@gauts/auth 0.8.2 → 0.10.0

package/SECURITY.md

@@ -29,20 +29,24 @@ Security reports may cover the password service, session core, database adapters
 
 Application-specific authorization, rate limiting, CSRF, CORS, proxy trust, deployment, and database access policies remain the consuming application's responsibility unless the vulnerability is caused by package behavior.
 
-## Signed session cache
+## Signed session context
 
-The optional browser cache is disabled when omitted. When configured, it is accepted only for `GET` and `HEAD` requests and is signed with HMAC-SHA-256 using an application-provided secret of at least 32 bytes.
+Browser integration uses an opaque session-token cookie and a signed context cookie. The context is signed with HMAC-SHA-256 using an API-only application secret of at least 32 bytes and is cryptographically bound to the opaque token. It contains session expiry and renewal scheduling plus optional short cached account/session data. It never authenticates without the opaque token.
 
-The cache is bound to the opaque session token, its own expiry, the authoritative session expiry, and the configured client fields. Invalid cache data never authenticates a request; it causes normal database validation.
+The API verifies the context signature before trusting any cached value. Missing, malformed, expired, altered, or incorrectly bound context data causes normal database validation and a new context cookie. It does not revoke an otherwise valid opaque session. The Next.js adapter may decode the expiry and renewal values without the secret, but treats them only as untrusted scheduling hints.
+
+The optional browser cache is disabled when omitted. When configured, it is accepted only for `GET` and `HEAD` requests and remains bound to its own expiry, the authoritative session expiry, and the configured client fields.
 
 Cookie caching introduces a bounded consistency window. A session revoked on another device, or selected account or relation access changed in the database, may remain readable until the cache TTL expires. Unsafe methods, renewal, logout, WebSockets, and direct core calls always validate through the database. Applications requiring immediate cross-device read revocation must leave the cache disabled or provide shared server-side enforcement outside this package.
 
-Keep `AUTH_SECRET` in the API environment. Do not expose it to browser code or share it with a frontend merely to inspect the renewal timestamp. The timestamp is intentionally untrusted and never authenticates or renews a session by itself.
+Keep `AUTH_SECRET` in the API environment. Do not expose it to browser code or share it with a frontend merely to inspect scheduling values. Those values are intentionally untrusted and never authenticate or renew a session by themselves.
 
 ## Session lifetime
 
 Sliding renewal is limited by `session.maxLifetime`, which defaults to 30 days from the original login. The maximum expiry is derived from the immutable session `created_at` value and enforced by the core during resolution and renewal. Browser cookies and cached session data never outlive the authoritative session expiry.
 
+Framework middleware renews inline when the verified context says renewal is due. The explicit renewal endpoint performs the same database-backed operation for server-rendered navigation. Both paths retain the same opaque token and rewrite the session and context cookie expiries.
+
 Activity and possession of the session token cannot extend this absolute limit. After it is reached, the user must authenticate again and receive a new session token.
 
 ## Social authentication

package/dist/adapters/drizzle/config.d.ts

@@ -0,0 +1,11 @@
+import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
+import type { ResolvedDrizzleModels } from "./types.js";
+export declare const DRIZZLE_FIELDS: {
+    readonly accounts: readonly ["id", "email", "user_id"];
+    readonly sessions: readonly ["account_id", "agent", "country", "created_at", "expires_at", "id", "ip", "platform", "revoked_at", "token_hash", "updated_at"];
+    readonly socials: readonly ["account_id", "created_at", "id", "provider", "provider_id"];
+    readonly users: readonly ["id", "name"];
+};
+export declare const resolveDrizzleModels: (input: unknown) => ResolvedDrizzleModels;
+export declare const getDrizzleSource: (table: AnyMySqlTable) => string;
+//# sourceMappingURL=config.d.ts.map

package/dist/adapters/drizzle/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/adapters/drizzle/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAK5D,OAAO,KAAK,EAA4B,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAkClF,eAAO,MAAM,cAAc;;;;;CAiBjB,CAAC;AA+HX,eAAO,MAAM,oBAAoB,GAAI,OAAO,OAAO,KAAG,qBAmCrD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,OAAO,aAAa,KAAG,MAEvD,CAAC"}

package/dist/adapters/drizzle/config.js

@@ -0,0 +1,147 @@
+import { getTableColumns, getTableName, isTable } from "drizzle-orm";
+import { createError } from "../../errors.js";
+import { isRecord } from "../../session/guards.js";
+import { isPrivateField } from "../model.js";
+export const DRIZZLE_FIELDS = {
+    accounts: ["id", "email", "user_id"],
+    sessions: [
+        "account_id",
+        "agent",
+        "country",
+        "created_at",
+        "expires_at",
+        "id",
+        "ip",
+        "platform",
+        "revoked_at",
+        "token_hash",
+        "updated_at",
+    ],
+    socials: ["account_id", "created_at", "id", "provider", "provider_id"],
+    users: ["id", "name"],
+};
+const DRIZZLE_SELECT = {
+    accounts: ["id", "email"],
+    users: ["id", "name"],
+};
+const isAuthScalar = (value) => {
+    return (value === null ||
+        typeof value === "boolean" ||
+        typeof value === "string" ||
+        (typeof value === "number" && Number.isFinite(value)));
+};
+const isAccessValue = (value) => {
+    return Array.isArray(value)
+        ? value.length > 0 && value.every(isAuthScalar)
+        : isAuthScalar(value);
+};
+const requireTable = ({ fields, input, path }) => {
+    if (!isTable(input)) {
+        throw createError({
+            code: "AUTH_CONFIG_INVALID",
+            message: `${path}.table must be a Drizzle MySQL table.`,
+        });
+    }
+    const columns = getTableColumns(input);
+    const missing = fields.filter((field) => !(field in columns));
+    if (missing.length > 0) {
+        throw createError({
+            code: "AUTH_CONFIG_INVALID",
+            message: `${path}.table is missing required columns: ${missing.join(", ")}.`,
+        });
+    }
+    return input;
+};
+const resolveSelect = ({ columns, defaults, input, path, }) => {
+    if (input === undefined) {
+        return defaults;
+    }
+    if (!Array.isArray(input) ||
+        input.some((field) => typeof field !== "string" || !field.trim()) ||
+        new Set(input).size !== input.length ||
+        input.some((field) => typeof field === "string" && isPrivateField(field)) ||
+        input.some((field) => typeof field === "string" && !(field in columns))) {
+        throw createError({
+            code: "AUTH_CONFIG_INVALID",
+            message: `${path}.select must contain unique public scalar column names.`,
+        });
+    }
+    return [...new Set([...defaults, ...input])];
+};
+const resolveAccess = ({ columns, input, path, }) => {
+    if (input === undefined) {
+        return {};
+    }
+    if (!isRecord(input) ||
+        Object.keys(input).some(isPrivateField) ||
+        Object.keys(input).some((field) => !(field in columns)) ||
+        Object.values(input).some((value) => !isAccessValue(value))) {
+        throw createError({
+            code: "AUTH_CONFIG_INVALID",
+            message: `${path}.access contains an invalid condition.`,
+        });
+    }
+    return input;
+};
+const resolveDataModel = ({ defaults, fields, input, path, }) => {
+    if (!isRecord(input)) {
+        throw createError({
+            code: "AUTH_CONFIG_INVALID",
+            message: `${path} model configuration is invalid.`,
+        });
+    }
+    const table = requireTable({ fields, input: input.table, path });
+    const columns = getTableColumns(table);
+    return {
+        access: resolveAccess({ columns, input: input.access, path }),
+        select: resolveSelect({ columns, defaults, input: input.select, path }),
+        table,
+    };
+};
+const resolveTableModel = ({ fields, input, path }) => {
+    if (!isRecord(input)) {
+        throw createError({
+            code: "AUTH_CONFIG_INVALID",
+            message: `${path} model configuration is invalid.`,
+        });
+    }
+    return requireTable({ fields, input: input.table, path });
+};
+export const resolveDrizzleModels = (input) => {
+    if (!isRecord(input)) {
+        throw createError({
+            code: "AUTH_CONFIG_INVALID",
+            message: "Drizzle models configuration is invalid.",
+        });
+    }
+    return {
+        accounts: resolveDataModel({
+            defaults: DRIZZLE_SELECT.accounts,
+            fields: DRIZZLE_FIELDS.accounts,
+            input: input.accounts,
+            path: "models.accounts",
+        }),
+        sessions: resolveTableModel({
+            fields: DRIZZLE_FIELDS.sessions,
+            input: input.sessions,
+            path: "models.sessions",
+        }),
+        socials: input.socials === undefined
+            ? null
+            : resolveTableModel({
+                fields: DRIZZLE_FIELDS.socials,
+                input: input.socials,
+                path: "models.socials",
+            }),
+        users: resolveDataModel({
+            defaults: DRIZZLE_SELECT.users,
+            fields: DRIZZLE_FIELDS.users,
+            input: input.users,
+            path: "models.users",
+        }),
+    };
+};
+export const getDrizzleSource = (table) => {
+    return getTableName(table);
+};
+//# sourceMappingURL=config.js.map

package/dist/adapters/drizzle/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/adapters/drizzle/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAA2B,MAAM,aAAa,CAAC;AAmCtE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC1B,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;IACpC,QAAQ,EAAE;QACN,YAAY;QACZ,OAAO;QACP,SAAS;QACT,YAAY;QACZ,YAAY;QACZ,IAAI;QACJ,IAAI;QACJ,UAAU;QACV,YAAY;QACZ,YAAY;QACZ,YAAY;KACf;IACD,OAAO,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC;IACtE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;CACf,CAAC;AAEX,MAAM,cAAc,GAAG;IACnB,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;CACf,CAAC;AAEX,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE;IACzD,OAAO,CACH,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,SAAS;QAC1B,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAW,EAAE;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAqB,EAAiB,EAAE;IAC/E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,IAAI,uCAAuC;SAC1D,CAAC,CAAC;IACP,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC;IAE9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,IAAI,uCAAuC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC/E,CAAC,CAAC;IACP,CAAC;IAED,OAAO,KAAsB,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,EACnB,OAAO,EACP,QAAQ,EACR,KAAK,EACL,IAAI,GACa,EAAqB,EAAE;IACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACpC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,EACzE,CAAC;QACC,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,IAAI,yDAAyD;SAC5E,CAAC,CAAC;IACP,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAI,KAAkB,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,EACnB,OAAO,EACP,KAAK,EACL,IAAI,GACa,EAAsC,EAAE;IACzD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IACI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAC7D,CAAC;QACC,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,IAAI,wCAAwC;SAC3D,CAAC,CAAC;IACP,CAAC;IAED,OAAO,KAA2C,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,EACtB,QAAQ,EACR,MAAM,EACN,KAAK,EACL,IAAI,GACgB,EAA4B,EAAE;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,IAAI,kCAAkC;SACrD,CAAC,CAAC;IACP,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEvC,OAAO;QACH,MAAM,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7D,MAAM,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACvE,KAAK;KACR,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAA0B,EAAiB,EAAE;IACzF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,IAAI,kCAAkC;SACrD,CAAC,CAAC;IACP,CAAC;IAED,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAyB,EAAE;IAC1E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,QAAQ,EAAE,gBAAgB,CAAC;YACvB,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,MAAM,EAAE,cAAc,CAAC,QAAQ;YAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,IAAI,EAAE,iBAAiB;SAC1B,CAAC;QACF,QAAQ,EAAE,iBAAiB,CAAC;YACxB,MAAM,EAAE,cAAc,CAAC,QAAQ;YAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,IAAI,EAAE,iBAAiB;SAC1B,CAAC;QACF,OAAO,EACH,KAAK,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,iBAAiB,CAAC;gBACd,MAAM,EAAE,cAAc,CAAC,OAAO;gBAC9B,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,IAAI,EAAE,gBAAgB;aACzB,CAAC;QACZ,KAAK,EAAE,gBAAgB,CAAC;YACpB,QAAQ,EAAE,cAAc,CAAC,KAAK;YAC9B,MAAM,EAAE,cAAc,CAAC,KAAK;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,cAAc;SACvB,CAAC;KACL,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAU,EAAE;IAC7D,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC,CAAC"}

package/dist/adapters/drizzle/index.d.ts

@@ -0,0 +1,4 @@
+import type { CreateDrizzleAdapter } from "./types.js";
+export type { DrizzleAccount, DrizzleAdapterInput, DrizzleDataModelConfig, DrizzleModelsConfig, DrizzleTableModelConfig, DrizzleUser, } from "./types.js";
+export declare const createDrizzleAdapter: CreateDrizzleAdapter;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/drizzle/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/drizzle/index.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACR,oBAAoB,EAMvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACR,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,GACd,MAAM,YAAY,CAAC;AAkCpB,eAAO,MAAM,oBAAoB,EAAE,oBAoLlC,CAAC"}

package/dist/adapters/drizzle/index.js

@@ -0,0 +1,156 @@
+import { randomUUID } from "node:crypto";
+import { and, desc, eq, getTableColumns, gt, inArray, isNull } from "drizzle-orm";
+import { createError } from "../../errors.js";
+import { isRecord } from "../../session/guards.js";
+import { DRIZZLE_FIELDS, resolveDrizzleModels } from "./config.js";
+import { createModelSelect, createSessionSelect, readAccount, requireAuthRow, requireRow, requireRows, } from "./model.js";
+const requireClient = (value) => {
+    if (!isRecord(value) ||
+        typeof value.insert !== "function" ||
+        typeof value.select !== "function" ||
+        typeof value.transaction !== "function" ||
+        typeof value.update !== "function") {
+        throw createError({
+            code: "AUTH_CONFIG_INVALID",
+            message: "Drizzle MySQL client is invalid.",
+        });
+    }
+    return value;
+};
+const getColumns = ({ fields, table, }) => {
+    const columns = getTableColumns(table);
+    return Object.fromEntries(fields.map((field) => [field, columns[field]]));
+};
+export const createDrizzleAdapter = (input) => {
+    const client = requireClient(input.client);
+    const models = resolveDrizzleModels(input.models);
+    const accountColumns = getColumns({
+        fields: DRIZZLE_FIELDS.accounts,
+        table: models.accounts.table,
+    });
+    const sessionColumns = getColumns({
+        fields: DRIZZLE_FIELDS.sessions,
+        table: models.sessions,
+    });
+    const userColumns = getColumns({
+        fields: DRIZZLE_FIELDS.users,
+        table: models.users.table,
+    });
+    const accountSelect = createModelSelect({ model: models.accounts });
+    const sessionSelect = createSessionSelect(models);
+    const userSelect = createModelSelect({ model: models.users });
+    const readSocialAccount = (value) => {
+        const resolved = readAccount({ models, value });
+        return {
+            account: resolved.account,
+            allowed: resolved.allowed,
+        };
+    };
+    const findAccount = async (where) => {
+        const rows = await client
+            .select({ account: accountSelect, user: userSelect })
+            .from(models.accounts.table)
+            .innerJoin(models.users.table, eq(accountColumns.user_id, userColumns.id))
+            .where(where)
+            .limit(1);
+        return rows[0] === undefined ? null : readSocialAccount(rows[0]);
+    };
+    const db = {
+        create: async (session) => {
+            await client.insert(models.sessions).values(session);
+        },
+        find: async ({ account_id, session_id }) => {
+            const rows = await client
+                .select(sessionSelect)
+                .from(models.sessions)
+                .where(and(eq(sessionColumns.account_id, account_id), eq(sessionColumns.id, session_id)))
+                .limit(1);
+            return rows[0] === undefined ? null : requireRow(rows[0]);
+        },
+        findActive: async ({ account_id, now }) => {
+            const rows = await client
+                .select(sessionSelect)
+                .from(models.sessions)
+                .where(and(eq(sessionColumns.account_id, account_id), gt(sessionColumns.expires_at, now), isNull(sessionColumns.revoked_at)))
+                .orderBy(desc(sessionColumns.created_at));
+            return requireRows(rows);
+        },
+        findToken: async (token_hash) => {
+            const rows = await client
+                .select({
+                account: accountSelect,
+                session: sessionSelect,
+                user: userSelect,
+            })
+                .from(models.sessions)
+                .innerJoin(models.accounts.table, eq(sessionColumns.account_id, accountColumns.id))
+                .innerJoin(models.users.table, eq(accountColumns.user_id, userColumns.id))
+                .where(eq(sessionColumns.token_hash, token_hash))
+                .limit(1);
+            return rows[0] === undefined
+                ? null
+                : requireAuthRow({ models, value: rows[0] });
+        },
+        revoke: async ({ revoked_at, session_ids }) => {
+            if (session_ids.length === 0) {
+                return;
+            }
+            await client
+                .update(models.sessions)
+                .set({
+                revoked_at,
+                updated_at: revoked_at,
+            })
+                .where(and(inArray(sessionColumns.id, session_ids), isNull(sessionColumns.revoked_at)));
+        },
+        updateExpiry: async ({ expires_at, session_id, updated_at }) => {
+            await client
+                .update(models.sessions)
+                .set({ expires_at, updated_at })
+                .where(eq(sessionColumns.id, session_id));
+        },
+    };
+    const socialTable = models.socials;
+    if (socialTable === null) {
+        return db;
+    }
+    const socialColumns = getColumns({
+        fields: DRIZZLE_FIELDS.socials,
+        table: socialTable,
+    });
+    const social = {
+        createAccount: async ({ email, name }) => {
+            return client.transaction(async (transaction) => {
+                const accountId = randomUUID();
+                const userId = randomUUID();
+                await transaction.insert(models.users.table).values({
+                    id: userId,
+                    name,
+                });
+                await transaction.insert(models.accounts.table).values({
+                    email,
+                    id: accountId,
+                    user_id: userId,
+                });
+                return accountId;
+            });
+        },
+        createSocial: async (socialRecord) => {
+            await client.insert(socialTable).values(socialRecord);
+        },
+        findAccount: async (account_id) => findAccount(eq(accountColumns.id, account_id)),
+        findEmail: async (email) => findAccount(eq(accountColumns.email, email)),
+        findSocial: async ({ provider, provider_id }) => {
+            const rows = await client
+                .select({ account: accountSelect, user: userSelect })
+                .from(socialTable)
+                .innerJoin(models.accounts.table, eq(socialColumns.account_id, accountColumns.id))
+                .innerJoin(models.users.table, eq(accountColumns.user_id, userColumns.id))
+                .where(and(eq(socialColumns.provider, provider), eq(socialColumns.provider_id, provider_id)))
+                .limit(1);
+            return rows[0] === undefined ? null : readSocialAccount(rows[0]);
+        },
+    };
+    return { ...db, ...social };
+};
+//# sourceMappingURL=index.js.map

package/dist/adapters/drizzle/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/drizzle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAY,MAAM,aAAa,CAAC;AAE5F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACH,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,UAAU,EACV,WAAW,GACd,MAAM,YAAY,CAAC;AAmBpB,MAAM,aAAa,GAAG,CAAC,KAAc,EAAiB,EAAE;IACpD,IACI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU;QAClC,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU;QAClC,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU;QACvC,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,EACpC,CAAC;QACC,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,kCAAkC;SAC9C,CAAC,CAAC;IACP,CAAC;IAED,OAAO,KAAiC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAyC,EACxD,MAAM,EACN,KAAK,GAIR,EAAuC,EAAE;IACtC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAGvE,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAyB,CAGtD,KAAkC,EACjB,EAAE;IAGnB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,UAAU,CAAC;QAC9B,MAAM,EAAE,cAAc,CAAC,QAAQ;QAC/B,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;KAC/B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,UAAU,CAAC;QAC9B,MAAM,EAAE,cAAc,CAAC,QAAQ;QAC/B,KAAK,EAAE,MAAM,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,UAAU,CAAC;QAC3B,MAAM,EAAE,cAAc,CAAC,KAAK;QAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;KAC5B,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE9D,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAE,EAAE;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhD,OAAO;YACH,OAAO,EAAE,QAAQ,CAAC,OAAsB;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC5B,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EAAE,KAAU,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,MAAM;aACpB,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;aACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;aAC3B,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;aACzE,KAAK,CAAC,KAAK,CAAC;aACZ,KAAK,CAAC,CAAC,CAAC,CAAC;QAEd,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,EAAE,GAA2B;QAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACtB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,MAAM;iBACpB,MAAM,CAAC,aAAa,CAAC;iBACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;iBACrB,KAAK,CACF,GAAG,CACC,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,EACzC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,CAAC,CACpC,CACJ;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YAEd,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,MAAM,MAAM;iBACpB,MAAM,CAAC,aAAa,CAAC;iBACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;iBACrB,KAAK,CACF,GAAG,CACC,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,EACzC,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,EAClC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CACpC,CACJ;iBACA,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;YAE9C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,MAAM,MAAM;iBACpB,MAAM,CAAC;gBACJ,OAAO,EAAE,aAAa;gBACtB,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,UAAU;aACnB,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;iBACrB,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;iBAClF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;iBACzE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;iBAChD,KAAK,CAAC,CAAC,CAAC,CAAC;YAEd,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBACxB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAE,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAoC,CAAC;QACzF,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,EAAE;YAC1C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACX,CAAC;YAED,MAAM,MAAM;iBACP,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;iBACvB,GAAG,CAAC;gBACD,UAAU;gBACV,UAAU,EAAE,UAAU;aACzB,CAAC;iBACD,KAAK,CACF,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAClF,CAAC;QACV,CAAC;QAED,YAAY,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE;YAC3D,MAAM,MAAM;iBACP,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;iBACvB,GAAG,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;iBAC/B,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAClD,CAAC;KACJ,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;IAEnC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAuB,CAAC;IACnC,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC;QAC7B,MAAM,EAAE,cAAc,CAAC,OAAO;QAC9B,KAAK,EAAE,WAAW;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAiC;QACzC,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;YACrC,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;gBAC5C,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;gBAE5B,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;oBAChD,EAAE,EAAE,MAAM;oBACV,IAAI;iBACP,CAAC,CAAC;gBACH,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;oBACnD,KAAK;oBACL,EAAE,EAAE,SAAS;oBACb,OAAO,EAAE,MAAM;iBAClB,CAAC,CAAC;gBAEH,OAAO,SAAS,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACjC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAEjF,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAExE,UAAU,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,MAAM,MAAM;iBACpB,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;iBACpD,IAAI,CAAC,WAAW,CAAC;iBACjB,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;iBACjF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;iBACzE,KAAK,CACF,GAAG,CACC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACpC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAC7C,CACJ;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YAEd,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;KACJ,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,EAAkC,CAAC;AAChE,CAAC,CAAC"}

package/dist/adapters/drizzle/model.d.ts

@@ -0,0 +1,21 @@
+import type { SelectedFieldsFlat } from "drizzle-orm/mysql-core";
+import type { AuthSessionRecord, SessionRecord } from "../../session/types.js";
+import type { ResolvedDrizzleDataModel, ResolvedDrizzleModels } from "./types.js";
+type ReadAccountInput = {
+    models: ResolvedDrizzleModels;
+    value: unknown;
+};
+type CreateModelSelectInput = {
+    model: ResolvedDrizzleDataModel;
+};
+export declare const createModelSelect: ({ model }: CreateModelSelectInput) => SelectedFieldsFlat;
+export declare const createSessionSelect: (models: ResolvedDrizzleModels) => SelectedFieldsFlat;
+export declare const readAccount: ({ models, value }: ReadAccountInput) => {
+    account: import("../../session/types.js").AuthAccount;
+    allowed: boolean;
+};
+export declare const requireRow: (value: unknown) => SessionRecord;
+export declare const requireRows: (value: unknown) => SessionRecord[];
+export declare const requireAuthRow: ({ models, value }: ReadAccountInput) => AuthSessionRecord;
+export {};
+//# sourceMappingURL=model.d.ts.map

package/dist/adapters/drizzle/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/adapters/drizzle/model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAe,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAElF,KAAK,gBAAgB,GAAG;IACpB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC1B,KAAK,EAAE,wBAAwB,CAAC;CACnC,CAAC;AAaF,eAAO,MAAM,iBAAiB,GAAI,WAAW,sBAAsB,KAAG,kBAKrE,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,QAAQ,qBAAqB,KAAG,kBASnE,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,mBAAmB,gBAAgB;;;CAkB9D,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,OAAO,KAAG,aAE3C,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,OAAO,OAAO,KAAG,aAAa,EAEzD,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,mBAAmB,gBAAgB,KAAG,iBAapE,CAAC"}

package/dist/adapters/drizzle/model.js

@@ -0,0 +1,61 @@
+import { getTableColumns } from "drizzle-orm";
+import { isRecord } from "../../session/guards.js";
+import { readAdapterAccount, requireSessionRecord, requireSessionRecords } from "../model.js";
+import { DRIZZLE_FIELDS, getDrizzleSource } from "./config.js";
+const pickColumns = ({ fields, model }) => {
+    const columns = getTableColumns(model.table);
+    return Object.fromEntries(fields.map((field) => [field, columns[field]]));
+};
+export const createModelSelect = ({ model }) => {
+    return pickColumns({
+        fields: [...new Set([...model.select, ...Object.keys(model.access)])],
+        model,
+    });
+};
+export const createSessionSelect = (models) => {
+    return pickColumns({
+        fields: DRIZZLE_FIELDS.sessions.filter((field) => field !== "country"),
+        model: {
+            access: {},
+            select: [],
+            table: models.sessions,
+        },
+    });
+};
+export const readAccount = ({ models, value }) => {
+    if (!isRecord(value)) {
+        throw new Error("Drizzle account relation returned invalid data.");
+    }
+    return readAdapterAccount({
+        account: value.account,
+        accounts: {
+            ...models.accounts,
+            source: getDrizzleSource(models.accounts.table),
+        },
+        adapter: "Drizzle",
+        user: value.user,
+        users: {
+            ...models.users,
+            source: getDrizzleSource(models.users.table),
+        },
+    });
+};
+export const requireRow = (value) => {
+    return requireSessionRecord({ adapter: "Drizzle", value });
+};
+export const requireRows = (value) => {
+    return requireSessionRecords({ adapter: "Drizzle", value });
+};
+export const requireAuthRow = ({ models, value }) => {
+    if (!isRecord(value)) {
+        throw new Error("Drizzle session table returned invalid data.");
+    }
+    const session = requireRow(value.session);
+    const resolved = readAccount({ models, value });
+    return {
+        ...session,
+        account: resolved.account,
+        allowed: resolved.allowed,
+    };
+};
+//# sourceMappingURL=model.js.map

package/dist/adapters/drizzle/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/adapters/drizzle/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAiB/D,MAAM,WAAW,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAoB,EAAsB,EAAE;IAC5E,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAgC,CAAC;IAE5E,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAuB,CAAC;AACpG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAE,KAAK,EAA0B,EAAsB,EAAE;IACvF,OAAO,WAAW,CAAC;QACf,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK;KACR,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAA6B,EAAsB,EAAE;IACrF,OAAO,WAAW,CAAC;QACf,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACtE,KAAK,EAAE;YACH,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,MAAM,CAAC,QAAQ;SACzB;KACJ,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAoB,EAAE,EAAE;IAC/D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,kBAAkB,CAAC;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE;YACN,GAAG,MAAM,CAAC,QAAQ;YAClB,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;SAClD;QACD,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE;YACH,GAAG,MAAM,CAAC,KAAK;YACf,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;SAC/C;KACJ,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAc,EAAiB,EAAE;IACxD,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAmB,EAAE;IAC3D,OAAO,qBAAqB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAoB,EAAqB,EAAE;IACrF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhD,OAAO;QACH,GAAG,OAAO;QACV,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC5B,CAAC;AACN,CAAC,CAAC"}