@browserlessapi/inferlo 0.7.0 → 0.8.0

package/dist/jwt.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Access tokens (JWTs) from an OpenID Connect provider as the app's auth: Auth0, Okta, Microsoft Entra ID, Google,
+ * Keycloak, Clerk, WorkOS, Cognito, Supabase and any other issuer that publishes its signing keys (JWKS).
+ *
+ *   createApp({
+ *     auth: jwt({
+ *       issuer: "https://acme.eu.auth0.com/",
+ *       audience: "https://api.acme.com",
+ *       user: (claims) => ({ id: claims.sub, email: claims.email, roles: claims.permissions ?? [] }),
+ *     }),
+ *   });
+ *
+ * Requests send "Authorization: Bearer <token>". The signature is checked with Web Crypto against the issuer's
+ * keys (found through its OpenID configuration, or jwksUrl), then the issuer, audience, expiry and not-before
+ * times. Tokens that fail any check sign nobody in (401). No runtime dependencies; runs on every runtime.
+ */
+import type { AuthConfig } from "./app.ts";
+import type { AppDb, AppUser } from "./route.ts";
+/** The claims of a verified token. Providers add their own (email, roles, permissions, org_id, scope, ...). */
+export interface JwtClaims {
+    /** The user (subject) the token was issued for. */
+    sub: string;
+    iss: string;
+    aud: string | string[];
+    exp: number;
+    iat?: number;
+    nbf?: number;
+    [claim: string]: unknown;
+}
+export type JwtAlgorithm = "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "Ed25519" | "HS256" | "HS384" | "HS512";
+export interface JwtOptions {
+    /** The issuer (the iss claim) exactly as the provider writes it, such as "https://acme.eu.auth0.com/". */
+    issuer: string;
+    /** The audience (aud claim) this API accepts: its identifier at the provider. A list accepts any of them. */
+    audience: string | string[];
+    /**
+     * Where the issuer's signing keys are (a JSON Web Key Set). Default: the jwks_uri of the issuer's OpenID
+     * configuration (<issuer>/.well-known/openid-configuration). Must be https, except on localhost.
+     */
+    jwksUrl?: string;
+    /** For providers that sign with a shared secret (HS256), at least 32 characters, instead of keys. */
+    secret?: string;
+    /** Algorithms to accept. Default: every asymmetric algorithm (RS, PS, ES, EdDSA), or HS256 with secret. */
+    algorithms?: JwtAlgorithm[];
+    /** The app's user for a verified token, or null to refuse it. Default: { id: sub, email, name, roles }. */
+    user?: (claims: JwtClaims, ctx: {
+        db: AppDb;
+        req: Request;
+    }) => AppUser | null | undefined | Promise<AppUser | null | undefined>;
+    /** Allowed clock difference with the issuer, in seconds, for exp, nbf and iat. Default 60, at most 300. */
+    clockToleranceSeconds?: number;
+    /** How long fetched keys are kept, in milliseconds. Default 10 minutes, from 1 minute to 1 day. */
+    cacheMs?: number;
+    /** Roles of a user, checked when a route uses auth: "<role>". Default: user.roles ?? []. */
+    roles?: (user: AppUser) => string[];
+    /** The tenant of a user, for tenant-scoped models. Default: user.tenantId. */
+    tenant?: (user: AppUser) => string | null | undefined;
+}
+export declare const ASYMMETRIC: JwtAlgorithm[];
+export declare function isLocal(url: URL): boolean;
+/**
+ * The app's auth from access tokens (JWTs) of an OpenID Connect provider: createApp({ auth: jwt({ issuer,
+ * audience }) }). Requests send Authorization: Bearer <token>.
+ */
+export declare function jwt(options: JwtOptions): AuthConfig;
+/** What createJwtVerifier needs: the checked options of jwt(), or of oidc() for ID tokens. */
+export interface JwtVerifierConfig {
+    issuer: string;
+    audiences: string[];
+    secret?: string;
+    allowed: JwtAlgorithm[];
+    tolerance: number;
+    cacheMs: number;
+    jwksUrl?: string;
+    /** Finds the key set's URL another way (oidc() shares its OpenID configuration). Default: the issuer's discovery. */
+    discoverJwksUrl?: () => Promise<string>;
+}
+/**
+ * Verifies JWTs for an issuer and audience: the signature against the issuer's keys (cached, fetched again for a
+ * rotated key) or a shared secret, then iss, aud, exp, nbf, iat and sub. Resolves to the claims, or null for any
+ * token that is not valid. Throws 503 IL3008 when no keys could ever be loaded. Internal: used by jwt() and oidc().
+ */
+export declare function createJwtVerifier(config: JwtVerifierConfig): (token: string) => Promise<JwtClaims | null>;

package/dist/jwt.js

@@ -0,0 +1,312 @@
+import { InferloError } from "./errors.js";
+export const ASYMMETRIC = ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA", "Ed25519"];
+const HMAC = ["HS256", "HS384", "HS512"];
+const OPTIONS = ["issuer", "audience", "jwksUrl", "secret", "algorithms", "user", "clockToleranceSeconds", "cacheMs", "roles", "tenant"];
+const MAX_TOKEN = 16 * 1024;
+const FETCH_TIMEOUT = 5000;
+/** A token with an unknown key id fetches the keys again, but not more often than this. */
+const REFETCH_COOLDOWN = 30_000;
+const fix = 'Use jwt({ issuer: "https://login.example.com/", audience: "https://api.example.com" }), with the issuer and audience your identity provider shows for this API.';
+function invalid(message, fixText = fix) {
+    return new InferloError("IL6042", message, { fix: fixText });
+}
+export function isLocal(url) {
+    return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+}
+function checkUrl(value, what) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw invalid(`jwt() ${what} must be a URL, got ${JSON.stringify(value)}.`);
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocal(url))) {
+        throw invalid(`jwt() ${what} must use https (plain http only on localhost), got ${JSON.stringify(value)}.`);
+    }
+    return url;
+}
+function base64urlBytes(text) {
+    if (!/^[A-Za-z0-9_-]*$/.test(text))
+        throw new Error("not base64url");
+    const base64 = text.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((text.length + 3) % 4);
+    return Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+}
+function decodeJson(text) {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(base64urlBytes(text)));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("not an object");
+    return value;
+}
+const HASH = { "256": "SHA-256", "384": "SHA-384", "512": "SHA-512" };
+/** Web Crypto import and verify parameters for an algorithm, or null when the key does not fit it. */
+function cryptoParams(alg, jwk) {
+    const bits = alg.slice(2);
+    if (alg.startsWith("RS")) {
+        if (jwk && jwk.kty !== "RSA")
+            return null;
+        return { importAlg: { name: "RSASSA-PKCS1-v1_5", hash: HASH[bits] }, verifyAlg: { name: "RSASSA-PKCS1-v1_5" } };
+    }
+    if (alg.startsWith("PS")) {
+        if (jwk && jwk.kty !== "RSA")
+            return null;
+        return { importAlg: { name: "RSA-PSS", hash: HASH[bits] }, verifyAlg: { name: "RSA-PSS", saltLength: Number(bits) / 8 } };
+    }
+    if (alg.startsWith("ES")) {
+        const curve = { ES256: "P-256", ES384: "P-384", ES512: "P-521" }[alg];
+        if (jwk && (jwk.kty !== "EC" || jwk.crv !== curve))
+            return null;
+        return { importAlg: { name: "ECDSA", namedCurve: curve }, verifyAlg: { name: "ECDSA", hash: HASH[bits] } };
+    }
+    if (alg === "EdDSA" || alg === "Ed25519") {
+        if (jwk && (jwk.kty !== "OKP" || jwk.crv !== "Ed25519"))
+            return null;
+        return { importAlg: { name: "Ed25519" }, verifyAlg: { name: "Ed25519" } };
+    }
+    return null;
+}
+/** Only the public parts of a key, so Web Crypto does not reject it over use, key_ops or alg fields. */
+function publicJwk(jwk) {
+    if (jwk.kty === "RSA")
+        return { kty: "RSA", n: jwk.n, e: jwk.e, ext: true };
+    if (jwk.kty === "EC")
+        return { kty: "EC", crv: jwk.crv, x: jwk.x, y: jwk.y, ext: true };
+    return { kty: "OKP", crv: jwk.crv, x: jwk.x, ext: true };
+}
+function defaultUser(claims) {
+    const roles = Array.isArray(claims.roles) ? claims.roles.filter((r) => typeof r === "string") : [];
+    const user = { id: claims.sub, roles };
+    if (typeof claims.email === "string")
+        user.email = claims.email;
+    if (typeof claims.name === "string")
+        user.name = claims.name;
+    // Apps that register their own user type (Register) map the claims with options.user.
+    return user;
+}
+/**
+ * The app's auth from access tokens (JWTs) of an OpenID Connect provider: createApp({ auth: jwt({ issuer,
+ * audience }) }). Requests send Authorization: Bearer <token>.
+ */
+export function jwt(options) {
+    if (!options || typeof options !== "object" || Array.isArray(options))
+        throw invalid("jwt() needs { issuer, audience }.");
+    for (const key of Object.keys(options))
+        if (!OPTIONS.includes(key))
+            throw invalid(`jwt() has no option "${key}".`, `Use ${OPTIONS.join(", ")}.`);
+    if (typeof options.issuer !== "string" || !options.issuer)
+        throw invalid("jwt() needs the issuer: the iss claim of the provider's tokens.");
+    const audiences = typeof options.audience === "string" ? [options.audience] : Array.isArray(options.audience) ? options.audience : [];
+    if (!audiences.length || audiences.some((a) => typeof a !== "string" || !a)) {
+        throw invalid("jwt() needs the audience: this API's identifier at the provider (the aud claim of its tokens), so tokens issued for other apps are refused.");
+    }
+    for (const key of ["user", "roles", "tenant"]) {
+        if (options[key] !== undefined && typeof options[key] !== "function")
+            throw invalid(`jwt() ${key} must be a function.`);
+    }
+    const secret = options.secret;
+    if (secret !== undefined) {
+        if (typeof secret !== "string" || secret.length < 32)
+            throw invalid("jwt() secret must be a string of at least 32 characters.", "Keep the provider's signing secret in config({ secrets }) and pass it as secret.");
+        if (options.jwksUrl !== undefined)
+            throw invalid("jwt() takes a secret or a jwksUrl, not both.");
+    }
+    const allowed = options.algorithms ?? (secret === undefined ? ASYMMETRIC : ["HS256"]);
+    if (!Array.isArray(allowed) || !allowed.length || allowed.some((a) => ![...ASYMMETRIC, ...HMAC].includes(a))) {
+        throw invalid(`jwt() algorithms must be a list of ${[...ASYMMETRIC, ...HMAC].join(", ")}.`);
+    }
+    if (secret === undefined && allowed.some((a) => HMAC.includes(a)))
+        throw invalid("jwt() algorithms HS256, HS384 and HS512 need a secret.");
+    if (secret !== undefined && allowed.some((a) => !HMAC.includes(a)))
+        throw invalid("jwt() with a secret accepts only HS256, HS384 or HS512.");
+    const tolerance = options.clockToleranceSeconds ?? 60;
+    if (!Number.isInteger(tolerance) || tolerance < 0 || tolerance > 300)
+        throw invalid("jwt() clockToleranceSeconds must be a whole number from 0 to 300.");
+    const cacheMs = options.cacheMs ?? 600_000;
+    if (!Number.isInteger(cacheMs) || cacheMs < 60_000 || cacheMs > 86_400_000)
+        throw invalid("jwt() cacheMs must be a whole number of milliseconds from 60000 (1 minute) to 86400000 (1 day).");
+    const issuer = options.issuer;
+    const jwksUrl = options.jwksUrl === undefined ? undefined : checkUrl(options.jwksUrl, "jwksUrl").href;
+    if (secret === undefined && jwksUrl === undefined)
+        checkUrl(issuer, "issuer");
+    const toUser = options.user ?? defaultUser;
+    const verify = createJwtVerifier({ issuer, audiences, secret, allowed, tolerance, cacheMs, jwksUrl });
+    return {
+        async resolve(req, { db }) {
+            const authorization = req.headers.get("authorization");
+            if (!authorization || !/^bearer\s+/i.test(authorization))
+                return null;
+            const claims = await verify(authorization.replace(/^bearer\s+/i, "").trim());
+            if (!claims)
+                return null;
+            return (await toUser(claims, { db, req })) ?? null;
+        },
+        ...(options.roles ? { roles: options.roles } : {}),
+        ...(options.tenant ? { tenant: options.tenant } : {}),
+    };
+}
+/**
+ * Verifies JWTs for an issuer and audience: the signature against the issuer's keys (cached, fetched again for a
+ * rotated key) or a shared secret, then iss, aud, exp, nbf, iat and sub. Resolves to the claims, or null for any
+ * token that is not valid. Throws 503 IL3008 when no keys could ever be loaded. Internal: used by jwt() and oidc().
+ */
+export function createJwtVerifier(config) {
+    const { issuer, audiences, secret, allowed, tolerance, cacheMs, jwksUrl } = config;
+    // Signing keys: fetched on first use, kept for cacheMs, and fetched again (at most every 30 s) for an unknown key id.
+    let keys;
+    let fetchedAt = 0;
+    let loading;
+    const imported = new Map();
+    const hmacKeys = new Map();
+    const getJson = async (url) => {
+        const response = await fetch(url, { headers: { accept: "application/json" }, redirect: "error", signal: AbortSignal.timeout(FETCH_TIMEOUT) });
+        if (!response.ok)
+            throw new Error(`${url} answered ${response.status}`);
+        const body = (await response.json());
+        if (!body || typeof body !== "object" || Array.isArray(body))
+            throw new Error(`${url} did not answer a JSON object`);
+        return body;
+    };
+    const load = async () => {
+        let url = jwksUrl;
+        if (!url && config.discoverJwksUrl)
+            url = await config.discoverJwksUrl();
+        if (!url) {
+            const discovery = await getJson(`${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`);
+            if (discovery.issuer !== issuer)
+                throw new Error(`the OpenID configuration names the issuer ${JSON.stringify(discovery.issuer)}, not ${JSON.stringify(issuer)}`);
+            if (typeof discovery.jwks_uri !== "string")
+                throw new Error("the OpenID configuration has no jwks_uri");
+            url = checkUrl(discovery.jwks_uri, "jwks_uri").href;
+        }
+        const set = await getJson(url);
+        if (!Array.isArray(set.keys))
+            throw new Error(`${url} is not a JSON Web Key Set`);
+        return set.keys.filter((k) => Boolean(k) && typeof k === "object" && k.use !== "enc");
+    };
+    const refresh = () => {
+        loading ??= load()
+            .then((found) => {
+            keys = found;
+            fetchedAt = Date.now();
+            imported.clear();
+            return found;
+        })
+            .finally(() => {
+            loading = undefined;
+        });
+        return loading;
+    };
+    const unavailable = (cause) => new InferloError("IL3008", "The identity provider's signing keys could not be loaded, so the token cannot be checked.", {
+        status: 503,
+        fix: `Check that ${jwksUrl ?? `${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`} is reachable from the server and answers the provider's keys (${cause instanceof Error ? cause.message : String(cause)}).`,
+    });
+    const candidates = async (kid, alg) => {
+        const match = (list) => list.filter((k) => (kid === undefined || k.kid === kid) && (k.alg === undefined || k.alg === alg) && cryptoParams(alg, k) !== null);
+        const stale = !keys || Date.now() - fetchedAt > cacheMs;
+        if (stale) {
+            try {
+                await refresh();
+            }
+            catch (error) {
+                // Keep using the keys we have while the provider cannot be reached; without any, nothing can be checked.
+                if (!keys)
+                    throw unavailable(error);
+                fetchedAt = Date.now() - cacheMs + REFETCH_COOLDOWN;
+            }
+        }
+        let found = match(keys);
+        if (!found.length && kid !== undefined && Date.now() - fetchedAt > REFETCH_COOLDOWN) {
+            // A key the provider started using since the last fetch (key rotation).
+            try {
+                found = match(await refresh());
+            }
+            catch {
+                found = [];
+            }
+        }
+        return found.slice(0, 10);
+    };
+    const keyFor = (jwk, alg) => {
+        const id = `${alg}\u0000${jwk.kid ?? ""}\u0000${jwk.n ?? ""}${jwk.x ?? ""}${jwk.y ?? ""}`;
+        let key = imported.get(id);
+        if (!key) {
+            key = crypto.subtle.importKey("jwk", publicJwk(jwk), cryptoParams(alg).importAlg, false, ["verify"]);
+            key.catch(() => imported.delete(id));
+            imported.set(id, key);
+        }
+        return key;
+    };
+    const hmacKey = (alg) => {
+        let key = hmacKeys.get(alg);
+        if (!key) {
+            key = crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: HASH[alg.slice(2)] }, false, ["verify"]);
+            hmacKeys.set(alg, key);
+        }
+        return key;
+    };
+    /** The verified claims of a token, or null for any token that is not valid for this API. */
+    const verify = async (token) => {
+        if (token.length > MAX_TOKEN)
+            return null;
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const [headerPart, payloadPart, signaturePart] = parts;
+        let header;
+        let claims;
+        let signature;
+        try {
+            header = decodeJson(headerPart);
+            claims = decodeJson(payloadPart);
+            signature = base64urlBytes(signaturePart);
+        }
+        catch {
+            return null;
+        }
+        const alg = header.alg;
+        if (typeof alg !== "string" || !allowed.includes(alg))
+            return null;
+        // Extensions this verifier does not understand must not be ignored (RFC 7515, section 4.1.11).
+        if (header.crit !== undefined)
+            return null;
+        if (header.kid !== undefined && typeof header.kid !== "string")
+            return null;
+        const data = new TextEncoder().encode(`${headerPart}.${payloadPart}`);
+        let valid = false;
+        if (secret !== undefined) {
+            valid = await crypto.subtle.verify("HMAC", await hmacKey(alg), signature, data);
+        }
+        else {
+            for (const jwk of await candidates(header.kid, alg)) {
+                try {
+                    if (await crypto.subtle.verify(cryptoParams(alg).verifyAlg, await keyFor(jwk, alg), signature, data)) {
+                        valid = true;
+                        break;
+                    }
+                }
+                catch {
+                    // A key Web Crypto cannot use (a malformed key in the set) does not verify anything.
+                }
+            }
+        }
+        if (!valid)
+            return null;
+        const now = Date.now() / 1000;
+        if (claims.iss !== issuer)
+            return null;
+        const aud = typeof claims.aud === "string" ? [claims.aud] : Array.isArray(claims.aud) ? claims.aud : [];
+        if (!aud.some((a) => audiences.includes(a)))
+            return null;
+        if (typeof claims.exp !== "number" || claims.exp + tolerance <= now)
+            return null;
+        if (claims.nbf !== undefined && (typeof claims.nbf !== "number" || claims.nbf - tolerance > now))
+            return null;
+        if (claims.iat !== undefined && (typeof claims.iat !== "number" || claims.iat - tolerance > now))
+            return null;
+        if (typeof claims.sub !== "string" || !claims.sub)
+            return null;
+        return claims;
+    };
+    return verify;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA2C3C,MAAM,CAAC,MAAM,UAAU,GAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAChJ,MAAM,IAAI,GAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AACzI,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,GAAG,GAAG,iKAAiK,CAAC;AAc9K,SAAS,OAAO,CAAC,OAAe,EAAE,OAAO,GAAG,GAAG;IAC7C,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAQ;IAC9B,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,CAAC,SAAS,IAAI,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,OAAO,CAAC,SAAS,IAAI,uDAAuD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/F,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAY,CAAC;IAC5G,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IAClG,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAE9F,sGAAsG;AACtG,SAAS,YAAY,CAAC,GAAiB,EAAE,GAAS;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAE,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAE,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7H,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAc,CAAC,CAAC;QACjF,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAE,EAAE,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,GAAQ;IACzB,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5E,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACxF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChH,MAAM,IAAI,GAA4B,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;IAChE,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAChE,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7D,sFAAsF;IACtF,OAAO,IAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,OAAmB;IACrC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAC1H,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,IAAI,EAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjJ,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,iEAAiE,CAAC,CAAC;IAC5I,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtI,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,OAAO,CAAC,6IAA6I,CAAC,CAAC;IAC/J,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAU,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU;YAAE,MAAM,OAAO,CAAC,SAAS,GAAG,sBAAsB,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,OAAO,CAAC,0DAA0D,EAAE,kFAAkF,CAAC,CAAC;QACpN,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC,8CAA8C,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,MAAM,OAAO,CAAC,sCAAsC,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,OAAO,CAAC,wDAAwD,CAAC,CAAC;IAC3I,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,OAAO,CAAC,yDAAyD,CAAC,CAAC;IAC7I,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,GAAG;QAAE,MAAM,OAAO,CAAC,mEAAmE,CAAC,CAAC;IACzJ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,MAAM,IAAI,OAAO,GAAG,UAAU;QAAE,MAAM,OAAO,CAAC,iGAAiG,CAAC,CAAC;IAC7L,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;IACtG,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAE3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtG,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;YACvB,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACvD,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QACrD,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACnF,sHAAsH;IACtH,IAAI,IAAuB,CAAC;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAmC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEvD,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAoC,EAAE;QACtE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC9I,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;QAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,+BAA+B,CAAC,CAAC;QACrH,OAAO,IAA+B,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,IAAoB,EAAE;QACtC,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,eAAe;YAAE,GAAG,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QACzE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAC;YAClG,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjK,IAAI,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACxG,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,4BAA4B,CAAC,CAAC;QAClF,OAAQ,GAAG,CAAC,IAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAS,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;IAC1H,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAmB,EAAE;QACnC,OAAO,KAAK,IAAI,EAAE;aACf,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,GAAG,KAAK,CAAC;YACb,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACL,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,EAAE,CACrC,IAAI,YAAY,CAAC,QAAQ,EAAE,2FAA2F,EAAE;QACtH,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,cAAc,OAAO,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,kEAAkE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;KAC3N,CAAC,CAAC;IAEL,MAAM,UAAU,GAAG,KAAK,EAAE,GAAuB,EAAE,GAAiB,EAAkB,EAAE;QACtF,MAAM,KAAK,GAAG,CAAC,IAAW,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACnK,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yGAAyG;gBACzG,IAAI,CAAC,IAAI;oBAAE,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;gBACpC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,gBAAgB,CAAC;YACtD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC,IAAK,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,gBAAgB,EAAE,CAAC;YACpF,wEAAwE;YACxE,IAAI,CAAC;gBACH,KAAK,GAAG,KAAK,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAQ,EAAE,GAAiB,EAAsB,EAAE;QACjE,MAAM,EAAE,GAAG,GAAG,GAAG,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1F,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,GAAG,CAAE,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAiB,EAAsB,EAAE;QACxD,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvI,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,4FAA4F;IAC5F,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAA6B,EAAE;QAChE,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;QACnF,IAAI,MAA+B,CAAC;QACpC,IAAI,MAA+B,CAAC;QACpC,IAAI,SAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YACjC,SAAS,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAmB,CAAC;QACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,+FAA+F;QAC/F,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,WAAW,EAAE,CAAC,CAAC;QAEtE,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,GAAG,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,GAAyB,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC;oBACH,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAE,CAAC,SAAS,EAAE,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;wBACtG,KAAK,GAAG,IAAI,CAAC;wBACb,MAAM;oBACR,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,qFAAqF;gBACvF,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC9B,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAW,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACjF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9G,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9G,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,MAAmB,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/model.js

@@ -14,7 +14,7 @@
  *   export const Ticket = model("tickets", { title: t.string() }, { tenant: true })
  */
 import { InferloError } from "./errors.js";
-import { ObjectSchema, Schema, t } from "./schema.js";
+import { ObjectSchema, Schema, containsFile, t } from "./schema.js";
 const TABLE_NAME = /^[a-z][a-z0-9_]{0,62}$/;
 const FIELD_NAME = /^[a-zA-Z][a-zA-Z0-9]{0,62}$/;
 const RESERVED = new Set(["id", "createdAt", "updatedAt"]);
@@ -65,6 +65,11 @@ export class Model {
                     fix: `Remove "${key}" from the model. Every model already has id, createdAt and updatedAt.`,
                 });
             }
+            if (containsFile(fields[key])) {
+                throw new InferloError("IL1004", `Field "${name}.${key}" uses t.file(), which only works in route bodies.`, {
+                    fix: "Accept the upload in a route body (body: t.object({ file: t.file() })), store the file elsewhere, and keep its key or URL in a t.string() field of the model.",
+                });
+            }
             if (!FIELD_NAME.test(key)) {
                 throw new InferloError("IL4005", `Field "${name}.${key}" is not a valid field name.`, {
                     fix: "Use camelCase letters and digits, e.g. ownerId. Inferlo stores it as owner_id.",

package/dist/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAA8E,MAAM,aAAa,CAAC;AAElI,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,UAAU,GAAG,6BAA6B,CAAC;AACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3D,SAAS,MAAM,CAAC,MAAwB,EAAE,IAAmB;IAC3D,OAAO,IAAI,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAkBD,yCAAyC;AACzC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAIjC,MAAM,OAAO,KAAK;IAChB,+DAA+D;IACtD,IAAI,CAAI;IACjB,0BAA0B;IACjB,MAAM,CAAI;IACnB,oGAAoG;IAC3F,GAAG,CAAsE;IAClF,oFAAoF;IAC3E,MAAM,CAAI;IACnB,qFAAqF;IAC5E,MAAM,CAAkB;IACjC,sDAAsD;IAC7C,MAAM,CAAgC;IAM/C,YAAY,IAAO,EAAE,MAAS,EAAE,UAAwB,EAAE;QACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,eAAe,IAAI,8BAA8B,EAAE;gBAClF,GAAG,EAAE,8GAA8G;aACpH,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,yBAAyB,IAAI,sBAAsB,EAAE,EAAE,GAAG,EAAE,eAAe,IAAI,gEAAgE,EAAE,CAAC,CAAC;QACtL,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,mBAAmB,GAAG,eAAe,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,6CAA6C,EAAE,CAAC,CAAC;YAC1I,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,+BAA+B,IAAI,0BAA0B,EAAE,EAAE,GAAG,EAAE,cAAc,IAAI,sCAAsC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,MAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,IAAI,mEAAmE,EAAE;oBAClH,GAAG,EAAE,sHAAsH;iBAC5H,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,IAAI,cAAc,GAAG,sCAAsC,EAAE;oBACtG,GAAG,EAAE,WAAW,GAAG,wEAAwE;iBAC5F,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,GAAG,8BAA8B,EAAE;oBACpF,GAAG,EAAE,gFAAgF;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAW,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,qGAAqG;QACrG,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM;YACnB,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC,EAAE,UAAU,CAAC,EAAE;YACjJ,CAAC,CAAC,MAAM,CAAM,CAAC;QACjB,MAAM,WAAW,GAAgB;YAC/B,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC;YAC1B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC;YACxC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC;SACzC,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC,MAAM,EAAqB,CAAU,CAAC;IACtF,CAAC;IAED,+FAA+F;IAC/F,IAAI,CAA6B,GAAG,IAAS;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,qEAAqE;IACrE,IAAI,CAA6B,GAAG,IAAS;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AAaD,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,MAAa,EAAE,OAAsB;IACvE,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAa,CAAC;AACtD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAA8E,MAAM,aAAa,CAAC;AAEhJ,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,UAAU,GAAG,6BAA6B,CAAC;AACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3D,SAAS,MAAM,CAAC,MAAwB,EAAE,IAAmB;IAC3D,OAAO,IAAI,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAkBD,yCAAyC;AACzC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAIjC,MAAM,OAAO,KAAK;IAChB,+DAA+D;IACtD,IAAI,CAAI;IACjB,0BAA0B;IACjB,MAAM,CAAI;IACnB,oGAAoG;IAC3F,GAAG,CAAsE;IAClF,oFAAoF;IAC3E,MAAM,CAAI;IACnB,qFAAqF;IAC5E,MAAM,CAAkB;IACjC,sDAAsD;IAC7C,MAAM,CAAgC;IAM/C,YAAY,IAAO,EAAE,MAAS,EAAE,UAAwB,EAAE;QACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,eAAe,IAAI,8BAA8B,EAAE;gBAClF,GAAG,EAAE,8GAA8G;aACpH,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,yBAAyB,IAAI,sBAAsB,EAAE,EAAE,GAAG,EAAE,eAAe,IAAI,gEAAgE,EAAE,CAAC,CAAC;QACtL,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,mBAAmB,GAAG,eAAe,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,6CAA6C,EAAE,CAAC,CAAC;YAC1I,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,+BAA+B,IAAI,0BAA0B,EAAE,EAAE,GAAG,EAAE,cAAc,IAAI,sCAAsC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,MAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,IAAI,mEAAmE,EAAE;oBAClH,GAAG,EAAE,sHAAsH;iBAC5H,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,IAAI,cAAc,GAAG,sCAAsC,EAAE;oBACtG,GAAG,EAAE,WAAW,GAAG,wEAAwE;iBAC5F,CAAC,CAAC;YACL,CAAC;YACD,IAAI,YAAY,CAAC,MAAM,CAAC,GAAG,CAAE,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,GAAG,oDAAoD,EAAE;oBAC1G,GAAG,EAAE,+JAA+J;iBACrK,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,GAAG,8BAA8B,EAAE;oBACpF,GAAG,EAAE,gFAAgF;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAW,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,qGAAqG;QACrG,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM;YACnB,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC,EAAE,UAAU,CAAC,EAAE;YACjJ,CAAC,CAAC,MAAM,CAAM,CAAC;QACjB,MAAM,WAAW,GAAgB;YAC/B,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC;YAC1B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC;YACxC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC;SACzC,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC,MAAM,EAAqB,CAAU,CAAC;IACtF,CAAC;IAED,+FAA+F;IAC/F,IAAI,CAA6B,GAAG,IAAS;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,qEAAqE;IACrE,IAAI,CAA6B,GAAG,IAAS;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AAaD,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,MAAa,EAAE,OAAsB;IACvE,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAa,CAAC;AACtD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,70 @@
+import { type JwtClaims } from "./jwt.ts";
+import { type AppDb, type RouteDef } from "./route.ts";
+import type { Sessions } from "./sessions.ts";
+/** The claims of a verified ID token. Providers add their own (email, email_verified, name, groups, tid, hd, ...). */
+export interface OidcClaims extends JwtClaims {
+    nonce?: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+}
+/** The provider's answer to the code exchange. */
+export interface OidcTokens {
+    idToken: string;
+    /** For calling the provider's APIs (userinfo, Microsoft Graph, ...); never stored by Inferlo. */
+    accessToken?: string;
+    refreshToken?: string;
+    /** Seconds until the access token expires, as the provider says. */
+    expiresIn?: number;
+    scope?: string;
+}
+export interface OidcOptions {
+    /** The provider's issuer exactly as its OpenID configuration names it, such as "https://acme.okta.com". https, except on localhost. */
+    issuer: string;
+    /** The app's client id at the provider. */
+    clientId: string;
+    /** The app's client secret (keep it in config({ secrets })). Leave it out for a public client, which PKCE protects. */
+    clientSecret?: string;
+    /** The sessions() the sign-in ends in; also the app's auth: createApp({ auth: session }). */
+    session: Sessions;
+    /**
+     * The id of the app's user for a verified ID token (find or create the user), or null to refuse the sign-in
+     * (403 IL3011). Check claims.email_verified before trusting claims.email.
+     */
+    userId: (claims: OidcClaims, ctx: {
+        db: AppDb;
+        req: Request;
+        tokens: OidcTokens;
+    }) => string | null | undefined | Promise<string | null | undefined>;
+    /** Where the provider sends the browser back, registered at the provider. Default: <the request's origin><basePath>/callback. */
+    redirectUri?: string;
+    /** Scopes to ask for. Default ["openid", "email", "profile"]; "openid" is always sent. */
+    scopes?: string[];
+    /** Where the login, callback and logout routes are. Default "/auth": GET /auth/login, GET /auth/callback and POST /auth/logout. */
+    basePath?: string;
+    /**
+     * Extra parameters for every sign-in at the provider, such as { prompt: "select_account" }, Google's
+     * { hd: "acme.com" } or Entra ID's { domain_hint: "acme.com" }. The flow's own parameters cannot be changed.
+     */
+    authorizationParams?: Record<string, string>;
+    /** Where the provider sends the browser after signing out, registered at the provider. Default: <the request's origin>/. */
+    postLogoutRedirectUri?: string;
+}
+/** routes: [sso] adds the two routes; oidcLogin starts a sign-in, oidcCallback finishes it. */
+export type Oidc = {
+    /** GET <basePath>/login?returnTo=/path: sends the browser to the provider. */
+    oidcLogin: RouteDef;
+    /** GET <basePath>/callback: the redirect URI registered at the provider. */
+    oidcCallback: RouteDef;
+    /** POST <basePath>/logout (with the session's _csrf field): ends the session, then signs out at the provider. */
+    oidcLogout: RouteDef;
+    /** The login route's path, for links: <a href={sso.loginPath}>. */
+    loginPath: string;
+    /** The logout route's path, for a form: <form method="post" action={sso.logoutPath}>. */
+    logoutPath: string;
+};
+/**
+ * OpenID Connect sign-in for browser apps: routes: [sso] with sso = oidc({ issuer, clientId, clientSecret,
+ * session, userId }). The sign-in ends in the session's cookie.
+ */
+export declare function oidc(options: OidcOptions): Oidc;