@hatk/hatk 0.0.1-alpha.11 → 0.0.1-alpha.111

package/dist/mst.js

@@ -1,5 +1,18 @@
 import { cborDecode } from "./cbor.js";
+/**
+ * Walk an AT Protocol Merkle Search Tree (MST) in key order, yielding every record entry.
+ *
+ * The MST is a prefix-compressed B+ tree used by AT Protocol repositories to map
+ * record paths to CIDs. Each node contains a left subtree pointer, an array of entries
+ * (each with a prefix length, key suffix, value CID, and right subtree pointer), and
+ * keys are reconstructed by combining the prefix of the previous key with the suffix.
+ *
+ * @param blocks - Block store that resolves CIDs to raw CBOR bytes
+ * @param rootCid - CID of the MST root node
+ * @yields {MstEntry} Record entries in lexicographic key order
+ */
 export function* walkMst(blocks, rootCid) {
+    /** Recursively visit an MST node, reconstructing full keys from prefix-compressed entries. */
     function* visit(cid, prefix) {
         const data = blocks.get(cid);
         if (!data)

package/dist/oauth/db.d.ts

@@ -1,4 +1,4 @@
-export declare const OAUTH_DDL = "\nCREATE TABLE IF NOT EXISTS _oauth_keys (\n  kid TEXT PRIMARY KEY,\n  private_key TEXT NOT NULL,\n  public_key TEXT NOT NULL,\n  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_sessions (\n  did TEXT PRIMARY KEY,\n  pds_endpoint TEXT NOT NULL,\n  access_token TEXT NOT NULL,\n  refresh_token TEXT,\n  dpop_jkt TEXT NOT NULL,\n  token_expires_at INTEGER,\n  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,\n  updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_requests (\n  request_uri TEXT PRIMARY KEY,\n  client_id TEXT NOT NULL,\n  redirect_uri TEXT NOT NULL,\n  scope TEXT,\n  state TEXT,\n  code_challenge TEXT NOT NULL,\n  code_challenge_method TEXT NOT NULL DEFAULT 'S256',\n  dpop_jkt TEXT NOT NULL,\n  pds_request_uri TEXT,\n  pds_auth_server TEXT,\n  pds_code_verifier TEXT,\n  pds_state TEXT,\n  did TEXT,\n  login_hint TEXT,\n  expires_at INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_codes (\n  code TEXT PRIMARY KEY,\n  request_uri TEXT NOT NULL,\n  created_at INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_refresh_tokens (\n  token TEXT PRIMARY KEY,\n  client_id TEXT NOT NULL,\n  did TEXT NOT NULL,\n  dpop_jkt TEXT NOT NULL,\n  scope TEXT,\n  created_at INTEGER NOT NULL,\n  expires_at INTEGER,\n  revoked INTEGER NOT NULL DEFAULT 0\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_dpop_jtis (\n  jti TEXT PRIMARY KEY,\n  expires_at INTEGER NOT NULL\n);\n";
+export declare const OAUTH_DDL = "\nCREATE TABLE IF NOT EXISTS _oauth_keys (\n  kid TEXT PRIMARY KEY,\n  private_key TEXT NOT NULL,\n  public_key TEXT NOT NULL,\n  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_sessions (\n  did TEXT PRIMARY KEY,\n  pds_endpoint TEXT NOT NULL,\n  pds_auth_server TEXT,\n  pds_token_endpoint TEXT,\n  access_token TEXT NOT NULL,\n  refresh_token TEXT,\n  dpop_jkt TEXT NOT NULL,\n  token_expires_at INTEGER,\n  requested_scope TEXT,\n  granted_scope TEXT,\n  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,\n  updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_requests (\n  request_uri TEXT PRIMARY KEY,\n  client_id TEXT NOT NULL,\n  redirect_uri TEXT NOT NULL,\n  scope TEXT,\n  state TEXT,\n  code_challenge TEXT NOT NULL,\n  code_challenge_method TEXT NOT NULL DEFAULT 'S256',\n  dpop_jkt TEXT NOT NULL,\n  pds_request_uri TEXT,\n  pds_auth_server TEXT,\n  pds_authorization_endpoint TEXT,\n  pds_token_endpoint TEXT,\n  pds_endpoint TEXT,\n  pds_code_verifier TEXT,\n  pds_state TEXT,\n  did TEXT,\n  login_hint TEXT,\n  pds_scope TEXT,\n  expires_at INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_codes (\n  code TEXT PRIMARY KEY,\n  request_uri TEXT NOT NULL,\n  created_at INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_refresh_tokens (\n  token TEXT PRIMARY KEY,\n  client_id TEXT NOT NULL,\n  did TEXT NOT NULL,\n  dpop_jkt TEXT NOT NULL,\n  scope TEXT,\n  created_at INTEGER NOT NULL,\n  expires_at INTEGER,\n  revoked INTEGER NOT NULL DEFAULT 0\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_dpop_jtis (\n  jti TEXT PRIMARY KEY,\n  expires_at INTEGER NOT NULL\n);\n";
 export declare function getServerKey(kid: string): Promise<{
     privateKey: string;
     publicKey: string;
@@ -14,10 +14,15 @@ export declare function storeOAuthRequest(requestUri: string, data: {
     dpopJkt: string;
     pdsRequestUri?: string;
     pdsAuthServer?: string;
+    pdsAuthorizationEndpoint?: string;
+    pdsTokenEndpoint?: string;
+    pdsEndpoint?: string;
     pdsCodeVerifier?: string;
     pdsState?: string;
     did?: string;
     loginHint?: string;
+    /** What was asked of the PDS, which is not always `scope`: see negotiateScope. */
+    pdsScope?: string;
     expiresAt: number;
 }): Promise<void>;
 export declare function getOAuthRequest(requestUri: string): Promise<any | null>;
@@ -26,12 +31,33 @@ export declare function storeAuthCode(code: string, requestUri: string): Promise
 export declare function consumeAuthCode(code: string): Promise<string | null>;
 export declare function storeSession(did: string, data: {
     pdsEndpoint: string;
+    pdsAuthServer?: string;
+    /** From the auth server's metadata, so refreshes don't guess the path. */
+    pdsTokenEndpoint?: string;
     accessToken: string;
     refreshToken?: string;
     dpopJkt: string;
     tokenExpiresAt?: number;
+    /**
+     * The scope asked of the PDS for this session, and the scope it granted.
+     * A server may grant less than it was asked for, on purpose — a group's
+     * host narrows a sign-in as the group to what the person's roles allow —
+     * and the difference is what tells a refusal it can do nothing about from
+     * one a new sign-in would fix. See withheldByServer in pds-proxy.ts.
+     */
+    requestedScope?: string;
+    grantedScope?: string;
 }): Promise<void>;
 export declare function getSession(did: string): Promise<any | null>;
+/**
+ * Every DID this instance holds a PDS session for, most recently refreshed
+ * first.
+ *
+ * Space indexing reads as a member rather than as itself, so this is the set of
+ * people it could borrow a delegation from. Ordered by recency because a
+ * session refreshed lately is the one most likely to still work.
+ */
+export declare function listSessionDids(): Promise<string[]>;
 export declare function deleteSession(did: string): Promise<void>;
 export declare function storeRefreshToken(token: string, data: {
     clientId: string;

package/dist/oauth/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/oauth/db.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,SAAS,87CA0DrB,CAAA;AAID,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAIzG;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtG;AAID,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB,GACA,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAM7E;AAED,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1E;AAID,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK1E;AAID,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAGjE;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAID,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACA,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAGxE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;AAID,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK3F;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CASzD"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/oauth/db.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,SAAS,4oDAkErB,CAAA;AAID,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAOzG;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtG;AAID,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;IAItB,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB,GACA,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAM7E;AAED,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1E;AAID,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnF;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO1E;AAID,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GACA,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAGjE;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAKzD;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAID,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACA,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAGxE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;AAID,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK3F;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAQzD"}

package/dist/oauth/db.js

@@ -1,5 +1,5 @@
 // packages/hatk/src/oauth/db.ts
-import { querySQL, runSQL } from "../db.js";
+import { querySQL, runSQL } from "../database/db.js";
 // --- DDL ---
 export const OAUTH_DDL = `
 CREATE TABLE IF NOT EXISTS _oauth_keys (
@@ -12,10 +12,14 @@ CREATE TABLE IF NOT EXISTS _oauth_keys (
 CREATE TABLE IF NOT EXISTS _oauth_sessions (
   did TEXT PRIMARY KEY,
   pds_endpoint TEXT NOT NULL,
+  pds_auth_server TEXT,
+  pds_token_endpoint TEXT,
   access_token TEXT NOT NULL,
   refresh_token TEXT,
   dpop_jkt TEXT NOT NULL,
   token_expires_at INTEGER,
+  requested_scope TEXT,
+  granted_scope TEXT,
   created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
   updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
 );
@@ -31,10 +35,14 @@ CREATE TABLE IF NOT EXISTS _oauth_requests (
   dpop_jkt TEXT NOT NULL,
   pds_request_uri TEXT,
   pds_auth_server TEXT,
+  pds_authorization_endpoint TEXT,
+  pds_token_endpoint TEXT,
+  pds_endpoint TEXT,
   pds_code_verifier TEXT,
   pds_state TEXT,
   did TEXT,
   login_hint TEXT,
+  pds_scope TEXT,
   expires_at INTEGER NOT NULL
 );
 
@@ -62,18 +70,42 @@ CREATE TABLE IF NOT EXISTS _oauth_dpop_jtis (
 `;
 // --- Key Management ---
 export async function getServerKey(kid) {
-    const rows = await querySQL('SELECT private_key, public_key FROM _oauth_keys WHERE kid = $1', [kid]);
+    const rows = (await querySQL('SELECT private_key, public_key FROM _oauth_keys WHERE kid = $1', [kid]));
     if (rows.length === 0)
         return null;
     return { privateKey: rows[0].private_key, publicKey: rows[0].public_key };
 }
 export async function storeServerKey(kid, privateKey, publicKey) {
-    await runSQL('INSERT OR REPLACE INTO _oauth_keys (kid, private_key, public_key) VALUES ($1, $2, $3)', kid, privateKey, publicKey);
+    await runSQL('INSERT OR REPLACE INTO _oauth_keys (kid, private_key, public_key) VALUES ($1, $2, $3)', [
+        kid,
+        privateKey,
+        publicKey,
+    ]);
 }
 // --- OAuth Request Storage ---
 export async function storeOAuthRequest(requestUri, data) {
-    await runSQL(`INSERT INTO _oauth_requests (request_uri, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, dpop_jkt, pds_request_uri, pds_auth_server, pds_code_verifier, pds_state, did, login_hint, expires_at)
-     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)`, requestUri, data.clientId, data.redirectUri, data.scope || null, data.state || null, data.codeChallenge, data.codeChallengeMethod || 'S256', data.dpopJkt, data.pdsRequestUri || null, data.pdsAuthServer || null, data.pdsCodeVerifier || null, data.pdsState || null, data.did || null, data.loginHint || null, data.expiresAt);
+    await runSQL(`INSERT INTO _oauth_requests (request_uri, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, dpop_jkt, pds_request_uri, pds_auth_server, pds_authorization_endpoint, pds_token_endpoint, pds_endpoint, pds_code_verifier, pds_state, did, login_hint, expires_at, pds_scope)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19)`, [
+        requestUri,
+        data.clientId,
+        data.redirectUri,
+        data.scope || null,
+        data.state || null,
+        data.codeChallenge,
+        data.codeChallengeMethod || 'S256',
+        data.dpopJkt,
+        data.pdsRequestUri || null,
+        data.pdsAuthServer || null,
+        data.pdsAuthorizationEndpoint || null,
+        data.pdsTokenEndpoint || null,
+        data.pdsEndpoint || null,
+        data.pdsCodeVerifier || null,
+        data.pdsState || null,
+        data.did || null,
+        data.loginHint || null,
+        data.expiresAt,
+        data.pdsScope || null,
+    ]);
 }
 export async function getOAuthRequest(requestUri) {
     const rows = await querySQL('SELECT * FROM _oauth_requests WHERE request_uri = $1 AND expires_at > $2', [
@@ -83,57 +115,86 @@ export async function getOAuthRequest(requestUri) {
     return rows.length > 0 ? rows[0] : null;
 }
 export async function deleteOAuthRequest(requestUri) {
-    await runSQL('DELETE FROM _oauth_requests WHERE request_uri = $1', requestUri);
+    await runSQL('DELETE FROM _oauth_requests WHERE request_uri = $1', [requestUri]);
 }
 // --- Authorization Codes ---
 export async function storeAuthCode(code, requestUri) {
-    await runSQL('INSERT INTO _oauth_codes (code, request_uri, created_at) VALUES ($1, $2, $3)', code, requestUri, Math.floor(Date.now() / 1000));
+    await runSQL('INSERT INTO _oauth_codes (code, request_uri, created_at) VALUES ($1, $2, $3)', [
+        code,
+        requestUri,
+        Math.floor(Date.now() / 1000),
+    ]);
 }
 export async function consumeAuthCode(code) {
-    const rows = await querySQL('SELECT request_uri FROM _oauth_codes WHERE code = $1', [code]);
+    const rows = (await querySQL('SELECT request_uri FROM _oauth_codes WHERE code = $1', [code]));
     if (rows.length === 0)
         return null;
-    await runSQL('DELETE FROM _oauth_codes WHERE code = $1', code);
+    await runSQL('DELETE FROM _oauth_codes WHERE code = $1', [code]);
     return rows[0].request_uri;
 }
 // --- Sessions ---
 export async function storeSession(did, data) {
-    await runSQL(`INSERT OR REPLACE INTO _oauth_sessions (did, pds_endpoint, access_token, refresh_token, dpop_jkt, token_expires_at, updated_at)
-     VALUES ($1,$2,$3,$4,$5,$6,CURRENT_TIMESTAMP)`, did, data.pdsEndpoint, data.accessToken, data.refreshToken || null, data.dpopJkt, data.tokenExpiresAt || null);
+    await runSQL(`INSERT OR REPLACE INTO _oauth_sessions (did, pds_endpoint, pds_auth_server, pds_token_endpoint, access_token, refresh_token, dpop_jkt, token_expires_at, requested_scope, granted_scope, updated_at)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,CURRENT_TIMESTAMP)`, [
+        did,
+        data.pdsEndpoint,
+        data.pdsAuthServer || null,
+        data.pdsTokenEndpoint || null,
+        data.accessToken,
+        data.refreshToken || null,
+        data.dpopJkt,
+        data.tokenExpiresAt || null,
+        data.requestedScope || null,
+        data.grantedScope || null,
+    ]);
 }
 export async function getSession(did) {
     const rows = await querySQL('SELECT * FROM _oauth_sessions WHERE did = $1', [did]);
     return rows.length > 0 ? rows[0] : null;
 }
+/**
+ * Every DID this instance holds a PDS session for, most recently refreshed
+ * first.
+ *
+ * Space indexing reads as a member rather than as itself, so this is the set of
+ * people it could borrow a delegation from. Ordered by recency because a
+ * session refreshed lately is the one most likely to still work.
+ */
+export async function listSessionDids() {
+    const rows = (await querySQL('SELECT did FROM _oauth_sessions ORDER BY updated_at DESC, created_at DESC'));
+    return rows.map((r) => r.did);
+}
 export async function deleteSession(did) {
-    await runSQL('DELETE FROM _oauth_sessions WHERE did = $1', did);
+    await runSQL('DELETE FROM _oauth_sessions WHERE did = $1', [did]);
 }
 // --- Refresh Tokens ---
 export async function storeRefreshToken(token, data) {
     const now = Math.floor(Date.now() / 1000);
     const expiresAt = data.expiresAt ?? now + 14 * 86400; // 14 days default
     await runSQL(`INSERT INTO _oauth_refresh_tokens (token, client_id, did, dpop_jkt, scope, created_at, expires_at)
-     VALUES ($1,$2,$3,$4,$5,$6,$7)`, token, data.clientId, data.did, data.dpopJkt, data.scope || null, now, expiresAt);
+     VALUES ($1,$2,$3,$4,$5,$6,$7)`, [token, data.clientId, data.did, data.dpopJkt, data.scope || null, now, expiresAt]);
 }
 export async function getRefreshToken(token) {
     const rows = await querySQL('SELECT * FROM _oauth_refresh_tokens WHERE token = $1', [token]);
     return rows.length > 0 ? rows[0] : null;
 }
 export async function revokeRefreshToken(token) {
-    await runSQL('UPDATE _oauth_refresh_tokens SET revoked = 1 WHERE token = $1', token);
+    await runSQL('UPDATE _oauth_refresh_tokens SET revoked = 1 WHERE token = $1', [token]);
 }
 // --- DPoP JTI Replay Protection ---
 export async function checkAndStoreDpopJti(jti, expiresAt) {
     const rows = await querySQL('SELECT 1 FROM _oauth_dpop_jtis WHERE jti = $1', [jti]);
     if (rows.length > 0)
         return false;
-    await runSQL('INSERT INTO _oauth_dpop_jtis (jti, expires_at) VALUES ($1, $2)', jti, expiresAt);
+    await runSQL('INSERT INTO _oauth_dpop_jtis (jti, expires_at) VALUES ($1, $2)', [jti, expiresAt]);
     return true;
 }
 export async function cleanupExpiredOAuth() {
     const now = Math.floor(Date.now() / 1000);
-    await runSQL('DELETE FROM _oauth_dpop_jtis WHERE expires_at < $1', now);
-    await runSQL('DELETE FROM _oauth_requests WHERE expires_at < $1', now);
-    await runSQL('DELETE FROM _oauth_codes WHERE created_at < $1', now - 600);
-    await runSQL('DELETE FROM _oauth_refresh_tokens WHERE revoked = 1 OR (expires_at IS NOT NULL AND expires_at < $1)', now);
+    await runSQL('DELETE FROM _oauth_dpop_jtis WHERE expires_at < $1', [now]);
+    await runSQL('DELETE FROM _oauth_requests WHERE expires_at < $1', [now]);
+    await runSQL('DELETE FROM _oauth_codes WHERE created_at < $1', [now - 600]);
+    await runSQL('DELETE FROM _oauth_refresh_tokens WHERE revoked = 1 OR (expires_at IS NOT NULL AND expires_at < $1)', [
+        now,
+    ]);
 }

package/dist/oauth/discovery.d.ts

@@ -18,5 +18,15 @@ export declare function discoverAuthServer(did: string, plcUrl: string): Promise
     authServerEndpoint: string;
     authServerMetadata: AuthServerMetadata;
 }>;
+/**
+ * A handle to its DID.
+ *
+ * The protocol defines two ways, and both are asked first: the DNS TXT record
+ * and the well-known document. Either answers for a handle on any PDS, which
+ * is what lets somebody from another host sign in here. A handle neither
+ * method knows — a dev network's `.test` names, which have no DNS and no TLS
+ * — falls back to asking a PDS: the local one in dev, the one behind a
+ * self-hosted relay, or bsky.social.
+ */
 export declare function resolveHandle(handle: string, relayUrl?: string): Promise<string>;
 //# sourceMappingURL=discovery.d.ts.map

package/dist/oauth/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/oauth/discovery.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,qCAAqC,CAAC,EAAE,MAAM,CAAA;IAC9C,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAU1E;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAGzD;AAED,wBAAsB,8BAA8B,CAClD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAI9C;AAED,wBAAsB,uBAAuB,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAIrG;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAA;IACnB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC,CAAC,CAWD;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtF"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/oauth/discovery.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,qCAAqC,CAAC,EAAE,MAAM,CAAA;IAC9C,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAU1E;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAGzD;AAED,wBAAsB,8BAA8B,CAClD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAI9C;AAED,wBAAsB,uBAAuB,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAIrG;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAA;IACnB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC,CAAC,CAWD;AA+BD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBtF"}

package/dist/oauth/discovery.js

@@ -1,4 +1,4 @@
-// packages/hatk/src/oauth/discovery.ts
+import { resolveTxt } from 'node:dns/promises';
 export async function resolveDid(did, plcUrl) {
     if (did.startsWith('did:web:')) {
         const domain = did.slice('did:web:'.length);
@@ -40,8 +40,60 @@ export async function discoverAuthServer(did, plcUrl) {
     const authServerMetadata = await fetchAuthServerMetadata(authServerEndpoint);
     return { pdsEndpoint, authServerEndpoint, authServerMetadata };
 }
+const HANDLE_RESOLVE_TIMEOUT_MS = 5000;
+/** The DNS method: a `_atproto.<handle>` TXT record carrying `did=...`. */
+async function resolveHandleViaDns(handle) {
+    try {
+        for (const chunks of await resolveTxt(`_atproto.${handle}`)) {
+            const txt = chunks.join('');
+            if (txt.startsWith('did='))
+                return txt.slice('did='.length).trim();
+        }
+    }
+    catch {
+        // No record, or not a resolvable name: not this method.
+    }
+    return null;
+}
+/** The HTTPS method: `https://<handle>/.well-known/atproto-did`, the DID as plain text. */
+async function resolveHandleViaWellKnown(handle) {
+    try {
+        const res = await fetch(`https://${handle}/.well-known/atproto-did`, {
+            signal: AbortSignal.timeout(HANDLE_RESOLVE_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const did = (await res.text()).trim().split('\n')[0].trim();
+        return did.startsWith('did:') ? did : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A handle to its DID.
+ *
+ * The protocol defines two ways, and both are asked first: the DNS TXT record
+ * and the well-known document. Either answers for a handle on any PDS, which
+ * is what lets somebody from another host sign in here. A handle neither
+ * method knows — a dev network's `.test` names, which have no DNS and no TLS
+ * — falls back to asking a PDS: the local one in dev, the one behind a
+ * self-hosted relay, or bsky.social.
+ */
 export async function resolveHandle(handle, relayUrl) {
-    const baseUrl = relayUrl?.includes('localhost:2583') ? 'http://localhost:2583' : 'https://bsky.social';
+    const direct = (await resolveHandleViaDns(handle)) ?? (await resolveHandleViaWellKnown(handle));
+    if (direct)
+        return direct;
+    let baseUrl;
+    if (relayUrl?.includes('localhost:2583')) {
+        baseUrl = 'http://localhost:2583';
+    }
+    else if (!relayUrl || relayUrl.includes('bsky.network')) {
+        baseUrl = 'https://bsky.social';
+    }
+    else {
+        baseUrl = relayUrl.replace(/^ws/, 'http'); // wss://pds.example → https://pds.example
+    }
     const res = await fetch(`${baseUrl}/xrpc/com.atproto.identity.resolveHandle?handle=${encodeURIComponent(handle)}`);
     if (!res.ok)
         throw new Error(`resolveHandle failed: ${res.status}`);

package/dist/oauth/server.d.ts

@@ -1,4 +1,18 @@
 import type { OAuthConfig } from '../config.ts';
+/**
+ * RFC 6749 §5.2 OAuth token-endpoint error.
+ *
+ * Surfaces as HTTP `status` (default 400) with body
+ * `{ error: code, error_description: description }` so OAuth clients can
+ * distinguish a permanently-rejected refresh token (`invalid_grant`) from
+ * a transient server failure and decide whether to log the user out.
+ */
+export declare class OAuthError extends Error {
+    readonly code: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
+    readonly description: string;
+    readonly status: number;
+    constructor(code: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope', description: string, status?: number);
+}
 export declare function initOAuth(_config: OAuthConfig, plcUrl: string, relayUrl: string): Promise<void>;
 export declare function getAuthServerMetadata(issuer: string, config: OAuthConfig): {
     issuer: string;
@@ -49,32 +63,148 @@ export declare function getJwks(): {
         y?: string;
     }[];
 };
+/**
+ * Whether we authenticate to PDSes as a confidential client.
+ *
+ * A confidential client gets a 2-year session and 3-month refresh window
+ * instead of 2 weeks, and is exempt from the consent screen atproto forces on
+ * every authorization request from a public client. It requires a fetchable
+ * `jwks_uri`, so loopback deployments (local dev) stay public.
+ */
+export declare function isConfidentialClient(issuer: string): boolean;
+/** Public half of the client-authentication key, for the PDS to verify assertions. */
+export declare function getClientJwks(): {
+    keys: {
+        kid: string;
+        use: string;
+        alg: string;
+        crv?: string;
+        d?: string;
+        dp?: string;
+        dq?: string;
+        e?: string;
+        ext?: boolean;
+        k?: string;
+        key_ops?: string[];
+        kty?: string;
+        n?: string;
+        oth?: RsaOtherPrimesInfo[];
+        p?: string;
+        q?: string;
+        qi?: string;
+        x?: string;
+        y?: string;
+    }[];
+};
 export declare function getClientMetadata(issuer: string, config: OAuthConfig): {
+    dpop_bound_access_tokens: boolean;
+    scope: string;
+    token_endpoint_auth_method: string;
+    token_endpoint_auth_signing_alg: string;
+    jwks_uri: string;
     client_id: string;
     client_name: string;
     redirect_uris: string[];
     grant_types: string[];
     response_types: string[];
-    token_endpoint_auth_method: string;
+} | {
     dpop_bound_access_tokens: boolean;
     scope: string;
+    token_endpoint_auth_method: string;
+    client_id: string;
+    client_name: string;
+    redirect_uris: string[];
+    grant_types: string[];
+    response_types: string[];
 };
+/**
+ * Handle a Pushed Authorization Request (PAR).
+ *
+ * Supports account creation via `prompt=create`. When set, `login_hint`
+ * is treated as a PDS hostname (e.g. "selfhosted.social" or "localhost:2583")
+ * rather than a handle or DID. The auth server is discovered from the PDS's
+ * protected resource metadata, and `prompt=create` is forwarded to the PDS
+ * PAR so it shows the signup page.
+ *
+ * For normal login, `login_hint` is a handle or DID as usual.
+ */
 export declare function handlePar(config: OAuthConfig, body: Record<string, string>, dpopHeader: string, requestUrl: string): Promise<{
     request_uri: string;
     expires_in: number;
 }>;
 export declare function buildAuthorizeRedirect(config: OAuthConfig, request: any): string;
+/**
+ * Initiate a server-side OAuth login or account creation flow.
+ *
+ * For account creation, pass `{ prompt: 'create', pds: 'selfhosted.social' }`.
+ * The `pds` is a bare hostname; the auth server is discovered from its
+ * protected resource metadata.
+ */
+export declare function serverLogin(config: OAuthConfig, handle: string, options?: {
+    prompt?: string;
+    pds?: string;
+}): Promise<string>;
 export declare function handleCallback(config: OAuthConfig, code: string, state: string | null, iss: string | null): Promise<{
     requestUri: string;
     clientRedirectUri: string;
     clientState: string | null;
+    did: string;
 }>;
+/**
+ * Handle an error redirect from the PDS (user denied, request expired, etc).
+ *
+ * The PDS reports failures by redirecting to our callback with `error` and no
+ * `code`. Discard the pending request and return a URL that hands the error
+ * back to the app, so the browser lands somewhere renderable instead of on a
+ * raw error response.
+ */
+export declare function handleCallbackError(config: OAuthConfig, error: string, errorDescription: string | null, state: string | null): Promise<string>;
 export declare function handleToken(config: OAuthConfig, body: Record<string, string>, dpopHeader: string, requestUrl: string): Promise<any>;
+/** A refusal from the endpoint {@link obtainSession} called, or an answer it cannot use. */
+export declare class ObtainSessionError extends Error {
+    /** The endpoint's error code, e.g. an XRPC error name. */
+    readonly error: string;
+    readonly status: number;
+    constructor(
+    /** The endpoint's error code, e.g. an XRPC error name. */
+    error: string, message: string, status: number);
+}
+/** What {@link obtainSession} returns: the endpoint's whole response, and whose session it held. */
+export interface ObtainedSession {
+    did: string;
+    response: Record<string, unknown>;
+}
+/**
+ * Obtain a session for another account straight from its authorization server,
+ * outside the redirect flow: a group host creating an account for this app and
+ * handing it a session, say.
+ *
+ * `body` is POSTed as JSON to `url` as this app's OAuth client, the way the
+ * token endpoint is called: `client_id` and, for a confidential client, a client
+ * assertion addressed to the endpoint's origin, are added to it, and the request
+ * carries a DPoP proof from the app's key, answering a nonce challenge once.
+ * `headers` are sent too, for whatever else the endpoint wants to know (service
+ * auth from the viewer, typically).
+ *
+ * The response must hold an OAuth token response, at `session` or as the whole
+ * body. That session is stored for its `sub` exactly as a login's is, bound to
+ * the same DPoP key, so refresh and the PDS helpers work for that DID from here
+ * on. It is only accepted if the account's own authorization server is the one
+ * that answered: an endpoint cannot hand over a session for an account it does
+ * not serve.
+ */
+export declare function obtainSession(config: OAuthConfig, url: string, body: Record<string, unknown>, opts?: {
+    headers?: Record<string, string>;
+}): Promise<ObtainedSession>;
 export declare function refreshPdsSession(config: OAuthConfig, session: {
     did: string;
     pds_endpoint: string;
+    pds_auth_server?: string;
+    pds_token_endpoint?: string;
     refresh_token: string;
     dpop_jkt: string;
+    requested_scope?: string | null;
+    granted_scope?: string | null;
 }): Promise<{
     accessToken: string;
     refreshToken?: string;

package/dist/oauth/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA0E/C,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;EAcpE;AAID,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAuItD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAShF;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAyHxF;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA0JD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAmEpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAgD/C;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe;aACH,WAAW,EAAE,MAAM;aACnB,MAAM,EAAE,MAAM;gBARd,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,EACH,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,MAAY;CAKvC;AA4FD,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,sFAAsF;AACtF,wBAAgB,aAAa;;;;;;;;;;;;;;;;;;;;;;EAW5B;AA0CD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;EAuBpE;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA0LtD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAYhF;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CAwIjB;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAqIrG;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA4JD,4FAA4F;AAC5F,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,0DAA0D;aAC1C,KAAK,EAAE,MAAM;aAEb,MAAM,EAAE,MAAM;;IAH9B,0DAA0D;IAC1C,KAAK,EAAE,MAAM,EAC7B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM;CAIjC;AAED,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAO,GAC9C,OAAO,CAAC,eAAe,CAAC,CAqD1B;AAID,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IACP,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B,GACA,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAuFpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}