@dreadkn1ght123/auth-core 0.2.0

package/dist/oidc.js

@@ -0,0 +1,421 @@
+import * as oidc from "openid-client";
+import { KeycloakJwtAccessTokenValidator, } from "./access-token.js";
+import { actorFromClaims } from "./claims.js";
+import { AuthError, classifyAuthError } from "./errors.js";
+import { assertProductionSafeStore } from "./store-security.js";
+const NOOP_LOGGER = {
+    debug() { },
+    info() { },
+    warn() { },
+    error() { },
+};
+function log(logger, level, message, fields) {
+    // Call sites pass only identifiers/status metadata. Exceptions and protocol
+    // responses are intentionally never forwarded because they can hold tokens.
+    logger[level](message, fields);
+}
+function diagnosticFields(error, correlationId) {
+    return {
+        authErrorCode: error.code,
+        stage: error.stage,
+        reason: error.reason,
+        ...(correlationId ? { correlationId } : {}),
+        ...(error.details.library ? { library: error.details.library } : {}),
+        ...(error.details.libraryCode
+            ? { libraryCode: error.details.libraryCode }
+            : {}),
+        ...(error.details.httpStatus
+            ? { httpStatus: error.details.httpStatus }
+            : {}),
+        ...(error.details.claim ? { claim: error.details.claim } : {}),
+        ...(error.details.causeName ? { causeName: error.details.causeName } : {}),
+        ...(error.details.causeCode ? { causeCode: error.details.causeCode } : {}),
+        ...(error.details.providerError
+            ? { providerError: error.details.providerError }
+            : {}),
+        ...(error.details.providerStatus
+            ? { providerStatus: error.details.providerStatus }
+            : {}),
+        ...(error.details.failedClaim
+            ? { failedClaim: error.details.failedClaim }
+            : {}),
+        ...(error.details.claimFailureReason
+            ? { claimFailureReason: error.details.claimFailureReason }
+            : {}),
+    };
+}
+function validateDiscoveryMetadata(config, metadata) {
+    if (config.environment !== "production")
+        return;
+    const expectedIssuer = config.issuer.href.replace(/\/$/, "");
+    if (metadata.issuer.replace(/\/$/, "") !== expectedIssuer) {
+        throw new AuthError("OIDC_DISCOVERY_FAILED", "Provider discovery issuer does not match configured issuer", { stage: "discovery", reason: "provider_metadata_invalid" });
+    }
+    for (const field of ["authorization_endpoint", "token_endpoint", "jwks_uri"]) {
+        const value = metadata[field];
+        let endpoint;
+        try {
+            endpoint = new URL(typeof value === "string" ? value : "");
+        }
+        catch {
+            throw new AuthError("OIDC_DISCOVERY_FAILED", `Provider discovery metadata has no valid ${field}`, { stage: "discovery", reason: "provider_metadata_invalid" });
+        }
+        if (endpoint.protocol !== "https:") {
+            throw new AuthError("OIDC_DISCOVERY_FAILED", `Provider discovery ${field} must use HTTPS`, { stage: "discovery", reason: "provider_metadata_invalid" });
+        }
+    }
+    if (metadata.response_types_supported &&
+        !metadata.response_types_supported.includes("code")) {
+        throw new AuthError("OIDC_DISCOVERY_FAILED", "Provider does not support the authorization code response type", { stage: "discovery", reason: "provider_metadata_invalid" });
+    }
+    if (metadata.token_endpoint_auth_methods_supported &&
+        !metadata.token_endpoint_auth_methods_supported.includes(config.clientAuthenticationMethod)) {
+        throw new AuthError("OIDC_DISCOVERY_FAILED", "Provider does not support configured client authentication", { stage: "discovery", reason: "provider_metadata_invalid" });
+    }
+    if (config.postLogoutRedirectUri &&
+        typeof metadata.end_session_endpoint !== "string") {
+        throw new AuthError("OIDC_DISCOVERY_FAILED", "Provider does not advertise an end-session endpoint", { stage: "discovery", reason: "provider_metadata_invalid" });
+    }
+    if (config.postLogoutRedirectUri) {
+        let logoutEndpoint;
+        try {
+            logoutEndpoint = new URL(metadata.end_session_endpoint);
+        }
+        catch {
+            throw new AuthError("OIDC_DISCOVERY_FAILED", "Provider end-session endpoint is invalid", { stage: "discovery", reason: "provider_metadata_invalid" });
+        }
+        if (logoutEndpoint.protocol !== "https:") {
+            throw new AuthError("OIDC_DISCOVERY_FAILED", "Provider end-session endpoint must use HTTPS", { stage: "discovery", reason: "provider_metadata_invalid" });
+        }
+    }
+}
+function serverTokens(response, now, accessClaims, previous) {
+    if (!response.access_token) {
+        throw new AuthError("AUTHORIZATION_FAILED", "Token endpoint did not return an access token", { stage: "token_exchange", reason: "access_token_missing" });
+    }
+    const expiresAt = typeof response.expires_in === "number" && response.expires_in > 0
+        ? now + response.expires_in * 1_000
+        : typeof accessClaims["exp"] === "number" &&
+            Number.isSafeInteger(accessClaims["exp"]) &&
+            accessClaims["exp"] * 1_000 > now
+            ? accessClaims["exp"] * 1_000
+            : undefined;
+    if (expiresAt === undefined) {
+        throw new AuthError("AUTHORIZATION_FAILED", "Token response has no usable expiration", {
+            stage: "access_token_validation",
+            reason: "required_claim_missing",
+            safeDetails: { failedClaim: "exp", claimFailureReason: "missing" },
+        });
+    }
+    return {
+        accessToken: response.access_token,
+        ...(response.refresh_token
+            ? { refreshToken: response.refresh_token }
+            : previous?.refreshToken
+                ? { refreshToken: previous.refreshToken }
+                : {}),
+        ...(response.id_token
+            ? { idToken: response.id_token }
+            : previous?.idToken
+                ? { idToken: previous.idToken }
+                : {}),
+        expiresAt,
+        ...(response.token_type ? { tokenType: response.token_type } : {}),
+        ...(response.scope ? { scope: response.scope } : {}),
+    };
+}
+export class VvpOidcClient {
+    #oidcConfig;
+    #config;
+    #sessions;
+    #logger;
+    #now;
+    #accessTokens;
+    constructor(oidcConfig, config, sessions, logger, now, accessTokens) {
+        this.#oidcConfig = oidcConfig;
+        this.#config = config;
+        this.#sessions = sessions;
+        this.#logger = logger;
+        this.#now = now;
+        this.#accessTokens = accessTokens;
+    }
+    static async discover(config, sessions, options = {}) {
+        const logger = options.logger ?? NOOP_LOGGER;
+        // Fail before any network activity: an un-attested store could otherwise
+        // let an application appear ready while losing sessions after discovery.
+        assertProductionSafeStore(sessions, config.environment, {
+            purpose: "session",
+        });
+        try {
+            const clientAuthentication = oidc.ClientSecretBasic(config.clientSecret);
+            const discovered = await oidc.discovery(config.issuer, config.clientId, {
+                redirect_uris: [config.redirectUri.href],
+                response_types: ["code"],
+            }, clientAuthentication);
+            const metadata = discovered.serverMetadata();
+            validateDiscoveryMetadata(config, metadata);
+            const jwksUri = typeof metadata.jwks_uri === "string"
+                ? new URL(metadata.jwks_uri)
+                : undefined;
+            const accessTokens = options.accessTokenValidator ??
+                (jwksUri
+                    ? new KeycloakJwtAccessTokenValidator(config, jwksUri)
+                    : undefined);
+            if (!accessTokens) {
+                throw new AuthError("OIDC_DISCOVERY_FAILED", "Provider discovery metadata does not include jwks_uri");
+            }
+            log(logger, "info", "OIDC discovery completed", {
+                issuerOrigin: config.issuer.origin,
+                clientId: config.clientId,
+            });
+            const client = new VvpOidcClient(discovered, config, sessions, logger, options.now ?? Date.now, accessTokens);
+            log(logger, "info", "vvp.auth.config.ready", {
+                stage: "configuration",
+                status: "ready",
+                issuerOrigin: config.issuer.origin,
+                clientId: config.clientId,
+                ...(config.publicOrigin
+                    ? { publicOrigin: config.publicOrigin.origin }
+                    : {}),
+                redirectOrigin: config.redirectUri.origin,
+                callbackPath: config.routes.callbackPath,
+                signedOutPath: config.routes.signedOutPath,
+                ...(config.postLogoutRedirectUri
+                    ? {
+                        postLogoutRedirectOrigin: config.postLogoutRedirectUri.origin,
+                        postLogoutRedirectPath: config.postLogoutRedirectUri.pathname,
+                    }
+                    : {}),
+                transactionCookiePath: config.routes.cookiePath,
+                expectedAccessTokenAudiences: config.accessTokenAudiences,
+                expectedAuthorizedParties: config.accessTokenAuthorizedParties,
+                scopes: config.scopes,
+            });
+            return client;
+        }
+        catch (cause) {
+            const classified = classifyAuthError(cause);
+            const error = cause instanceof AuthError
+                ? cause
+                : new AuthError("OIDC_DISCOVERY_FAILED", "Unable to discover the OIDC provider", {
+                    cause,
+                    stage: "discovery",
+                    reason: classified.reason === "callback_failed_unknown"
+                        ? "provider_unavailable"
+                        : classified.reason,
+                    details: classified.details,
+                });
+            log(logger, "error", "vvp.auth.discovery.failed", {
+                ...diagnosticFields(error),
+                issuerOrigin: config.issuer.origin,
+                clientId: config.clientId,
+            });
+            throw error;
+        }
+    }
+    async createAuthorizationRequest(options = {}) {
+        const codeVerifier = oidc.randomPKCECodeVerifier();
+        const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
+        const state = oidc.randomState();
+        const nonce = oidc.randomNonce();
+        const parameters = {
+            ...options.additionalParameters,
+            redirect_uri: this.#config.redirectUri.href,
+            scope: this.#config.scopes.join(" "),
+            response_type: "code",
+            code_challenge: codeChallenge,
+            code_challenge_method: "S256",
+            state,
+            nonce,
+        };
+        if (options.loginHint)
+            parameters["login_hint"] = options.loginHint;
+        if (options.prompt)
+            parameters["prompt"] = options.prompt;
+        return {
+            authorizationUrl: oidc.buildAuthorizationUrl(this.#oidcConfig, parameters),
+            state,
+            nonce,
+            codeVerifier,
+        };
+    }
+    async handleCallback(input) {
+        try {
+            const response = await oidc.authorizationCodeGrant(this.#oidcConfig, input.callbackUrl, {
+                expectedState: input.state,
+                expectedNonce: input.nonce,
+                pkceCodeVerifier: input.codeVerifier,
+                idTokenExpected: true,
+            });
+            const claims = response.claims();
+            if (!claims) {
+                throw new AuthError("CLAIMS_INVALID", "The provider did not return verified ID token claims", { stage: "id_token_validation", reason: "id_token_missing" });
+            }
+            const accessClaims = await this.#accessTokens.validate(response.access_token);
+            if (typeof accessClaims["sub"] !== "string" ||
+                accessClaims["sub"] !== claims.sub) {
+                throw new AuthError("ACCESS_TOKEN_INVALID", "ID token and access token subjects do not match", {
+                    stage: "access_token_validation",
+                    reason: "token_subject_mismatch",
+                    safeDetails: { failedClaim: "sub", claimFailureReason: "check_failed" },
+                });
+            }
+            const mergedClaims = {
+                ...claims,
+                realm_access: accessClaims["realm_access"],
+                resource_access: accessClaims["resource_access"],
+            };
+            const now = this.#now();
+            const session = {
+                id: oidc.randomState(),
+                actor: actorFromClaims(mergedClaims),
+                tokens: serverTokens(response, now, accessClaims),
+                createdAt: now,
+                updatedAt: now,
+            };
+            try {
+                await this.#sessions.set(session, this.#config.sessionTtlSeconds);
+            }
+            catch (cause) {
+                throw new AuthError("SESSION_PERSISTENCE_FAILED", "Unable to persist the authenticated session", {
+                    cause,
+                    stage: "session_persistence",
+                    reason: "session_store_failed",
+                });
+            }
+            log(this.#logger, "info", "vvp.auth.callback.succeeded", {
+                stage: "callback_redirect",
+                ...(input.correlationId ? { correlationId: input.correlationId } : {}),
+                hasBusinessActorId: Boolean(session.actor.vvpActorId),
+            });
+            return session;
+        }
+        catch (cause) {
+            const error = cause instanceof AuthError
+                ? cause
+                : (() => {
+                    const classified = classifyAuthError(cause);
+                    return new AuthError("AUTHORIZATION_FAILED", "OIDC authorization callback failed", {
+                        cause,
+                        stage: classified.reason === "invalid_client" ||
+                            classified.reason === "pkce_validation_failed" ||
+                            classified.reason === "token_endpoint_rejected"
+                            ? "token_exchange"
+                            : "authorization_response_validation",
+                        reason: classified.reason,
+                        details: classified.details,
+                    });
+                })();
+            log(this.#logger, "warn", "vvp.auth.callback.rejected", diagnosticFields(error, input.correlationId));
+            throw error;
+        }
+    }
+    async refreshSession(sessionId) {
+        const session = await this.#sessions.get(sessionId);
+        if (!session) {
+            throw new AuthError("SESSION_NOT_FOUND", "Session was not found");
+        }
+        if (!session.tokens.refreshToken) {
+            await this.#sessions.delete(sessionId);
+            throw new AuthError("TOKEN_REFRESH_FAILED", "Session has no refresh token");
+        }
+        try {
+            const response = await oidc.refreshTokenGrant(this.#oidcConfig, session.tokens.refreshToken);
+            const now = this.#now();
+            const claims = response.claims();
+            const accessClaims = await this.#accessTokens.validate(response.access_token);
+            if (typeof accessClaims["sub"] !== "string" ||
+                accessClaims["sub"] !== (claims?.sub ?? session.actor.sub)) {
+                throw new AuthError("ACCESS_TOKEN_INVALID", "Identity and refreshed access token subjects do not match", {
+                    stage: "access_token_validation",
+                    reason: "token_subject_mismatch",
+                    safeDetails: { failedClaim: "sub", claimFailureReason: "check_failed" },
+                });
+            }
+            const mergedClaims = claims
+                ? {
+                    ...claims,
+                    realm_access: accessClaims["realm_access"],
+                    resource_access: accessClaims["resource_access"],
+                }
+                : undefined;
+            const refreshed = {
+                ...session,
+                actor: mergedClaims
+                    ? actorFromClaims(mergedClaims)
+                    : {
+                        ...session.actor,
+                        realmRoles: actorFromClaims({
+                            sub: session.actor.sub,
+                            realm_access: accessClaims["realm_access"],
+                        }).realmRoles,
+                        clientRoles: actorFromClaims({
+                            sub: session.actor.sub,
+                            resource_access: accessClaims["resource_access"],
+                        }).clientRoles,
+                    },
+                tokens: serverTokens(response, now, accessClaims, session.tokens),
+                updatedAt: now,
+            };
+            await this.#sessions.set(refreshed, this.#config.sessionTtlSeconds);
+            log(this.#logger, "info", "OIDC tokens refreshed", {
+                hasBusinessActorId: Boolean(refreshed.actor.vvpActorId),
+            });
+            return refreshed;
+        }
+        catch (cause) {
+            await this.#sessions.delete(sessionId);
+            const error = cause instanceof AuthError
+                ? cause
+                : new AuthError("TOKEN_REFRESH_FAILED", "OIDC token refresh failed", {
+                    cause,
+                    stage: "token_refresh",
+                    reason: classifyAuthError(cause).reason,
+                    safeDetails: classifyAuthError(cause).details,
+                });
+            log(this.#logger, "warn", "vvp.auth.session.refresh_failed", diagnosticFields(error));
+            throw error;
+        }
+    }
+    async logout(sessionId) {
+        const session = await this.#sessions.get(sessionId);
+        const parameters = {};
+        if (session?.tokens.idToken) {
+            parameters["id_token_hint"] = session.tokens.idToken;
+        }
+        if (this.#config.postLogoutRedirectUri) {
+            parameters["post_logout_redirect_uri"] =
+                this.#config.postLogoutRedirectUri.href;
+        }
+        await this.#sessions.delete(sessionId);
+        log(this.#logger, "info", "vvp.auth.logout.local_session_deleted", {
+            stage: "logout",
+            reason: "local_session_deleted",
+            hadSession: Boolean(session),
+        });
+        try {
+            const logoutUrl = oidc.buildEndSessionUrl(this.#oidcConfig, parameters);
+            log(this.#logger, "info", "vvp.auth.logout.redirect_created", {
+                stage: "logout",
+                reason: "provider_logout_redirect_created",
+            });
+            return logoutUrl;
+        }
+        catch (cause) {
+            const error = new AuthError("LOGOUT_FAILED", "Unable to create provider logout redirect", {
+                cause,
+                stage: "logout",
+                reason: "provider_logout_rejected",
+            });
+            log(this.#logger, "warn", "vvp.auth.logout.rejected", diagnosticFields(error));
+            throw error;
+        }
+    }
+}
+export function toPublicSession(session) {
+    return {
+        actor: session.actor,
+        ...(session.tokens.expiresAt ? { expiresAt: session.tokens.expiresAt } : {}),
+    };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EACL,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AA0BhE,MAAM,WAAW,GAAe;IAC9B,KAAK,KAAI,CAAC;IACV,IAAI,KAAI,CAAC;IACT,IAAI,KAAI,CAAC;IACT,KAAK,KAAI,CAAC;CACX,CAAC;AAEF,SAAS,GAAG,CACV,MAAkB,EAClB,KAAuB,EACvB,OAAe,EACf,MAAsB;IAEtB,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAgB,EAChB,aAAsB;IAEtB,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,IAAI;QACzB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW;YAC3B,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;YAC1B,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa;YAC7B,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc;YAC9B,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW;YAC3B,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE;YAC1D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAkB,EAAE,QAA6B;IAClF,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY;QAAE,OAAO;IAChD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,4DAA4D,EAC5D,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,EAAE,UAAU,CAAU,EAAE,CAAC;QACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,4CAA4C,KAAK,EAAE,EACnD,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,sBAAsB,KAAK,iBAAiB,EAC5C,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,wBAAwB;QACjC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,gEAAgE,EAChE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,qCAAqC;QAC9C,CAAC,QAAQ,CAAC,qCAAqC,CAAC,QAAQ,CACtD,MAAM,CAAC,0BAA0B,CAClC,EAAE,CAAC;QACN,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,4DAA4D,EAC5D,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB;QAC5B,OAAO,QAAQ,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,qDAAqD,EACrD,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjC,IAAI,cAAmB,CAAC;QACxB,IAAI,CAAC;YACH,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAqB,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,0CAA0C,EAC1C,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,8CAA8C,EAC9C,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,QAAiE,EACjE,GAAW,EACX,YAA+C,EAC/C,QAAuB;IAEvB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,+CAA+C,EAC/C,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC;QAChE,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,KAAK;QACnC,CAAC,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,QAAQ;YACrC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACzC,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,GAAG;YACnC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK;YAC7B,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,yCAAyC,EACzC;YACE,KAAK,EAAE,yBAAyB;YAChC,MAAM,EAAE,wBAAwB;YAChC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE;SACnE,CACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,YAAY;QAClC,GAAG,CAAC,QAAQ,CAAC,aAAa;YACxB,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE;YAC1C,CAAC,CAAC,QAAQ,EAAE,YAAY;gBACtB,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE;gBACzC,CAAC,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,QAAQ,CAAC,QAAQ;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE;YAChC,CAAC,CAAC,QAAQ,EAAE,OAAO;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;QACT,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,aAAa;IACf,WAAW,CAAqB;IAChC,OAAO,CAAa;IACpB,SAAS,CAAe;IACxB,OAAO,CAAa;IACpB,IAAI,CAAe;IACnB,aAAa,CAAuB;IAE7C,YACE,UAA8B,EAC9B,MAAkB,EAClB,QAAsB,EACtB,MAAkB,EAClB,GAAiB,EACjB,YAAkC;QAElC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CACnB,MAAkB,EAClB,QAAsB,EACtB,UAII,EAAE;QAEN,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC;QAC7C,yEAAyE;QACzE,yEAAyE;QACzE,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE;YACtD,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CACrC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,EACf;gBACE,aAAa,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;gBACxC,cAAc,EAAE,CAAC,MAAM,CAAC;aACzB,EACD,oBAAoB,CACrB,CAAC;YACF,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,EAAE,CAAC;YAC7C,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC5C,MAAM,OAAO,GACX,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ;gBACnC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,YAAY,GAChB,OAAO,CAAC,oBAAoB;gBAC5B,CAAC,OAAO;oBACN,CAAC,CAAC,IAAI,+BAA+B,CAAC,MAAM,EAAE,OAAO,CAAC;oBACtD,CAAC,CAAC,SAAS,CAAC,CAAC;YACjB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE;gBAC9C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,aAAa,CAC9B,UAAU,EACV,MAAM,EACN,QAAQ,EACR,MAAM,EACN,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EACvB,YAAY,CACb,CAAC;YACF,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE;gBAC3C,KAAK,EAAE,eAAe;gBACtB,MAAM,EAAE,OAAO;gBACf,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,YAAY;oBACrB,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;oBAC9C,CAAC,CAAC,EAAE,CAAC;gBACP,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;gBACzC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;gBACxC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;gBAC1C,GAAG,CAAC,MAAM,CAAC,qBAAqB;oBAC9B,CAAC,CAAC;wBACE,wBAAwB,EAAE,MAAM,CAAC,qBAAqB,CAAC,MAAM;wBAC7D,sBAAsB,EAAE,MAAM,CAAC,qBAAqB,CAAC,QAAQ;qBAC9D;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;gBAC/C,4BAA4B,EAAE,MAAM,CAAC,oBAAoB;gBACzD,yBAAyB,EAAE,MAAM,CAAC,4BAA4B;gBAC9D,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,KAAK,YAAY,SAAS;gBACtC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,SAAS,CACX,uBAAuB,EACvB,sCAAsC,EACtC;oBACE,KAAK;oBACL,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,yBAAyB;wBACrD,CAAC,CAAC,sBAAsB;wBACxB,CAAC,CAAC,UAAU,CAAC,MAAM;oBACrB,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B,CACF,CAAC;YACN,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE;gBAChD,GAAG,gBAAgB,CAAC,KAAK,CAAC;gBAC1B,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,0BAA0B,CAC9B,UAAgC,EAAE;QAElC,MAAM,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACnD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,UAAU,GAA2B;YACzC,GAAG,OAAO,CAAC,oBAAoB;YAC/B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI;YAC3C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACpC,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,KAAK;YACL,KAAK;SACN,CAAC;QACF,IAAI,OAAO,CAAC,SAAS;YAAE,UAAU,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QACpE,IAAI,OAAO,CAAC,MAAM;YAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QAE1D,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC;YAC1E,KAAK;YACL,KAAK;YACL,YAAY;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoB;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAChD,IAAI,CAAC,WAAW,EAChB,KAAK,CAAC,WAAW,EACjB;gBACE,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,gBAAgB,EAAE,KAAK,CAAC,YAAY;gBACpC,eAAe,EAAE,IAAI;aACtB,CACF,CAAC;YACF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,sDAAsD,EACtD,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAC7D,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CACpD,QAAQ,CAAC,YAAY,CACtB,CAAC;YACF,IACE,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,QAAQ;gBACvC,YAAY,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,GAAG,EAClC,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,iDAAiD,EACjD;oBACE,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,wBAAwB;oBAChC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE;iBACxE,CACF,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAG;gBACnB,GAAG,MAAM;gBACT,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC;gBAC1C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;aACjD,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,OAAO,GAAkB;gBAC7B,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;gBACtB,KAAK,EAAE,eAAe,CAAC,YAAY,CAAC;gBACpC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,CAAC;gBACjD,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,SAAS,CACjB,4BAA4B,EAC5B,6CAA6C,EAC7C;oBACE,KAAK;oBACL,KAAK,EAAE,qBAAqB;oBAC5B,MAAM,EAAE,sBAAsB;iBAC/B,CACF,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE;gBACvD,KAAK,EAAE,mBAAmB;gBAC1B,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;aACtD,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,KAAK,YAAY,SAAS;gBACtC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,CAAC,GAAG,EAAE;oBACJ,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;oBAC5C,OAAO,IAAI,SAAS,CAClB,sBAAsB,EACtB,oCAAoC,EACpC;wBACE,KAAK;wBACL,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,gBAAgB;4BACzC,UAAU,CAAC,MAAM,KAAK,wBAAwB;4BAC9C,UAAU,CAAC,MAAM,KAAK,yBAAyB;4BACjD,CAAC,CAAC,gBAAgB;4BAClB,CAAC,CAAC,mCAAmC;wBACvC,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,OAAO,EAAE,UAAU,CAAC,OAAO;qBAC5B,CACF,CAAC;gBACJ,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CACD,IAAI,CAAC,OAAO,EACZ,MAAM,EACN,4BAA4B,EAC5B,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAC7C,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAC3C,IAAI,CAAC,WAAW,EAChB,OAAO,CAAC,MAAM,CAAC,YAAY,CAC5B,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CACpD,QAAQ,CAAC,YAAY,CACtB,CAAC;YACF,IACE,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,QAAQ;gBACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAC1D,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,2DAA2D,EAC3D;oBACE,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,wBAAwB;oBAChC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE;iBACxE,CACF,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAG,MAAM;gBACzB,CAAC,CAAC;oBACE,GAAG,MAAM;oBACT,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC;oBAC1C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;iBACjD;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,SAAS,GAAkB;gBAC/B,GAAG,OAAO;gBACV,KAAK,EAAE,YAAY;oBACjB,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC;oBAC/B,CAAC,CAAC;wBACE,GAAG,OAAO,CAAC,KAAK;wBAChB,UAAU,EAAE,eAAe,CAAC;4BAC1B,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG;4BACtB,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC;yBAC3C,CAAC,CAAC,UAAU;wBACb,WAAW,EAAE,eAAe,CAAC;4BAC3B,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG;4BACtB,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;yBACjD,CAAC,CAAC,WAAW;qBACf;gBACL,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC;gBACjE,SAAS,EAAE,GAAG;aACf,CAAC;YACF,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE;gBACjD,kBAAkB,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,KAAK,YAAY,SAAS;gBACtC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,SAAS,CAAC,sBAAsB,EAAE,2BAA2B,EAAE;oBACjE,KAAK;oBACL,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM;oBACvC,WAAW,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,OAAO;iBAC9C,CAAC,CAAC;YACP,GAAG,CACD,IAAI,CAAC,OAAO,EACZ,MAAM,EACN,iCAAiC,EACjC,gBAAgB,CAAC,KAAK,CAAC,CACxB,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,IAAI,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAC5B,UAAU,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;YACvC,UAAU,CAAC,0BAA0B,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,uCAAuC,EAAE;YACjE,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,kCAAkC,EAAE;gBAC5D,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,kCAAkC;aAC3C,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,SAAS,CACzB,eAAe,EACf,2CAA2C,EAC3C;gBACE,KAAK;gBACL,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,0BAA0B;aACnC,CACF,CAAC;YACF,GAAG,CACD,IAAI,CAAC,OAAO,EACZ,MAAM,EACN,0BAA0B,EAC1B,gBAAgB,CAAC,KAAK,CAAC,CACxB,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,OAAsB;IACpD,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC"}

package/dist/return-to.d.ts

@@ -0,0 +1,11 @@
+export interface ReturnToOptions {
+    fallback?: string;
+    baseOrigin?: string;
+    allowedOrigins?: readonly string[];
+}
+/**
+ * Accepts local absolute paths, or HTTP(S) URLs on an explicitly allowed
+ * origin. Protocol-relative URLs, credentials and non-HTTP schemes are denied.
+ */
+export declare function safeReturnTo(candidate: string | null | undefined, options?: ReturnToOptions): string;
+//# sourceMappingURL=return-to.d.ts.map

package/dist/return-to.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-to.d.ts","sourceRoot":"","sources":["../src/return-to.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAkCR"}

package/dist/return-to.js

@@ -0,0 +1,39 @@
+import { AuthError } from "./errors.js";
+/**
+ * Accepts local absolute paths, or HTTP(S) URLs on an explicitly allowed
+ * origin. Protocol-relative URLs, credentials and non-HTTP schemes are denied.
+ */
+export function safeReturnTo(candidate, options = {}) {
+    const fallback = options.fallback ?? "/";
+    if (!candidate)
+        return fallback;
+    const value = candidate.trim();
+    if (!value || value.startsWith("//") || value.includes("\\"))
+        return fallback;
+    if (value.startsWith("/")) {
+        return value;
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return fallback;
+    }
+    if ((url.protocol !== "https:" && url.protocol !== "http:") ||
+        url.username ||
+        url.password) {
+        return fallback;
+    }
+    const allowed = new Set(options.allowedOrigins ?? []);
+    if (options.baseOrigin) {
+        try {
+            allowed.add(new URL(options.baseOrigin).origin);
+        }
+        catch {
+            throw new AuthError("RETURN_TO_INVALID", "baseOrigin must be an absolute URL");
+        }
+    }
+    return allowed.has(url.origin) ? url.href : fallback;
+}
+//# sourceMappingURL=return-to.js.map

package/dist/return-to.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-to.js","sourceRoot":"","sources":["../src/return-to.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQxC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAoC,EACpC,UAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;IACzC,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEhC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE9E,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ,EACZ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC"}

package/dist/session-store.d.ts

@@ -0,0 +1,20 @@
+import type { RuntimeEnvironment, ServerSession, SessionStore } from "@dreadkn1ght123/auth-types";
+/**
+ * Process-local and non-durable. This implementation intentionally refuses to
+ * start in production, where callers must supply a shared persistent store.
+ */
+export declare class MemorySessionStore implements SessionStore {
+    #private;
+    readonly capabilities: {
+        readonly persistence: "memory";
+        readonly shared: false;
+    };
+    constructor(environment: RuntimeEnvironment, options?: {
+        now?: () => number;
+    });
+    get(id: string): Promise<ServerSession | null>;
+    set(session: ServerSession, ttlSeconds: number): Promise<void>;
+    delete(id: string): Promise<void>;
+    touch(id: string, ttlSeconds: number): Promise<void>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../src/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,YAAY,EACb,MAAM,4BAA4B,CAAC;AAYpC;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,YAAY;;IACrD,QAAQ,CAAC,YAAY;;;MAGV;gBAKT,WAAW,EAAE,kBAAkB,EAC/B,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAWhC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAU9C,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI3D"}

package/dist/session-store.js

@@ -0,0 +1,50 @@
+import { AuthError } from "./errors.js";
+function clone(session) {
+    return structuredClone(session);
+}
+/**
+ * Process-local and non-durable. This implementation intentionally refuses to
+ * start in production, where callers must supply a shared persistent store.
+ */
+export class MemorySessionStore {
+    capabilities = {
+        persistence: "memory",
+        shared: false,
+    };
+    #entries = new Map();
+    #now;
+    constructor(environment, options = {}) {
+        if (environment === "production") {
+            throw new AuthError("SESSION_STORE_UNSAFE", "MemorySessionStore must not be used in production");
+        }
+        this.#now = options.now ?? Date.now;
+    }
+    async get(id) {
+        const entry = this.#entries.get(id);
+        if (!entry)
+            return null;
+        if (entry.expiresAt <= this.#now()) {
+            this.#entries.delete(id);
+            return null;
+        }
+        return clone(entry.session);
+    }
+    async set(session, ttlSeconds) {
+        if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds <= 0) {
+            throw new AuthError("CONFIG_INVALID", "Session TTL must be a positive integer");
+        }
+        this.#entries.set(session.id, {
+            session: clone(session),
+            expiresAt: this.#now() + ttlSeconds * 1_000,
+        });
+    }
+    async delete(id) {
+        this.#entries.delete(id);
+    }
+    async touch(id, ttlSeconds) {
+        const entry = this.#entries.get(id);
+        if (entry)
+            entry.expiresAt = this.#now() + ttlSeconds * 1_000;
+    }
+}
+//# sourceMappingURL=session-store.js.map

package/dist/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../src/session-store.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAOxC,SAAS,KAAK,CAAC,OAAsB;IACnC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACpB,YAAY,GAAG;QACtB,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,KAAK;KACL,CAAC;IACF,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IACpC,IAAI,CAAe;IAE5B,YACE,WAA+B,EAC/B,UAAkC,EAAE;QAEpC,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAsB,EAAE,UAAkB;QAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;YACvB,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,GAAG,KAAK;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,UAAkB;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK;YAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC;IAChE,CAAC;CACF"}

package/dist/store-security.d.ts

@@ -0,0 +1,18 @@
+import type { AuthStoreCapabilities, RuntimeEnvironment } from "@dreadkn1ght123/auth-types";
+type AttestedStore = {
+    readonly capabilities?: AuthStoreCapabilities;
+};
+export declare function isProductionSafeStore(store: AttestedStore, options?: {
+    requireAtomicConsume?: boolean;
+}): boolean;
+/**
+ * Rejects un-attested stores in production. An optional capabilities property
+ * keeps the SessionStore structural contract backward compatible in non-prod,
+ * while making production safety explicit and auditable.
+ */
+export declare function assertProductionSafeStore(store: AttestedStore, environment: RuntimeEnvironment, options?: {
+    requireAtomicConsume?: boolean;
+    purpose?: "session" | "transaction";
+}): void;
+export {};
+//# sourceMappingURL=store-security.d.ts.map

package/dist/store-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-security.d.ts","sourceRoot":"","sources":["../src/store-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAG5F,KAAK,aAAa,GAAG;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAEvE,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,OAAO,CAKT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,GAAG,aAAa,CAAA;CAAO,GACpF,IAAI,CASN"}

package/dist/store-security.js

@@ -0,0 +1,21 @@
+import { AuthError } from "./errors.js";
+export function isProductionSafeStore(store, options = {}) {
+    const capabilities = store.capabilities;
+    return capabilities?.persistence === "persistent" &&
+        capabilities.shared === true &&
+        (!options.requireAtomicConsume || capabilities.atomicConsume === true);
+}
+/**
+ * Rejects un-attested stores in production. An optional capabilities property
+ * keeps the SessionStore structural contract backward compatible in non-prod,
+ * while making production safety explicit and auditable.
+ */
+export function assertProductionSafeStore(store, environment, options = {}) {
+    if (environment !== "production")
+        return;
+    if (isProductionSafeStore(store, options))
+        return;
+    const purpose = options.purpose ?? "session";
+    throw new AuthError("SESSION_STORE_UNSAFE", `A persistent shared ${purpose} store${options.requireAtomicConsume ? " with atomic consume" : ""} is required in production`, { stage: "configuration", reason: "store_unsafe" });
+}
+//# sourceMappingURL=store-security.js.map

package/dist/store-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-security.js","sourceRoot":"","sources":["../src/store-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,MAAM,UAAU,qBAAqB,CACnC,KAAoB,EACpB,UAA8C,EAAE;IAEhD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,OAAO,YAAY,EAAE,WAAW,KAAK,YAAY;QAC/C,YAAY,CAAC,MAAM,KAAK,IAAI;QAC5B,CAAC,CAAC,OAAO,CAAC,oBAAoB,IAAI,YAAY,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAoB,EACpB,WAA+B,EAC/B,UAAmF,EAAE;IAErF,IAAI,WAAW,KAAK,YAAY;QAAE,OAAO;IACzC,IAAI,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,OAAO;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC;IAC7C,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,uBAAuB,OAAO,SAAS,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAC7H,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,CACnD,CAAC;AACJ,CAAC"}

package/dist/transaction.d.ts

@@ -0,0 +1,11 @@
+import type { TransactionConsumeOutcome } from "@dreadkn1ght123/auth-types";
+import { AuthError } from "./errors.js";
+/**
+ * Converts an explicit, secret-free atomic consume result to the diagnostic
+ * used by adapters. The successful transaction is deliberately never copied
+ * into the error or its safe details.
+ */
+export declare function transactionConsumeError<T>(outcome: Exclude<TransactionConsumeOutcome<T>, {
+    status: "ok";
+}>): AuthError;
+//# sourceMappingURL=transaction.d.ts.map