@kortix/sdk 0.13.5 → 0.13.9

package/dist/node/auth.js

@@ -0,0 +1,414 @@
+/**
+ * `createKortixAuth` — "Sign in with Kortix" for a standalone app.
+ *
+ * A third-party app (a dashboard, an internal tool, a vertical wrapper) mounts
+ * ONE catch-all route on `handler()` and gets the whole OAuth 2.1 lifecycle
+ * against Kortix: PKCE sign-in, the callback exchange, an encrypted session
+ * cookie, silent refresh, sign-out with revocation, a `/me` identity probe for
+ * the browser, and a same-origin `/proxy` so `createKortix` in the browser
+ * talks to Kortix AS the signed-in viewer without ever holding a token.
+ *
+ * Framework-free on purpose: only Web `Request`/`Response`, `URL`, `fetch` and
+ * WebCrypto (`crypto.subtle`) — present in Node ≥ 19, Bun, Deno and every edge
+ * runtime. No `node:` import beyond what `./server` already carries for
+ * `createScopedKortix`. Works identically against kortix.com and a self-host;
+ * the only Kortix-specific inputs are `backendUrl` and a registered client
+ * (`kortix.iam.oauthClients.create`, or Account → Tokens → OAuth apps).
+ *
+ * Server-side state is the cookie. `viewer()` is read-only and never consumes
+ * the (single-use, rotating) refresh token; the `/refresh`, `/me` and `/proxy`
+ * paths — which return a `Response` and can set cookies — are the only places
+ * a rotation is persisted. `requireViewer()` turns an expired session into a
+ * redirect through `/refresh`, so a page never renders "signed out" for a user
+ * whose refresh token is still good.
+ */
+import { createScopedKortix, forwardKortixRequest } from './server.js';
+import { stripTrailingSlashes } from '../platform/strings.js';
+export class KortixAuthError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'KortixAuthError';
+    }
+}
+/** The bearer the browser sends; `/proxy` replaces it with the viewer's token. */
+export const KORTIX_SESSION_SENTINEL = 'kortix-session';
+const DEFAULT_SCOPES = ['profile', 'email', 'kortix'];
+const TXN_TTL_S = 10 * 60;
+const DEFAULT_SESSION_TTL_S = 30 * 24 * 3600;
+/** Treat a token as expired this long before Kortix does, so a call in flight never lands on a dead token. */
+const EXPIRY_SKEW_S = 30;
+// ─── small codecs ────────────────────────────────────────────────────────────
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+function b64url(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function fromB64url(value) {
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (value.length % 4)) % 4);
+    const s = atob(padded);
+    const out = new Uint8Array(new ArrayBuffer(s.length));
+    for (let i = 0; i < s.length; i += 1)
+        out[i] = s.charCodeAt(i);
+    return out;
+}
+function randomB64url(bytes) {
+    const buf = new Uint8Array(bytes);
+    crypto.getRandomValues(buf);
+    return b64url(buf);
+}
+async function sha256B64url(input) {
+    return b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', enc.encode(input))));
+}
+async function aesKey(secret) {
+    const raw = await crypto.subtle.digest('SHA-256', enc.encode(secret));
+    return crypto.subtle.importKey('raw', raw, 'AES-GCM', false, ['encrypt', 'decrypt']);
+}
+async function seal(value, secret) {
+    const iv = new Uint8Array(12);
+    crypto.getRandomValues(iv);
+    const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await aesKey(secret), enc.encode(JSON.stringify(value)));
+    return `${b64url(iv)}.${b64url(new Uint8Array(ct))}`;
+}
+async function open(token, secret) {
+    const [ivPart, ctPart, extra] = token.split('.');
+    if (!ivPart || !ctPart || extra)
+        return null;
+    try {
+        const pt = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: fromB64url(ivPart) }, await aesKey(secret), fromB64url(ctPart));
+        return JSON.parse(dec.decode(pt));
+    }
+    catch {
+        return null;
+    }
+}
+function readCookie(request, name) {
+    const header = request.headers.get('cookie') ?? '';
+    for (const part of header.split(';')) {
+        const [k, ...v] = part.trim().split('=');
+        if (k === name)
+            return v.join('=') || null;
+    }
+    return null;
+}
+/** Only a same-origin path may be a post-auth destination. */
+export function safeReturnTo(value) {
+    if (!value)
+        return '/';
+    if (!value.startsWith('/') || value.startsWith('//') || value.startsWith('/\\'))
+        return '/';
+    return value;
+}
+// ─── the kit ─────────────────────────────────────────────────────────────────
+export function createKortixAuth(options) {
+    if (!options.cookieSecret || options.cookieSecret.length < 32) {
+        throw new KortixAuthError('invalid_options', 'cookieSecret must be at least 32 characters');
+    }
+    let redirect;
+    try {
+        redirect = new URL(options.redirectUri);
+    }
+    catch {
+        throw new KortixAuthError('invalid_options', 'redirectUri must be an absolute URL');
+    }
+    if (redirect.protocol !== 'https:' && redirect.protocol !== 'http:') {
+        throw new KortixAuthError('invalid_options', 'redirectUri must be http(s)');
+    }
+    if (!options.clientId)
+        throw new KortixAuthError('invalid_options', 'clientId is required');
+    if (!options.backendUrl)
+        throw new KortixAuthError('invalid_options', 'backendUrl is required');
+    const backendUrl = stripTrailingSlashes(options.backendUrl);
+    const rawBase = options.basePath ?? (redirect.pathname.endsWith('/callback/') ? redirect.pathname.slice(0, -'/callback/'.length) : redirect.pathname.endsWith('/callback') ? redirect.pathname.slice(0, -'/callback'.length) : redirect.pathname);
+    const basePath = stripTrailingSlashes(rawBase) || '/';
+    const secure = redirect.protocol === 'https:';
+    const sessionCookie = secure ? '__Host-kortix_session' : 'kortix_session';
+    const txnCookie = secure ? '__Host-kortix_oauth_txn' : 'kortix_oauth_txn';
+    const scopes = options.scopes?.length ? options.scopes : DEFAULT_SCOPES;
+    const sessionTtl = options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_S;
+    const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    let now = options.now ?? (() => Date.now());
+    const nowS = () => Math.floor(now() / 1000);
+    const cookieLine = (name, value, maxAge) => `${name}=${value}; Path=/; Max-Age=${maxAge}; HttpOnly; SameSite=Lax${secure ? '; Secure' : ''}`;
+    const clearLine = (name) => cookieLine(name, '', 0);
+    const redirectTo = (location, cookies = []) => {
+        const headers = new Headers({ location, 'cache-control': 'no-store' });
+        for (const c of cookies)
+            headers.append('set-cookie', c);
+        return new Response(null, { status: 302, headers });
+    };
+    const jsonResponse = (body, status = 200, cookies = []) => {
+        const headers = new Headers({ 'content-type': 'application/json', 'cache-control': 'no-store' });
+        for (const c of cookies)
+            headers.append('set-cookie', c);
+        return new Response(JSON.stringify(body), { status, headers });
+    };
+    const pathOf = (request) => {
+        const url = new URL(request.url);
+        return `${url.pathname}${url.search}`;
+    };
+    const signInUrl = (returnTo) => returnTo ? `${basePath}/signin?return_to=${encodeURIComponent(safeReturnTo(returnTo))}` : `${basePath}/signin`;
+    const signOutUrl = (returnTo) => returnTo ? `${basePath}/signout?return_to=${encodeURIComponent(safeReturnTo(returnTo))}` : `${basePath}/signout`;
+    const refreshUrl = (returnTo) => `${basePath}/refresh?return_to=${encodeURIComponent(safeReturnTo(returnTo))}`;
+    // ── Kortix calls ──
+    const clientAuthFields = () => ({
+        client_id: options.clientId,
+        ...(options.clientSecret ? { client_secret: options.clientSecret } : {}),
+    });
+    async function tokenRequest(fields) {
+        let res;
+        try {
+            res = await fetchImpl(`${backendUrl}/oauth/token`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: new URLSearchParams({ ...fields, ...clientAuthFields() }).toString(),
+            });
+        }
+        catch (err) {
+            return { ok: false, status: 502, error: 'upstream_unreachable', description: err.message };
+        }
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok || typeof body.access_token !== 'string' || typeof body.refresh_token !== 'string') {
+            return {
+                ok: false,
+                status: res.status,
+                error: typeof body.error === 'string' ? body.error : 'token_error',
+                description: typeof body.error_description === 'string' ? body.error_description : undefined,
+            };
+        }
+        const expiresIn = typeof body.expires_in === 'number' ? body.expires_in : 3600;
+        return {
+            ok: true,
+            session: {
+                v: 1,
+                at: body.access_token,
+                rt: body.refresh_token,
+                exp: nowS() + expiresIn,
+                scopes: typeof body.scope === 'string' ? body.scope.split(' ').filter(Boolean) : scopes,
+            },
+        };
+    }
+    async function revoke(token) {
+        try {
+            await fetchImpl(`${backendUrl}/oauth/revoke`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: new URLSearchParams({ token, ...clientAuthFields() }).toString(),
+            });
+        }
+        catch {
+            // Best effort: the cookie is cleared regardless; the token dies at its TTL.
+        }
+    }
+    async function identity(token) {
+        try {
+            const res = await fetchImpl(`${backendUrl}/accounts/me`, {
+                headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+            });
+            if (!res.ok)
+                return null;
+            return (await res.json());
+        }
+        catch {
+            return null;
+        }
+    }
+    // ── session cookie ──
+    const readSession = async (request) => {
+        const raw = readCookie(request, sessionCookie);
+        if (!raw)
+            return null;
+        const payload = await open(raw, options.cookieSecret);
+        return payload && payload.v === 1 && typeof payload.at === 'string' && typeof payload.rt === 'string' ? payload : null;
+    };
+    const isLive = (s) => s.exp - EXPIRY_SKEW_S > nowS();
+    const sessionCookieLine = async (s) => cookieLine(sessionCookie, await seal(s, options.cookieSecret), sessionTtl);
+    const toViewer = (s, id) => ({
+        userId: id.user_id,
+        email: id.email,
+        accounts: id.accounts ?? [],
+        scopes: s.scopes,
+        token: s.at,
+        expiresAt: s.exp * 1000,
+    });
+    /**
+     * A live session, refreshing (and persisting via `setCookie`) when the access
+     * token is expired but the refresh token may still be good. Used by the paths
+     * that return a Response; `viewer()` deliberately does not go through here.
+     */
+    async function liveSession(request) {
+        const session = await readSession(request);
+        if (!session)
+            return null;
+        if (isLive(session))
+            return { session, setCookie: null };
+        const refreshed = await tokenRequest({ grant_type: 'refresh_token', refresh_token: session.rt });
+        if (!refreshed.ok)
+            return null;
+        return { session: refreshed.session, setCookie: await sessionCookieLine(refreshed.session) };
+    }
+    // ── route handlers ──
+    async function handleSignIn(request) {
+        const url = new URL(request.url);
+        const returnTo = safeReturnTo(url.searchParams.get('return_to'));
+        const state = randomB64url(24);
+        const verifier = randomB64url(48);
+        const challenge = await sha256B64url(verifier);
+        const txn = { v: 1, state, verifier, returnTo, exp: nowS() + TXN_TTL_S };
+        const authorize = new URL(`${backendUrl}/oauth/authorize`);
+        authorize.searchParams.set('response_type', 'code');
+        authorize.searchParams.set('client_id', options.clientId);
+        authorize.searchParams.set('redirect_uri', options.redirectUri);
+        authorize.searchParams.set('scope', scopes.join(' '));
+        authorize.searchParams.set('state', state);
+        authorize.searchParams.set('code_challenge', challenge);
+        authorize.searchParams.set('code_challenge_method', 'S256');
+        return redirectTo(authorize.toString(), [cookieLine(txnCookie, await seal(txn, options.cookieSecret), TXN_TTL_S)]);
+    }
+    async function handleCallback(request) {
+        const url = new URL(request.url);
+        const rawTxn = readCookie(request, txnCookie);
+        const txn = rawTxn ? await open(rawTxn, options.cookieSecret) : null;
+        const state = url.searchParams.get('state') ?? '';
+        if (!txn || txn.v !== 1 || txn.exp <= nowS() || !state || state !== txn.state) {
+            return jsonResponse({ error: 'state_mismatch', error_description: 'The sign-in transaction is missing, expired, or does not match this callback.' }, 400, [clearLine(txnCookie)]);
+        }
+        const returnTo = safeReturnTo(txn.returnTo);
+        const oauthError = url.searchParams.get('error');
+        if (oauthError) {
+            const target = new URL(returnTo, 'http://local');
+            target.searchParams.set('kortix_auth_error', oauthError);
+            return redirectTo(`${target.pathname}${target.search}`, [clearLine(txnCookie)]);
+        }
+        const code = url.searchParams.get('code') ?? '';
+        if (!code)
+            return jsonResponse({ error: 'invalid_callback', error_description: 'Missing code' }, 400, [clearLine(txnCookie)]);
+        const exchanged = await tokenRequest({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: options.redirectUri,
+            code_verifier: txn.verifier,
+        });
+        if (!exchanged.ok) {
+            return jsonResponse({ error: 'token_exchange_failed', upstream_error: exchanged.error, error_description: exchanged.description ?? null }, exchanged.status === 502 ? 502 : 400, [clearLine(txnCookie)]);
+        }
+        return redirectTo(returnTo, [await sessionCookieLine(exchanged.session), clearLine(txnCookie)]);
+    }
+    async function handleRefresh(request) {
+        const url = new URL(request.url);
+        const returnTo = safeReturnTo(url.searchParams.get('return_to'));
+        const session = await readSession(request);
+        if (!session)
+            return redirectTo(signInUrl(returnTo), [clearLine(sessionCookie)]);
+        if (isLive(session))
+            return redirectTo(returnTo);
+        const refreshed = await tokenRequest({ grant_type: 'refresh_token', refresh_token: session.rt });
+        if (!refreshed.ok)
+            return redirectTo(signInUrl(returnTo), [clearLine(sessionCookie)]);
+        return redirectTo(returnTo, [await sessionCookieLine(refreshed.session)]);
+    }
+    async function handleSignOut(request) {
+        const url = new URL(request.url);
+        const returnTo = safeReturnTo(url.searchParams.get('return_to'));
+        const session = await readSession(request);
+        if (session)
+            await revoke(session.rt);
+        return redirectTo(returnTo, [clearLine(sessionCookie), clearLine(txnCookie)]);
+    }
+    async function handleMe(request) {
+        const live = await liveSession(request);
+        if (!live)
+            return jsonResponse({ error: 'unauthenticated' }, 401, [clearLine(sessionCookie)]);
+        const id = await identity(live.session.at);
+        if (!id)
+            return jsonResponse({ error: 'unauthenticated' }, 401, [clearLine(sessionCookie)]);
+        const viewer = toViewer(live.session, id);
+        return jsonResponse({ user_id: viewer.userId, email: viewer.email, accounts: viewer.accounts, scopes: viewer.scopes, expires_at: new Date(viewer.expiresAt).toISOString() }, 200, live.setCookie ? [live.setCookie] : []);
+    }
+    async function handleProxy(request, rest) {
+        const live = await liveSession(request);
+        if (!live)
+            return jsonResponse({ error: 'unauthenticated', error_description: 'Sign in with Kortix first.' }, 401);
+        const url = new URL(request.url);
+        const upstream = await forwardKortixRequest({
+            request,
+            upstreamUrl: `${backendUrl}/${rest.replace(/^\/+/, '')}${url.search}`,
+            token: live.session.at,
+            fetch: fetchImpl,
+        });
+        if (!live.setCookie)
+            return upstream;
+        const headers = new Headers(upstream.headers);
+        headers.append('set-cookie', live.setCookie);
+        return new Response(upstream.body, { status: upstream.status, headers });
+    }
+    async function handler(request) {
+        const url = new URL(request.url);
+        if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) {
+            return jsonResponse({ error: 'not_found', error_description: `Not under ${basePath}` }, 404);
+        }
+        const sub = url.pathname.slice(basePath.length).replace(/^\/+/, '');
+        const [head, ...tail] = sub.split('/');
+        switch (head) {
+            case 'signin':
+                return handleSignIn(request);
+            case 'callback':
+                return handleCallback(request);
+            case 'refresh':
+                return handleRefresh(request);
+            case 'signout':
+                return handleSignOut(request);
+            case 'me':
+                return handleMe(request);
+            case 'proxy':
+                return handleProxy(request, tail.join('/'));
+            default:
+                return jsonResponse({ error: 'not_found' }, 404);
+        }
+    }
+    async function viewer(request) {
+        const session = await readSession(request);
+        if (!session || !isLive(session))
+            return null;
+        const id = await identity(session.at);
+        return id ? toViewer(session, id) : null;
+    }
+    async function requireViewer(request) {
+        const current = await viewer(request);
+        if (current)
+            return { viewer: current };
+        const returnTo = pathOf(request);
+        const session = await readSession(request);
+        if (session && !isLive(session))
+            return { response: redirectTo(refreshUrl(returnTo)) };
+        return { response: redirectTo(signInUrl(returnTo)) };
+    }
+    async function kortix(request) {
+        const current = await viewer(request);
+        if (!current)
+            throw new KortixAuthError('unauthenticated', 'No signed-in Kortix viewer on this request');
+        const token = current.token;
+        return createScopedKortix({ backendUrl, getToken: async () => token, fetch: fetchImpl, clientSource: 'web' });
+    }
+    return {
+        basePath,
+        handler,
+        viewer,
+        requireViewer,
+        kortix,
+        signInUrl,
+        signOutUrl,
+        clientConfig(origin) {
+            const base = origin ?? (typeof window !== 'undefined' ? window.location.origin : '');
+            return { backendUrl: `${stripTrailingSlashes(base)}${basePath}/proxy`, getToken: async () => KORTIX_SESSION_SENTINEL };
+        },
+        __setNow(next) {
+            now = next;
+        },
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/node/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/node/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAGpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAwE3D,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAEtB;IADlB,YACkB,IAKI,EACpB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QARC,SAAI,GAAJ,IAAI,CAKA;QAIpB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAExD,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AACtD,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,CAAC;AAC1B,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7C,8GAA8G;AAC9G,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,gFAAgF;AAEhF,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtG,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAa;IACvC,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,KAAc,EAAE,MAAc;IAChD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzH,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,IAAI,CAAI,KAAa,EAAE,MAAc;IAClD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACpC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAC3C,MAAM,MAAM,CAAC,MAAM,CAAC,EACpB,UAAU,CAAC,MAAM,CAAC,CACnB,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,KAAgC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAqBD,gFAAgF;AAEhF,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IAC5F,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IAEhG,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClP,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAC1E,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;IACxE,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACtE,MAAM,SAAS,GAAgB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACtF,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE5C,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc,EAAE,EAAE,CACjE,GAAG,IAAI,IAAI,KAAK,qBAAqB,MAAM,2BAA2B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACnG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,UAAoB,EAAE,EAAY,EAAE;QACxE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;QACvE,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,UAAoB,EAAE,EAAY,EAAE;QACrF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;QACjG,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IACxC,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,QAAiB,EAAE,EAAE,CACtC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,qBAAqB,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,SAAS,CAAC;IACjH,MAAM,UAAU,GAAG,CAAC,QAAiB,EAAE,EAAE,CACvC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,sBAAsB,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,UAAU,CAAC;IACnH,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,GAAG,QAAQ,sBAAsB,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;IAEvH,qBAAqB;IACrB,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CAAC,MAA8B;QAIxD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,cAAc,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,gBAAgB,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC/F,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa;gBAClE,WAAW,EAAE,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;aAC7F,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE;gBACP,CAAC,EAAE,CAAC;gBACJ,EAAE,EAAE,IAAI,CAAC,YAAY;gBACrB,EAAE,EAAE,IAAI,CAAC,aAAa;gBACtB,GAAG,EAAE,IAAI,EAAE,GAAG,SAAS;gBACvB,MAAM,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM;aACxF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,KAAa;QACjC,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,UAAU,eAAe,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,gBAAgB,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,KAAa;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,cAAc,EAAE;gBACvD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aAC1E,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAkC,EAAE;QAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAiB,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACtE,OAAO,OAAO,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACzH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,aAAa,GAAG,IAAI,EAAE,CAAC;IACrE,MAAM,iBAAiB,GAAG,KAAK,EAAE,CAAiB,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;IAElI,MAAM,QAAQ,GAAG,CAAC,CAAiB,EAAE,EAAmB,EAAgB,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,EAAE,CAAC,OAAO;QAClB,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,EAAE;QACX,SAAS,EAAE,CAAC,CAAC,GAAG,GAAG,IAAI;KACxB,CAAC,CAAC;IAEH;;;;OAIG;IACH,KAAK,UAAU,WAAW,CACxB,OAAgB;QAEhB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/F,CAAC;IAED,uBAAuB;IACvB,KAAK,UAAU,YAAY,CAAC,OAAgB;QAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAe,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,UAAU,kBAAkB,CAAC,CAAC;QAC3D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAChE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACxD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAa,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YAC9E,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,+EAA+E,EAAE,EAC/H,GAAG,EACH,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CACvB,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YACjD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;YACzD,OAAO,UAAU,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9H,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC;YACnC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,GAAG,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,uBAAuB,EAAE,cAAc,EAAE,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,SAAS,CAAC,WAAW,IAAI,IAAI,EAAE,EACrH,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EACpC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CACvB,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,OAAgB;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,OAAO,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,OAAgB;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO;YAAE,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,YAAY,CACjB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,EACvJ,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACvC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,IAAY;QACvD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QACnH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YAC1C,OAAO;YACP,WAAW,EAAE,GAAG,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE;YACrE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACtB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAgB;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC1E,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,QAAQ;gBACX,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;YAC/B,KAAK,UAAU;gBACb,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;YACjC,KAAK,SAAS;gBACZ,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;YAChC,KAAK,SAAS;gBACZ,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;YAChC,KAAK,IAAI;gBACP,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3B,KAAK,OAAO;gBACV,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C;gBACE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,OAAgB;QAC3C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;QACzG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,OAAO,kBAAkB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,OAAO;QACP,MAAM;QACN,aAAa;QACb,MAAM;QACN,SAAS;QACT,UAAU;QACV,YAAY,CAAC,MAAe;YAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrF,OAAO,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,QAAQ,QAAQ,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,uBAAuB,EAAE,CAAC;QACzH,CAAC;QACD,QAAQ,CAAC,IAAI;YACX,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/node/server.d.ts

@@ -43,6 +43,25 @@ export declare function forwardKortixRequest(options: {
     request: Request;
     upstreamUrl: string;
     token: string;
+    /** Custom `fetch` (tests, edge adapters). Defaults to the global. */
+    fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 }): Promise<Response>;
 export declare function createScopedKortix(config: KortixPlatformConfig): Kortix;
+/**
+ * "Sign in with Kortix" for a standalone app — OAuth 2.1 sign-in, session
+ * cookie, refresh, sign-out, `/me`, and a same-origin `/proxy`. See ./auth.ts.
+ */
+export { createKortixAuth, KortixAuthError, KORTIX_SESSION_SENTINEL, safeReturnTo, type KortixAuth, type KortixFetch, type KortixAuthOptions, type KortixViewer, type RequireViewerResult, } from './auth.js';
+/**
+ * Types a server-side consumer's declaration emit may need to name `Kortix`
+ * (the `auth` member and its session store) without reaching into src/.
+ */
+export type { HeadlessAuthApi, AuthSession, AuthUser, AuthSessionResult, AuthRequestOptions } from '../core/rest/platform-client/auth.js';
+export type { KortixSession, KortixSessionOptions, KortixSessionStorage } from '../core/auth/session.js';
+/**
+ * Kortix Apps — the viewer the Apps gate signs into every request. See
+ * ./app-viewer.ts: an App hosted by Kortix authenticates its visitor with no
+ * login of its own.
+ */
+export { readAppViewer, createAppViewerKortix, AppViewerUnavailableError, APP_VIEWER_HEADER, APP_VIEWER_TOKEN_HEADER, APP_VIEWER_SECRET_ENV, type KortixAppViewer, type ReadAppViewerOptions, } from './app-viewer.js';
 //# sourceMappingURL=server.d.ts.map

package/dist/node/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/node/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAa,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAI1C;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+CpB;AA4GD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAQvE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/node/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAa,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAI1C;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgDpB;AA4GD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAQvE;AAED;;;GAGG;AACH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACzB,MAAM,QAAQ,CAAC;AAEhB;;;GAGG;AACH,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvI,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEtG;;;;GAIG;AACH,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC"}

package/dist/node/server.js

@@ -41,6 +41,7 @@ const MAX_WRAP_DEPTH = 12;
  */
 export async function forwardKortixRequest(options) {
     const { request, upstreamUrl, token } = options;
+    const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
     const headers = new Headers(request.headers);
     headers.delete('host');
     headers.delete('content-length');
@@ -65,7 +66,7 @@ export async function forwardKortixRequest(options) {
      */
     let upstreamResponse;
     try {
-        upstreamResponse = await fetch(upstreamUrl, {
+        upstreamResponse = await fetchImpl(upstreamUrl, {
             method: request.method,
             headers,
             redirect: 'manual',
@@ -195,4 +196,15 @@ export function createScopedKortix(config) {
     scoped.runtime = scopedRuntimeUnavailable;
     return scoped;
 }
+/**
+ * "Sign in with Kortix" for a standalone app — OAuth 2.1 sign-in, session
+ * cookie, refresh, sign-out, `/me`, and a same-origin `/proxy`. See ./auth.ts.
+ */
+export { createKortixAuth, KortixAuthError, KORTIX_SESSION_SENTINEL, safeReturnTo, } from './auth.js';
+/**
+ * Kortix Apps — the viewer the Apps gate signs into every request. See
+ * ./app-viewer.ts: an App hosted by Kortix authenticates its visitor with no
+ * login of its own.
+ */
+export { readAppViewer, createAppViewerKortix, AppViewerUnavailableError, APP_VIEWER_HEADER, APP_VIEWER_TOKEN_HEADER, APP_VIEWER_SECRET_ENV, } from './app-viewer.js';
 //# sourceMappingURL=server.js.map

package/dist/node/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/node/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAGpF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAE1C,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAI1C;IACC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D;;;;;;;;;;;;;OAaG;IAEH,IAAI,gBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO;YACP,QAAQ,EAAE,QAAQ;YAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC9D,eAAe,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC3C,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAErC,OAAO,IAAI,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE;QACzC,MAAM,EAAE,gBAAgB,CAAC,MAAM;QAC/B,OAAO,EAAE,eAAe;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,UAAU,CAAI,KAAQ,EAAE,MAA4B,EAAE,IAAqB,EAAE,KAAK,GAAG,CAAC;IAC7F,IAAI,KAAK,GAAG,cAAc;QAAE,OAAO,KAAK,CAAC;IAEzC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,KAAwC,CAAC;QACpD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAe,EAAW,EAAE;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACpD,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;gBAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC;QACF,OAAO,OAAuB,CAAC;IACjC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAiB,CAAC;IACxF,CAAC;IAED,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC9B,UAAU,EAAE,IAAI;oBAChB,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;iBACvE,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;;;;;;;;;;GAUG;AACH,SAAS,wBAAwB;IAC/B,MAAM,IAAI,KAAK,CACb,6FAA6F;QAC3F,8FAA8F;QAC9F,0FAA0F;QAC1F,oCAAoC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;IACxD,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,CAAC,OAAO,GAAG,wBAAwB,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/node/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAGpF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAE1C,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAM1C;IACC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAwB,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D;;;;;;;;;;;;;OAaG;IAEH,IAAI,gBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO;YACP,QAAQ,EAAE,QAAQ;YAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC9D,eAAe,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC3C,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAErC,OAAO,IAAI,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE;QACzC,MAAM,EAAE,gBAAgB,CAAC,MAAM;QAC/B,OAAO,EAAE,eAAe;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,UAAU,CAAI,KAAQ,EAAE,MAA4B,EAAE,IAAqB,EAAE,KAAK,GAAG,CAAC;IAC7F,IAAI,KAAK,GAAG,cAAc;QAAE,OAAO,KAAK,CAAC;IAEzC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,KAAwC,CAAC;QACpD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAe,EAAW,EAAE;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACpD,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;gBAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC;QACF,OAAO,OAAuB,CAAC;IACjC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAiB,CAAC;IACxF,CAAC;IAED,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC9B,UAAU,EAAE,IAAI;oBAChB,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;iBACvE,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;;;;;;;;;;GAUG;AACH,SAAS,wBAAwB;IAC/B,MAAM,IAAI,KAAK,CACb,6FAA6F;QAC3F,8FAA8F;QAC9F,0FAA0F;QAC1F,oCAAoC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;IACxD,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,CAAC,OAAO,GAAG,wBAAwB,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,YAAY,GAMb,MAAM,QAAQ,CAAC;AAShB;;;;GAIG;AACH,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GAGtB,MAAM,cAAc,CAAC"}

package/dist/react/bedrock-invokable.d.ts

@@ -0,0 +1,58 @@
+import type { FlatModel } from './model-flatten.js';
+import type { ModelKey } from './use-model-store.js';
+/**
+ * Resolution-time guard: a resolved model key must never be a bare Bedrock
+ * in-region id when that provider serves cross-region inference profiles.
+ *
+ * *** THE PROBLEM THIS FIXES ***
+ *
+ * Bedrock refuses the bare id for its current model families — "Invocation of
+ * model ID xai.grok-4.6 with on-demand throughput isn't supported. Retry your
+ * request with the ID or ARN of an inference profile" — and OpenCode retries
+ * forever ("Retrying in Ns"), so the session never produces a turn.
+ *
+ * Fixing the AUTO-SEEDED catalog default (`nativeProviderListFromCatalog`) is
+ * necessary but not sufficient: that default is only Priority 3 of the LAST
+ * source in `use-opencode-local`'s chain
+ * (explicit > serverDefault > globalDefault > agent.model > fallback), and the
+ * explicit slot is browser-global, not project-scoped —
+ * `agentScopedModelSelectionKey(mode, agentName)` is `` `${mode}:${name ?? ''}` ``
+ * (use-opencode-local.ts:226-231). The project-home composer has no agent and
+ * no sessionId, so every native project in one browser shares the slot
+ * `native:`. One earlier session pinned `xai.grok-4.6` there and every future
+ * workspace inherited it, above anything the catalog default could say.
+ * Observed on Essentia 2026-08-26 with a bundle that already carried the
+ * catalog-default fix.
+ *
+ * On the GATEWAY path PR #6897 already re-prefixes a bare id after Bedrock's
+ * 400. Native mode has no gateway and therefore no retry — this is its
+ * analogue, applied BEFORE the request instead of after the failure.
+ *
+ * The rule, applied only within the key's OWN provider:
+ *  0. a GATEWAY key (`providerID` in `GATEWAY_PROVIDER_IDS`) → untouched. Under
+ *     the gateway every served model is registered as `kortix` and the real
+ *     provider rides in the modelID prefix (`amazon-bedrock/…`, `openrouter/…`,
+ *     `codex/…`), so "the same provider" would be the WHOLE catalog, and
+ *     `bedrockInferenceProfileRank` strips that prefix — a Bedrock profile
+ *     served through the gateway still ranks > 0. Without this step every
+ *     gateway pick without a twin (an OpenRouter or Codex model, a bare Bedrock
+ *     id) fell through to step 3 and "healed" to the newest Bedrock profile in
+ *     the catalog: on Essentia (2026-08-27) the chip was pinned to Claude Opus 5
+ *     (Global) whatever the user clicked, and every prompt was sent with it.
+ *     The gateway re-prefixes a bare id itself after Bedrock's 400 (PR #6897);
+ *     this guard is the native analogue and has no business on that path.
+ *  1. already an inference profile (`global.`/regional) → untouched;
+ *  2. a `global.` or regional twin of the same bare id is offered → use it
+ *     (same model, invokable id — this also heals ids pinned or seeded before
+ *     the fix);
+ *  3. no twin, but the provider offers OTHER inference profiles → the bare id
+ *     is not invokable here, so fall back to `autoSeedDefaultModel` over that
+ *     provider's profiles;
+ *  4. the provider offers no profile ids at all → untouched.
+ *
+ * Step 4 is what makes this inert for every non-Bedrock provider: no id there
+ * ever scores `bedrockInferenceProfileRank > 0`. Returns the SAME object when
+ * nothing changes, so callers can use it inside a memo without churn.
+ */
+export declare function healBedrockModelKey(key: ModelKey | undefined, offered: FlatModel[]): ModelKey | undefined;
+//# sourceMappingURL=bedrock-invokable.d.ts.map

package/dist/react/bedrock-invokable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bedrock-invokable.d.ts","sourceRoot":"","sources":["../../src/react/bedrock-invokable.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,QAAQ,GAAG,SAAS,EACzB,OAAO,EAAE,SAAS,EAAE,GACnB,QAAQ,GAAG,SAAS,CA8BtB"}