once so the metadata and the mount agree. */
+exports.DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+/** What a boop app can meaningfully scope, before an operator narrows it. */
+exports.DEFAULT_SCOPES_SUPPORTED = ['profile', 'email', 'offline_access'];
+/** One hour, matching the donor's `Cache-Control` and the ecosystem's habit. */
+exports.DISCOVERY_MAX_AGE_SECONDS = 3600;
+/** Trim one trailing slash, so `https://app/` and `https://app` agree. */
+function origin(value) {
+    return value.endsWith('/') ? value.slice(0, -1) : value;
+}
+/** RFC 8414, plus the CIMD field the Claude ecosystem reads. */
+function buildAuthorizationServerMetadata(config) {
+    const base = origin(config.issuer);
+    const grantTypes = ['authorization_code', 'refresh_token'];
+    if (config.deviceCodeEnabled)
+        grantTypes.push(exports.DEVICE_CODE_GRANT_TYPE);
+    const metadata = {
+        issuer: base,
+        authorization_endpoint: `${base}/oauth/authorize`,
+        token_endpoint: `${base}/oauth/token`,
+        // Honest only because Slice 1 ships the endpoint. Advertising a
+        // registration endpoint that does not exist is the same class of lie as
+        // advertising the device grant with the flag off.
+        registration_endpoint: `${base}/oauth/register`,
+        // Honest for the same reason: `createRevocationRouter` mounts it on the
+        // same router the token endpoint is on. It was the one field in this
+        // document that broke the rule above, until it did.
+        revocation_endpoint: `${base}/oauth/revoke`,
+        response_types_supported: ['code'],
+        grant_types_supported: grantTypes,
+        // PKCE is not optional here. OAuth 2.1 requires it for public clients, and
+        // every client this server will see is public.
+        code_challenge_methods_supported: [...exports.CODE_CHALLENGE_METHODS_SUPPORTED],
+        // `none` is what a public client authenticates with: nothing. It has to be
+        // advertised, because a client that finds only confidential methods here
+        // concludes it cannot use this server at all.
+        token_endpoint_auth_methods_supported: ['none'],
+        scopes_supported: [...config.scopesSupported],
+        client_id_metadata_document_supported: true,
+    };
+    if (config.documentationUri)
+        metadata.service_documentation = config.documentationUri;
+    return metadata;
+}
+/** RFC 9728. */
+function buildProtectedResourceMetadata(config) {
+    const metadata = {
+        // As clients enter it — see the field's note on DiscoveryConfig.
+        resource: origin(config.resource),
+        // One entry, and Claude reads only the first. A second entry would not be
+        // an error, but it would be decoration.
+        authorization_servers: [origin(config.issuer)],
+        scopes_supported: [...config.scopesSupported],
+        // The header, and only the header. A bearer token in a query string lands
+        // in access logs and `Referer`.
+        bearer_methods_supported: ['header'],
+    };
+    if (config.documentationUri)
+        metadata.resource_documentation = config.documentationUri;
+    return metadata;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AAiEH,4EAmCC;AAWD,wEAiBC;AAhGD,yEAAyE;AAC5D,QAAA,gCAAgC,GAAG,CAAC,MAAM,CAAU,CAAC;AAElE,6EAA6E;AAChE,QAAA,sBAAsB,GAAG,8CAA8C,CAAC;AAErF,6EAA6E;AAChE,QAAA,wBAAwB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAE/E,gFAAgF;AACnE,QAAA,yBAAyB,GAAG,IAAI,CAAC;AAE9C,0EAA0E;AAC1E,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAiBD,gEAAgE;AAChE,SAAgB,gCAAgC,CAC9C,MAAuB;IAEvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,iBAAiB;QAAE,UAAU,CAAC,IAAI,CAAC,8BAAsB,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAgC;QAC5C,MAAM,EAAE,IAAI;QACZ,sBAAsB,EAAE,GAAG,IAAI,kBAAkB;QACjD,cAAc,EAAE,GAAG,IAAI,cAAc;QACrC,gEAAgE;QAChE,wEAAwE;QACxE,kDAAkD;QAClD,qBAAqB,EAAE,GAAG,IAAI,iBAAiB;QAC/C,wEAAwE;QACxE,qEAAqE;QACrE,oDAAoD;QACpD,mBAAmB,EAAE,GAAG,IAAI,eAAe;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,UAAU;QACjC,2EAA2E;QAC3E,+CAA+C;QAC/C,gCAAgC,EAAE,CAAC,GAAG,wCAAgC,CAAC;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,8CAA8C;QAC9C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QAC7C,qCAAqC,EAAE,IAAI;KAC5C,CAAC;IAEF,IAAI,MAAM,CAAC,gBAAgB;QAAE,QAAQ,CAAC,qBAAqB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACtF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD,gBAAgB;AAChB,SAAgB,8BAA8B,CAC5C,MAAuB;IAEvB,MAAM,QAAQ,GAA8B;QAC1C,iEAAiE;QACjE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,0EAA0E;QAC1E,wCAAwC;QACxC,qBAAqB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QAC7C,0EAA0E;QAC1E,gCAAgC;QAChC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;IAEF,IAAI,MAAM,CAAC,gBAAgB;QAAE,QAAQ,CAAC,sBAAsB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACvF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The registry's refusals, as typed errors carrying an RFC-shaped code.
+ *
+ * The code is what the controller writes into an OAuth error body, so it is
+ * chosen from the specification rather than invented: RFC 7591 §3.2.2 defines
+ * `invalid_client_metadata` and `invalid_redirect_uri` for registration, and
+ * RFC 6749 §5.2 defines `invalid_client` and `invalid_request`. Everything the
+ * specification has no word for gets a code prefixed `boop_`, so a reader can
+ * tell at a glance which half of the vocabulary they are looking at.
+ */
+/** Codes a registration or lookup refusal can carry. */
+export type ClientRegistryErrorCode = 'invalid_client_metadata' | 'invalid_redirect_uri' | 'invalid_client' | 'invalid_request'
+/** The row exists and is `static`; the registration surface may not touch it. */
+ | 'boop_static_client_immutable'
+/** The registry has reached its configured row ceiling. */
+ | 'boop_registration_capacity'
+/** A Client ID Metadata Document could not be fetched, parsed or trusted. */
+ | 'boop_metadata_document_unusable';
+export declare class ClientRegistryError extends Error {
+    readonly code: ClientRegistryErrorCode;
+    readonly status: number;
+    constructor(code: ClientRegistryErrorCode, message: string);
+}
+/** Is this one of ours? Narrower than `instanceof` across module instances. */
+export declare function isClientRegistryError(err: unknown): err is ClientRegistryError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,wDAAwD;AACxD,MAAM,MAAM,uBAAuB,GAC/B,yBAAyB,GACzB,sBAAsB,GACtB,gBAAgB,GAChB,iBAAiB;AACnB,iFAAiF;GAC/E,8BAA8B;AAChC,2DAA2D;GACzD,4BAA4B;AAC9B,6EAA6E;GAC3E,iCAAiC,CAAC;AAatC,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAM3D;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,mBAAmB,CAO9E"}

package/dist/errors.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * The registry's refusals, as typed errors carrying an RFC-shaped code.
+ *
+ * The code is what the controller writes into an OAuth error body, so it is
+ * chosen from the specification rather than invented: RFC 7591 §3.2.2 defines
+ * `invalid_client_metadata` and `invalid_redirect_uri` for registration, and
+ * RFC 6749 §5.2 defines `invalid_client` and `invalid_request`. Everything the
+ * specification has no word for gets a code prefixed `boop_`, so a reader can
+ * tell at a glance which half of the vocabulary they are looking at.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientRegistryError = void 0;
+exports.isClientRegistryError = isClientRegistryError;
+/** HTTP status a controller should answer a given code with. */
+const STATUS_BY_CODE = {
+    invalid_client_metadata: 400,
+    invalid_redirect_uri: 400,
+    invalid_client: 400,
+    invalid_request: 400,
+    boop_static_client_immutable: 403,
+    boop_registration_capacity: 503,
+    boop_metadata_document_unusable: 400,
+};
+class ClientRegistryError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'ClientRegistryError';
+        this.code = code;
+        this.status = STATUS_BY_CODE[code];
+    }
+}
+exports.ClientRegistryError = ClientRegistryError;
+/** Is this one of ours? Narrower than `instanceof` across module instances. */
+function isClientRegistryError(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        err.name === 'ClientRegistryError' &&
+        typeof err.code === 'string');
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAuCH,sDAOC;AA/BD,gEAAgE;AAChE,MAAM,cAAc,GAA4C;IAC9D,uBAAuB,EAAE,GAAG;IAC5B,oBAAoB,EAAE,GAAG;IACzB,cAAc,EAAE,GAAG;IACnB,eAAe,EAAE,GAAG;IACpB,4BAA4B,EAAE,GAAG;IACjC,0BAA0B,EAAE,GAAG;IAC/B,+BAA+B,EAAE,GAAG;CACrC,CAAC;AAEF,MAAa,mBAAoB,SAAQ,KAAK;IAI5C,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACF;AAVD,kDAUC;AAED,+EAA+E;AAC/E,SAAgB,qBAAqB,CAAC,GAAY;IAChD,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACX,GAA0B,CAAC,IAAI,KAAK,qBAAqB;QAC1D,OAAQ,GAA0B,CAAC,IAAI,KAAK,QAAQ,CACrD,CAAC;AACJ,CAAC"}

package/dist/express.d.ts

@@ -0,0 +1,66 @@
+import type { OAuthGrantRecord } from './grant-service.js';
+/**
+ * The Express request fields this capability reads and writes.
+ *
+ * Declared here rather than in the file that writes them so that both the
+ * consent controller (which reads `req.user`) and the bearer middleware (which
+ * writes `req.oauthGrant`) get the same declarations without importing each
+ * other, and so a consuming application picks them up by importing the package.
+ *
+ * ## Why each of these is a *re*-declaration, and why that is safe
+ *
+ * cap-users declares `user`, `sessionToken` and `authStrategy` in its
+ * scaffolded `src/types/express.ts`, which exists only inside a generated
+ * application — this package has to type-check without one. Global interface
+ * declarations merge, so both files can describe the same field as long as they
+ * describe it **identically**; TypeScript reports TS2717 the moment two
+ * declarations of one property disagree about its type.
+ *
+ * So: `authStrategy` is `string` here, exactly as cap-users widened it in Slice
+ * 0 — not the `'api-key'` literal it used to be, which is the whole point of
+ * the widening. And `user` hangs off `Express.User` rather than naming a
+ * concrete type, for the reason cap-users' own file explains at length:
+ * `@types/passport` types `Request['user']` as `Express.User`, so any capability
+ * that named a different type would collide with it and break every handler in
+ * the application. Extending the empty interface is what lets three packages
+ * describe one field and still agree.
+ */
+declare global {
+    namespace Express {
+        interface User {
+        }
+        interface Request {
+            /** Set by cap-users' cookie resolver or by this package's bearer path. */
+            user?: User;
+            /** The raw credential this request presented. cap-users' field. */
+            sessionToken?: string;
+            /**
+             * Which door this request came through. `'oauth'` for this package's
+             * bearer path — never `'api-key'`, which is the literal `requireApiKey`
+             * gates on, and which an OAuth access token must fail by construction.
+             */
+            authStrategy?: string;
+            /**
+             * The grant behind this request's OAuth access token — written by
+             * `createOAuthBearerMiddleware` and by nothing else.
+             *
+             * It is the **scope authority**: the token carries no scope copy, so a
+             * grant narrowed a moment ago binds this request. Present only when
+             * `authStrategy === 'oauth'`.
+             */
+            oauthGrant?: OAuthGrantRecord;
+            /**
+             * The `WWW-Authenticate` challenge this deployment sends on a 401 —
+             * written by `createOAuthBearerMiddleware` and read by `requireOAuth`.
+             *
+             * It exists so the resolver and the gate cannot be configured with
+             * different challenges. Set on every request the resolver sees, including
+             * the ones it lets through unauthenticated, because those are exactly the
+             * ones the gate has to refuse.
+             */
+            oauthChallenge?: string;
+        }
+    }
+}
+export {};
+//# sourceMappingURL=express.d.ts.map

package/dist/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAKhB,UAAU,IAAI;SAAG;QAEjB,UAAU,OAAO;YACf,0EAA0E;YAC1E,IAAI,CAAC,EAAE,IAAI,CAAC;YACZ,mEAAmE;YACnE,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB;;;;eAIG;YACH,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB;;;;;;;eAOG;YACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;YAC9B;;;;;;;;eAQG;YACH,cAAc,CAAC,EAAE,MAAM,CAAC;SACzB;KACF;CACF;AAED,OAAO,EAAE,CAAC"}

package/dist/express.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":""}

package/dist/grant-service.d.ts

@@ -0,0 +1,102 @@
+import type { PropertyStore } from './user-store.js';
+/**
+ * `oauth-grants` — the record of what a person approved, for which client.
+ *
+ * ## The grant is the scope authority, and the token carries no copy
+ *
+ * The spec says a minted token "inherits" the code's approved scopes, and
+ * separately that the resource server reads scopes from `oauth-grants`. If both
+ * were true there would be two answers and they would eventually disagree. The
+ * plan settles it: the code's `scopes` are written **into the grant** at
+ * redemption, and the guard reads the grant on every request. A token minted
+ * under a wider set is bound by the grant's current, narrower one on its very
+ * next call — no revocation, no new mechanism, and a test says so.
+ *
+ * RFC 8707 `resource` is the exception and stays on the token: an audience is a
+ * property of a credential, not of a relationship, which is exactly why a
+ * cautious client can ask for a narrow token against an unchanged grant.
+ *
+ * ## Re-consent replaces, it does not union
+ *
+ * The screen showed the user a list and they approved that list. A union would
+ * grant scopes the screen never showed, which is the one thing a consent screen
+ * must never do. Replacement also gives a downgrade path, which a union has no
+ * way to express.
+ *
+ * ## Nothing in here is a credential
+ *
+ * Only `credentials` is on cap-users' sensitive-property list, so this property
+ * is readable by default. Client ids, scopes and timestamps belong here. Token
+ * values, raw codes and PKCE verifiers do not, and stay in identity rows as
+ * hashes. `refresh_key` is the one field that looks like an exception and is
+ * not: it is the *stored* identity key, which is already a SHA-256 digest, and
+ * it is the same value `user_identities.key` holds. The credentials-at-rest
+ * test asserts against the raw values, and this passes it.
+ */
+/** The property name. One place, because two spellings is one bug. */
+export declare const OAUTH_GRANTS_PROPERTY = "oauth-grants";
+/** Tags the blob's shape, the way cap-users tags its own property schemas. */
+export declare const OAUTH_GRANTS_INFO_SCHEMA = "boop.oauth-server.grants.v1";
+export interface OAuthGrantRecord {
+    /** Stable, non-secret handle. What the connected-clients screen links to. */
+    grant_id: string;
+    /** What the client presents as `client_id` — a URL, for a CIMD client. */
+    client_id: string;
+    /** The token prefix. The join between a presented token and this record. */
+    client_public_id: string;
+    /** The current approved set. Replaced wholesale on re-consent. */
+    scopes: string[];
+    /** RFC 8707, as last requested. Informational here; the token is authority. */
+    resource: string | null;
+    /**
+     * The identity key of the grant's **current** refresh token, or `null`.
+     *
+     * This is what makes reuse of a rotated refresh token detectable. A rotated
+     * token's identity row is deliberately left *active* so that presenting it
+     * still resolves to a user and therefore to this grant; the row grants
+     * nothing, because the key no longer matches this field. See
+     * `token-controller.ts` for the whole argument.
+     */
+    refresh_key: string | null;
+    created_at: string;
+    updated_at: string;
+    /** Soft revocation. A grant is never deleted; the history is the point. */
+    ended_at: string | null;
+    ended_reason: string | null;
+}
+export interface ApproveGrantInput {
+    clientId: string;
+    clientPublicId: string;
+    scopes: string[];
+    resource?: string | null;
+}
+export interface GrantsSnapshot {
+    grants: OAuthGrantRecord[];
+    revision: number | undefined;
+}
+export interface GrantService {
+    /** The whole property, with the revision a write has to quote back. */
+    read(userId: number): Promise<GrantsSnapshot>;
+    /** Write the whole array under `expectedRevision`. Refused if stale. */
+    write(userId: number, grants: OAuthGrantRecord[], revision: number | undefined): Promise<void>;
+    /** Every grant, ended ones included — the connected-clients screen's read. */
+    list(userId: number): Promise<OAuthGrantRecord[]>;
+    /** The live grant for this client, if there is one. */
+    findActive(userId: number, clientPublicId: string): Promise<OAuthGrantRecord | null>;
+    findById(userId: number, grantId: string): Promise<OAuthGrantRecord | null>;
+    /** Create or re-consent. Replaces the scope set; never unions it. */
+    approve(userId: number, input: ApproveGrantInput): Promise<OAuthGrantRecord>;
+    /** Record the rotation. The old key stops being the grant's current one. */
+    setRefreshKey(userId: number, grantId: string, refreshKey: string | null): Promise<void>;
+    /** Soft revocation, with the reason that will be read back months later. */
+    end(userId: number, grantId: string, reason: string): Promise<OAuthGrantRecord | null>;
+}
+export interface GrantServiceOptions {
+    propertyStore: PropertyStore;
+    /** Injectable clock, so a test can pin `created_at`. */
+    now?: () => Date;
+}
+/** Is this grant live? One predicate, so the guard and the screen agree. */
+export declare function isGrantActive(grant: OAuthGrantRecord): boolean;
+export declare function createGrantService(options: GrantServiceOptions): GrantService;
+//# sourceMappingURL=grant-service.d.ts.map

package/dist/grant-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-service.d.ts","sourceRoot":"","sources":["../src/grant-service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;;OAQG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9C,wEAAwE;IACxE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,8EAA8E;IAC9E,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClD,uDAAuD;IACvD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5E,qEAAqE;IACrE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7E,4EAA4E;IAC5E,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,4EAA4E;IAC5E,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,aAAa,CAAC;IAC7B,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAoH7E"}

package/dist/grant-service.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_GRANTS_INFO_SCHEMA = exports.OAUTH_GRANTS_PROPERTY = void 0;
+exports.isGrantActive = isGrantActive;
+exports.createGrantService = createGrantService;
+const node_crypto_1 = require("node:crypto");
+const property_array_js_1 = require("./property-array.js");
+/**
+ * `oauth-grants` — the record of what a person approved, for which client.
+ *
+ * ## The grant is the scope authority, and the token carries no copy
+ *
+ * The spec says a minted token "inherits" the code's approved scopes, and
+ * separately that the resource server reads scopes from `oauth-grants`. If both
+ * were true there would be two answers and they would eventually disagree. The
+ * plan settles it: the code's `scopes` are written **into the grant** at
+ * redemption, and the guard reads the grant on every request. A token minted
+ * under a wider set is bound by the grant's current, narrower one on its very
+ * next call — no revocation, no new mechanism, and a test says so.
+ *
+ * RFC 8707 `resource` is the exception and stays on the token: an audience is a
+ * property of a credential, not of a relationship, which is exactly why a
+ * cautious client can ask for a narrow token against an unchanged grant.
+ *
+ * ## Re-consent replaces, it does not union
+ *
+ * The screen showed the user a list and they approved that list. A union would
+ * grant scopes the screen never showed, which is the one thing a consent screen
+ * must never do. Replacement also gives a downgrade path, which a union has no
+ * way to express.
+ *
+ * ## Nothing in here is a credential
+ *
+ * Only `credentials` is on cap-users' sensitive-property list, so this property
+ * is readable by default. Client ids, scopes and timestamps belong here. Token
+ * values, raw codes and PKCE verifiers do not, and stay in identity rows as
+ * hashes. `refresh_key` is the one field that looks like an exception and is
+ * not: it is the *stored* identity key, which is already a SHA-256 digest, and
+ * it is the same value `user_identities.key` holds. The credentials-at-rest
+ * test asserts against the raw values, and this passes it.
+ */
+/** The property name. One place, because two spellings is one bug. */
+exports.OAUTH_GRANTS_PROPERTY = 'oauth-grants';
+/** Tags the blob's shape, the way cap-users tags its own property schemas. */
+exports.OAUTH_GRANTS_INFO_SCHEMA = 'boop.oauth-server.grants.v1';
+/** Is this grant live? One predicate, so the guard and the screen agree. */
+function isGrantActive(grant) {
+    return grant.ended_at === null;
+}
+function createGrantService(options) {
+    const { propertyStore } = options;
+    const now = options.now ?? (() => new Date());
+    async function read(userId) {
+        const snapshot = await (0, property_array_js_1.readArray)(propertyStore, userId, exports.OAUTH_GRANTS_PROPERTY);
+        return { grants: snapshot.entries, revision: snapshot.revision };
+    }
+    async function write(userId, grants, revision) {
+        await (0, property_array_js_1.writeArray)(propertyStore, userId, exports.OAUTH_GRANTS_PROPERTY, grants, { revision }, {
+            infoSchema: exports.OAUTH_GRANTS_INFO_SCHEMA,
+        });
+    }
+    return {
+        read,
+        write,
+        async list(userId) {
+            return (await read(userId)).grants;
+        },
+        async findActive(userId, clientPublicId) {
+            const { grants } = await read(userId);
+            return (grants.find((g) => g.client_public_id === clientPublicId && isGrantActive(g)) ?? null);
+        },
+        async findById(userId, grantId) {
+            const { grants } = await read(userId);
+            return grants.find((g) => g.grant_id === grantId) ?? null;
+        },
+        async approve(userId, input) {
+            const { grants, revision } = await read(userId);
+            const timestamp = now().toISOString();
+            const index = grants.findIndex((g) => g.client_public_id === input.clientPublicId && isGrantActive(g));
+            // Re-consent REPLACES the scope set. See the header: a union would grant
+            // scopes the screen the user just read never showed them.
+            const grant = index >= 0
+                ? {
+                    ...grants[index],
+                    client_id: input.clientId,
+                    scopes: [...input.scopes],
+                    resource: input.resource ?? null,
+                    updated_at: timestamp,
+                }
+                : {
+                    grant_id: (0, node_crypto_1.randomUUID)(),
+                    client_id: input.clientId,
+                    client_public_id: input.clientPublicId,
+                    scopes: [...input.scopes],
+                    resource: input.resource ?? null,
+                    refresh_key: null,
+                    created_at: timestamp,
+                    updated_at: timestamp,
+                    ended_at: null,
+                    ended_reason: null,
+                };
+            const next = index >= 0 ? grants.map((g, i) => (i === index ? grant : g)) : [...grants, grant];
+            await write(userId, next, revision);
+            return grant;
+        },
+        async setRefreshKey(userId, grantId, refreshKey) {
+            const { grants, revision } = await read(userId);
+            const timestamp = now().toISOString();
+            const next = grants.map((g) => g.grant_id === grantId ? { ...g, refresh_key: refreshKey, updated_at: timestamp } : g);
+            await write(userId, next, revision);
+        },
+        async end(userId, grantId, reason) {
+            const { grants, revision } = await read(userId);
+            const target = grants.find((g) => g.grant_id === grantId);
+            if (!target)
+                return null;
+            // Already ended? Keep the first reason and the first timestamp: the
+            // interesting fact is why it ended, and a second revoke overwriting
+            // "refresh_reuse" with "user_revoked" would erase the theft signal.
+            if (!isGrantActive(target))
+                return target;
+            const timestamp = now().toISOString();
+            const ended = {
+                ...target,
+                // A revoked grant's refresh token is gone, and leaving the key here
+                // would make a later reuse read as a rotation rather than as reuse.
+                refresh_key: null,
+                ended_at: timestamp,
+                ended_reason: reason,
+                updated_at: timestamp,
+            };
+            await write(userId, grants.map((g) => (g.grant_id === grantId ? ended : g)), revision);
+            return ended;
+        },
+    };
+}
+//# sourceMappingURL=grant-service.js.map

package/dist/grant-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-service.js","sourceRoot":"","sources":["../src/grant-service.ts"],"names":[],"mappings":";;;AA+GA,sCAEC;AAED,gDAoHC;AAvOD,6CAAyC;AAEzC,2DAA4D;AAG5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,sEAAsE;AACzD,QAAA,qBAAqB,GAAG,cAAc,CAAC;AAEpD,8EAA8E;AACjE,QAAA,wBAAwB,GAAG,6BAA6B,CAAC;AAkEtE,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,KAAuB;IACnD,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;AACjC,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE9C,KAAK,UAAU,IAAI,CAAC,MAAc;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAA,6BAAS,EAC9B,aAAa,EACb,MAAM,EACN,6BAAqB,CACtB,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,MAAc,EACd,MAA0B,EAC1B,QAA4B;QAE5B,MAAM,IAAA,8BAAU,EAAC,aAAa,EAAE,MAAM,EAAE,6BAAqB,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE;YACnF,UAAU,EAAE,gCAAwB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK;QAEL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc;YACrC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,cAAc,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CACtF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO;YAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK;YACzB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAEtC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,KAAK,CAAC,cAAc,IAAI,aAAa,CAAC,CAAC,CAAC,CACvE,CAAC;YAEF,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,KAAK,GACT,KAAK,IAAI,CAAC;gBACR,CAAC,CAAC;oBACE,GAAG,MAAM,CAAC,KAAK,CAAC;oBAChB,SAAS,EAAE,KAAK,CAAC,QAAQ;oBACzB,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;oBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;oBAChC,UAAU,EAAE,SAAS;iBACtB;gBACH,CAAC,CAAC;oBACE,QAAQ,EAAE,IAAA,wBAAU,GAAE;oBACtB,SAAS,EAAE,KAAK,CAAC,QAAQ;oBACzB,gBAAgB,EAAE,KAAK,CAAC,cAAc;oBACtC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;oBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;oBAChC,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,IAAI;iBACnB,CAAC;YAER,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;YAC/F,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU;YAC7C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CACtF,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM;YAC/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,oEAAoE;YACpE,oEAAoE;YACpE,oEAAoE;YACpE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YAE1C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,KAAK,GAAqB;gBAC9B,GAAG,MAAM;gBACT,oEAAoE;gBACpE,oEAAoE;gBACpE,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,SAAS;gBACnB,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,SAAS;aACtB,CAAC;YACF,MAAM,KAAK,CACT,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACvD,QAAQ,CACT,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}