@growth-labs/auth 0.11.0 → 0.12.0

package/dist/workers.js

@@ -0,0 +1,516 @@
+import { createClientSecretBasicAuthHeader } from './utils/client-secret-header.js';
+import { getCookie, setCookie } from './utils/cookies.js';
+import { extractIdentityId } from './utils/identity.js';
+import { resolveInternalIssuer } from './utils/issuer.js';
+import { generatePKCE } from './utils/pkce.js';
+import { generateState, verifyState } from './utils/state.js';
+import { verifyAccessToken } from './utils/tokens.js';
+const DEFAULT_CALLBACK_PATH = '/api/auth/callback';
+const DEFAULT_LOGIN_PATH = '/login';
+const DEFAULT_ACCESS_TOKEN_MAX_AGE = 900;
+const DEFAULT_REFRESH_TOKEN_MAX_AGE = 2_592_000;
+const DEFAULT_TRANSACTION_MAX_AGE = 600;
+const DEFAULT_CLOCK_SKEW = 60;
+export class WorkersAuthServiceUnavailableError extends Error {
+    code = 'AUTH_SERVICE_UNAVAILABLE';
+    status = 503;
+    constructor() {
+        super('Auth service unavailable');
+        this.name = 'WorkersAuthServiceUnavailableError';
+    }
+}
+function normalizeIssuer(value, label) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new TypeError(`${label} must be an absolute HTTP URL`);
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        (url.pathname !== '/' && url.pathname !== '') ||
+        url.search !== '' ||
+        url.hash !== '') {
+        throw new TypeError(`${label} must be an origin without credentials, path, query, or fragment`);
+    }
+    return url.origin;
+}
+function validateResource(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new TypeError('resource must be an absolute HTTP URL');
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.hash !== '') {
+        throw new TypeError('resource must be an absolute HTTP URL without credentials or fragment');
+    }
+    return value;
+}
+function isSafeAbsolutePath(path) {
+    const lower = path.toLowerCase();
+    if (!path.startsWith('/') ||
+        path.startsWith('//') ||
+        path.includes('\\') ||
+        lower.includes('%2f') ||
+        lower.includes('%5c')) {
+        return false;
+    }
+    try {
+        const parsed = new URL(path, 'https://local.invalid');
+        return parsed.origin === 'https://local.invalid';
+    }
+    catch {
+        return false;
+    }
+}
+function isSafeLocalRoute(path) {
+    if (!isSafeAbsolutePath(path))
+        return false;
+    const parsed = new URL(path, 'https://local.invalid');
+    return parsed.search === '' && parsed.hash === '';
+}
+function safeRedirect(path) {
+    return path !== null && isSafeAbsolutePath(path) ? path : '/';
+}
+function positiveSeconds(value, fallback, label) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new TypeError(`${label} must be a positive integer number of seconds`);
+    }
+    return value;
+}
+function normalizeConfig(config) {
+    const issuer = normalizeIssuer(config.issuer, 'issuer');
+    const issuerInternal = config.issuerInternal
+        ? normalizeIssuer(config.issuerInternal, 'issuerInternal')
+        : issuer;
+    if (typeof config.clientId !== 'string' || config.clientId.trim() === '') {
+        throw new TypeError('clientId is required');
+    }
+    if (typeof config.cookiePrefix !== 'string' || !/^[A-Za-z0-9_-]+$/.test(config.cookiePrefix)) {
+        throw new TypeError('cookiePrefix must contain only letters, numbers, underscores, or hyphens');
+    }
+    const callbackPath = config.callbackPath ?? DEFAULT_CALLBACK_PATH;
+    const loginPath = config.loginPath ?? DEFAULT_LOGIN_PATH;
+    if (!isSafeLocalRoute(callbackPath))
+        throw new TypeError('callbackPath must be a local route');
+    if (!isSafeLocalRoute(loginPath))
+        throw new TypeError('loginPath must be a local route');
+    if (!Array.isArray(config.providers) || config.providers.length === 0) {
+        throw new TypeError('at least one provider is required');
+    }
+    if (config.providers.some((provider) => typeof provider !== 'string' || provider.trim() === '')) {
+        throw new TypeError('providers must be non-empty strings');
+    }
+    const gatedPaths = [...(config.gatedPaths ?? [])];
+    for (const pattern of gatedPaths) {
+        const route = pattern.endsWith('/*') ? pattern.slice(0, -1) : pattern;
+        if (!isSafeLocalRoute(route))
+            throw new TypeError('gatedPaths must contain local routes');
+    }
+    if (config.sessionCookieDomain !== undefined &&
+        (!/^(?:\.?[A-Za-z0-9-]+)(?:\.[A-Za-z0-9-]+)*$/.test(config.sessionCookieDomain) ||
+            config.sessionCookieDomain.includes('..'))) {
+        throw new TypeError('sessionCookieDomain is invalid');
+    }
+    return {
+        issuer,
+        issuerInternal,
+        clientId: config.clientId,
+        clientSecret: config.clientSecret,
+        resource: validateResource(config.resource),
+        callbackPath,
+        cookiePrefix: config.cookiePrefix,
+        sessionCookieDomain: config.sessionCookieDomain,
+        providers: [...config.providers],
+        gatedPaths,
+        loginPath,
+        accessTokenMaxAge: positiveSeconds(config.accessTokenMaxAge, DEFAULT_ACCESS_TOKEN_MAX_AGE, 'accessTokenMaxAge'),
+        refreshTokenMaxAge: positiveSeconds(config.refreshTokenMaxAge, DEFAULT_REFRESH_TOKEN_MAX_AGE, 'refreshTokenMaxAge'),
+        transactionMaxAge: positiveSeconds(config.transactionMaxAge, DEFAULT_TRANSACTION_MAX_AGE, 'transactionMaxAge'),
+        clockSkew: positiveSeconds(config.clockSkew, DEFAULT_CLOCK_SKEW, 'clockSkew'),
+    };
+}
+function requestFrom(input) {
+    if (input instanceof Request)
+        return input;
+    if (input && input.req?.raw instanceof Request)
+        return input.req.raw;
+    throw new TypeError('expected a Web Request or Hono Context');
+}
+function cookieName(config, suffix) {
+    return `${config.cookiePrefix}_${suffix}`;
+}
+function setSecureCookie(response, name, value, path, maxAge, domain) {
+    setCookie(response, name, value, {
+        path,
+        maxAge,
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        ...(domain ? { domain } : {}),
+    });
+}
+function setTransactionCookies(config, response, transaction) {
+    const callbackNames = ['pkce', 'callback', 'expires'];
+    const callbackValues = [
+        transaction.verifier,
+        transaction.callback,
+        String(transaction.expires),
+    ];
+    for (let index = 0; index < callbackNames.length; index += 1) {
+        setSecureCookie(response, cookieName(config, callbackNames[index]), callbackValues[index], config.callbackPath, config.transactionMaxAge);
+    }
+    for (const [suffix, value] of [
+        ['state', transaction.state],
+        ['redirect', transaction.redirect],
+        ['provider', transaction.provider],
+    ]) {
+        setSecureCookie(response, cookieName(config, suffix), value, '/', config.transactionMaxAge);
+    }
+}
+function clearTransactionCookies(config, response) {
+    for (const suffix of ['pkce', 'callback', 'expires']) {
+        setSecureCookie(response, cookieName(config, suffix), '', config.callbackPath, 0);
+    }
+    for (const suffix of ['state', 'redirect', 'provider']) {
+        setSecureCookie(response, cookieName(config, suffix), '', '/', 0);
+    }
+}
+function setSessionCookiesNormalized(config, response, tokens) {
+    const mutable = cloneMutableResponse(response);
+    appendSessionCookiesNormalized(config, mutable, tokens);
+    return mutable;
+}
+function appendSessionCookiesNormalized(config, response, tokens) {
+    setSecureCookie(response, cookieName(config, 'at'), tokens.AccessToken, '/', config.accessTokenMaxAge, config.sessionCookieDomain);
+    setSecureCookie(response, cookieName(config, 'rt'), tokens.RefreshToken, '/', config.refreshTokenMaxAge, config.sessionCookieDomain);
+}
+function clearSessionCookiesNormalized(config, response) {
+    const mutable = cloneMutableResponse(response);
+    setSecureCookie(mutable, cookieName(config, 'at'), '', '/', 0, config.sessionCookieDomain);
+    setSecureCookie(mutable, cookieName(config, 'rt'), '', '/', 0, config.sessionCookieDomain);
+    return mutable;
+}
+function cloneMutableResponse(response) {
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: new Headers(response.headers),
+    });
+}
+function clearTerminalTransaction(config, response) {
+    clearTransactionCookies(config, response);
+    return response;
+}
+function serviceUnavailable(request) {
+    const headers = {
+        'Cache-Control': 'private, no-store',
+        Pragma: 'no-cache',
+        Expires: '0',
+    };
+    const acceptsJson = request.headers
+        .get('accept')
+        ?.split(',')
+        .some((part) => part.split(';', 1)[0].trim().toLowerCase() === 'application/json');
+    if (acceptsJson) {
+        return Response.json({ error: 'auth_service_unavailable' }, { status: 503, headers });
+    }
+    return new Response('Service unavailable', { status: 503, headers });
+}
+async function resolveSecret(config, request) {
+    const source = config.clientSecret;
+    if (source === undefined)
+        return null;
+    let value;
+    try {
+        if (source instanceof Uint8Array) {
+            value = source;
+        }
+        else if (typeof source === 'function') {
+            value = await source(request);
+        }
+        else if ('resolve' in source && typeof source.resolve === 'function') {
+            value = await source.resolve(request);
+        }
+        else if ('get' in source && typeof source.get === 'function') {
+            value = await source.get();
+        }
+    }
+    catch {
+        throw new WorkersAuthServiceUnavailableError();
+    }
+    let secret;
+    try {
+        secret =
+            value instanceof Uint8Array
+                ? new TextDecoder('utf-8', { fatal: true }).decode(value)
+                : typeof value === 'string'
+                    ? value
+                    : '';
+    }
+    catch {
+        throw new WorkersAuthServiceUnavailableError();
+    }
+    if (secret.trim() === '')
+        throw new WorkersAuthServiceUnavailableError();
+    return secret;
+}
+function principalFromClaims(claims) {
+    try {
+        const userId = claims.userId ?? extractIdentityId(claims.sub);
+        return {
+            Subject: claims.sub,
+            UserID: userId,
+            Email: claims.email,
+            Name: claims.name ?? '',
+            Image: claims.image ?? '',
+            Roles: [...(claims.roles ?? [])],
+            Audiences: [...(claims.audiences ?? [])],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function verifyToken(config, token) {
+    const claims = await verifyAccessToken(config.issuer, token, {
+        audience: config.resource,
+        algorithms: ['ES256'],
+        jwksIssuer: resolveInternalIssuer(config),
+        requireUserToken: true,
+        clockSkew: config.clockSkew,
+    });
+    return claims ? principalFromClaims(claims) : null;
+}
+async function requestTokens(config, request, form) {
+    const secret = await resolveSecret(config, request);
+    const headers = new Headers({ 'Content-Type': 'application/x-www-form-urlencoded' });
+    if (secret !== null) {
+        headers.set('Authorization', createClientSecretBasicAuthHeader(config.clientId, secret));
+    }
+    let response;
+    try {
+        response = await fetch(`${config.issuerInternal}/token`, {
+            method: 'POST',
+            headers,
+            body: form.toString(),
+        });
+    }
+    catch {
+        return null;
+    }
+    if (!response.ok)
+        return null;
+    let data;
+    try {
+        data = await response.json();
+    }
+    catch {
+        return null;
+    }
+    if (typeof data !== 'object' ||
+        data === null ||
+        typeof data.access_token !== 'string' ||
+        typeof data.refresh_token !== 'string') {
+        return null;
+    }
+    const tokens = {
+        AccessToken: data.access_token,
+        RefreshToken: data.refresh_token,
+    };
+    const principal = await verifyToken(config, tokens.AccessToken);
+    return principal ? { tokens, principal } : null;
+}
+export async function Authorize(config, requestOrContext, provider, redirectPath) {
+    const normalized = normalizeConfig(config);
+    if (!normalized.providers.includes(provider))
+        throw new TypeError('provider is not configured');
+    const request = requestFrom(requestOrContext);
+    const requestUrl = new URL(request.url);
+    const callback = `${requestUrl.origin}${normalized.callbackPath}`;
+    const { verifier, challenge } = await generatePKCE();
+    const state = generateState();
+    const redirect = safeRedirect(redirectPath);
+    const expires = Math.floor(Date.now() / 1000) + normalized.transactionMaxAge;
+    const authorizationUrl = new URL(`${normalized.issuer}/authorize`);
+    for (const [key, value] of [
+        ['response_type', 'code'],
+        ['client_id', normalized.clientId],
+        ['redirect_uri', callback],
+        ['scope', 'openid email profile'],
+        ['state', state],
+        ['code_challenge', challenge],
+        ['code_challenge_method', 'S256'],
+        ['provider', provider === 'email-code' ? 'code' : provider],
+        ['resource', normalized.resource],
+    ]) {
+        authorizationUrl.searchParams.set(key, value);
+    }
+    const response = new Response(null, {
+        status: 302,
+        headers: { Location: authorizationUrl.toString() },
+    });
+    setTransactionCookies(normalized, response, {
+        verifier,
+        callback,
+        expires,
+        state,
+        redirect,
+        provider,
+    });
+    return response;
+}
+export async function Callback(config, requestOrContext) {
+    const normalized = normalizeConfig(config);
+    const request = requestFrom(requestOrContext);
+    const url = new URL(request.url);
+    const state = url.searchParams.get('state') ?? '';
+    const storedState = getCookie(request, cookieName(normalized, 'state')) ?? '';
+    const callback = getCookie(request, cookieName(normalized, 'callback'));
+    const expectedCallback = `${url.origin}${normalized.callbackPath}`;
+    const storedExpires = getCookie(request, cookieName(normalized, 'expires')) ?? '';
+    const expires = /^(?:0|[1-9]\d*)$/.test(storedExpires) ? Number(storedExpires) : Number.NaN;
+    if (url.pathname !== normalized.callbackPath || !verifyState(state, storedState)) {
+        return new Response('Invalid state parameter', { status: 403 });
+    }
+    if (callback !== expectedCallback ||
+        !Number.isSafeInteger(expires) ||
+        Math.floor(Date.now() / 1000) >= expires) {
+        return clearTerminalTransaction(normalized, new Response('Invalid state parameter', { status: 403 }));
+    }
+    const verifier = getCookie(request, cookieName(normalized, 'pkce'));
+    if (!verifier) {
+        return clearTerminalTransaction(normalized, new Response('Missing PKCE verifier', { status: 400 }));
+    }
+    const code = url.searchParams.get('code');
+    if (url.searchParams.has('error') || !code) {
+        return clearTerminalTransaction(normalized, new Response(null, {
+            status: 302,
+            headers: { Location: `${normalized.loginPath}?error=auth_failed` },
+        }));
+    }
+    const form = new URLSearchParams();
+    form.set('grant_type', 'authorization_code');
+    form.set('code', code);
+    form.set('code_verifier', verifier);
+    form.set('redirect_uri', callback);
+    form.set('client_id', normalized.clientId);
+    form.set('resource', normalized.resource);
+    let result;
+    try {
+        result = await requestTokens(normalized, request, form);
+    }
+    catch (error) {
+        if (error instanceof WorkersAuthServiceUnavailableError) {
+            return clearTerminalTransaction(normalized, serviceUnavailable(request));
+        }
+        throw error;
+    }
+    if (!result) {
+        return clearTerminalTransaction(normalized, new Response(null, {
+            status: 302,
+            headers: { Location: `${normalized.loginPath}?error=auth_failed` },
+        }));
+    }
+    let response = new Response(null, {
+        status: 302,
+        headers: { Location: safeRedirect(getCookie(request, cookieName(normalized, 'redirect'))) },
+    });
+    response = setSessionCookiesNormalized(normalized, response, result.tokens);
+    clearTransactionCookies(normalized, response);
+    return response;
+}
+async function getSessionNormalized(config, request) {
+    const accessToken = getCookie(request, cookieName(config, 'at')) ?? '';
+    const refreshToken = getCookie(request, cookieName(config, 'rt')) ?? '';
+    if (accessToken) {
+        const principal = await verifyToken(config, accessToken);
+        if (principal) {
+            return {
+                Principal: principal,
+                Tokens: { AccessToken: accessToken, RefreshToken: refreshToken },
+                Refreshed: false,
+            };
+        }
+    }
+    if (refreshToken) {
+        const form = new URLSearchParams();
+        form.set('grant_type', 'refresh_token');
+        form.set('refresh_token', refreshToken);
+        form.set('client_id', config.clientId);
+        form.set('resource', config.resource);
+        const result = await requestTokens(config, request, form);
+        if (result) {
+            return { Principal: result.principal, Tokens: result.tokens, Refreshed: true };
+        }
+    }
+    return { Principal: null, Tokens: null, Refreshed: false };
+}
+export async function getSession(config, requestOrContext) {
+    return getSessionNormalized(normalizeConfig(config), requestFrom(requestOrContext));
+}
+export function setSessionCookies(config, response, tokens) {
+    return setSessionCookiesNormalized(normalizeConfig(config), response, tokens);
+}
+export function clearSessionCookies(config, response) {
+    return clearSessionCookiesNormalized(normalizeConfig(config), response);
+}
+export function Principal(source) {
+    if ('Principal' in source)
+        return source.Principal;
+    return source.get('principal') ?? null;
+}
+function isGated(config, path) {
+    return config.gatedPaths.some((pattern) => pattern.endsWith('/*') ? path.startsWith(pattern.slice(0, -1)) : path === pattern);
+}
+export function Middleware(config) {
+    const normalized = normalizeConfig(config);
+    return async (context, next) => {
+        const request = context.req.raw;
+        let session;
+        try {
+            session = await getSessionNormalized(normalized, request);
+        }
+        catch (error) {
+            if (error instanceof WorkersAuthServiceUnavailableError)
+                return serviceUnavailable(request);
+            throw error;
+        }
+        context.set('session', session);
+        context.set('principal', session.Principal);
+        if (!session.Principal && isGated(normalized, new URL(request.url).pathname)) {
+            const login = new URL(normalized.loginPath, request.url);
+            login.searchParams.set('redirect', new URL(request.url).pathname);
+            return context.redirect(login.toString(), 302);
+        }
+        await next();
+        if (session.Refreshed && session.Tokens) {
+            context.res = cloneMutableResponse(context.res);
+            appendSessionCookiesNormalized(normalized, context.res, session.Tokens);
+        }
+    };
+}
+export function New(config) {
+    const normalized = normalizeConfig(config);
+    const stableConfig = normalized;
+    return {
+        Authorize: (requestOrContext, provider, redirectPath) => Authorize(stableConfig, requestOrContext, provider, redirectPath),
+        Callback: (requestOrContext) => Callback(stableConfig, requestOrContext),
+        Middleware: () => Middleware(stableConfig),
+        Principal,
+        getSession: (requestOrContext) => getSession(stableConfig, requestOrContext),
+        setSessionCookies: (response, tokens) => setSessionCookies(stableConfig, response, tokens),
+        clearSessionCookies: (response) => clearSessionCookies(stableConfig, response),
+    };
+}
+export const createWorkersAuth = New;
+//# sourceMappingURL=workers.js.map

package/dist/workers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workers.js","sourceRoot":"","sources":["../src/workers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAA;AACnF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAuB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1E,MAAM,qBAAqB,GAAG,oBAAoB,CAAA;AAClD,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AACnC,MAAM,4BAA4B,GAAG,GAAG,CAAA;AACxC,MAAM,6BAA6B,GAAG,SAAS,CAAA;AAC/C,MAAM,2BAA2B,GAAG,GAAG,CAAA;AACvC,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAsG7B,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IACnD,IAAI,GAAG,0BAA0B,CAAA;IACjC,MAAM,GAAG,GAAG,CAAA;IAErB;QACC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAA;IACjD,CAAC;CACD;AAgBD,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAA;IAC7D,CAAC;IACD,IACC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACd,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,kEAAkE,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACtC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;IAC7D,CAAC;IACD,IACC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,IAAI,KAAK,EAAE,EACd,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,uEAAuE,CAAC,CAAA;IAC7F,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,IACC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EACpB,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;QACrD,OAAO,MAAM,CAAC,MAAM,KAAK,uBAAuB,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACrD,OAAO,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,CAAA;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IACxC,OAAO,IAAI,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB,EAAE,KAAa;IAClF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IACjD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc;QAC3C,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAC1D,CAAC,CAAC,MAAM,CAAA;IACT,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAA;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACxD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAA;IAC9F,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAA;IACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAA;IACjD,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QACrE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC1F,CAAC;IACD,IACC,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACxC,CAAC,CAAC,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC9E,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAC1C,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO;QACN,MAAM;QACN,cAAc;QACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;QAChC,UAAU;QACV,SAAS;QACT,iBAAiB,EAAE,eAAe,CACjC,MAAM,CAAC,iBAAiB,EACxB,4BAA4B,EAC5B,mBAAmB,CACnB;QACD,kBAAkB,EAAE,eAAe,CAClC,MAAM,CAAC,kBAAkB,EACzB,6BAA6B,EAC7B,oBAAoB,CACpB;QACD,iBAAiB,EAAE,eAAe,CACjC,MAAM,CAAC,iBAAiB,EACxB,2BAA2B,EAC3B,mBAAmB,CACnB;QACD,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,EAAE,WAAW,CAAC;KAC7E,CAAA;AACF,CAAC;AAED,SAAS,WAAW,CAAC,KAA2B;IAC/C,IAAI,KAAK,YAAY,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1C,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,OAAO;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAA;IACpE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,MAAmC,EAAE,MAAc;IACtE,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAA;AAC1C,CAAC;AAED,SAAS,eAAe,CACvB,QAAkB,EAClB,IAAY,EACZ,KAAa,EACb,IAAY,EACZ,MAAc,EACd,MAAe;IAEf,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;QAChC,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7B,CAAC,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAmC,EACnC,QAAkB,EAClB,WAOC;IAED,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAU,CAAA;IAC9D,MAAM,cAAc,GAAG;QACtB,WAAW,CAAC,QAAQ;QACpB,WAAW,CAAC,QAAQ;QACpB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;KAClB,CAAA;IACV,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,eAAe,CACd,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EACxC,cAAc,CAAC,KAAK,CAAC,EACrB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,iBAAiB,CACxB,CAAA;IACF,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC;QAC5B,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC;QAClC,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC;KACzB,EAAE,CAAC;QACZ,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAC5F,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAmC,EAAE,QAAkB;IACvF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;QACtD,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACxD,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAClE,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B,CACnC,MAAmC,EACnC,QAAkB,EAClB,MAAc;IAEd,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC9C,8BAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,8BAA8B,CACtC,MAAmC,EACnC,QAAkB,EAClB,MAAc;IAEd,eAAe,CACd,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EACxB,MAAM,CAAC,WAAW,EAClB,GAAG,EACH,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,mBAAmB,CAC1B,CAAA;IACD,eAAe,CACd,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EACxB,MAAM,CAAC,YAAY,EACnB,GAAG,EACH,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,mBAAmB,CAC1B,CAAA;AACF,CAAC;AAED,SAAS,6BAA6B,CACrC,MAAmC,EACnC,QAAkB;IAElB,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC9C,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC1F,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC1F,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAkB;IAC/C,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAmC,EACnC,QAAkB;IAElB,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACzC,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG;QACf,eAAe,EAAE,mBAAmB;QACpC,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,GAAG;KACZ,CAAA;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO;SACjC,GAAG,CAAC,QAAQ,CAAC;QACd,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB,CAAC,CAAA;IACnF,IAAI,WAAW,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,MAAmC,EACnC,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAA;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACJ,IAAI,MAAM,YAAY,UAAU,EAAE,CAAC;YAClC,KAAK,GAAG,MAAM,CAAA;QACf,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACzC,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACxE,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACtC,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QAC3B,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kCAAkC,EAAE,CAAA;IAC/C,CAAC;IACD,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACJ,MAAM;YACL,KAAK,YAAY,UAAU;gBAC1B,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBAC1B,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,EAAE,CAAA;IACR,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kCAAkC,EAAE,CAAA;IAC/C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,kCAAkC,EAAE,CAAA;IACxE,OAAO,MAAM,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAsB;IAClD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7D,OAAO;YACN,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAChC,SAAS,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;SACxC,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,MAAmC,EACnC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;QAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,UAAU,EAAE,qBAAqB,CAAC,MAAM,CAAC;QACzC,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,MAAmC,EACnC,OAAgB,EAChB,IAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC,CAAA;IACpF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,iCAAiC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,cAAc,QAAQ,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IACC,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,OAAQ,IAAmC,CAAC,YAAY,KAAK,QAAQ;QACrE,OAAQ,IAAoC,CAAC,aAAa,KAAK,QAAQ,EACtE,CAAC;QACF,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,MAAM,GAAW;QACtB,WAAW,EAAG,IAAiC,CAAC,YAAY;QAC5D,YAAY,EAAG,IAAkC,CAAC,aAAa;KAC/D,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;IAC/D,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,MAAyB,EACzB,gBAAsC,EACtC,QAAgB,EAChB,YAAoB;IAEpB,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAA;IAC/F,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,CAAA;IACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAA;IAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,YAAY,CAAC,CAAA;IAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,eAAe,EAAE,MAAM,CAAC;QACzB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC;QAClC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAC1B,CAAC,OAAO,EAAE,sBAAsB,CAAC;QACjC,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,gBAAgB,EAAE,SAAS,CAAC;QAC7B,CAAC,uBAAuB,EAAE,MAAM,CAAC;QACjC,CAAC,UAAU,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3D,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;KACxB,EAAE,CAAC;QACZ,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACnC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE;KAClD,CAAC,CAAA;IACF,qBAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE;QAC3C,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,KAAK;QACL,QAAQ;QACR,QAAQ;KACR,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,MAAyB,EACzB,gBAAsC;IAEtC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACjD,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;IACvE,MAAM,gBAAgB,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,CAAA;IAClE,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;IACjF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;IAC3F,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,IACC,QAAQ,KAAK,gBAAgB;QAC7B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,OAAO,EACvC,CAAC;QACF,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACxD,CAAA;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACtD,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,SAAS,oBAAoB,EAAE;SAClE,CAAC,CACF,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAA;IAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACtB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;IACnC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzC,IAAI,MAAiD,CAAA;IACrD,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;YACzD,OAAO,wBAAwB,CAAC,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,KAAK,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,SAAS,oBAAoB,EAAE;SAClE,CAAC,CACF,CAAA;IACF,CAAC;IACD,IAAI,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE;KAC3F,CAAC,CAAA;IACF,QAAQ,GAAG,2BAA2B,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3E,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAClC,MAAmC,EACnC,OAAgB;IAEhB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IACtE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IACvE,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACxD,IAAI,SAAS,EAAE,CAAC;YACf,OAAO;gBACN,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE;gBAChE,SAAS,EAAE,KAAK;aAChB,CAAA;QACF,CAAC;IACF,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;QAClC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QACzD,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QAC/E,CAAC;IACF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,MAAyB,EACzB,gBAAsC;IAEtC,OAAO,oBAAoB,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAChC,MAAyB,EACzB,QAAkB,EAClB,MAAc;IAEd,OAAO,2BAA2B,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAyB,EAAE,QAAkB;IAChF,OAAO,6BAA6B,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAuB;IAChD,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,SAAS,CAAA;IAClD,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAA;AACvC,CAAC;AAED,SAAS,OAAO,CAAC,MAAmC,EAAE,IAAY;IACjE,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CACjF,CAAA;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB;IACnD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAA;QAC/B,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,kCAAkC;gBAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3F,MAAM,KAAK,CAAA;QACZ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;YACxD,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;YACjE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;QACZ,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/C,8BAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACxE,CAAC;IACF,CAAC,CAAA;AACF,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAyB;IAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,YAAY,GAAsB,UAAU,CAAA;IAClD,OAAO;QACN,SAAS,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CACvD,SAAS,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,CAAC;QAClE,QAAQ,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;QACxE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAC1C,SAAS;QACT,UAAU,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,gBAAgB,CAAC;QAC5E,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC1F,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,QAAQ,CAAC;KAC9E,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/auth",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -16,6 +16,10 @@
       "types": "./dist/server.d.ts",
       "import": "./dist/server.js"
     },
+    "./workers": {
+      "types": "./dist/workers.d.ts",
+      "import": "./dist/workers.js"
+    },
     "./middleware/*": {
       "types": "./dist/middleware/*.d.ts",
       "import": "./dist/middleware/*.js",
@@ -46,7 +50,19 @@
   },
   "peerDependencies": {
     "@growth-labs/analytics": ">=0.5.1",
-    "astro": "^6.1.10 || ^7.0.0"
+    "astro": "^6.1.10 || ^7.0.0",
+    "hono": "^4.12.25"
+  },
+  "peerDependenciesMeta": {
+    "@growth-labs/analytics": {
+      "optional": true
+    },
+    "astro": {
+      "optional": true
+    },
+    "hono": {
+      "optional": true
+    }
   },
   "dependencies": {
     "jose": "^6.0.0",
@@ -54,14 +70,17 @@
   },
   "devDependencies": {
     "astro": "^6.4.6",
+    "hono": "^4.12.25",
     "typescript": "^5.8.0",
     "vite": "^7.3.5",
     "vitest": "^4.1.8",
+    "wrangler": "^4.92.0",
     "@growth-labs/analytics": "0.18.4"
   },
   "scripts": {
     "build": "tsc",
     "check": "biome check src/",
+    "spike:hono-worker": "wrangler deploy --dry-run --config __tests__/fixtures/hono-worker-subpaths/wrangler.jsonc --outdir .wrangler/hono-worker-subpaths --metafile",
     "test": "vitest run",
     "test:watch": "vitest"
   }

package/src/utils/client-secret-header.ts

@@ -0,0 +1,8 @@
+export function createClientSecretBasicAuthHeader(clientId: string, clientSecret: string): string {
+	return `Basic ${btoa(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`
+}
+
+function formEncode(value: string): string {
+	const params = new URLSearchParams({ value })
+	return params.toString().slice('value='.length)
+}

package/src/utils/client-secret.ts

@@ -5,6 +5,7 @@ import {
 	literalClientSecret,
 } from './client-secret-literal.js'
 
+export { createClientSecretBasicAuthHeader } from './client-secret-header.js'
 export type { ClientSecretLiteral }
 export { isClientSecretLiteral, literalClientSecret }
 
@@ -140,12 +141,3 @@ export async function resolveClientSecret(
 	// No Request context: resolve without caching (test or internal call).
 	return doResolve(clientSecret)
 }
-
-export function createClientSecretBasicAuthHeader(clientId: string, clientSecret: string): string {
-	return `Basic ${btoa(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`
-}
-
-function formEncode(value: string): string {
-	const params = new URLSearchParams({ value })
-	return params.toString().slice('value='.length)
-}

package/src/utils/cookies.ts

@@ -16,7 +16,12 @@ export function getCookie(request: Request, name: string): string | null {
 	const header = request.headers.get('cookie')
 	if (!header) return null
 	const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`))
-	return match ? decodeURIComponent(match[1]) : null
+	if (!match) return null
+	try {
+		return decodeURIComponent(match[1])
+	} catch {
+		return null
+	}
 }
 
 export function setCookie(