@downcity/city 0.2.205 → 0.2.213

package/bin/client/city.js

@@ -1,126 +1,82 @@
 /**
- * City 客户端统一访问入口。
+ * City 终端用户客户端。
  *
- * City 面向开发者表达“我以某种角色进入 Federation”，内部再委托给
- * admin / user 协议访问层（`pact/`），让用户在第一层概念上无需关心 client 拆分。
+ * City 只持有 Federation 地址与可选 user_token。city_id 由 Federation 在服务端
+ * 验签后从 token 中读取，客户端不能重复声明或覆盖。
  */
-import { AdminPactAccess } from "../pact/admin/index.js";
 import { UserPactAccess } from "../pact/user/index.js";
-/**
- * Downcity City 客户端。
- */
+import { defaultFetch, requestJSON } from "../pact/http.js";
+/** Downcity City 用户客户端。 */
 export class City {
-    /**
-     * 当前 City 客户端的访问角色。
-     */
-    role;
-    /**
-     * Admin 能力面。
-     *
-     * 仅 `role: "admin"` 时可用。
-     */
-    admin_access;
-    /**
-     * User 能力面。
-     *
-     * 仅 `role: "user"` 时可用。
-     */
     user_access;
+    user_token;
+    fetcher;
     constructor(options) {
         if (!options || typeof options !== "object") {
             throw new TypeError("City options are required");
         }
-        this.role = options.role;
-        if (options.role === "admin") {
-            this.admin_access = new AdminPactAccess({
-                base_url: options.federation_url,
-                city_id: options.city_id,
-                admin_secret_key: options.admin_secret_key,
-                fetch: options.fetch,
-            });
-            return;
-        }
         this.user_access = new UserPactAccess({
             base_url: options.federation_url,
-            city_id: options.city_id,
             user_token: options.user_token,
             fetch: options.fetch,
         });
+        this.user_token = options.user_token;
+        this.fetcher = options.fetch ?? defaultFetch();
     }
-    /**
-     * User 角色的 AI 调用入口。
-     */
+    /** 用户侧 AI 调用入口。 */
     get ai() {
-        return this.require_user().ai;
+        return this.user_access.ai;
     }
-    /**
-     * User 角色的支付入口。
-     */
+    /** 用户侧支付入口。 */
     get payment() {
-        return this.require_user().payment;
-    }
-    /**
-     * Admin 角色的余额服务入口。
-     */
-    get balance() {
-        return this.require_admin().balance;
-    }
-    /**
-     * Admin 角色的 City 管理入口。
-     */
-    get cities() {
-        return this.require_admin().cities;
-    }
-    /**
-     * Admin 角色的环境变量服务入口。
-     */
-    get env() {
-        return this.require_admin().env;
+        return this.user_access.payment;
     }
-    /**
-     * Token 管理入口。
-     *
-     * 不需要传 city_id，构造时传入的 city_id 会自动注入。
-     */
-    get tokens() {
-        const admin = this.require_admin();
-        return { apply: (input) => admin.applyToken(input) };
+    /** Federation 当前用户数据入口。 */
+    user() {
+        return this.user_access.user;
     }
-    /**
-     * 获取普通 service 调用器。
-     */
+    /** 获取普通 Service 调用器。 */
     service(name) {
-        return this.admin_access?.service(name) ?? this.require_user().service(name);
+        return this.user_access.service(name);
     }
-    /**
-     * 列出当前 Federation 暴露的 service。
-     */
+    /** 列出 Federation 暴露的 Service。 */
     listServices() {
-        return this.admin_access?.listServices() ?? this.require_user().listServices();
+        return this.user_access.listServices();
     }
-    /**
-     * 列出 Federation 模型目录。
-     */
-    listModels() {
-        return this.require_admin().listModels();
+    /** 发送 JSON GET 请求，并返回解析后的 JSON。 */
+    get(url) {
+        return this.request_json(url, { method: "GET" });
     }
-    /**
-     * 读取 Federation 聚合说明文档。
-     */
-    instruction() {
-        return this.require_admin().instruction();
+    /** 发送 JSON POST 请求，第二个参数会直接序列化为请求体。 */
+    post(url, body = {}) {
+        return this.request_json(url, {
+            method: "POST",
+            body: JSON.stringify(body),
+        });
     }
-    require_admin() {
-        if (!this.admin_access) {
-            throw new TypeError("City role admin is required for this operation");
-        }
-        return this.admin_access;
+    request_json(url, init) {
+        const headers = {
+            accept: "application/json",
+            "content-type": "application/json",
+        };
+        if (this.user_token)
+            headers.authorization = `Bearer ${this.user_token}`;
+        return requestJSON({
+            fetch: this.fetcher,
+            url: resolve_request_url(url, this.user_access.serverUrl),
+            init: { ...init, headers },
+        });
     }
-    require_user() {
-        if (!this.user_access) {
-            throw new TypeError("City role user is required for this operation");
-        }
-        return this.user_access;
+}
+function resolve_request_url(value, base_url) {
+    const input = String(value ?? "").trim();
+    if (!input)
+        throw new TypeError("url is required");
+    try {
+        return new URL(input, base_url).toString();
+    }
+    catch {
+        throw new TypeError("url must be a valid URL");
     }
 }
 //# sourceMappingURL=city.js.map

package/bin/client/city.js.map

@@ -1 +1 @@
-{"version":3,"file":"city.js","sourceRoot":"","sources":["../../src/client/city.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAMvD;;GAEG;AACH,MAAM,OAAO,IAAI;IACf;;OAEG;IACM,IAAI,CAAQ;IAErB;;;;OAIG;IACc,YAAY,CAAmB;IAEhD;;;;OAIG;IACc,WAAW,CAAkB;IAE9C,YAAY,OAAkC;QAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAa,CAAC;QAElC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,eAAe,CAAC;gBACtC,QAAQ,EAAE,OAAO,CAAC,cAAc;gBAChC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,cAAc,CAAC;YACpC,QAAQ,EAAE,OAAO,CAAC,cAAc;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,EAAE;QACJ,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,IAAI,MAAM;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,CAAC;IACjF,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"city.js","sourceRoot":"","sources":["../../src/client/city.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAwC,MAAM,iBAAiB,CAAC;AAElG,2BAA2B;AAC3B,MAAM,OAAO,IAAI;IACE,WAAW,CAAiB;IAC5B,UAAU,CAAU;IACpB,OAAO,CAAY;IAEpC,YAAY,OAAoB;QAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,cAAc,CAAC;YACpC,QAAQ,EAAE,OAAO,CAAC,cAAc;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;IACjD,CAAC;IAED,mBAAmB;IACnB,IAAI,EAAE;QACJ,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;IAC7B,CAAC;IAED,eAAe;IACf,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,2BAA2B;IAC3B,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,wBAAwB;IACxB,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,iCAAiC;IACjC,YAAY;QACV,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,mCAAmC;IACnC,GAAG,CAAc,GAAW;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAI,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAc,GAAW,EAAE,OAAgB,EAAE;QAC/C,OAAO,IAAI,CAAC,YAAY,CAAI,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAI,GAAW,EAAE,IAAqB;QACxD,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;QACzE,OAAO,WAAW,CAAI;YACpB,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,GAAG,EAAE,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YACzD,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,QAAgB;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/bin/client/types.d.ts

@@ -1,81 +1,21 @@
 /**
- * City 客户端构造类型模块。
+ * City 用户客户端构造类型模块。
  *
- * City 是访问 Federation 的统一客户端入口：开发者只需要声明访问角色，
- * SDK 会在内部选择 admin 或 user 能力面。底层 HTTP 协议实现位于 `pact/`。
+ * City 只表达终端用户访问 Federation。已登录身份和 city_id 均来自 user_token。
+ * City 也可以把同一个 user_token 携带到 Bureau 提供的可选独立服务。
  */
 import type { FetchLike } from "../pact/http.js";
-/**
- * City 访问角色。
- */
-export type CityRole = "admin" | "user";
-/**
- * City 客户端共享构造参数。
- */
-export interface CityBaseOptions {
-    /**
-     * Federation 的 HTTP 入口地址。
-     *
-     * 示例：`https://city.example.com`、`http://localhost:43127`
-     * 或本机 loopback HTTP：`http://127.0.0.1:15315`。
-     */
+/** City 用户客户端构造参数。 */
+export interface CityOptions {
+    /** Federation 的 HTTP 入口地址。 */
     federation_url: string;
     /**
-     * 自定义 fetch 实现。
-     *
-     * 主要用于测试、Worker 运行时适配，或在请求层注入日志与追踪。
-     */
-    fetch?: FetchLike;
-}
-/**
- * Admin 角色的 City 构造参数。
- */
-export interface AdminCityOptions extends CityBaseOptions {
-    /**
-     * 使用 admin 身份访问 Federation。
-     */
-    role: "admin";
-    /**
-     * 当前管理的 City ID。
+     * Federation 签发的终端用户 token。
      *
-     * token 签发等服务会自动使用该 ID，调用方无需再传 city_id。
-     */
-    city_id: string;
-    /**
-     * Federation 管理密钥。
-     *
-     * 未传入时会由 SDK 回退读取 `DOWNCITY_FEDERATION_ADMIN_SECRET_KEY`。
-     */
-    admin_secret_key?: string;
-}
-/**
- * User 角色的 City 构造参数。
- */
-export interface UserCityOptions extends CityBaseOptions {
-    /**
-     * 使用 user 身份访问 Federation。
-     */
-    role: "user";
-    /**
-     * 当前 user_token 绑定的 City ID。
-     *
-     * 普通 service action 调用会自动把该值注入为 `city_id`。
-     * AI 调用会优先使用 `user_token` 解析出的 City 身份。
-     */
-    city_id?: string;
-    /**
-     * 终端用户访问 token。
-     *
-     * 仅访问 public action（例如 accounts 本地登录）时可以暂不传。
+     * 访问 accounts 登录等公开 Action 时可以省略；受保护操作必须提供。
      */
     user_token?: string;
+    /** 自定义 fetch 实现。 */
+    fetch?: FetchLike;
 }
-/**
- * City 构造参数。
- */
-export type CityOptions = AdminCityOptions | UserCityOptions;
-/**
- * 按角色收窄后的 City 构造参数。
- */
-export type CityOptionsForRole<TRole extends CityRole> = TRole extends "admin" ? AdminCityOptions : UserCityOptions;
 //# sourceMappingURL=types.d.ts.map

package/bin/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/client/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAExC;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD;;OAEG;IACH,IAAI,EAAE,OAAO,CAAC;IAEd;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAE7D;;GAEG;AACH,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,QAAQ,IAAI,KAAK,SAAS,OAAO,GAC1E,gBAAgB,GAChB,eAAe,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/client/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,sBAAsB;AACtB,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,cAAc,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,oBAAoB;IACpB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB"}

package/bin/client/types.js

@@ -1,8 +1,8 @@
 /**
- * City 客户端构造类型模块。
+ * City 用户客户端构造类型模块。
  *
- * City 是访问 Federation 的统一客户端入口：开发者只需要声明访问角色，
- * SDK 会在内部选择 admin 或 user 能力面。底层 HTTP 协议实现位于 `pact/`。
+ * City 只表达终端用户访问 Federation。已登录身份和 city_id 均来自 user_token。
+ * City 也可以把同一个 user_token 携带到 Bureau 提供的可选独立服务。
  */
 export {};
 //# sourceMappingURL=types.js.map

package/bin/federation/auth/authenticator.d.ts

@@ -1,14 +1,16 @@
 /**
  * 统一鉴权模块。
  *
- * Authenticator 统一处理 admin（secret key）和 user（JWT token）两种鉴权方式。
+ * Authenticator 统一处理管理凭证（root secret 或 Bureau Token）和
+ * user_token（Ed25519 JWT）两类鉴权方式。
  * 所有鉴权失败统一抛出 httpError（ErrorWithStatus）。
- *
- * TokenSigner 实例通过 getSigner() 缓存，避免重复 new TokenSigner(key)。
  */
 import { type RouteAuth, type RouteIdentity } from "../../service/service.js";
 import type { EnvProvider } from "../runtime.js";
-import type { CreateUserTokenInput, UserTokenPayload, UserTokenIssueResult, RuntimeUser } from "./types.js";
+import { type UserTokenAuthority } from "./user-token-authority.js";
+import type { FederationKeyStore } from "./federation-key-store.js";
+import type { BureauTokenStore } from "./bureau-token-store.js";
+import type { CreateUserTokenInput, FederationDiscovery, FederationJwks, UserTokenPayload, UserTokenIssueResult, RuntimeUser } from "./types.js";
 import type { FederationTrustedIdentity } from "../types.js";
 /** 鉴权级别 */
 /** 鉴权结果 */
@@ -27,8 +29,9 @@ export interface AuthResult {
 export declare class Authenticator {
     private env;
     private store;
-    /** 缓存的 TokenSigner 实例 */
-    private tokenSigner?;
+    private readonly token_authority;
+    private readonly key_store;
+    private readonly bureau_token_store;
     constructor(env: EnvProvider, store: () => Promise<{
         city: {
             get(id: string): Promise<{
@@ -36,13 +39,7 @@ export declare class Authenticator {
                 status: string;
             } | undefined>;
         };
-    }>);
-    /**
-     * 获取（或创建）TokenSigner 单例。
-     *
-     * 首次调用时从 env 读取 DOWNCITY_FEDERATION_TOKEN_SIGNING_KEY 创建实例并缓存。
-     */
-    private getSigner;
+    }>, token_authority: UserTokenAuthority, key_store: FederationKeyStore, bureau_token_store: BureauTokenStore);
     /**
      * 解析请求身份。
      *
@@ -84,5 +81,9 @@ export declare class Authenticator {
      * @returns 解析出的 token 载荷
      */
     verifyToken(token: string): Promise<UserTokenPayload>;
+    /** 返回 Federation 当前可公开使用的 JWKS。 */
+    get_public_jwks(): Promise<FederationJwks>;
+    /** 根据当前请求 origin 生成 Federation 发现信息。 */
+    get_discovery(origin: string): FederationDiscovery;
 }
 //# sourceMappingURL=authenticator.d.ts.map

package/bin/federation/auth/authenticator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../src/federation/auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC5G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D,WAAW;AACX,WAAW;AACX,MAAM,WAAW,UAAU;IACzB,eAAe;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,+BAA+B;IAC/B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,YAAY;AACZ,qBAAa,aAAa;IAKtB,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,KAAK;IALf,yBAAyB;IACzB,OAAO,CAAC,WAAW,CAAC,CAAc;gBAGxB,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,GAAG,SAAS,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC;IAGvH;;;;OAIG;IACH,OAAO,CAAC,SAAS;IASjB;;;;;OAKG;IACG,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IA0BpD;;;;;;OAMG;IACH,cAAc,CAAC,QAAQ,EAAE,yBAAyB,GAAG,UAAU;IAW/D;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU;IAY/D;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiB7E;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAG5D"}
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../src/federation/auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D,WAAW;AACX,WAAW;AACX,MAAM,WAAW,UAAU;IACzB,eAAe;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,+BAA+B;IAC/B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,YAAY;AACZ,qBAAa,aAAa;IAEtB,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAJ3B,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,GAAG,SAAS,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC,EACpG,eAAe,EAAE,kBAAkB,EACnC,SAAS,EAAE,kBAAkB,EAC7B,kBAAkB,EAAE,gBAAgB;IAGvD;;;;;OAKG;IACG,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IA8BpD;;;;;;OAMG;IACH,cAAc,CAAC,QAAQ,EAAE,yBAAyB,GAAG,UAAU;IAW/D;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU;IAY/D;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgB7E;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI3D,mCAAmC;IACnC,eAAe,IAAI,OAAO,CAAC,cAAc,CAAC;IAI1C,wCAAwC;IACxC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB;CASnD"}

package/bin/federation/auth/authenticator.js

@@ -1,37 +1,26 @@
 /**
  * 统一鉴权模块。
  *
- * Authenticator 统一处理 admin（secret key）和 user（JWT token）两种鉴权方式。
+ * Authenticator 统一处理管理凭证（root secret 或 Bureau Token）和
+ * user_token（Ed25519 JWT）两类鉴权方式。
  * 所有鉴权失败统一抛出 httpError（ErrorWithStatus）。
- *
- * TokenSigner 实例通过 getSigner() 缓存，避免重复 new TokenSigner(key)。
  */
 import { bearerToken, httpError } from "../../utils/helpers.js";
-import { TokenSigner } from "./token-signer.js";
 import { normalizeRouteAuth } from "../../service/service.js";
+import { parse_user_token_ttl } from "./user-token-authority.js";
 /** 统一鉴权器 */
 export class Authenticator {
     env;
     store;
-    /** 缓存的 TokenSigner 实例 */
-    tokenSigner;
-    constructor(env, store) {
+    token_authority;
+    key_store;
+    bureau_token_store;
+    constructor(env, store, token_authority, key_store, bureau_token_store) {
         this.env = env;
         this.store = store;
-    }
-    /**
-     * 获取（或创建）TokenSigner 单例。
-     *
-     * 首次调用时从 env 读取 DOWNCITY_FEDERATION_TOKEN_SIGNING_KEY 创建实例并缓存。
-     */
-    getSigner() {
-        if (!this.tokenSigner) {
-            const signingKey = this.env.get("DOWNCITY_FEDERATION_TOKEN_SIGNING_KEY");
-            if (!signingKey)
-                throw new Error("DOWNCITY_FEDERATION_TOKEN_SIGNING_KEY is required");
-            this.tokenSigner = new TokenSigner(signingKey);
-        }
-        return this.tokenSigner;
+        this.token_authority = token_authority;
+        this.key_store = key_store;
+        this.bureau_token_store = bureau_token_store;
     }
     /**
      * 解析请求身份。
@@ -47,8 +36,11 @@ export class Authenticator {
         if (adminKey && token === adminKey) {
             return { level: "admin" };
         }
+        if (await this.bureau_token_store.resolve(token)) {
+            return { level: "admin" };
+        }
         try {
-            const payload = await this.getSigner().verify(token);
+            const payload = await this.token_authority.verify(token);
             const store = await this.store();
             const city = await store.city.get(payload.city_id);
             if (!city)
@@ -119,14 +111,13 @@ export class Authenticator {
             throw httpError(404, `Unknown city: ${input.city_id}`);
         if (city.status !== "active")
             throw httpError(403, `City is not active: ${input.city_id}`);
-        const user_token = await this.getSigner().sign(input);
+        const ttl_seconds = parse_user_token_ttl(input.ttl);
+        const user_token = await this.token_authority.sign(input);
         return {
             user_token,
             city_id: input.city_id,
             user_id: input.user_id,
-            ...(input.ttl
-                ? { expires_at: new Date(Date.now() + TokenSigner.parseTTL(input.ttl) * 1000).toISOString() }
-                : {}),
+            expires_at: new Date(Date.now() + ttl_seconds * 1000).toISOString(),
         };
     }
     /**
@@ -136,7 +127,22 @@ export class Authenticator {
      * @returns 解析出的 token 载荷
      */
     async verifyToken(token) {
-        return this.getSigner().verify(token);
+        return this.token_authority.verify(token);
+    }
+    /** 返回 Federation 当前可公开使用的 JWKS。 */
+    get_public_jwks() {
+        return this.key_store.get_public_jwks();
+    }
+    /** 根据当前请求 origin 生成 Federation 发现信息。 */
+    get_discovery(origin) {
+        const federation_id = this.env.get("DOWNCITY_FEDERATION_ID");
+        if (!federation_id)
+            throw new Error("DOWNCITY_FEDERATION_ID is required");
+        return {
+            issuer: `urn:downcity:federation:${federation_id}`,
+            jwks_uri: `${origin.replace(/\/+$/, "")}/.well-known/jwks.json`,
+            user_token_audience: "downcity:user",
+        };
     }
 }
 //# sourceMappingURL=authenticator.js.map

package/bin/federation/auth/authenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../../src/federation/auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAsC,MAAM,0BAA0B,CAAC;AAiBlG,YAAY;AACZ,MAAM,OAAO,aAAa;IAKd;IACA;IALV,yBAAyB;IACjB,WAAW,CAAe;IAElC,YACU,GAAgB,EAChB,KAA6G;QAD7G,QAAG,GAAH,GAAG,CAAa;QAChB,UAAK,GAAL,KAAK,CAAwG;IACpH,CAAC;IAEJ;;;;OAIG;IACK,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAAgB;QAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACtE,IAAI,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAExD,OAAO;gBACL,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE;gBACpE,IAAI;aACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,QAAmC;QAChD,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAkB,EAAE,QAAoB;QAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAE9E,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,SAAS,CAAC,GAAG,EAAE,2BAA2B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,QAAoB;QACvD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,MAAM,SAAS,CAAC,GAAG,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,SAAS,CAAC,GAAG,EAAE,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3F,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO;YACL,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;gBAC7F,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../../src/federation/auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAsC,MAAM,0BAA0B,CAAC;AAElG,OAAO,EAAE,oBAAoB,EAA2B,MAAM,2BAA2B,CAAC;AAyB1F,YAAY;AACZ,MAAM,OAAO,aAAa;IAEd;IACA;IACS;IACA;IACA;IALnB,YACU,GAAgB,EAChB,KAA6G,EACpG,eAAmC,EACnC,SAA6B,EAC7B,kBAAoC;QAJ7C,QAAG,GAAH,GAAG,CAAa;QAChB,UAAK,GAAL,KAAK,CAAwG;QACpG,oBAAe,GAAf,eAAe,CAAoB;QACnC,cAAS,GAAT,SAAS,CAAoB;QAC7B,uBAAkB,GAAlB,kBAAkB,CAAkB;IACpD,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAAgB;QAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACtE,IAAI,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAExD,OAAO;gBACL,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE;gBACpE,IAAI;aACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,QAAmC;QAChD,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAkB,EAAE,QAAoB;QAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAE9E,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,SAAS,CAAC,GAAG,EAAE,2BAA2B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,QAAoB;QACvD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,MAAM,SAAS,CAAC,GAAG,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,SAAS,CAAC,GAAG,EAAE,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3F,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAO;YACL,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACpE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,mCAAmC;IACnC,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;IAC1C,CAAC;IAED,wCAAwC;IACxC,aAAa,CAAC,MAAc;QAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1E,OAAO;YACL,MAAM,EAAE,2BAA2B,aAAa,EAAE;YAClD,QAAQ,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;YAC/D,mBAAmB,EAAE,eAAe;SACrC,CAAC;IACJ,CAAC;CACF"}