@corgelabs/corge 0.0.1 → 1.0.1

package/dist/auth/routes.d.ts

@@ -0,0 +1,226 @@
+import type { Context } from 'hono';
+import type { z } from 'zod';
+import { type AppEnv, type DbRole } from '../config';
+import type { EntryId } from '../db';
+import type { StepRunner } from '../tasks';
+import { blockUserBody, completeAccountRecoveryBody, customTokenBody, emailSignInBody, emailSignUpBody, forgotPasswordBody, initiateAccountRecoveryBody, resetPasswordBody, sessionBody, setRecoveryEmailBody, signOutBody, socialSignInInput, verifyEmailBody, verifyRecoveryEmailBody, type AuthUser, type EraseUserInput } from './schema';
+export declare const coreAuthRoutes: {
+    'auth.custom-token': {
+        input: z.ZodDefault<z.ZodObject<{
+            uid: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        handler: ({ input, userId, role }: {
+            input: z.infer<typeof customTokenBody>;
+            userId: EntryId;
+            role: DbRole;
+        }) => Promise<{
+            uid: string;
+            customToken: string;
+        }>;
+    };
+    'auth.session.create': {
+        input: z.ZodObject<{
+            idToken: z.ZodString;
+        }, z.core.$strip>;
+        handler: ({ c, input }: {
+            c: Context<AppEnv>;
+            input: z.infer<typeof sessionBody>;
+        }) => Promise<AuthUser>;
+    };
+    'auth.session.get': {
+        handler: ({ userId }: {
+            userId: EntryId;
+        }) => Promise<{
+            userId: string;
+        }>;
+    };
+    'auth.sign-up.email': {
+        input: z.ZodObject<{
+            email: z.ZodString;
+            password: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        handler: ({ c, input }: {
+            c: Context<AppEnv>;
+            input: z.infer<typeof emailSignUpBody>;
+        }) => Promise<AuthUser>;
+    };
+    'auth.sign-in.email': {
+        input: z.ZodObject<{
+            email: z.ZodString;
+            password: z.ZodString;
+        }, z.core.$strip>;
+        handler: ({ c, input }: {
+            c: Context<AppEnv>;
+            input: z.infer<typeof emailSignInBody>;
+        }) => Promise<AuthUser>;
+    };
+    'auth.sign-in.social': {
+        input: z.ZodObject<{
+            provider: z.ZodEnum<{
+                apple: "apple";
+                google: "google";
+            }>;
+            idToken: z.ZodString;
+            nonce: z.ZodOptional<z.ZodString>;
+            accessToken: z.ZodOptional<z.ZodString>;
+            profile: z.ZodOptional<z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                avatarUrl: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        handler: ({ c, input }: {
+            c: Context<AppEnv>;
+            input: z.infer<typeof socialSignInInput>;
+        }) => Promise<AuthUser>;
+    };
+    'auth.email.send-verification': {
+        input: z.ZodDefault<z.ZodObject<{}, z.core.$strip>>;
+        handler: ({ userId }: {
+            userId: EntryId;
+        }) => Promise<{
+            sent: true;
+            expiresInMinutes: number;
+        }>;
+    };
+    'auth.email.verify': {
+        input: z.ZodObject<{
+            email: z.ZodString;
+            codeOrToken: z.ZodString;
+        }, z.core.$strip>;
+        handler: ({ input }: {
+            input: z.infer<typeof verifyEmailBody>;
+        }) => Promise<{
+            verified: true;
+            userId: string;
+        }>;
+    };
+    'auth.password.forgot': {
+        input: z.ZodObject<{
+            email: z.ZodString;
+        }, z.core.$strip>;
+        handler: ({ input }: {
+            input: z.infer<typeof forgotPasswordBody>;
+        }) => Promise<{
+            sent: true;
+        }>;
+    };
+    'auth.password.reset': {
+        input: z.ZodObject<{
+            email: z.ZodString;
+            codeOrToken: z.ZodString;
+            newPassword: z.ZodString;
+        }, z.core.$strip>;
+        handler: ({ input }: {
+            input: z.infer<typeof resetPasswordBody>;
+        }) => Promise<{
+            reset: true;
+        }>;
+    };
+    'auth.recovery-email.set': {
+        input: z.ZodObject<{
+            recoveryEmail: z.ZodString;
+        }, z.core.$strip>;
+        handler: ({ userId, input }: {
+            userId: EntryId;
+            input: z.infer<typeof setRecoveryEmailBody>;
+        }) => Promise<{
+            recoveryEmail: string;
+            recoveryEmailVerified: false;
+            sent: true;
+        }>;
+    };
+    'auth.recovery-email.verify': {
+        input: z.ZodObject<{
+            codeOrToken: z.ZodString;
+        }, z.core.$strip>;
+        handler: ({ userId, input }: {
+            userId: EntryId;
+            input: z.infer<typeof verifyRecoveryEmailBody>;
+        }) => Promise<{
+            recoveryEmail: string;
+            recoveryEmailVerified: true;
+            verified: true;
+        }>;
+    };
+    'auth.account-recovery.initiate': {
+        input: z.ZodObject<{
+            primaryEmail: z.ZodString;
+            recoveryEmail: z.ZodString;
+        }, z.core.$strip>;
+        handler: ({ input }: {
+            input: z.infer<typeof initiateAccountRecoveryBody>;
+        }) => Promise<{
+            initiated: true;
+        }>;
+    };
+    'auth.account-recovery.complete': {
+        input: z.ZodObject<{
+            primaryEmail: z.ZodString;
+            recoveryEmail: z.ZodString;
+            codeOrToken: z.ZodString;
+            newPrimaryEmail: z.ZodString;
+            newPassword: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        handler: ({ c, input }: {
+            c: Context<AppEnv>;
+            input: z.infer<typeof completeAccountRecoveryBody>;
+        }) => Promise<AuthUser>;
+    };
+    'auth.users.list': {
+        handler: () => Promise<AuthUser[]>;
+    };
+    'auth.users.block': {
+        input: z.ZodDefault<z.ZodObject<{
+            userId: z.ZodOptional<z.ZodString>;
+            blocked: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        handler: ({ userId, input }: {
+            userId: EntryId;
+            input: z.infer<typeof blockUserBody>;
+        }) => Promise<{
+            userId: EntryId;
+            blocked: boolean;
+            deleted: boolean;
+        }>;
+    };
+    'auth.users.delete': {
+        mode: 'workflow';
+        workflowName: string;
+        input: z.ZodObject<{
+            userId: z.ZodString;
+            backupBeforeErase: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>;
+        output: z.ZodObject<{
+            userId: z.ZodString;
+            backupOperation: z.ZodOptional<z.ZodString>;
+            erasedFiles: z.ZodNumber;
+            erasedChats: z.ZodNumber;
+            erasedCollections: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+            erasedUser: z.ZodBoolean;
+        }, z.core.$strip>;
+        handler: ({ input, step }: {
+            input: EraseUserInput;
+            step: StepRunner;
+        }) => Promise<{
+            userId: string;
+            backupOperation?: string | undefined;
+            erasedFiles: number;
+            erasedChats: number;
+            erasedCollections?: Record<string, number> | undefined;
+            erasedUser: boolean;
+        }>;
+    };
+    'auth.sign-out': {
+        input: z.ZodDefault<z.ZodObject<{
+            deleteUser: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        handler: ({ c, input }: {
+            c: Context<AppEnv>;
+            input: z.infer<typeof signOutBody>;
+        }) => Promise<{
+            ok: boolean;
+        }>;
+    };
+};
+//# sourceMappingURL=routes.d.ts.map

package/dist/auth/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,EAAe,KAAK,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAEpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EACL,aAAa,EACb,2BAA2B,EAC3B,eAAe,EACf,eAAe,EACf,eAAe,EAGf,kBAAkB,EAClB,2BAA2B,EAC3B,iBAAiB,EAEjB,WAAW,EACX,oBAAoB,EACpB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,KAAK,QAAQ,EACb,KAAK,cAAc,EACpB,MAAM,UAAU,CAAA;AAWjB,eAAO,MAAM,cAAc;IACzB,mBAAmB;QACjB,KAAK;;;QACL,OAAO,4BAIJ;YACD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;YACtC,MAAM,EAAE,OAAO,CAAA;YACf,IAAI,EAAE,MAAM,CAAA;SACb;;;;;IAOH,qBAAqB;QACnB,KAAK;;;QACL,OAAO,iBAAuB;YAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;SAAE;;IAK1F,kBAAkB;QAChB,OAAO,eAAqB;YAAE,MAAM,EAAE,OAAO,CAAA;SAAE;;;;IAEjD,oBAAoB;QAClB,KAAK;;;;;QACL,OAAO,iBAAuB;YAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;SAAE;;IAG9F,oBAAoB;QAClB,KAAK;;;;QACL,OAAO,iBAAuB;YAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;SAAE;;IAG9F,qBAAqB;QACnB,KAAK;;;;;;;;;;;;;QACL,OAAO,iBAAuB;YAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;SAAE;;IAGhG,8BAA8B;QAC5B,KAAK;QACL,OAAO,eAAqB;YAAE,MAAM,EAAE,OAAO,CAAA;SAAE;;;;;IAEjD,mBAAmB;QACjB,KAAK;;;;QACL,OAAO,cAAoB;YAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;SAAE;;;;;IAEvE,sBAAsB;QACpB,KAAK;;;QACL,OAAO,cAAoB;YAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;SAAE;;;;IAE1E,qBAAqB;QACnB,KAAK;;;;;QACL,OAAO,cAAoB;YAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;SAAE;;;;IAEzE,yBAAyB;QACvB,KAAK;;;QACL,OAAO,sBAA4B;YAAE,MAAM,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;SAAE;;;;;;IAGrG,4BAA4B;QAC1B,KAAK;;;QACL,OAAO,sBAA4B;YAAE,MAAM,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;SAAE;;;;;;IAGxG,gCAAgC;QAC9B,KAAK;;;;QACL,OAAO,cAAoB;YAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;SAAE;;;;IAGnF,gCAAgC;QAC9B,KAAK;;;;;;;QACL,OAAO,iBAAuB;YAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;SAAE;;IAG1G,iBAAiB;QACf,OAAO;;IAET,kBAAkB;QAChB,KAAK;;;;QACL,OAAO,sBAA4B;YAAE,MAAM,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;SAAE;;;;;;IAG9F,mBAAmB;QACjB,IAAI,EAAE,UAAU;QAChB,YAAY;QACZ,KAAK;;;;QACL,MAAM;;;;;;;;QACN,OAAO,oBAA0B;YAAE,KAAK,EAAE,cAAc,CAAC;YAAC,IAAI,EAAE,UAAU,CAAA;SAAE;;;;;;;;;IAE9E,eAAe;QACb,KAAK;;;QACL,OAAO,iBAAuB;YAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;SAAE;;;;CAO3F,CAAA"}

package/dist/auth/routes.js

@@ -0,0 +1,96 @@
+import { deleteCookie, getCookie } from 'hono/cookie';
+import { CORE_CONFIG } from '../config';
+import { core } from '../index';
+import { blockUserBody, completeAccountRecoveryBody, customTokenBody, emailSignInBody, emailSignUpBody, eraseUserInput, eraseUserOutput, forgotPasswordBody, initiateAccountRecoveryBody, resetPasswordBody, sendVerificationEmailBody, sessionBody, setRecoveryEmailBody, signOutBody, socialSignInInput, verifyEmailBody, verifyRecoveryEmailBody } from './schema';
+const respondWithSession = async (c, p) => {
+    const { user, sessionCookie } = await p;
+    core.internals.auth.setSessionCookie(c, sessionCookie);
+    return user;
+};
+export const coreAuthRoutes = {
+    'auth.custom-token': {
+        input: customTokenBody,
+        handler: async ({ input, userId, role }) => {
+            if (input.uid && role !== 'admin' && userId !== CORE_CONFIG.auth.adminUserId) {
+                return core.errors.httpError(403, 'Admin privileges required to mint token for specific UID', 'FORBIDDEN');
+            }
+            return core.internals.auth.mintCustomToken(input.uid);
+        }
+    },
+    'auth.session.create': {
+        input: sessionBody,
+        handler: async ({ c, input }) => respondWithSession(c, core.internals.auth.createSession(input.idToken)).catch(() => core.errors.httpError(401, 'Invalid ID token', 'INVALID_ID_TOKEN'))
+    },
+    'auth.session.get': {
+        handler: async ({ userId }) => ({ userId })
+    },
+    'auth.sign-up.email': {
+        input: emailSignUpBody,
+        handler: async ({ c, input }) => respondWithSession(c, core.internals.auth.signUpEmail(input.email, input.password, input.name))
+    },
+    'auth.sign-in.email': {
+        input: emailSignInBody,
+        handler: async ({ c, input }) => respondWithSession(c, core.internals.auth.signInEmail(input.email, input.password))
+    },
+    'auth.sign-in.social': {
+        input: socialSignInInput,
+        handler: async ({ c, input }) => respondWithSession(c, core.auth.signInSocial(input))
+    },
+    'auth.email.send-verification': {
+        input: sendVerificationEmailBody,
+        handler: async ({ userId }) => core.auth.sendVerificationEmail(userId)
+    },
+    'auth.email.verify': {
+        input: verifyEmailBody,
+        handler: async ({ input }) => core.auth.verifyEmail(input)
+    },
+    'auth.password.forgot': {
+        input: forgotPasswordBody,
+        handler: async ({ input }) => core.auth.forgotPassword(input)
+    },
+    'auth.password.reset': {
+        input: resetPasswordBody,
+        handler: async ({ input }) => core.auth.resetPassword(input)
+    },
+    'auth.recovery-email.set': {
+        input: setRecoveryEmailBody,
+        handler: async ({ userId, input }) => core.auth.setRecoveryEmail(input, userId)
+    },
+    'auth.recovery-email.verify': {
+        input: verifyRecoveryEmailBody,
+        handler: async ({ userId, input }) => core.auth.verifyRecoveryEmail(input, userId)
+    },
+    'auth.account-recovery.initiate': {
+        input: initiateAccountRecoveryBody,
+        handler: async ({ input }) => core.auth.initiateAccountRecovery(input)
+    },
+    'auth.account-recovery.complete': {
+        input: completeAccountRecoveryBody,
+        handler: async ({ c, input }) => respondWithSession(c, core.auth.completeAccountRecovery(input))
+    },
+    'auth.users.list': {
+        handler: async () => core.auth.listUsers()
+    },
+    'auth.users.block': {
+        input: blockUserBody,
+        handler: async ({ userId, input }) => core.auth.blockUser(input.userId ?? userId, input.blocked)
+    },
+    'auth.users.delete': {
+        mode: 'workflow',
+        workflowName: 'erase-user',
+        input: eraseUserInput,
+        output: eraseUserOutput,
+        handler: async ({ input, step }) => core.auth.eraseUser(input, step)
+    },
+    'auth.sign-out': {
+        input: signOutBody,
+        handler: async ({ c, input }) => {
+            const cookie = getCookie(c, CORE_CONFIG.auth.sessionCookie);
+            if (cookie)
+                await core.internals.auth.revokeSession(cookie, Boolean(input.deleteUser)).catch(() => { });
+            deleteCookie(c, CORE_CONFIG.auth.sessionCookie, { path: '/' });
+            return { ok: true };
+        }
+    }
+};
+//# sourceMappingURL=routes.js.map

package/dist/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAGrD,OAAO,EAAE,WAAW,EAA4B,MAAM,WAAW,CAAA;AAEjE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EACL,aAAa,EACb,2BAA2B,EAC3B,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,oBAAoB,EACpB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EAGxB,MAAM,UAAU,CAAA;AAEjB,MAAM,kBAAkB,GAAG,KAAK,EAC9B,CAAkB,EAClB,CAAqD,EAClC,EAAE;IACrB,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,CAAA;IACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;IACtD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,mBAAmB,EAAE;QACnB,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,MAAM,EACN,IAAI,EAKL,EAAE,EAAE;YACH,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,IAAI,MAAM,KAAK,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,0DAA0D,EAAE,WAAW,CAAC,CAAA;YAC5G,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvD,CAAC;KACF;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAA8D,EAAE,EAAE,CAC1F,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CACjF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CACnE;KACJ;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAuB,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KACjE;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAkE,EAAE,EAAE,CAC9F,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;KAClG;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAkE,EAAE,EAAE,CAC9F,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;KACtF;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAoE,EAAE,EAAE,CAChG,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;KACvD;IACD,8BAA8B,EAAE;QAC9B,KAAK,EAAE,yBAAyB;QAChC,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;KAC5F;IACD,mBAAmB,EAAE;QACnB,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAA8C,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;KACvG;IACD,sBAAsB,EAAE;QACtB,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAiD,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;KAC7G;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAgD,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;KAC3G;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAoE,EAAE,EAAE,CACrG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC;KAC5C;IACD,4BAA4B,EAAE;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAuE,EAAE,EAAE,CACxG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;KAC/C;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,2BAA2B;QAClC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAA0D,EAAE,EAAE,CACnF,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;KAC3C;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,2BAA2B;QAClC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAA8E,EAAE,EAAE,CAC1G,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;KAClE;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;KAC3C;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAA6D,EAAE,EAAE,CAC9F,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;KAC7D;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,UAAmB;QACzB,YAAY,EAAE,YAAY;QAC1B,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAA+C,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;KAClH;IACD,eAAe,EAAE;QACf,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAA8D,EAAE,EAAE;YAC1F,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YAC3D,IAAI,MAAM;gBAAE,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACtG,YAAY,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;KACF;CACF,CAAA"}

package/dist/auth/schema.d.ts

@@ -0,0 +1,158 @@
+import { z } from 'zod';
+import { type AuthEmailPurpose, type AuthTokenPurpose, type DbRole, type TransactionalEmailPayload } from '../config';
+import { type BaseEntryFields, type EntryId } from '../db';
+export { type AuthEmailPurpose, type AuthTokenPurpose, type TransactionalEmailPayload };
+export declare const SESSION_COOKIE: string;
+export declare const SESSION_EXPIRES_IN: number;
+export declare const ADMIN_USER_ID: EntryId;
+export type OAuthProvider = 'google' | 'apple';
+export interface LinkedProvider {
+    provider: OAuthProvider;
+    providerUserId: string;
+    email?: string | null;
+    linkedAt: Date;
+}
+export interface CachedTokenEntry {
+    uid: EntryId;
+    role: DbRole;
+    exp: number;
+    cachedAt: number;
+    strictVerified: boolean;
+    emailVerified?: boolean;
+}
+export interface UserAuthMetaRecord {
+    email?: string | null;
+    emailVerified?: boolean;
+    name?: string | null;
+    avatarUrl?: string | null;
+    recoveryEmail?: string | null;
+    recoveryEmailVerified?: boolean;
+    linkedProviders?: LinkedProvider[];
+    providerKeys?: string[];
+    createdAt?: Date;
+    updatedAt?: Date;
+}
+export interface VerifiedOidcClaims {
+    sub: string;
+    email: string | null;
+    emailVerified: boolean;
+    name?: string;
+    picture?: string;
+}
+export interface AuthUser {
+    id: EntryId;
+    email: string | null;
+    emailVerified: boolean;
+    name: string | null;
+    avatarUrl?: string | null;
+    /** Secondary recovery email (stored normalized/lowercase) */
+    recoveryEmail?: string | null;
+    /** True only after the user verifies ownership of `recoveryEmail` via OTP */
+    recoveryEmailVerified?: boolean;
+    linkedProviders?: LinkedProvider[];
+    customClaims?: Record<string, unknown>;
+    deleted: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface AuthTokenDoc extends BaseEntryFields {
+    userId: EntryId;
+    purpose: AuthTokenPurpose;
+    /** Target email address (primary email or recovery email) */
+    targetEmail: string;
+    /** SHA-256 hex digest of the 6-digit OTP code or 32-byte URL token */
+    tokenHash: string;
+    urlTokenHash?: string;
+    /** Max 5 failed verification attempts before automatic invalidation */
+    attempts: number;
+    expiresAt: Date;
+    consumedAt?: Date | null;
+}
+export declare const eraseUserInput: z.ZodObject<{
+    userId: z.ZodString;
+    backupBeforeErase: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const eraseUserOutput: z.ZodObject<{
+    userId: z.ZodString;
+    backupOperation: z.ZodOptional<z.ZodString>;
+    erasedFiles: z.ZodNumber;
+    erasedChats: z.ZodNumber;
+    erasedCollections: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    erasedUser: z.ZodBoolean;
+}, z.core.$strip>;
+export type EraseUserInput = z.input<typeof eraseUserInput>;
+export type EraseUserOutput = z.infer<typeof eraseUserOutput>;
+export declare const customTokenBody: z.ZodDefault<z.ZodObject<{
+    uid: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+export declare const sessionBody: z.ZodObject<{
+    idToken: z.ZodString;
+}, z.core.$strip>;
+export declare const emailSignUpBody: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const emailSignInBody: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>;
+export declare const socialSignInInput: z.ZodObject<{
+    provider: z.ZodEnum<{
+        apple: "apple";
+        google: "google";
+    }>;
+    idToken: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodOptional<z.ZodString>;
+    profile: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        avatarUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SocialSignInInput = z.infer<typeof socialSignInInput>;
+export declare const sendVerificationEmailBody: z.ZodDefault<z.ZodObject<{}, z.core.$strip>>;
+export declare const verifyEmailBody: z.ZodObject<{
+    email: z.ZodString;
+    codeOrToken: z.ZodString;
+}, z.core.$strip>;
+export type VerifyEmailInput = z.infer<typeof verifyEmailBody>;
+export declare const forgotPasswordBody: z.ZodObject<{
+    email: z.ZodString;
+}, z.core.$strip>;
+export type ForgotPasswordInput = z.infer<typeof forgotPasswordBody>;
+export declare const resetPasswordBody: z.ZodObject<{
+    email: z.ZodString;
+    codeOrToken: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strip>;
+export type ResetPasswordInput = z.infer<typeof resetPasswordBody>;
+export declare const setRecoveryEmailBody: z.ZodObject<{
+    recoveryEmail: z.ZodString;
+}, z.core.$strip>;
+export type SetRecoveryEmailInput = z.infer<typeof setRecoveryEmailBody>;
+export declare const verifyRecoveryEmailBody: z.ZodObject<{
+    codeOrToken: z.ZodString;
+}, z.core.$strip>;
+export type VerifyRecoveryEmailInput = z.infer<typeof verifyRecoveryEmailBody>;
+export declare const initiateAccountRecoveryBody: z.ZodObject<{
+    primaryEmail: z.ZodString;
+    recoveryEmail: z.ZodString;
+}, z.core.$strip>;
+export type InitiateAccountRecoveryInput = z.infer<typeof initiateAccountRecoveryBody>;
+export declare const completeAccountRecoveryBody: z.ZodObject<{
+    primaryEmail: z.ZodString;
+    recoveryEmail: z.ZodString;
+    codeOrToken: z.ZodString;
+    newPrimaryEmail: z.ZodString;
+    newPassword: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type CompleteAccountRecoveryInput = z.infer<typeof completeAccountRecoveryBody>;
+export declare const blockUserBody: z.ZodDefault<z.ZodObject<{
+    userId: z.ZodOptional<z.ZodString>;
+    blocked: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>>;
+export declare const signOutBody: z.ZodDefault<z.ZodObject<{
+    deleteUser: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/auth/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/auth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,MAAM,EACX,KAAK,yBAAyB,EAC/B,MAAM,WAAW,CAAA;AAClB,OAAO,EAAW,KAAK,eAAe,EAAE,KAAK,OAAO,EAAE,MAAM,OAAO,CAAA;AAEnE,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,KAAK,yBAAyB,EAAE,CAAA;AAEvF,eAAO,MAAM,cAAc,QAAiC,CAAA;AAC5D,eAAO,MAAM,kBAAkB,QAAsC,CAAA;AACrE,eAAO,MAAM,aAAa,EAAE,OAAsC,CAAA;AAElE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAA;AAE9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,aAAa,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,IAAI,CAAA;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,OAAO,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,eAAe,CAAC,EAAE,cAAc,EAAE,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,EAAE,OAAO,CAAA;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,6EAA6E;IAC7E,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,eAAe,CAAC,EAAE,cAAc,EAAE,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,YAAa,SAAQ,eAAe;IACnD,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,EAAE,gBAAgB,CAAA;IACzB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAA;IACnB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,IAAI,CAAA;IACf,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CACzB;AAED,eAAO,MAAM,cAAc;;;iBAGzB,CAAA;AACF,eAAO,MAAM,eAAe;;;;;;;iBAO1B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAE7D,eAAO,MAAM,eAAe;;kBAEd,CAAA;AACd,eAAO,MAAM,WAAW;;iBAA2C,CAAA;AACnE,eAAO,MAAM,eAAe;;;;iBAI1B,CAAA;AACF,eAAO,MAAM,eAAe;;;iBAAgF,CAAA;AAE5G,eAAO,MAAM,iBAAiB;;;;;;;;;;;;iBAkB5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAEjE,eAAO,MAAM,yBAAyB,8CAA2B,CAAA;AACjE,eAAO,MAAM,eAAe;;;iBAG1B,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAE9D,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAEpE,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAElE,eAAO,MAAM,oBAAoB;;iBAE/B,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAExE,eAAO,MAAM,uBAAuB;;iBAElC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE9E,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAEtF,eAAO,MAAM,2BAA2B;;;;;;iBAMtC,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAEtF,eAAO,MAAM,aAAa;;;kBAEG,CAAA;AAC7B,eAAO,MAAM,WAAW;;kBAA+D,CAAA"}

package/dist/auth/schema.js

@@ -0,0 +1,82 @@
+import { z } from 'zod';
+import { CORE_CONFIG } from '../config';
+import { entryId } from '../db';
+export const SESSION_COOKIE = CORE_CONFIG.auth.sessionCookie;
+export const SESSION_EXPIRES_IN = CORE_CONFIG.auth.sessionExpiresInMs;
+export const ADMIN_USER_ID = CORE_CONFIG.auth.adminUserId;
+export const eraseUserInput = z.object({
+    userId: entryId,
+    backupBeforeErase: z.boolean().default(false)
+});
+export const eraseUserOutput = z.object({
+    userId: entryId,
+    backupOperation: z.string().optional(),
+    erasedFiles: z.number(),
+    erasedChats: z.number(),
+    erasedCollections: z.record(z.string(), z.number()).optional(),
+    erasedUser: z.boolean()
+});
+export const customTokenBody = z
+    .object({ uid: entryId.refine((id) => id !== CORE_CONFIG.auth.adminUserId, 'Reserved UID').optional() })
+    .default({});
+export const sessionBody = z.object({ idToken: z.string().min(1) });
+export const emailSignUpBody = z.object({
+    email: z.string().email(),
+    password: z.string().min(8).max(128),
+    name: z.string().min(1).max(120).optional()
+});
+export const emailSignInBody = z.object({ email: z.string().email(), password: z.string().min(1).max(128) });
+export const socialSignInInput = z.object({
+    provider: z.enum(['google', 'apple']),
+    /** OIDC ID token returned by Apple Sign-In (iOS/Capacitor/Web) or Google Sign-In */
+    idToken: z.string().min(20),
+    /** Optional raw nonce for Apple Sign-In replay protection */
+    nonce: z.string().optional(),
+    /** Optional access token (Google) */
+    accessToken: z.string().optional(),
+    /**
+     * Apple iOS/Capacitor quirk: Apple ONLY sends the user's `name` on the VERY FIRST authorization.
+     * Accept optional first-time profile data from the client and persist it immediately.
+     */
+    profile: z
+        .object({
+        name: z.string().min(1).max(128).optional(),
+        avatarUrl: z.string().url().optional()
+    })
+        .optional()
+});
+export const sendVerificationEmailBody = z.object({}).default({});
+export const verifyEmailBody = z.object({
+    email: z.string().email(),
+    codeOrToken: z.string().min(4).max(512)
+});
+export const forgotPasswordBody = z.object({
+    email: z.string().email()
+});
+export const resetPasswordBody = z.object({
+    email: z.string().email(),
+    codeOrToken: z.string().min(4).max(512),
+    newPassword: z.string().min(8).max(128)
+});
+export const setRecoveryEmailBody = z.object({
+    recoveryEmail: z.string().email()
+});
+export const verifyRecoveryEmailBody = z.object({
+    codeOrToken: z.string().min(4).max(512)
+});
+export const initiateAccountRecoveryBody = z.object({
+    primaryEmail: z.string().email(),
+    recoveryEmail: z.string().email()
+});
+export const completeAccountRecoveryBody = z.object({
+    primaryEmail: z.string().email(),
+    recoveryEmail: z.string().email(),
+    codeOrToken: z.string().min(4).max(512),
+    newPrimaryEmail: z.string().email(),
+    newPassword: z.string().min(8).max(128).optional()
+});
+export const blockUserBody = z
+    .object({ userId: entryId.optional(), blocked: z.boolean().default(true) })
+    .default({ blocked: true });
+export const signOutBody = z.object({ deleteUser: z.boolean().optional() }).default({});
+//# sourceMappingURL=schema.js.map

package/dist/auth/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/auth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,WAAW,EAKZ,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,OAAO,EAAsC,MAAM,OAAO,CAAA;AAInE,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,CAAA;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAA;AACrE,MAAM,CAAC,MAAM,aAAa,GAAY,WAAW,CAAC,IAAI,CAAC,WAAW,CAAA;AAwElE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,OAAO;IACf,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,OAAO;IACf,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;KACvG,OAAO,CAAC,EAAE,CAAC,CAAA;AACd,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAE5G,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,oFAAoF;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3B,6DAA6D;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,qCAAqC;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;OAGG;IACH,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACvC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAClC,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAClC,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;KAC1E,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AAC7B,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA"}