@ifc-lite/collab-server 0.2.4 → 0.2.6

package/dist/room-token.d.ts

@@ -0,0 +1,160 @@
+import type * as http from 'node:http';
+import type { AuthenticateFn, Principal, Role } from './auth.js';
+export interface RoomTokenClaims {
+    /** Room id this token grants access to. */
+    room: string;
+    /** Granted access role. */
+    role: Role;
+    /** Issued-at (seconds since epoch). */
+    iat: number;
+    /** Expiry (seconds since epoch). */
+    exp: number;
+    /** Unique token id — enables single-link revocation. */
+    jti: string;
+    /** Key id (for rotation). Mirrors the JWS header `kid`. */
+    kid?: string;
+}
+/** Resolve a secret, optionally by `kid`, for verification (key rotation). */
+export type SecretResolver = string | ((kid: string | undefined) => string | undefined);
+export interface SignRoomTokenOptions {
+    roomId: string;
+    role: Role;
+    /** Signing secret (must match the verifier's secret for this `kid`). */
+    secret: string;
+    /** Token lifetime in seconds (default 7 days). */
+    ttlSeconds?: number;
+    /** Key id written to the JWS header for rotation. */
+    kid?: string;
+    /** Override the unique token id (default: random UUID). */
+    jti?: string;
+    /** Injectable clock (ms) for deterministic tests. */
+    now?: () => number;
+}
+/** Mint a signed room token. */
+export declare function signRoomToken(opts: SignRoomTokenOptions): string;
+export interface VerifyRoomTokenOptions {
+    secret: SecretResolver;
+    /** When set, require the token's `room` claim to equal this value. */
+    room?: string;
+    /** Injectable clock (ms) for deterministic tests. */
+    now?: () => number;
+    /** Allowed clock skew in seconds (default 30). */
+    clockToleranceSec?: number;
+}
+/**
+ * Verify a room token. Returns the decoded claims, or `null` for any failure
+ * (bad shape, wrong/unknown key, tampered signature, expired, room mismatch).
+ * Never throws on malformed input.
+ */
+export declare function verifyRoomToken(token: string, opts: VerifyRoomTokenOptions): RoomTokenClaims | null;
+export interface RoomTokenAuthenticatorOptions {
+    secret: SecretResolver;
+    /** Deny-list check for revoked `jti`s ("revoke this link"). */
+    isRevoked?: (jti: string) => boolean | Promise<boolean>;
+    now?: () => number;
+    clockToleranceSec?: number;
+    /**
+     * Map verified claims to a `Principal`. Default: a fresh anonymous
+     * per-connection userId (the real identity lives in awareness) with the
+     * token's role, expiry, and `{ jti, room }` audit metadata.
+     */
+    principalFor?: (claims: RoomTokenClaims) => Principal;
+}
+/**
+ * Build an `AuthenticateFn` that authorizes a websocket connection from a
+ * room token. Pass to `startCollabServer({ authenticate })`.
+ */
+export declare function createRoomTokenAuthenticator(opts: RoomTokenAuthenticatorOptions): AuthenticateFn;
+export interface MintRequestBody {
+    roomId: string;
+    role: Role;
+    /** Requested lifetime in seconds (clamped by `maxTtlSeconds`). */
+    ttlSeconds?: number;
+}
+export interface TokenEndpointOptions {
+    /** Secret used to sign newly minted tokens. */
+    secret: string;
+    /**
+     * Authorize a mint request. Receives the requested grant and the verified
+     * claims of the caller's bearer token (or `null` if none/invalid). Return the
+     * role to actually grant, or `null` to deny (→ 403). This is where consumers
+     * encode policy — e.g. "only an `admin` token for this room may mint", or
+     * "anyone may create a fresh room and become its owner".
+     */
+    authorize: (request: MintRequestBody, context: {
+        bearerClaims: RoomTokenClaims | null;
+    }) => Promise<Role | null> | Role | null;
+    /** Secret(s) used to verify the caller's bearer token (default: `secret`). */
+    verifySecret?: SecretResolver;
+    /**
+     * Deny-list check for revoked `jti`s. A revoked bearer (e.g. a kicked
+     * admin's token) must not keep minting links even though its signature +
+     * expiry still verify — when this returns true the bearer is treated as
+     * absent, so `authorize` sees `bearerClaims: null`.
+     */
+    isRevoked?: (jti: string) => boolean | Promise<boolean>;
+    /** Lifetime for minted tokens when the request omits one (default 7 days). */
+    defaultTtlSeconds?: number;
+    /** Upper bound applied to a requested `ttlSeconds` (default 30 days). */
+    maxTtlSeconds?: number;
+    /** Key id stamped on minted tokens. */
+    kid?: string;
+    /** CORS `Access-Control-Allow-Origin` (default `*`). */
+    allowOrigin?: string;
+    /** Reject bodies larger than this (default 4 KB). */
+    maxBodyBytes?: number;
+    now?: () => number;
+}
+/**
+ * Handle `POST /collab/token` (and its CORS preflight). Returns `true` when the
+ * request matched this route (and a response was sent), `false` otherwise so
+ * the caller can fall through to its own 404.
+ */
+export declare function handleTokenMintRequest(req: http.IncomingMessage, res: http.ServerResponse, opts: TokenEndpointOptions): Promise<boolean>;
+export interface RevokeRequestBody {
+    /** The share token to invalidate. */
+    token: string;
+}
+export interface RevokeEndpointOptions {
+    /** Secret used to verify the target + bearer tokens. */
+    secret: SecretResolver;
+    /** Add a `jti` to the server's deny-list. The authenticator's `isRevoked`
+     *  should consult the same store so future joins with this token are rejected. */
+    recordRevocation: (jti: string, room: string) => void | Promise<void>;
+    /** Deny-list check — a bearer whose own `jti` was revoked (e.g. a kicked
+     *  admin) must not be able to keep revoking other people's links. */
+    isRevoked?: (jti: string) => boolean | Promise<boolean>;
+    allowOrigin?: string;
+    maxBodyBytes?: number;
+    now?: () => number;
+}
+/**
+ * Handle `POST /collab/revoke` (and its CORS preflight). The caller must
+ * present an `admin` bearer token for the same room as the token being revoked.
+ * Returns `true` when this route matched (and a response was sent).
+ */
+export declare function handleRevokeRequest(req: http.IncomingMessage, res: http.ServerResponse, opts: RevokeEndpointOptions): Promise<boolean>;
+export interface KickRequestBody {
+    roomId: string;
+    /** Awareness clientId of the peer to disconnect. */
+    clientId: number;
+}
+export interface KickEndpointOptions {
+    /** Secret used to verify the admin bearer token. */
+    secret: SecretResolver;
+    /** Force-disconnect a peer by awareness clientId; returns whether one matched. */
+    kick: (roomId: string, clientId: number) => boolean | Promise<boolean>;
+    /** Deny-list check — a bearer whose own `jti` was revoked (e.g. an admin who
+     *  was themselves kicked) must not be able to keep kicking peers. */
+    isRevoked?: (jti: string) => boolean | Promise<boolean>;
+    allowOrigin?: string;
+    maxBodyBytes?: number;
+    now?: () => number;
+}
+/**
+ * Handle `POST /collab/kick` (and its CORS preflight). The caller must present
+ * an `admin` bearer token for the target room. Returns `true` when this route
+ * matched (and a response was sent).
+ */
+export declare function handleKickRequest(req: http.IncomingMessage, res: http.ServerResponse, opts: KickEndpointOptions): Promise<boolean>;
+//# sourceMappingURL=room-token.d.ts.map

package/dist/room-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-token.d.ts","sourceRoot":"","sources":["../src/room-token.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjE,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAqBxF,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,gCAAgC;AAChC,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAqBhE;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,cAAc,CAAC;IACvB,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,GAAG,eAAe,GAAG,IAAI,CA8CnG;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,cAAc,CAAC;IACvB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,SAAS,CAAC;CACvD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,6BAA6B,GAClC,cAAc,CAmBhB;AAID,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,EAAE,CACT,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE;QAAE,YAAY,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,KAC9C,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACxC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAiCD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,OAAO,CAAC,CA8FlB;AAID,MAAM,WAAW,iBAAiB;IAChC,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,MAAM,EAAE,cAAc,CAAC;IACvB;sFACkF;IAClF,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;yEACqE;IACrE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAID,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,MAAM,EAAE,cAAc,CAAC;IACvB,kFAAkF;IAClF,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE;yEACqE;IACrE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,OAAO,CAAC,CAyDlB"}

package/dist/room-token.js

@@ -0,0 +1,387 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+/**
+ * Room tokens — accountless, link-based access control (plan §3).
+ *
+ * Sharing is a signed capability, not an account: a short JWT (HS256, a
+ * server-held secret) carries the room id and the granted role
+ * (`viewer` / `commenter` / `editor` / `admin`). Anyone with the link
+ * presents the token as `?token=` on connect; the server verifies the
+ * signature + expiry and derives the `Principal.role` from it. The display
+ * identity (handle / color) travels separately over awareness — the token
+ * collects no PII.
+ *
+ * HS256 is implemented directly on `node:crypto` so the reference server
+ * needs no JWT dependency. `kid` supports key rotation ("revoke all links"
+ * rotates the active key); `jti` supports single-link revocation via an
+ * `isRevoked` deny-list.
+ */
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+const VALID_ROLES = new Set([
+    'viewer',
+    'commenter',
+    'editor',
+    'admin',
+]);
+const DEFAULT_TTL_SECONDS = 7 * 24 * 60 * 60; // 7 days
+const DEFAULT_CLOCK_TOLERANCE_SEC = 30;
+function b64urlEncode(input) {
+    const buf = typeof input === 'string' ? Buffer.from(input, 'utf8') : input;
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function b64urlToBuffer(input) {
+    const b64 = input.replace(/-/g, '+').replace(/_/g, '/');
+    const pad = b64.length % 4 === 0 ? '' : '='.repeat(4 - (b64.length % 4));
+    return Buffer.from(b64 + pad, 'base64');
+}
+function hmac(signingInput, secret) {
+    return createHmac('sha256', secret).update(signingInput).digest();
+}
+function resolveSecret(secret, kid) {
+    return typeof secret === 'function' ? secret(kid) : secret;
+}
+/** Mint a signed room token. */
+export function signRoomToken(opts) {
+    if (!VALID_ROLES.has(opts.role)) {
+        throw new Error(`signRoomToken: invalid role "${opts.role}"`);
+    }
+    if (!opts.roomId)
+        throw new Error('signRoomToken: roomId is required');
+    if (!opts.secret)
+        throw new Error('signRoomToken: secret is required');
+    const nowSec = Math.floor((opts.now ? opts.now() : Date.now()) / 1000);
+    const claims = {
+        room: opts.roomId,
+        role: opts.role,
+        iat: nowSec,
+        exp: nowSec + (opts.ttlSeconds ?? DEFAULT_TTL_SECONDS),
+        jti: opts.jti ?? randomUUID(),
+        ...(opts.kid ? { kid: opts.kid } : {}),
+    };
+    const header = { alg: 'HS256', typ: 'JWT', ...(opts.kid ? { kid: opts.kid } : {}) };
+    const signingInput = `${b64urlEncode(JSON.stringify(header))}.${b64urlEncode(JSON.stringify(claims))}`;
+    const sig = b64urlEncode(hmac(signingInput, opts.secret));
+    return `${signingInput}.${sig}`;
+}
+/**
+ * Verify a room token. Returns the decoded claims, or `null` for any failure
+ * (bad shape, wrong/unknown key, tampered signature, expired, room mismatch).
+ * Never throws on malformed input.
+ */
+export function verifyRoomToken(token, opts) {
+    if (typeof token !== 'string' || token.length === 0)
+        return null;
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return null;
+    const [headerB64, payloadB64, sigB64] = parts;
+    let header;
+    let claims;
+    try {
+        header = JSON.parse(b64urlToBuffer(headerB64).toString('utf8'));
+        claims = JSON.parse(b64urlToBuffer(payloadB64).toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (header.alg !== 'HS256')
+        return null;
+    const kid = typeof header.kid === 'string' ? header.kid : undefined;
+    const secret = resolveSecret(opts.secret, kid);
+    if (!secret)
+        return null;
+    // Constant-time signature comparison.
+    const expected = hmac(`${headerB64}.${payloadB64}`, secret);
+    const provided = b64urlToBuffer(sigB64);
+    if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+        return null;
+    }
+    // Structural + role validation.
+    if (typeof claims.room !== 'string' ||
+        typeof claims.exp !== 'number' ||
+        typeof claims.iat !== 'number' ||
+        typeof claims.jti !== 'string' ||
+        !VALID_ROLES.has(claims.role)) {
+        return null;
+    }
+    const nowSec = Math.floor((opts.now ? opts.now() : Date.now()) / 1000);
+    const tolerance = opts.clockToleranceSec ?? DEFAULT_CLOCK_TOLERANCE_SEC;
+    if (claims.exp + tolerance < nowSec)
+        return null; // expired
+    if (claims.iat - tolerance > nowSec)
+        return null; // issued in the future
+    if (opts.room !== undefined && claims.room !== opts.room)
+        return null;
+    return claims;
+}
+/**
+ * Build an `AuthenticateFn` that authorizes a websocket connection from a
+ * room token. Pass to `startCollabServer({ authenticate })`.
+ */
+export function createRoomTokenAuthenticator(opts) {
+    return async (token, roomId) => {
+        const claims = verifyRoomToken(token ?? '', {
+            secret: opts.secret,
+            room: roomId,
+            now: opts.now,
+            clockToleranceSec: opts.clockToleranceSec,
+        });
+        if (!claims)
+            return null;
+        if (opts.isRevoked && (await opts.isRevoked(claims.jti)))
+            return null;
+        if (opts.principalFor)
+            return opts.principalFor(claims);
+        return {
+            userId: `anon-${randomUUID()}`,
+            role: claims.role,
+            expiresAt: claims.exp * 1000,
+            meta: { jti: claims.jti, room: claims.room },
+        };
+    };
+}
+function readJsonBody(req, maxBytes) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > maxBytes) {
+                reject(new Error('body-too-large'));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            try {
+                resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+            }
+            catch {
+                reject(new Error('invalid-json'));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+function bearerToken(req) {
+    const header = req.headers['authorization'];
+    if (typeof header !== 'string')
+        return undefined;
+    const m = header.match(/^Bearer\s+(.+)$/i);
+    return m ? m[1] : undefined;
+}
+/**
+ * Handle `POST /collab/token` (and its CORS preflight). Returns `true` when the
+ * request matched this route (and a response was sent), `false` otherwise so
+ * the caller can fall through to its own 404.
+ */
+export async function handleTokenMintRequest(req, res, opts) {
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    if (url.pathname !== '/collab/token')
+        return false;
+    const allowOrigin = opts.allowOrigin ?? '*';
+    const cors = {
+        'access-control-allow-origin': allowOrigin,
+        'access-control-allow-methods': 'POST, OPTIONS',
+        'access-control-allow-headers': 'content-type, authorization',
+    };
+    if (req.method === 'OPTIONS') {
+        res.writeHead(204, cors);
+        res.end();
+        return true;
+    }
+    if (req.method !== 'POST') {
+        res.writeHead(405, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'method-not-allowed' }));
+        return true;
+    }
+    let body;
+    try {
+        body = await readJsonBody(req, opts.maxBodyBytes ?? 4096);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : 'bad-request';
+        res.writeHead(reason === 'body-too-large' ? 413 : 400, {
+            ...cors,
+            'content-type': 'application/json',
+        });
+        res.end(JSON.stringify({ error: reason }));
+        return true;
+    }
+    const reqBody = body;
+    if (typeof reqBody?.roomId !== 'string' ||
+        !reqBody.roomId ||
+        typeof reqBody.role !== 'string' ||
+        !VALID_ROLES.has(reqBody.role)) {
+        res.writeHead(400, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'invalid-request' }));
+        return true;
+    }
+    const mintReq = {
+        roomId: reqBody.roomId,
+        role: reqBody.role,
+        ttlSeconds: typeof reqBody.ttlSeconds === 'number' ? reqBody.ttlSeconds : undefined,
+    };
+    let bearerClaims = verifyRoomToken(bearerToken(req) ?? '', {
+        secret: opts.verifySecret ?? opts.secret,
+        now: opts.now,
+    });
+    // A revoked bearer (kicked admin / revoked link) is treated as no bearer at
+    // all, so the mint policy can't be exercised with a denied credential.
+    if (bearerClaims && opts.isRevoked && (await opts.isRevoked(bearerClaims.jti))) {
+        bearerClaims = null;
+    }
+    let grantedRole;
+    try {
+        grantedRole = await opts.authorize(mintReq, { bearerClaims });
+    }
+    catch (err) {
+        // eslint-disable-next-line no-console
+        console.error('[collab-server] token authorize threw:', err);
+        res.writeHead(500, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'authorize-error' }));
+        return true;
+    }
+    if (!grantedRole) {
+        res.writeHead(403, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'forbidden' }));
+        return true;
+    }
+    const maxTtl = opts.maxTtlSeconds ?? 30 * 24 * 60 * 60;
+    const ttlSeconds = Math.min(mintReq.ttlSeconds ?? opts.defaultTtlSeconds ?? DEFAULT_TTL_SECONDS, maxTtl);
+    const token = signRoomToken({
+        roomId: mintReq.roomId,
+        role: grantedRole,
+        secret: opts.secret,
+        ttlSeconds,
+        kid: opts.kid,
+        now: opts.now,
+    });
+    const expSec = Math.floor((opts.now ? opts.now() : Date.now()) / 1000) + ttlSeconds;
+    res.writeHead(200, { ...cors, 'content-type': 'application/json' });
+    res.end(JSON.stringify({ token, roomId: mintReq.roomId, role: grantedRole, exp: expSec }));
+    return true;
+}
+/**
+ * Handle `POST /collab/revoke` (and its CORS preflight). The caller must
+ * present an `admin` bearer token for the same room as the token being revoked.
+ * Returns `true` when this route matched (and a response was sent).
+ */
+export async function handleRevokeRequest(req, res, opts) {
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    if (url.pathname !== '/collab/revoke')
+        return false;
+    const allowOrigin = opts.allowOrigin ?? '*';
+    const cors = {
+        'access-control-allow-origin': allowOrigin,
+        'access-control-allow-methods': 'POST, OPTIONS',
+        'access-control-allow-headers': 'content-type, authorization',
+    };
+    if (req.method === 'OPTIONS') {
+        res.writeHead(204, cors);
+        res.end();
+        return true;
+    }
+    if (req.method !== 'POST') {
+        res.writeHead(405, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'method-not-allowed' }));
+        return true;
+    }
+    let body;
+    try {
+        body = await readJsonBody(req, opts.maxBodyBytes ?? 4096);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : 'bad-request';
+        res.writeHead(reason === 'body-too-large' ? 413 : 400, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: reason }));
+        return true;
+    }
+    const target = verifyRoomToken(body?.token ?? '', {
+        secret: opts.secret,
+        now: opts.now,
+    });
+    if (!target) {
+        res.writeHead(400, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'invalid-token' }));
+        return true;
+    }
+    // Only a non-revoked admin token for the *same room* may revoke.
+    const bearer = verifyRoomToken(bearerToken(req) ?? '', {
+        secret: opts.secret,
+        room: target.room,
+        now: opts.now,
+    });
+    if (!bearer ||
+        bearer.role !== 'admin' ||
+        (opts.isRevoked && (await opts.isRevoked(bearer.jti)))) {
+        res.writeHead(403, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'forbidden' }));
+        return true;
+    }
+    await opts.recordRevocation(target.jti, target.room);
+    res.writeHead(200, { ...cors, 'content-type': 'application/json' });
+    res.end(JSON.stringify({ revoked: true, jti: target.jti }));
+    return true;
+}
+/**
+ * Handle `POST /collab/kick` (and its CORS preflight). The caller must present
+ * an `admin` bearer token for the target room. Returns `true` when this route
+ * matched (and a response was sent).
+ */
+export async function handleKickRequest(req, res, opts) {
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    if (url.pathname !== '/collab/kick')
+        return false;
+    const allowOrigin = opts.allowOrigin ?? '*';
+    const cors = {
+        'access-control-allow-origin': allowOrigin,
+        'access-control-allow-methods': 'POST, OPTIONS',
+        'access-control-allow-headers': 'content-type, authorization',
+    };
+    if (req.method === 'OPTIONS') {
+        res.writeHead(204, cors);
+        res.end();
+        return true;
+    }
+    if (req.method !== 'POST') {
+        res.writeHead(405, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'method-not-allowed' }));
+        return true;
+    }
+    let body;
+    try {
+        body = await readJsonBody(req, opts.maxBodyBytes ?? 4096);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : 'bad-request';
+        res.writeHead(reason === 'body-too-large' ? 413 : 400, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: reason }));
+        return true;
+    }
+    const reqBody = body;
+    if (typeof reqBody?.roomId !== 'string' || !reqBody.roomId || typeof reqBody.clientId !== 'number') {
+        res.writeHead(400, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'invalid-request' }));
+        return true;
+    }
+    const bearer = verifyRoomToken(bearerToken(req) ?? '', {
+        secret: opts.secret,
+        room: reqBody.roomId,
+        now: opts.now,
+    });
+    if (!bearer ||
+        bearer.role !== 'admin' ||
+        (opts.isRevoked && (await opts.isRevoked(bearer.jti)))) {
+        res.writeHead(403, { ...cors, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'forbidden' }));
+        return true;
+    }
+    const kicked = await opts.kick(reqBody.roomId, reqBody.clientId);
+    res.writeHead(200, { ...cors, 'content-type': 'application/json' });
+    res.end(JSON.stringify({ kicked }));
+    return true;
+}
+//# sourceMappingURL=room-token.js.map

package/dist/room-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-token.js","sourceRoot":"","sources":["../src/room-token.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAItE,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IAC/C,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AACvD,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAoBvC,SAAS,YAAY,CAAC,KAAsB;IAC1C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,IAAI,CAAC,YAAoB,EAAE,MAAc;IAChD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,MAAsB,EAAE,GAAuB;IACpE,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAiBD,gCAAgC;AAChC,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,MAAM,MAAM,GAAoB;QAC9B,IAAI,EAAE,IAAI,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;QACtD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE;QAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;IAEF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpF,MAAM,YAAY,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IACvG,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,GAAG,YAAY,IAAI,GAAG,EAAE,CAAC;AAClC,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAA4B;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAE9C,IAAI,MAAwC,CAAC;IAC7C,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAoB,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,sCAAsC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,IACE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;IACxE,IAAI,MAAM,CAAC,GAAG,GAAG,SAAS,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IAC5D,IAAI,MAAM,CAAC,GAAG,GAAG,SAAS,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IAEzE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAmC;IAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,IAAI,EAAE,EAAE;YAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtE,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,QAAQ,UAAU,EAAE,EAAE;YAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,GAAG,GAAG,IAAI;YAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;SAC7C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AA+CD,SAAS,YAAY,CAAC,GAAyB,EAAE,QAAgB;IAC/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACpC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAyB;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAyB,EACzB,GAAwB,EACxB,IAA0B;IAE1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC;IAC5C,MAAM,IAAI,GAAG;QACX,6BAA6B,EAAE,WAAW;QAC1C,8BAA8B,EAAE,eAAe;QAC/C,8BAA8B,EAAE,6BAA6B;KAC9D,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QAClE,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;YACrD,GAAG,IAAI;YACP,cAAc,EAAE,kBAAkB;SACnC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAgC,CAAC;IACjD,IACE,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ;QACnC,CAAC,OAAO,CAAC,MAAM;QACf,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAChC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAC9B,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAoB;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACpF,CAAC;IAEF,IAAI,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE;QACzD,MAAM,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM;QACxC,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,YAAY,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/E,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,IAAI,WAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,iBAAiB,IAAI,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,aAAa,CAAC;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU;QACV,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC;IAEpF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAyB,EACzB,GAAwB,EACxB,IAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAEpD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC;IAC5C,MAAM,IAAI,GAAG;QACX,6BAA6B,EAAE,WAAW;QAC1C,8BAA8B,EAAE,eAAe;QAC/C,8BAA8B,EAAE,6BAA6B;KAC9D,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QAClE,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAE,IAAmC,EAAE,KAAK,IAAI,EAAE,EAAE;QAChF,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iEAAiE;IACjE,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,IACE,CAAC,MAAM;QACP,MAAM,CAAC,IAAI,KAAK,OAAO;QACvB,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EACtD,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAyB,EACzB,GAAwB,EACxB,IAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAElD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC;IAC5C,MAAM,IAAI,GAAG;QACX,6BAA6B,EAAE,WAAW;QAC1C,8BAA8B,EAAE,eAAe;QAC/C,8BAA8B,EAAE,6BAA6B;KAC9D,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QAClE,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAgC,CAAC;IACjD,IAAI,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,IACE,CAAC,MAAM;QACP,MAAM,CAAC,IAAI,KAAK,OAAO;QACvB,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EACtD,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server.d.ts

@@ -10,7 +10,25 @@ import { type AuditSink } from './audit-log.js';
 import { type RateLimitOptions } from './rate-limit.js';
 import { type VerifyMessageFn } from './room-manager.js';
 import { type BlobAuthorizeFn, type ServerBlobStorage } from './blob-route.js';
+import { type TokenEndpointOptions, type RevokeEndpointOptions, type KickEndpointOptions } from './room-token.js';
 import { MetricsRegistry } from './metrics.js';
+/**
+ * Cross-origin policy for the HTTP routes (`/blobs`, `/collab/*`, `/healthz`,
+ * `/metrics`). The viewer is typically served from a different origin than the
+ * collab-server, so a browser `fetch()`/`PUT` to the blob route needs
+ * `Access-Control-Allow-*` headers and an `OPTIONS` preflight response —
+ * without them the WebSocket doc syncs but geometry blobs are blocked, so
+ * recipients see an empty model.
+ */
+export interface CorsOptions {
+    /**
+     * Allowed origin(s). `'*'` or omitted reflects whatever `Origin` the
+     * request carries (permissive — fine for dev and same-trust deployments).
+     * An explicit string or array restricts to those origins; a non-matching
+     * origin gets no CORS headers (and the browser blocks the request).
+     */
+    origin?: '*' | string | string[];
+}
 export interface StartCollabServerOptions {
     port?: number;
     host?: string;
@@ -62,6 +80,33 @@ export interface StartCollabServerOptions {
      * `reject` with the reason and drops the message.
      */
     verifyMessage?: VerifyMessageFn;
+    /**
+     * Enable the `POST /collab/token` mint route for link-based sharing.
+     * Omit to leave the route disabled (404). Pair with
+     * `authenticate: createRoomTokenAuthenticator({ secret })` so connections
+     * are verified against the same secret.
+     */
+    tokenEndpoint?: TokenEndpointOptions;
+    /**
+     * Enable the `POST /collab/revoke` route so an admin can invalidate a share
+     * link (its `jti` is added to a deny-list the authenticator's `isRevoked`
+     * consults). Omit to leave the route disabled (404).
+     */
+    revokeEndpoint?: RevokeEndpointOptions;
+    /**
+     * Enable the `POST /collab/kick` route so an admin can force-disconnect a
+     * peer by awareness clientId. The server binds the kick to its room manager;
+     * only the verifying `secret` is supplied here. Omit to disable (404).
+     */
+    kickEndpoint?: Pick<KickEndpointOptions, 'secret' | 'isRevoked'>;
+    /**
+     * Cross-origin access for the HTTP routes. Default: enabled with origin
+     * reflection (permissive). Pass an allow-list to restrict, or `false` to
+     * disable entirely (e.g. when a reverse proxy owns CORS). Only applies to
+     * the server this function creates — ignored when you pass your own
+     * `server`.
+     */
+    cors?: CorsOptions | false;
 }
 export interface CollabServerHandle {
     readonly url: string;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AACrD,OAAO,EAAE,WAAW,EAAuB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAkC,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAkB,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC;IACrB,wDAAwD;IACxD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,qEAAqE;IACrE,SAAS,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,KAAK,gBAAgB,CAAC,CAAC;IAC5E;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAID,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAmK7B;AAsID,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AACrD,OAAO,EAAE,WAAW,EAAuB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAkC,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAkB,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;CAClC;AA6CD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC;IACrB,wDAAwD;IACxD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,qEAAqE;IACrE,SAAS,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,KAAK,gBAAgB,CAAC,CAAC;IAC5E;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;OAIG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;OAIG;IACH,YAAY,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAID,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAwM7B;AAsID,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC"}