@leaguebrain/provenance 0.0.0-stage → 0.14.0

package/dist/index.js

@@ -0,0 +1,551 @@
+// src/helpers/cookies.ts
+var chunkIndex = (cookieName, sessionCookieName) => {
+  const prefix = `${sessionCookieName}-`;
+  if (!cookieName.startsWith(prefix)) {
+    return null;
+  }
+  const suffix = cookieName.slice(prefix.length);
+  if (!/^\d+$/.test(suffix)) {
+    return null;
+  }
+  return parseInt(suffix);
+};
+var isSessionChunkCookie = (cookieName, sessionCookieName) => chunkIndex(cookieName, sessionCookieName) !== null;
+var chunkSessionCookies = (session) => {
+  const maxCookieSize = 3500;
+  const fullCookie = JSON.stringify(session);
+  const chunksCount = Math.ceil(fullCookie.length / maxCookieSize);
+  const chunks = [...Array(chunksCount).keys()].map(
+    (i) => fullCookie.substring(i * maxCookieSize, (i + 1) * maxCookieSize)
+  );
+  return chunks;
+};
+var dechunkSessionCookies = (cookies, options) => {
+  const sessionChunkCookies = cookies.flatMap((cookie) => {
+    const index = chunkIndex(cookie.name, options.sessionCookieName);
+    return index !== null ? [{ value: cookie.value, index }] : [];
+  });
+  if (sessionChunkCookies.length > 0) {
+    const sorted = sessionChunkCookies.sort((a, b) => a.index - b.index);
+    const fullCookie = sorted.reduce((prev, current) => prev + current.value, "");
+    return fullCookie;
+  } else {
+    return null;
+  }
+};
+
+// src/helpers/encoding.ts
+var bytesToBinary = (bytes) => {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return binary;
+};
+var binaryToBytes = (binary) => {
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+};
+var encodeBase64 = (bytes) => btoa(bytesToBinary(bytes));
+var decodeBase64 = (data) => binaryToBytes(atob(data));
+var encodeBase64urlNoPadding = (bytes) => encodeBase64(bytes).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+var b64Encode = (data) => {
+  const encoder = new TextEncoder();
+  return encodeBase64(encoder.encode(data));
+};
+var b64Decode = (data) => {
+  const decoder = new TextDecoder();
+  return decoder.decode(decodeBase64(data), {});
+};
+
+// src/helpers/logs.ts
+var logStarter = (...rest) => console.log("\x1B[36m%s\x1B[0m", "provenance:", ...rest);
+
+// src/helpers/referrer.ts
+var sanitizeReferrer = (referrer) => {
+  if (!referrer) {
+    return null;
+  }
+  if (!referrer.startsWith("/") || referrer.startsWith("//") || referrer.startsWith("/\\")) {
+    return null;
+  }
+  return referrer;
+};
+
+// src/resolvers/locals.ts
+var localsResolver = () => async (context, resolve, logging) => {
+  if (logging) logStarter("locals");
+  let session;
+  try {
+    session = context.session.getCookie();
+  } catch (e) {
+    console.error("provenance:", e);
+    context.session.deleteCookie();
+    session = null;
+  }
+  context.locals.session = session;
+  return await resolve();
+};
+
+// src/resolvers/login.ts
+var loginResolver = () => async (context, resolve, logging) => {
+  if (context.routes.login.is) {
+    const session = context.locals.session;
+    const referrer = sanitizeReferrer(context.oauth.referrer);
+    if (session === null) {
+      if (logging) logStarter("login");
+      await context.oauth.redirectLogin(referrer);
+    } else {
+      return referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();
+    }
+  }
+  return await resolve();
+};
+
+// src/resolvers/logout.ts
+var logoutResolver = () => async (context, resolve, logging) => {
+  if (context.routes.logout.is) {
+    const session = context.locals.session;
+    const referrer = sanitizeReferrer(context.oauth.referrer);
+    if (session !== null) {
+      if (logging) logStarter("logout");
+      context.session.deleteCookie();
+      context.locals.session = null;
+    }
+    return referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();
+  }
+  return await resolve();
+};
+
+// src/resolvers/redirect-uri.ts
+var redirectUriResolver = () => async (context, resolve, logging) => {
+  if (context.routes.redirectUri.is) {
+    if (logging) logStarter("redirectUri");
+    let referrer = void 0;
+    try {
+      const expectedState = context.checks.state.use();
+      const codeVerifier = context.checks.pkce.use();
+      const { code, state } = context.oauth.processAuthResponse(expectedState);
+      referrer = sanitizeReferrer(state.referrer) ?? void 0;
+      const tokens = await context.oauth.requestToken(codeVerifier, code);
+      const session = context.session.create(tokens);
+      context.session.deleteCookie();
+      context.session.setCookie(session);
+    } catch (e) {
+      console.error("provenance:", e);
+    }
+    if (referrer) {
+      context.routes.redirect(referrer);
+    } else {
+      context.routes.home.redirect();
+    }
+  }
+  return await resolve();
+};
+
+// src/resolvers/refresh.ts
+var refreshResolver = (options) => {
+  return async (context, resolve, logging) => {
+    const session = context.locals.session;
+    if (session !== null && Date.now() >= session.accessExpiresAt - options.eagerRefresh) {
+      if (logging) logStarter("refresh");
+      const destroySession = () => {
+        context.session.deleteCookie();
+        context.locals.session = null;
+      };
+      if (session.refreshExpiresAt === void 0 || Date.now() < session.refreshExpiresAt) {
+        try {
+          const newTokens = await context.oauth.refresh(session.refreshToken);
+          const newSession = context.session.create(newTokens);
+          destroySession();
+          context.session.setCookie(newSession);
+          context.locals.session = newSession;
+        } catch (e) {
+          console.error("provenance:", e);
+          destroySession();
+        }
+      } else {
+        destroySession();
+      }
+    }
+    return await resolve();
+  };
+};
+
+// src/resolvers/signup.ts
+var signupResolver = () => async (context, resolve, logging) => {
+  if (context.routes.signup.is) {
+    const session = context.locals.session;
+    const referrer = sanitizeReferrer(context.oauth.referrer);
+    if (session === null) {
+      if (logging) logStarter("signup");
+      await context.oauth.redirectSignup(referrer);
+    } else {
+      return referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();
+    }
+  }
+  return await resolve();
+};
+
+// src/tokens.ts
+var TokenRequestResult = class {
+  body;
+  constructor(body) {
+    this.body = body;
+  }
+  string(field) {
+    const value = this.body[field];
+    return typeof value === "string" ? value : void 0;
+  }
+  requireString(field) {
+    const value = this.string(field);
+    if (value === void 0) {
+      throw new Error(`Missing or invalid '${field}' field`);
+    }
+    return value;
+  }
+  hasErrorCode() {
+    return this.string("error") !== void 0;
+  }
+  errorCode() {
+    return this.requireString("error");
+  }
+  hasErrorDescription() {
+    return this.string("error_description") !== void 0;
+  }
+  errorDescription() {
+    return this.requireString("error_description");
+  }
+  hasErrorURI() {
+    return this.string("error_uri") !== void 0;
+  }
+  errorURI() {
+    return this.requireString("error_uri");
+  }
+  hasState() {
+    return this.string("state") !== void 0;
+  }
+  state() {
+    return this.requireString("state");
+  }
+  tokenType() {
+    return this.requireString("token_type");
+  }
+  accessToken() {
+    return this.requireString("access_token");
+  }
+  accessTokenExpiresInSeconds() {
+    const value = this.body.expires_in;
+    if (typeof value !== "number") {
+      throw new Error(`Missing or invalid 'expires_in' field`);
+    }
+    return value;
+  }
+  accessTokenExpiresAt() {
+    return new Date(Date.now() + this.accessTokenExpiresInSeconds() * 1e3);
+  }
+  hasRefreshToken() {
+    return this.string("refresh_token") !== void 0;
+  }
+  refreshToken() {
+    return this.requireString("refresh_token");
+  }
+  hasScopes() {
+    return this.string("scope") !== void 0;
+  }
+  scopes() {
+    return this.requireString("scope").split(" ");
+  }
+};
+
+// src/modules/checks.ts
+var STATE_MAX_AGE = 60 * 5;
+var STATE_COOKIE_NAME = "state";
+var PKCE_MAX_AGE = 60 * 5;
+var PKCE_COOKIE_NAME = "pkce-code-verifier";
+var generateRandomValue = () => {
+  const randomValues = new Uint8Array(32);
+  crypto.getRandomValues(randomValues);
+  return encodeBase64urlNoPadding(randomValues);
+};
+var generateCodeVerifier = () => generateRandomValue();
+var generateState = () => generateRandomValue();
+var createS256CodeChallenge = async (codeVerifier) => {
+  const codeChallengeBytes = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(codeVerifier)
+  );
+  return encodeBase64urlNoPadding(new Uint8Array(codeChallengeBytes));
+};
+var c = () => {
+  return {
+    state: {
+      create(data) {
+        const value = b64Encode(JSON.stringify({ ...data, random: generateState() }));
+        const cookie = {
+          name: STATE_COOKIE_NAME,
+          value,
+          options: {
+            path: "/",
+            maxAge: STATE_MAX_AGE
+          }
+        };
+        return { state: value, cookie };
+      },
+      use(cookies) {
+        const state = cookies.get(STATE_COOKIE_NAME);
+        cookies.delete(STATE_COOKIE_NAME, { path: "/" });
+        if (state !== void 0) {
+          return state;
+        } else {
+          throw new Error("State not found in cookies");
+        }
+      },
+      decode(state) {
+        const { random: _random, ...data } = JSON.parse(b64Decode(state));
+        return data;
+      }
+    },
+    pkce: {
+      async create() {
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = await createS256CodeChallenge(codeVerifier);
+        const cookie = {
+          name: PKCE_COOKIE_NAME,
+          value: codeVerifier,
+          options: {
+            path: "/",
+            maxAge: PKCE_MAX_AGE
+          }
+        };
+        return { codeChallenge, cookie };
+      },
+      use(cookies) {
+        const codeVerifier = cookies.get(PKCE_COOKIE_NAME);
+        cookies.delete(PKCE_COOKIE_NAME, { path: "/" });
+        if (codeVerifier !== void 0) {
+          return codeVerifier;
+        } else {
+          throw new Error("code_verifier not found in cookies");
+        }
+      }
+    }
+  };
+};
+
+// src/modules/oauth.ts
+async function processTokensResponse(tokensResponse) {
+  const data = await tokensResponse.json();
+  if (typeof data !== "object" || data === null) {
+    throw new Error("Unexpected response");
+  }
+  const result = new TokenRequestResult(data);
+  if (result.hasErrorCode()) {
+    const error = result.errorCode();
+    const errorDescription = result.errorDescription();
+    throw new Error(`${error}: ${errorDescription}`);
+  }
+  return result;
+}
+var o = (modules, provider, options) => {
+  return {
+    /**
+     * create a redirect to the auth server for the user to login
+     * @param redirectUriOrigin origin for redirect uri.. typically the origin of the website that is logging in
+     * @param referrer the path that initiated the login
+     * @param setCookie a callback that will be used to set oauth check values in cookies to be consumed by the redirect uri handler
+     * @returns the generated auth server url
+     */
+    async login(redirectUriOrigin, referrer, setCookie) {
+      const stateCheck = modules.checks.state.create(referrer ? { referrer } : {});
+      const pkceCheck = await modules.checks.pkce.create();
+      const redirectUri = new URL(options.redirectUriPathname, redirectUriOrigin);
+      const url = provider.endpoints.createLoginUrl(redirectUri.toString(), {
+        state: stateCheck.state,
+        codeChallenge: pkceCheck.codeChallenge
+      });
+      setCookie(stateCheck.cookie.name, stateCheck.cookie.value, stateCheck.cookie.options);
+      setCookie(pkceCheck.cookie.name, pkceCheck.cookie.value, pkceCheck.cookie.options);
+      return url.toString();
+    },
+    /**
+     * create a redirect to the auth server for the user to login
+     * @param redirectUriOrigin origin for redirect uri.. typically the origin of the website that is logging in
+     * @param referrer the path that initiated the login
+     * @param setCookie a callback that will be used to set oauth check values in cookies to be consumed by the redirect uri handler
+     * @returns the generated auth server url
+     */
+    async signup(redirectUriOrigin, referrer, setCookie) {
+      const stateCheck = modules.checks.state.create(referrer ? { referrer } : {});
+      const pkceCheck = await modules.checks.pkce.create();
+      const redirectUri = new URL(options.redirectUriPathname, redirectUriOrigin);
+      const url = provider.endpoints.createSignupUrl(redirectUri.toString(), {
+        state: stateCheck.state,
+        codeChallenge: pkceCheck.codeChallenge
+      });
+      setCookie(stateCheck.cookie.name, stateCheck.cookie.value, stateCheck.cookie.options);
+      setCookie(pkceCheck.cookie.name, pkceCheck.cookie.value, pkceCheck.cookie.options);
+      return url.toString();
+    },
+    /**
+     * post to the oauth logout endpoint to destroy the oauth session (not the session stored in the cookies)
+     * @param fetch
+     */
+    async logout(fetch, session) {
+      const { url, body } = provider.endpoints.createLogoutUrl(session);
+      await fetch(url, body);
+    },
+    /**
+     * post to the oauth token endpoint to request a new set of tokens
+     * @param fetchRefreshedTokens
+     * @param refreshToken refreshToken as stored in session
+     * @returns fresh tokens
+     */
+    async refresh(fetchRefreshedTokens, refreshToken) {
+      const url = provider.endpoints.createTokenUrl();
+      const response = await fetchRefreshedTokens(url, {
+        client_id: provider.authServer.clientId,
+        client_secret: provider.authServer.clientSecret,
+        grant_type: "refresh_token",
+        refresh_token: refreshToken
+      });
+      return processTokensResponse(response);
+    },
+    /**
+     * process the redirect from the oauth auth endpoint with a one time authorization code in url params
+     * @param url the url (with params such as code) that the auth server redirects to after user logs in (get from the request event on redirectUri)
+     * @param expectedState state stored in a cookie by this client at the start of the auth flow
+     * @returns one time authorization code to be used with the token endpoint
+     */
+    processAuthResponse(url, expectedState) {
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (!code) {
+        throw new Error(`auth response code not found in search params`);
+      }
+      if (!state) {
+        throw new Error(`auth response state not found in search params`);
+      }
+      if (state !== expectedState) {
+        throw new Error(`auth response state did not match stored expected state`);
+      }
+      return {
+        code,
+        state: modules.checks.state.decode(state)
+      };
+    },
+    /**
+     * request a set of tokens from the oauth token endpoint using a one time authorization code
+     * @param fetchRequestToken callback that contains the fetch call
+     * @returns brand new tokens
+     */
+    async requestToken(fetchRequestToken) {
+      const url = provider.endpoints.createTokenUrl();
+      const authorizationCodeGrantResponse = await fetchRequestToken(url, {
+        clientId: provider.authServer.clientId,
+        clientSecret: provider.authServer.clientSecret,
+        redirectUri: options.redirectUriPathname
+      });
+      return processTokensResponse(authorizationCodeGrantResponse);
+    }
+  };
+};
+
+// src/modules/routes.ts
+var r = (options) => {
+  return {
+    redirectUri: {
+      pathname: options.redirectUriPathname
+    },
+    login: {
+      pathname: options.loginPathname
+    },
+    signup: {
+      pathname: options.signupPathname
+    },
+    logout: {
+      pathname: options.logoutPathname
+    },
+    refresh: {
+      pathname: options.refreshPathname
+    },
+    home: {
+      pathname: options.homePathname
+    }
+  };
+};
+
+// src/modules/session.ts
+var s = (provider, options) => {
+  return {
+    /**
+     * create a session object from a set of tokens
+     * @param tokens
+     * @returns session to be stored in cookies
+     */
+    create(tokens) {
+      const session = provider.session.transformTokens(tokens);
+      return provider.session.fixSession(session);
+    },
+    /**
+     * set the session object in cookies, splitting into chunks if too large
+     * @param cookies cookies from request event
+     * @param sessionCookieName
+     * @param session the session object to be set in cookies
+     */
+    setCookie(set, session) {
+      const validatedSession = provider.session.validateSession(session);
+      const chunks = chunkSessionCookies(validatedSession);
+      const maxAge = provider.session.sessionCookieAge(validatedSession);
+      chunks.forEach((chunk, i) => {
+        set(`${options.sessionCookieName}-${i}`, chunk, maxAge);
+      });
+    },
+    /**
+     * get the session object from cookies
+     * @param getAll call back for retrieving cookies
+     * @returns the session object stored in cookies or null if there is no session stored
+     */
+    getCookie(getAll) {
+      const session = dechunkSessionCookies(getAll(), {
+        sessionCookieName: options.sessionCookieName
+      });
+      if (session) {
+        const validatedSession = provider.session.validateSession(JSON.parse(session));
+        return validatedSession;
+      } else {
+        return null;
+      }
+    },
+    /**
+     * expire the session object in cookies
+     * @param cookies cookies from request event
+     * @param sessionCookieName
+     */
+    deleteCookie(getAll, _delete) {
+      const sessionChunkCookies = getAll().filter(
+        (cookie) => isSessionChunkCookie(cookie.name, options.sessionCookieName)
+      );
+      sessionChunkCookies.forEach((cookie) => {
+        _delete(cookie.name);
+      });
+    }
+  };
+};
+export {
+  TokenRequestResult,
+  c,
+  localsResolver,
+  loginResolver,
+  logoutResolver,
+  o,
+  r,
+  redirectUriResolver,
+  refreshResolver,
+  s,
+  signupResolver
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/helpers/cookies.ts","../src/helpers/encoding.ts","../src/helpers/logs.ts","../src/helpers/referrer.ts","../src/resolvers/locals.ts","../src/resolvers/login.ts","../src/resolvers/logout.ts","../src/resolvers/redirect-uri.ts","../src/resolvers/refresh.ts","../src/resolvers/signup.ts","../src/tokens.ts","../src/modules/checks.ts","../src/modules/oauth.ts","../src/modules/routes.ts","../src/modules/session.ts"],"sourcesContent":["const chunkIndex = (cookieName: string, sessionCookieName: string): number | null => {\n\tconst prefix = `${sessionCookieName}-`;\n\tif (!cookieName.startsWith(prefix)) {\n\t\treturn null;\n\t}\n\n\tconst suffix = cookieName.slice(prefix.length);\n\tif (!/^\\d+$/.test(suffix)) {\n\t\treturn null;\n\t}\n\n\treturn parseInt(suffix);\n};\n\nexport const isSessionChunkCookie = (cookieName: string, sessionCookieName: string): boolean =>\n\tchunkIndex(cookieName, sessionCookieName) !== null;\n\nexport const chunkSessionCookies = (session: any) => {\n\tconst maxCookieSize = 3500;\n\tconst fullCookie = JSON.stringify(session);\n\n\tconst chunksCount = Math.ceil(fullCookie.length / maxCookieSize);\n\tconst chunks = [...Array(chunksCount).keys()].map((i) =>\n\t\tfullCookie.substring(i * maxCookieSize, (i + 1) * maxCookieSize)\n\t);\n\n\treturn chunks;\n};\n\nexport const dechunkSessionCookies = (\n\tcookies: { name: string; value: string }[],\n\toptions: { sessionCookieName: string }\n) => {\n\tconst sessionChunkCookies = cookies.flatMap((cookie) => {\n\t\tconst index = chunkIndex(cookie.name, options.sessionCookieName);\n\t\treturn index !== null ? [{ value: cookie.value, index }] : [];\n\t});\n\n\tif (sessionChunkCookies.length > 0) {\n\t\tconst sorted = sessionChunkCookies.sort((a, b) => a.index - b.index);\n\n\t\tconst fullCookie = sorted.reduce((prev, current) => prev + current.value, '');\n\n\t\treturn fullCookie;\n\t} else {\n\t\treturn null;\n\t}\n};\n","const bytesToBinary = (bytes: Uint8Array) => {\n\tlet binary = '';\n\tfor (let i = 0; i < bytes.length; i++) {\n\t\tbinary += String.fromCharCode(bytes[i]);\n\t}\n\treturn binary;\n};\n\nconst binaryToBytes = (binary: string) => {\n\tconst bytes = new Uint8Array(binary.length);\n\tfor (let i = 0; i < binary.length; i++) {\n\t\tbytes[i] = binary.charCodeAt(i);\n\t}\n\treturn bytes;\n};\n\nexport const encodeBase64 = (bytes: Uint8Array) => btoa(bytesToBinary(bytes));\n\nexport const decodeBase64 = (data: string) => binaryToBytes(atob(data));\n\nexport const encodeBase64urlNoPadding = (bytes: Uint8Array) =>\n\tencodeBase64(bytes).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');\n\nexport const decodeBase64urlIgnorePadding = (data: string) => {\n\tconst base64 = data.replaceAll('-', '+').replaceAll('_', '/').replace(/=+$/, '');\n\treturn decodeBase64(base64.padEnd(Math.ceil(base64.length / 4) * 4, '='));\n};\n\nexport const b64Encode = (data: string) => {\n\tconst encoder = new TextEncoder();\n\n\treturn encodeBase64(encoder.encode(data));\n};\n\nexport const b64Decode = (data: string) => {\n\tconst decoder = new TextDecoder();\n\n\treturn decoder.decode(decodeBase64(data), {});\n};\n","export const logStarter = (...rest: string[]) =>\n\tconsole.log('\\x1b[36m%s\\x1b[0m', 'provenance:', ...rest);\n","/**\n * only allow same-origin relative paths as redirect targets, guarding against\n * open redirects like `/login?referrer=https://evil.com` (or protocol-relative\n * `//evil.com` and backslash `/\\evil.com` variants)\n * @param referrer untrusted referrer (from url search params or oauth state)\n * @returns the referrer if it is a safe relative path, otherwise null\n */\nexport const sanitizeReferrer = (referrer: string | null | undefined): string | null => {\n\tif (!referrer) {\n\t\treturn null;\n\t}\n\n\tif (!referrer.startsWith('/') || referrer.startsWith('//') || referrer.startsWith('/\\\\')) {\n\t\treturn null;\n\t}\n\n\treturn referrer;\n};\n","import { logStarter } from '../helpers';\nimport type { Resolver } from './types';\n\nexport const localsResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (logging) logStarter('locals');\n\n\t\tlet session: Session | null;\n\t\ttry {\n\t\t\tsession = context.session.getCookie();\n\t\t} catch (e) {\n\t\t\t// possibly need to redirect to an auth error page\n\t\t\tconsole.error('provenance:', e);\n\n\t\t\tcontext.session.deleteCookie();\n\t\t\tsession = null;\n\t\t}\n\n\t\tcontext.locals.session = session;\n\t\treturn await resolve();\n\t};\n","import { logStarter, sanitizeReferrer } from '../helpers';\nimport type { Resolver } from './types';\n\nexport const loginResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (context.routes.login.is) {\n\t\t\tconst session = context.locals.session;\n\t\t\tconst referrer = sanitizeReferrer(context.oauth.referrer);\n\n\t\t\tif (session === null) {\n\t\t\t\tif (logging) logStarter('login');\n\n\t\t\t\tawait context.oauth.redirectLogin(referrer);\n\t\t\t} else {\n\t\t\t\treturn referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();\n\t\t\t}\n\t\t}\n\t\treturn await resolve();\n\t};\n","import { logStarter, sanitizeReferrer } from '../helpers';\nimport { Resolver } from './types';\n\nexport const logoutResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (context.routes.logout.is) {\n\t\t\tconst session = context.locals.session;\n\t\t\tconst referrer = sanitizeReferrer(context.oauth.referrer);\n\n\t\t\tif (session !== null) {\n\t\t\t\tif (logging) logStarter('logout');\n\n\t\t\t\tcontext.session.deleteCookie();\n\t\t\t\tcontext.locals.session = null;\n\t\t\t}\n\n\t\t\treturn referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();\n\t\t}\n\t\treturn await resolve();\n\t};\n","import { logStarter, sanitizeReferrer } from '../helpers';\nimport { Resolver } from './types';\n\nexport const redirectUriResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (context.routes.redirectUri.is) {\n\t\t\tif (logging) logStarter('redirectUri');\n\n\t\t\tlet referrer: string | undefined = undefined;\n\t\t\ttry {\n\t\t\t\t// state stored at beginning of authorization flow (right before login redirects to auth server)\n\t\t\t\tconst expectedState = context.checks.state.use();\n\n\t\t\t\t// nonce and code verifier stored at beginning of authorization flow (right before login redirects to auth server)\n\t\t\t\tconst codeVerifier = context.checks.pkce.use();\n\n\t\t\t\t// matching state allows this route to ensure the redirect from auth server originated from this application\n\t\t\t\t// the code returned (in url params) to this redirect uri will be used to get a token set from the oauth2 token endpoint\n\t\t\t\tconst { code, state } = context.oauth.processAuthResponse(expectedState);\n\n\t\t\t\t// set referrer, if available, for redirect\n\t\t\t\treferrer = sanitizeReferrer(state.referrer) ?? undefined;\n\n\t\t\t\t// make a request for tokens using the code and the matching code verifier\n\t\t\t\t// code verifier is required by the auth server to ensure the code matches the originator of the auth request\n\t\t\t\t// nonce allows this application to ensure that the tokens returned came from the same auth server that the code grant request was initiated with, similar to state\n\t\t\t\tconst tokens = await context.oauth.requestToken(codeVerifier, code);\n\n\t\t\t\t// turn the returned tokens into the session (including user, access token, refresh token)\n\t\t\t\tconst session = context.session.create(tokens);\n\t\t\t\tcontext.session.deleteCookie();\n\t\t\t\tcontext.session.setCookie(session);\n\t\t\t} catch (e) {\n\t\t\t\t// possibly need to redirect to an auth error page\n\t\t\t\tconsole.error('provenance:', e);\n\t\t\t}\n\n\t\t\tif (referrer) {\n\t\t\t\t// redirect to the actual route that the user was trying to access\n\t\t\t\tcontext.routes.redirect(referrer);\n\t\t\t} else {\n\t\t\t\t// if any of these checks throw an error (login took longer than the cookies were available), we should try the whole process again\n\t\t\t\t// also if somehow no referrer was set in the state\n\t\t\t\tcontext.routes.home.redirect();\n\t\t\t}\n\t\t}\n\t\treturn await resolve();\n\t};\n","import { logStarter } from '../helpers';\nimport { Resolver } from './types';\n\nexport const refreshResolver = <\n\tSession extends {\n\t\trefreshToken: string;\n\t\taccessExpiresAt: number;\n\t\trefreshExpiresAt?: number;\n\t}\n>(options: {\n\t/** in ms */\n\teagerRefresh: number;\n}): Resolver<Session> => {\n\treturn async (context, resolve, logging) => {\n\t\tconst session = context.locals.session;\n\n\t\t// attempt refresh if there is a session and the access token expires within the \"eagerRefresh\" threshold\n\t\tif (session !== null && Date.now() >= session.accessExpiresAt - options.eagerRefresh) {\n\t\t\tif (logging) logStarter('refresh');\n\n\t\t\tconst destroySession = () => {\n\t\t\t\tcontext.session.deleteCookie();\n\t\t\t\tcontext.locals.session = null;\n\t\t\t};\n\n\t\t\t// don't bother trying to refresh if your session has an expired refresh token\n\t\t\t// in practice, this should be true as the session cookie should expire at the same time as the refresh token\n\t\t\tif (session.refreshExpiresAt === undefined || Date.now() < session.refreshExpiresAt) {\n\t\t\t\ttry {\n\t\t\t\t\t// the access token has expired, so refresh with the refresh token\n\t\t\t\t\tconst newTokens = await context.oauth.refresh(session.refreshToken);\n\t\t\t\t\tconst newSession = context.session.create(newTokens);\n\n\t\t\t\t\tdestroySession();\n\t\t\t\t\tcontext.session.setCookie(newSession);\n\t\t\t\t\tcontext.locals.session = newSession;\n\t\t\t\t} catch (e) {\n\t\t\t\t\t// destroy the session if an error occurs (likely in the oauth refresh flow)\n\t\t\t\t\tconsole.error('provenance:', e);\n\t\t\t\t\tdestroySession();\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tdestroySession();\n\t\t\t}\n\t\t}\n\t\treturn await resolve();\n\t};\n};\n","import { logStarter, sanitizeReferrer } from '../helpers';\nimport type { Resolver } from './types';\n\nexport const signupResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (context.routes.signup.is) {\n\t\t\tconst session = context.locals.session;\n\t\t\tconst referrer = sanitizeReferrer(context.oauth.referrer);\n\n\t\t\tif (session === null) {\n\t\t\t\tif (logging) logStarter('signup');\n\n\t\t\t\tawait context.oauth.redirectSignup(referrer);\n\t\t\t} else {\n\t\t\t\treturn referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();\n\t\t\t}\n\t\t}\n\t\treturn await resolve();\n\t};\n","/**\n * wraps the JSON body of an OAuth 2.0 token endpoint response (RFC 6749 section 5)\n */\nexport class TokenRequestResult {\n\tbody: object;\n\n\tconstructor(body: object) {\n\t\tthis.body = body;\n\t}\n\n\tprivate string(field: string): string | undefined {\n\t\tconst value = (this.body as Record<string, unknown>)[field];\n\t\treturn typeof value === 'string' ? value : undefined;\n\t}\n\n\tprivate requireString(field: string): string {\n\t\tconst value = this.string(field);\n\t\tif (value === undefined) {\n\t\t\tthrow new Error(`Missing or invalid '${field}' field`);\n\t\t}\n\t\treturn value;\n\t}\n\n\thasErrorCode(): boolean {\n\t\treturn this.string('error') !== undefined;\n\t}\n\n\terrorCode(): string {\n\t\treturn this.requireString('error');\n\t}\n\n\thasErrorDescription(): boolean {\n\t\treturn this.string('error_description') !== undefined;\n\t}\n\n\terrorDescription(): string {\n\t\treturn this.requireString('error_description');\n\t}\n\n\thasErrorURI(): boolean {\n\t\treturn this.string('error_uri') !== undefined;\n\t}\n\n\terrorURI(): string {\n\t\treturn this.requireString('error_uri');\n\t}\n\n\thasState(): boolean {\n\t\treturn this.string('state') !== undefined;\n\t}\n\n\tstate(): string {\n\t\treturn this.requireString('state');\n\t}\n\n\ttokenType(): string {\n\t\treturn this.requireString('token_type');\n\t}\n\n\taccessToken(): string {\n\t\treturn this.requireString('access_token');\n\t}\n\n\taccessTokenExpiresInSeconds(): number {\n\t\tconst value = (this.body as Record<string, unknown>).expires_in;\n\t\tif (typeof value !== 'number') {\n\t\t\tthrow new Error(`Missing or invalid 'expires_in' field`);\n\t\t}\n\t\treturn value;\n\t}\n\n\taccessTokenExpiresAt(): Date {\n\t\treturn new Date(Date.now() + this.accessTokenExpiresInSeconds() * 1000);\n\t}\n\n\thasRefreshToken(): boolean {\n\t\treturn this.string('refresh_token') !== undefined;\n\t}\n\n\trefreshToken(): string {\n\t\treturn this.requireString('refresh_token');\n\t}\n\n\thasScopes(): boolean {\n\t\treturn this.string('scope') !== undefined;\n\t}\n\n\tscopes(): string[] {\n\t\treturn this.requireString('scope').split(' ');\n\t}\n}\n","import type { Cookie, Cookies } from '../types';\nimport { b64Decode, b64Encode, encodeBase64urlNoPadding } from '../helpers';\n\nconst STATE_MAX_AGE = 60 * 5;\nconst STATE_COOKIE_NAME = 'state';\n\nconst PKCE_MAX_AGE = 60 * 5;\nconst PKCE_COOKIE_NAME = 'pkce-code-verifier';\n\nconst generateRandomValue = (): string => {\n\tconst randomValues = new Uint8Array(32);\n\tcrypto.getRandomValues(randomValues);\n\treturn encodeBase64urlNoPadding(randomValues);\n};\n\nconst generateCodeVerifier = (): string => generateRandomValue();\nconst generateState = (): string => generateRandomValue();\n\nconst createS256CodeChallenge = async (codeVerifier: string): Promise<string> => {\n\tconst codeChallengeBytes = await crypto.subtle.digest(\n\t\t'SHA-256',\n\t\tnew TextEncoder().encode(codeVerifier)\n\t);\n\treturn encodeBase64urlNoPadding(new Uint8Array(codeChallengeBytes));\n};\n\nexport const c = <State extends Record<string, any>>() => {\n\treturn {\n\t\tstate: {\n\t\t\tcreate(data: State): { state: string; cookie: Cookie } {\n\t\t\t\tconst value = b64Encode(JSON.stringify({ ...data, random: generateState() }));\n\n\t\t\t\tconst cookie = {\n\t\t\t\t\tname: STATE_COOKIE_NAME,\n\t\t\t\t\tvalue: value,\n\t\t\t\t\toptions: {\n\t\t\t\t\t\tpath: '/',\n\t\t\t\t\t\tmaxAge: STATE_MAX_AGE\n\t\t\t\t\t}\n\t\t\t\t};\n\n\t\t\t\treturn { state: value, cookie };\n\t\t\t},\n\t\t\tuse(cookies: Cookies): string {\n\t\t\t\tconst state = cookies.get(STATE_COOKIE_NAME);\n\t\t\t\tcookies.delete(STATE_COOKIE_NAME, { path: '/' });\n\n\t\t\t\tif (state !== undefined) {\n\t\t\t\t\treturn state;\n\t\t\t\t} else {\n\t\t\t\t\tthrow new Error('State not found in cookies');\n\t\t\t\t}\n\t\t\t},\n\t\t\tdecode(state: string): State {\n\t\t\t\tconst { random: _random, ...data } = JSON.parse(b64Decode(state));\n\t\t\t\treturn data;\n\t\t\t}\n\t\t},\n\t\tpkce: {\n\t\t\tasync create(): Promise<{ codeChallenge: string; cookie: Cookie }> {\n\t\t\t\tconst codeVerifier = generateCodeVerifier();\n\t\t\t\tconst codeChallenge = await createS256CodeChallenge(codeVerifier);\n\n\t\t\t\tconst cookie = {\n\t\t\t\t\tname: PKCE_COOKIE_NAME,\n\t\t\t\t\tvalue: codeVerifier,\n\t\t\t\t\toptions: {\n\t\t\t\t\t\tpath: '/',\n\t\t\t\t\t\tmaxAge: PKCE_MAX_AGE\n\t\t\t\t\t}\n\t\t\t\t};\n\n\t\t\t\treturn { codeChallenge, cookie };\n\t\t\t},\n\t\t\tuse(cookies: Cookies): string {\n\t\t\t\tconst codeVerifier = cookies.get(PKCE_COOKIE_NAME);\n\t\t\t\tcookies.delete(PKCE_COOKIE_NAME, { path: '/' });\n\n\t\t\t\tif (codeVerifier !== undefined) {\n\t\t\t\t\treturn codeVerifier;\n\t\t\t\t} else {\n\t\t\t\t\tthrow new Error('code_verifier not found in cookies');\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t};\n};\n\nexport type ChecksModule<State extends Record<string, any>> = ReturnType<typeof c<State>>;\n","import { TokenRequestResult } from '../tokens';\n\nimport type { SerializeOptions } from 'cookie';\n\nimport type { Provider } from '../providers/types';\nimport type { ChecksModule } from './checks';\n\nasync function processTokensResponse(tokensResponse: Response) {\n\tconst data = await tokensResponse.json();\n\tif (typeof data !== 'object' || data === null) {\n\t\tthrow new Error('Unexpected response');\n\t}\n\tconst result = new TokenRequestResult(data);\n\tif (result.hasErrorCode()) {\n\t\tconst error = result.errorCode();\n\t\tconst errorDescription = result.errorDescription();\n\t\tthrow new Error(`${error}: ${errorDescription}`);\n\t}\n\n\treturn result;\n}\n\nexport const o = <Session>(\n\tmodules: { checks: ChecksModule<{ referrer?: string }> },\n\tprovider: Provider<Session>,\n\toptions: { redirectUriPathname: string }\n) => {\n\treturn {\n\t\t/**\n\t\t * create a redirect to the auth server for the user to login\n\t\t * @param redirectUriOrigin origin for redirect uri.. typically the origin of the website that is logging in\n\t\t * @param referrer the path that initiated the login\n\t\t * @param setCookie a callback that will be used to set oauth check values in cookies to be consumed by the redirect uri handler\n\t\t * @returns the generated auth server url\n\t\t */\n\t\tasync login(\n\t\t\tredirectUriOrigin: string,\n\t\t\treferrer: string | null,\n\t\t\tsetCookie: (name: string, value: string, opts: SerializeOptions & { path: string }) => void\n\t\t) {\n\t\t\tconst stateCheck = modules.checks.state.create(referrer ? { referrer } : {});\n\t\t\tconst pkceCheck = await modules.checks.pkce.create();\n\n\t\t\tconst redirectUri = new URL(options.redirectUriPathname, redirectUriOrigin);\n\n\t\t\tconst url = provider.endpoints.createLoginUrl(redirectUri.toString(), {\n\t\t\t\tstate: stateCheck.state,\n\t\t\t\tcodeChallenge: pkceCheck.codeChallenge\n\t\t\t});\n\n\t\t\tsetCookie(stateCheck.cookie.name, stateCheck.cookie.value, stateCheck.cookie.options);\n\t\t\tsetCookie(pkceCheck.cookie.name, pkceCheck.cookie.value, pkceCheck.cookie.options);\n\n\t\t\treturn url.toString();\n\t\t},\n\t\t/**\n\t\t * create a redirect to the auth server for the user to login\n\t\t * @param redirectUriOrigin origin for redirect uri.. typically the origin of the website that is logging in\n\t\t * @param referrer the path that initiated the login\n\t\t * @param setCookie a callback that will be used to set oauth check values in cookies to be consumed by the redirect uri handler\n\t\t * @returns the generated auth server url\n\t\t */\n\t\tasync signup(\n\t\t\tredirectUriOrigin: string,\n\t\t\treferrer: string | null,\n\t\t\tsetCookie: (name: string, value: string, opts: SerializeOptions & { path: string }) => void\n\t\t) {\n\t\t\tconst stateCheck = modules.checks.state.create(referrer ? { referrer } : {});\n\t\t\tconst pkceCheck = await modules.checks.pkce.create();\n\n\t\t\tconst redirectUri = new URL(options.redirectUriPathname, redirectUriOrigin);\n\n\t\t\tconst url = provider.endpoints.createSignupUrl(redirectUri.toString(), {\n\t\t\t\tstate: stateCheck.state,\n\t\t\t\tcodeChallenge: pkceCheck.codeChallenge\n\t\t\t});\n\n\t\t\tsetCookie(stateCheck.cookie.name, stateCheck.cookie.value, stateCheck.cookie.options);\n\t\t\tsetCookie(pkceCheck.cookie.name, pkceCheck.cookie.value, pkceCheck.cookie.options);\n\n\t\t\treturn url.toString();\n\t\t},\n\t\t/**\n\t\t * post to the oauth logout endpoint to destroy the oauth session (not the session stored in the cookies)\n\t\t * @param fetch\n\t\t */\n\t\tasync logout(fetch: (url: URL, body?: URLSearchParams) => Promise<Response>, session: Session) {\n\t\t\tconst { url, body } = provider.endpoints.createLogoutUrl(session);\n\n\t\t\tawait fetch(url, body);\n\t\t},\n\t\t/**\n\t\t * post to the oauth token endpoint to request a new set of tokens\n\t\t * @param fetchRefreshedTokens\n\t\t * @param refreshToken refreshToken as stored in session\n\t\t * @returns fresh tokens\n\t\t */\n\t\tasync refresh(\n\t\t\tfetchRefreshedTokens: (\n\t\t\t\turl: URL,\n\t\t\t\tbody: {\n\t\t\t\t\tclient_id: string;\n\t\t\t\t\tclient_secret: string;\n\t\t\t\t\tgrant_type: 'refresh_token';\n\t\t\t\t\trefresh_token: string;\n\t\t\t\t}\n\t\t\t) => Promise<Response>,\n\t\t\trefreshToken: string\n\t\t) {\n\t\t\tconst url = provider.endpoints.createTokenUrl();\n\n\t\t\tconst response = await fetchRefreshedTokens(url, {\n\t\t\t\tclient_id: provider.authServer.clientId,\n\t\t\t\tclient_secret: provider.authServer.clientSecret,\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\trefresh_token: refreshToken\n\t\t\t});\n\n\t\t\treturn processTokensResponse(response);\n\t\t},\n\t\t/**\n\t\t * process the redirect from the oauth auth endpoint with a one time authorization code in url params\n\t\t * @param url the url (with params such as code) that the auth server redirects to after user logs in (get from the request event on redirectUri)\n\t\t * @param expectedState state stored in a cookie by this client at the start of the auth flow\n\t\t * @returns one time authorization code to be used with the token endpoint\n\t\t */\n\t\tprocessAuthResponse(url: URL, expectedState: string) {\n\t\t\t// ensure that the url params on the keycloak redirect-to-redirect_uri step of the flow are valid\n\t\t\tconst code = url.searchParams.get('code');\n\t\t\tconst state = url.searchParams.get('state');\n\n\t\t\tif (!code) {\n\t\t\t\tthrow new Error(`auth response code not found in search params`);\n\t\t\t}\n\n\t\t\tif (!state) {\n\t\t\t\tthrow new Error(`auth response state not found in search params`);\n\t\t\t}\n\n\t\t\tif (state !== expectedState) {\n\t\t\t\tthrow new Error(`auth response state did not match stored expected state`);\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tcode,\n\t\t\t\tstate: modules.checks.state.decode(state)\n\t\t\t};\n\t\t},\n\t\t/**\n\t\t * request a set of tokens from the oauth token endpoint using a one time authorization code\n\t\t * @param fetchRequestToken callback that contains the fetch call\n\t\t * @returns brand new tokens\n\t\t */\n\t\tasync requestToken(\n\t\t\tfetchRequestToken: (\n\t\t\t\turl: URL,\n\t\t\t\tparams: {\n\t\t\t\t\tclientId: string;\n\t\t\t\t\tclientSecret: string;\n\t\t\t\t\tredirectUri: string;\n\t\t\t\t}\n\t\t\t) => Promise<Response>\n\t\t) {\n\t\t\tconst url = provider.endpoints.createTokenUrl();\n\n\t\t\tconst authorizationCodeGrantResponse = await fetchRequestToken(url, {\n\t\t\t\tclientId: provider.authServer.clientId,\n\t\t\t\tclientSecret: provider.authServer.clientSecret,\n\t\t\t\tredirectUri: options.redirectUriPathname\n\t\t\t});\n\n\t\t\treturn processTokensResponse(authorizationCodeGrantResponse);\n\t\t}\n\t};\n};\n\nexport type OAuthModule = ReturnType<typeof o>;\n","export const r = (options: {\n\tredirectUriPathname: string;\n\tloginPathname: string;\n\tsignupPathname: string;\n\tlogoutPathname: string;\n\trefreshPathname: string;\n\thomePathname: string;\n}) => {\n\treturn {\n\t\tredirectUri: {\n\t\t\tpathname: options.redirectUriPathname\n\t\t},\n\t\tlogin: {\n\t\t\tpathname: options.loginPathname\n\t\t},\n\t\tsignup: {\n\t\t\tpathname: options.signupPathname\n\t\t},\n\t\tlogout: {\n\t\t\tpathname: options.logoutPathname\n\t\t},\n\t\trefresh: {\n\t\t\tpathname: options.refreshPathname\n\t\t},\n\t\thome: {\n\t\t\tpathname: options.homePathname\n\t\t}\n\t};\n};\n\nexport type RoutesModule = ReturnType<typeof r>;\n","import type { TokenRequestResult } from '../tokens';\n\nimport type { Provider } from '../providers/types';\nimport {\n\tchunkSessionCookies,\n\tdechunkSessionCookies,\n\tisSessionChunkCookie\n} from '../helpers/cookies';\n\nexport const s = <Session>(provider: Provider<Session>, options: { sessionCookieName: string }) => {\n\treturn {\n\t\t/**\n\t\t * create a session object from a set of tokens\n\t\t * @param tokens\n\t\t * @returns session to be stored in cookies\n\t\t */\n\t\tcreate(tokens: TokenRequestResult): Session {\n\t\t\tconst session = provider.session.transformTokens(tokens);\n\n\t\t\treturn provider.session.fixSession(session);\n\t\t},\n\n\t\t/**\n\t\t * set the session object in cookies, splitting into chunks if too large\n\t\t * @param cookies cookies from request event\n\t\t * @param sessionCookieName\n\t\t * @param session the session object to be set in cookies\n\t\t */\n\t\tsetCookie(set: (name: string, value: string, maxAge: number) => void, session: Session) {\n\t\t\tconst validatedSession = provider.session.validateSession(session);\n\n\t\t\tconst chunks = chunkSessionCookies(validatedSession);\n\n\t\t\tconst maxAge = provider.session.sessionCookieAge(validatedSession);\n\n\t\t\tchunks.forEach((chunk, i) => {\n\t\t\t\tset(`${options.sessionCookieName}-${i}`, chunk, maxAge);\n\t\t\t});\n\t\t},\n\t\t/**\n\t\t * get the session object from cookies\n\t\t * @param getAll call back for retrieving cookies\n\t\t * @returns the session object stored in cookies or null if there is no session stored\n\t\t */\n\t\tgetCookie(getAll: () => { name: string; value: string }[]): Session | null {\n\t\t\tconst session = dechunkSessionCookies(getAll(), {\n\t\t\t\tsessionCookieName: options.sessionCookieName\n\t\t\t});\n\t\t\tif (session) {\n\t\t\t\tconst validatedSession = provider.session.validateSession(JSON.parse(session));\n\t\t\t\treturn validatedSession;\n\t\t\t} else {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t},\n\t\t/**\n\t\t * expire the session object in cookies\n\t\t * @param cookies cookies from request event\n\t\t * @param sessionCookieName\n\t\t */\n\t\tdeleteCookie(getAll: () => { name: string; value: string }[], _delete: (name: string) => void) {\n\t\t\tconst sessionChunkCookies = getAll().filter((cookie) =>\n\t\t\t\tisSessionChunkCookie(cookie.name, options.sessionCookieName)\n\t\t\t);\n\n\t\t\tsessionChunkCookies.forEach((cookie) => {\n\t\t\t\t_delete(cookie.name);\n\t\t\t});\n\t\t}\n\t};\n};\n\nexport type SessionModule<Session> = ReturnType<typeof s<Session>>;\n"],"mappings":";AAAA,IAAM,aAAa,CAAC,YAAoB,sBAA6C;AACpF,QAAM,SAAS,GAAG,iBAAiB;AACnC,MAAI,CAAC,WAAW,WAAW,MAAM,GAAG;AACnC,WAAO;AAAA,EACR;AAEA,QAAM,SAAS,WAAW,MAAM,OAAO,MAAM;AAC7C,MAAI,CAAC,QAAQ,KAAK,MAAM,GAAG;AAC1B,WAAO;AAAA,EACR;AAEA,SAAO,SAAS,MAAM;AACvB;AAEO,IAAM,uBAAuB,CAAC,YAAoB,sBACxD,WAAW,YAAY,iBAAiB,MAAM;AAExC,IAAM,sBAAsB,CAAC,YAAiB;AACpD,QAAM,gBAAgB;AACtB,QAAM,aAAa,KAAK,UAAU,OAAO;AAEzC,QAAM,cAAc,KAAK,KAAK,WAAW,SAAS,aAAa;AAC/D,QAAM,SAAS,CAAC,GAAG,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE;AAAA,IAAI,CAAC,MAClD,WAAW,UAAU,IAAI,gBAAgB,IAAI,KAAK,aAAa;AAAA,EAChE;AAEA,SAAO;AACR;AAEO,IAAM,wBAAwB,CACpC,SACA,YACI;AACJ,QAAM,sBAAsB,QAAQ,QAAQ,CAAC,WAAW;AACvD,UAAM,QAAQ,WAAW,OAAO,MAAM,QAAQ,iBAAiB;AAC/D,WAAO,UAAU,OAAO,CAAC,EAAE,OAAO,OAAO,OAAO,MAAM,CAAC,IAAI,CAAC;AAAA,EAC7D,CAAC;AAED,MAAI,oBAAoB,SAAS,GAAG;AACnC,UAAM,SAAS,oBAAoB,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAEnE,UAAM,aAAa,OAAO,OAAO,CAAC,MAAM,YAAY,OAAO,QAAQ,OAAO,EAAE;AAE5E,WAAO;AAAA,EACR,OAAO;AACN,WAAO;AAAA,EACR;AACD;;;AC/CA,IAAM,gBAAgB,CAAC,UAAsB;AAC5C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACtC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACvC;AACA,SAAO;AACR;AAEA,IAAM,gBAAgB,CAAC,WAAmB;AACzC,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACvC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAC/B;AACA,SAAO;AACR;AAEO,IAAM,eAAe,CAAC,UAAsB,KAAK,cAAc,KAAK,CAAC;AAErE,IAAM,eAAe,CAAC,SAAiB,cAAc,KAAK,IAAI,CAAC;AAE/D,IAAM,2BAA2B,CAAC,UACxC,aAAa,KAAK,EAAE,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG,EAAE,QAAQ,OAAO,EAAE;AAOzE,IAAM,YAAY,CAAC,SAAiB;AAC1C,QAAM,UAAU,IAAI,YAAY;AAEhC,SAAO,aAAa,QAAQ,OAAO,IAAI,CAAC;AACzC;AAEO,IAAM,YAAY,CAAC,SAAiB;AAC1C,QAAM,UAAU,IAAI,YAAY;AAEhC,SAAO,QAAQ,OAAO,aAAa,IAAI,GAAG,CAAC,CAAC;AAC7C;;;ACtCO,IAAM,aAAa,IAAI,SAC7B,QAAQ,IAAI,qBAAqB,eAAe,GAAG,IAAI;;;ACMjD,IAAM,mBAAmB,CAAC,aAAuD;AACvF,MAAI,CAAC,UAAU;AACd,WAAO;AAAA,EACR;AAEA,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,IAAI,KAAK,SAAS,WAAW,KAAK,GAAG;AACzF,WAAO;AAAA,EACR;AAEA,SAAO;AACR;;;ACdO,IAAM,iBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAS,YAAW,QAAQ;AAEhC,MAAI;AACJ,MAAI;AACH,cAAU,QAAQ,QAAQ,UAAU;AAAA,EACrC,SAAS,GAAG;AAEX,YAAQ,MAAM,eAAe,CAAC;AAE9B,YAAQ,QAAQ,aAAa;AAC7B,cAAU;AAAA,EACX;AAEA,UAAQ,OAAO,UAAU;AACzB,SAAO,MAAM,QAAQ;AACtB;;;AClBM,IAAM,gBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAQ,OAAO,MAAM,IAAI;AAC5B,UAAM,UAAU,QAAQ,OAAO;AAC/B,UAAM,WAAW,iBAAiB,QAAQ,MAAM,QAAQ;AAExD,QAAI,YAAY,MAAM;AACrB,UAAI,QAAS,YAAW,OAAO;AAE/B,YAAM,QAAQ,MAAM,cAAc,QAAQ;AAAA,IAC3C,OAAO;AACN,aAAO,WAAW,QAAQ,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,KAAK,SAAS;AAAA,IACpF;AAAA,EACD;AACA,SAAO,MAAM,QAAQ;AACtB;;;AChBM,IAAM,iBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAQ,OAAO,OAAO,IAAI;AAC7B,UAAM,UAAU,QAAQ,OAAO;AAC/B,UAAM,WAAW,iBAAiB,QAAQ,MAAM,QAAQ;AAExD,QAAI,YAAY,MAAM;AACrB,UAAI,QAAS,YAAW,QAAQ;AAEhC,cAAQ,QAAQ,aAAa;AAC7B,cAAQ,OAAO,UAAU;AAAA,IAC1B;AAEA,WAAO,WAAW,QAAQ,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,KAAK,SAAS;AAAA,EACpF;AACA,SAAO,MAAM,QAAQ;AACtB;;;ACjBM,IAAM,sBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAQ,OAAO,YAAY,IAAI;AAClC,QAAI,QAAS,YAAW,aAAa;AAErC,QAAI,WAA+B;AACnC,QAAI;AAEH,YAAM,gBAAgB,QAAQ,OAAO,MAAM,IAAI;AAG/C,YAAM,eAAe,QAAQ,OAAO,KAAK,IAAI;AAI7C,YAAM,EAAE,MAAM,MAAM,IAAI,QAAQ,MAAM,oBAAoB,aAAa;AAGvE,iBAAW,iBAAiB,MAAM,QAAQ,KAAK;AAK/C,YAAM,SAAS,MAAM,QAAQ,MAAM,aAAa,cAAc,IAAI;AAGlE,YAAM,UAAU,QAAQ,QAAQ,OAAO,MAAM;AAC7C,cAAQ,QAAQ,aAAa;AAC7B,cAAQ,QAAQ,UAAU,OAAO;AAAA,IAClC,SAAS,GAAG;AAEX,cAAQ,MAAM,eAAe,CAAC;AAAA,IAC/B;AAEA,QAAI,UAAU;AAEb,cAAQ,OAAO,SAAS,QAAQ;AAAA,IACjC,OAAO;AAGN,cAAQ,OAAO,KAAK,SAAS;AAAA,IAC9B;AAAA,EACD;AACA,SAAO,MAAM,QAAQ;AACtB;;;AC7CM,IAAM,kBAAkB,CAM7B,YAGuB;AACxB,SAAO,OAAO,SAAS,SAAS,YAAY;AAC3C,UAAM,UAAU,QAAQ,OAAO;AAG/B,QAAI,YAAY,QAAQ,KAAK,IAAI,KAAK,QAAQ,kBAAkB,QAAQ,cAAc;AACrF,UAAI,QAAS,YAAW,SAAS;AAEjC,YAAM,iBAAiB,MAAM;AAC5B,gBAAQ,QAAQ,aAAa;AAC7B,gBAAQ,OAAO,UAAU;AAAA,MAC1B;AAIA,UAAI,QAAQ,qBAAqB,UAAa,KAAK,IAAI,IAAI,QAAQ,kBAAkB;AACpF,YAAI;AAEH,gBAAM,YAAY,MAAM,QAAQ,MAAM,QAAQ,QAAQ,YAAY;AAClE,gBAAM,aAAa,QAAQ,QAAQ,OAAO,SAAS;AAEnD,yBAAe;AACf,kBAAQ,QAAQ,UAAU,UAAU;AACpC,kBAAQ,OAAO,UAAU;AAAA,QAC1B,SAAS,GAAG;AAEX,kBAAQ,MAAM,eAAe,CAAC;AAC9B,yBAAe;AAAA,QAChB;AAAA,MACD,OAAO;AACN,uBAAe;AAAA,MAChB;AAAA,IACD;AACA,WAAO,MAAM,QAAQ;AAAA,EACtB;AACD;;;AC5CO,IAAM,iBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAQ,OAAO,OAAO,IAAI;AAC7B,UAAM,UAAU,QAAQ,OAAO;AAC/B,UAAM,WAAW,iBAAiB,QAAQ,MAAM,QAAQ;AAExD,QAAI,YAAY,MAAM;AACrB,UAAI,QAAS,YAAW,QAAQ;AAEhC,YAAM,QAAQ,MAAM,eAAe,QAAQ;AAAA,IAC5C,OAAO;AACN,aAAO,WAAW,QAAQ,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,KAAK,SAAS;AAAA,IACpF;AAAA,EACD;AACA,SAAO,MAAM,QAAQ;AACtB;;;AChBM,IAAM,qBAAN,MAAyB;AAAA,EAC/B;AAAA,EAEA,YAAY,MAAc;AACzB,SAAK,OAAO;AAAA,EACb;AAAA,EAEQ,OAAO,OAAmC;AACjD,UAAM,QAAS,KAAK,KAAiC,KAAK;AAC1D,WAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,EAC5C;AAAA,EAEQ,cAAc,OAAuB;AAC5C,UAAM,QAAQ,KAAK,OAAO,KAAK;AAC/B,QAAI,UAAU,QAAW;AACxB,YAAM,IAAI,MAAM,uBAAuB,KAAK,SAAS;AAAA,IACtD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,eAAwB;AACvB,WAAO,KAAK,OAAO,OAAO,MAAM;AAAA,EACjC;AAAA,EAEA,YAAoB;AACnB,WAAO,KAAK,cAAc,OAAO;AAAA,EAClC;AAAA,EAEA,sBAA+B;AAC9B,WAAO,KAAK,OAAO,mBAAmB,MAAM;AAAA,EAC7C;AAAA,EAEA,mBAA2B;AAC1B,WAAO,KAAK,cAAc,mBAAmB;AAAA,EAC9C;AAAA,EAEA,cAAuB;AACtB,WAAO,KAAK,OAAO,WAAW,MAAM;AAAA,EACrC;AAAA,EAEA,WAAmB;AAClB,WAAO,KAAK,cAAc,WAAW;AAAA,EACtC;AAAA,EAEA,WAAoB;AACnB,WAAO,KAAK,OAAO,OAAO,MAAM;AAAA,EACjC;AAAA,EAEA,QAAgB;AACf,WAAO,KAAK,cAAc,OAAO;AAAA,EAClC;AAAA,EAEA,YAAoB;AACnB,WAAO,KAAK,cAAc,YAAY;AAAA,EACvC;AAAA,EAEA,cAAsB;AACrB,WAAO,KAAK,cAAc,cAAc;AAAA,EACzC;AAAA,EAEA,8BAAsC;AACrC,UAAM,QAAS,KAAK,KAAiC;AACrD,QAAI,OAAO,UAAU,UAAU;AAC9B,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACxD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,uBAA6B;AAC5B,WAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,4BAA4B,IAAI,GAAI;AAAA,EACvE;AAAA,EAEA,kBAA2B;AAC1B,WAAO,KAAK,OAAO,eAAe,MAAM;AAAA,EACzC;AAAA,EAEA,eAAuB;AACtB,WAAO,KAAK,cAAc,eAAe;AAAA,EAC1C;AAAA,EAEA,YAAqB;AACpB,WAAO,KAAK,OAAO,OAAO,MAAM;AAAA,EACjC;AAAA,EAEA,SAAmB;AAClB,WAAO,KAAK,cAAc,OAAO,EAAE,MAAM,GAAG;AAAA,EAC7C;AACD;;;ACvFA,IAAM,gBAAgB,KAAK;AAC3B,IAAM,oBAAoB;AAE1B,IAAM,eAAe,KAAK;AAC1B,IAAM,mBAAmB;AAEzB,IAAM,sBAAsB,MAAc;AACzC,QAAM,eAAe,IAAI,WAAW,EAAE;AACtC,SAAO,gBAAgB,YAAY;AACnC,SAAO,yBAAyB,YAAY;AAC7C;AAEA,IAAM,uBAAuB,MAAc,oBAAoB;AAC/D,IAAM,gBAAgB,MAAc,oBAAoB;AAExD,IAAM,0BAA0B,OAAO,iBAA0C;AAChF,QAAM,qBAAqB,MAAM,OAAO,OAAO;AAAA,IAC9C;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,YAAY;AAAA,EACtC;AACA,SAAO,yBAAyB,IAAI,WAAW,kBAAkB,CAAC;AACnE;AAEO,IAAM,IAAI,MAAyC;AACzD,SAAO;AAAA,IACN,OAAO;AAAA,MACN,OAAO,MAAgD;AACtD,cAAM,QAAQ,UAAU,KAAK,UAAU,EAAE,GAAG,MAAM,QAAQ,cAAc,EAAE,CAAC,CAAC;AAE5E,cAAM,SAAS;AAAA,UACd,MAAM;AAAA,UACN;AAAA,UACA,SAAS;AAAA,YACR,MAAM;AAAA,YACN,QAAQ;AAAA,UACT;AAAA,QACD;AAEA,eAAO,EAAE,OAAO,OAAO,OAAO;AAAA,MAC/B;AAAA,MACA,IAAI,SAA0B;AAC7B,cAAM,QAAQ,QAAQ,IAAI,iBAAiB;AAC3C,gBAAQ,OAAO,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAE/C,YAAI,UAAU,QAAW;AACxB,iBAAO;AAAA,QACR,OAAO;AACN,gBAAM,IAAI,MAAM,4BAA4B;AAAA,QAC7C;AAAA,MACD;AAAA,MACA,OAAO,OAAsB;AAC5B,cAAM,EAAE,QAAQ,SAAS,GAAG,KAAK,IAAI,KAAK,MAAM,UAAU,KAAK,CAAC;AAChE,eAAO;AAAA,MACR;AAAA,IACD;AAAA,IACA,MAAM;AAAA,MACL,MAAM,SAA6D;AAClE,cAAM,eAAe,qBAAqB;AAC1C,cAAM,gBAAgB,MAAM,wBAAwB,YAAY;AAEhE,cAAM,SAAS;AAAA,UACd,MAAM;AAAA,UACN,OAAO;AAAA,UACP,SAAS;AAAA,YACR,MAAM;AAAA,YACN,QAAQ;AAAA,UACT;AAAA,QACD;AAEA,eAAO,EAAE,eAAe,OAAO;AAAA,MAChC;AAAA,MACA,IAAI,SAA0B;AAC7B,cAAM,eAAe,QAAQ,IAAI,gBAAgB;AACjD,gBAAQ,OAAO,kBAAkB,EAAE,MAAM,IAAI,CAAC;AAE9C,YAAI,iBAAiB,QAAW;AAC/B,iBAAO;AAAA,QACR,OAAO;AACN,gBAAM,IAAI,MAAM,oCAAoC;AAAA,QACrD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACD;;;AC/EA,eAAe,sBAAsB,gBAA0B;AAC9D,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC9C,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACtC;AACA,QAAM,SAAS,IAAI,mBAAmB,IAAI;AAC1C,MAAI,OAAO,aAAa,GAAG;AAC1B,UAAM,QAAQ,OAAO,UAAU;AAC/B,UAAM,mBAAmB,OAAO,iBAAiB;AACjD,UAAM,IAAI,MAAM,GAAG,KAAK,KAAK,gBAAgB,EAAE;AAAA,EAChD;AAEA,SAAO;AACR;AAEO,IAAM,IAAI,CAChB,SACA,UACA,YACI;AACJ,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQN,MAAM,MACL,mBACA,UACA,WACC;AACD,YAAM,aAAa,QAAQ,OAAO,MAAM,OAAO,WAAW,EAAE,SAAS,IAAI,CAAC,CAAC;AAC3E,YAAM,YAAY,MAAM,QAAQ,OAAO,KAAK,OAAO;AAEnD,YAAM,cAAc,IAAI,IAAI,QAAQ,qBAAqB,iBAAiB;AAE1E,YAAM,MAAM,SAAS,UAAU,eAAe,YAAY,SAAS,GAAG;AAAA,QACrE,OAAO,WAAW;AAAA,QAClB,eAAe,UAAU;AAAA,MAC1B,CAAC;AAED,gBAAU,WAAW,OAAO,MAAM,WAAW,OAAO,OAAO,WAAW,OAAO,OAAO;AACpF,gBAAU,UAAU,OAAO,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,OAAO;AAEjF,aAAO,IAAI,SAAS;AAAA,IACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,OACL,mBACA,UACA,WACC;AACD,YAAM,aAAa,QAAQ,OAAO,MAAM,OAAO,WAAW,EAAE,SAAS,IAAI,CAAC,CAAC;AAC3E,YAAM,YAAY,MAAM,QAAQ,OAAO,KAAK,OAAO;AAEnD,YAAM,cAAc,IAAI,IAAI,QAAQ,qBAAqB,iBAAiB;AAE1E,YAAM,MAAM,SAAS,UAAU,gBAAgB,YAAY,SAAS,GAAG;AAAA,QACtE,OAAO,WAAW;AAAA,QAClB,eAAe,UAAU;AAAA,MAC1B,CAAC;AAED,gBAAU,WAAW,OAAO,MAAM,WAAW,OAAO,OAAO,WAAW,OAAO,OAAO;AACpF,gBAAU,UAAU,OAAO,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,OAAO;AAEjF,aAAO,IAAI,SAAS;AAAA,IACrB;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,OAAO,OAAgE,SAAkB;AAC9F,YAAM,EAAE,KAAK,KAAK,IAAI,SAAS,UAAU,gBAAgB,OAAO;AAEhE,YAAM,MAAM,KAAK,IAAI;AAAA,IACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,QACL,sBASA,cACC;AACD,YAAM,MAAM,SAAS,UAAU,eAAe;AAE9C,YAAM,WAAW,MAAM,qBAAqB,KAAK;AAAA,QAChD,WAAW,SAAS,WAAW;AAAA,QAC/B,eAAe,SAAS,WAAW;AAAA,QACnC,YAAY;AAAA,QACZ,eAAe;AAAA,MAChB,CAAC;AAED,aAAO,sBAAsB,QAAQ;AAAA,IACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,oBAAoB,KAAU,eAAuB;AAEpD,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,UAAI,CAAC,MAAM;AACV,cAAM,IAAI,MAAM,+CAA+C;AAAA,MAChE;AAEA,UAAI,CAAC,OAAO;AACX,cAAM,IAAI,MAAM,gDAAgD;AAAA,MACjE;AAEA,UAAI,UAAU,eAAe;AAC5B,cAAM,IAAI,MAAM,yDAAyD;AAAA,MAC1E;AAEA,aAAO;AAAA,QACN;AAAA,QACA,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;AAAA,MACzC;AAAA,IACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,aACL,mBAQC;AACD,YAAM,MAAM,SAAS,UAAU,eAAe;AAE9C,YAAM,iCAAiC,MAAM,kBAAkB,KAAK;AAAA,QACnE,UAAU,SAAS,WAAW;AAAA,QAC9B,cAAc,SAAS,WAAW;AAAA,QAClC,aAAa,QAAQ;AAAA,MACtB,CAAC;AAED,aAAO,sBAAsB,8BAA8B;AAAA,IAC5D;AAAA,EACD;AACD;;;AC9KO,IAAM,IAAI,CAAC,YAOZ;AACL,SAAO;AAAA,IACN,aAAa;AAAA,MACZ,UAAU,QAAQ;AAAA,IACnB;AAAA,IACA,OAAO;AAAA,MACN,UAAU,QAAQ;AAAA,IACnB;AAAA,IACA,QAAQ;AAAA,MACP,UAAU,QAAQ;AAAA,IACnB;AAAA,IACA,QAAQ;AAAA,MACP,UAAU,QAAQ;AAAA,IACnB;AAAA,IACA,SAAS;AAAA,MACR,UAAU,QAAQ;AAAA,IACnB;AAAA,IACA,MAAM;AAAA,MACL,UAAU,QAAQ;AAAA,IACnB;AAAA,EACD;AACD;;;ACnBO,IAAM,IAAI,CAAU,UAA6B,YAA2C;AAClG,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMN,OAAO,QAAqC;AAC3C,YAAM,UAAU,SAAS,QAAQ,gBAAgB,MAAM;AAEvD,aAAO,SAAS,QAAQ,WAAW,OAAO;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,UAAU,KAA4D,SAAkB;AACvF,YAAM,mBAAmB,SAAS,QAAQ,gBAAgB,OAAO;AAEjE,YAAM,SAAS,oBAAoB,gBAAgB;AAEnD,YAAM,SAAS,SAAS,QAAQ,iBAAiB,gBAAgB;AAEjE,aAAO,QAAQ,CAAC,OAAO,MAAM;AAC5B,YAAI,GAAG,QAAQ,iBAAiB,IAAI,CAAC,IAAI,OAAO,MAAM;AAAA,MACvD,CAAC;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,UAAU,QAAiE;AAC1E,YAAM,UAAU,sBAAsB,OAAO,GAAG;AAAA,QAC/C,mBAAmB,QAAQ;AAAA,MAC5B,CAAC;AACD,UAAI,SAAS;AACZ,cAAM,mBAAmB,SAAS,QAAQ,gBAAgB,KAAK,MAAM,OAAO,CAAC;AAC7E,eAAO;AAAA,MACR,OAAO;AACN,eAAO;AAAA,MACR;AAAA,IACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,aAAa,QAAiD,SAAiC;AAC9F,YAAM,sBAAsB,OAAO,EAAE;AAAA,QAAO,CAAC,WAC5C,qBAAqB,OAAO,MAAM,QAAQ,iBAAiB;AAAA,MAC5D;AAEA,0BAAoB,QAAQ,CAAC,WAAW;AACvC,gBAAQ,OAAO,IAAI;AAAA,MACpB,CAAC;AAAA,IACF;AAAA,EACD;AACD;","names":[]}

package/dist/initiatives/index.d.ts

@@ -0,0 +1,19 @@
+import { C as Context } from '../context-C2cW461e.js';
+
+declare const deleteSessionCookies: <RequestEvent, ProviderSession, AppSession>(createContext: (event: RequestEvent) => Context<ProviderSession, AppSession>) => (event: RequestEvent) => Promise<void>;
+
+declare const protectRoute: <RequestEvent, ProviderSession, AppSession>(createContext: (event: RequestEvent) => Context<ProviderSession, AppSession>) => (event: RequestEvent) => Promise<AppSession & ({} | undefined)>;
+
+declare const refresh: <RequestEvent, ProviderSession, AppSession extends {
+    refreshToken: string;
+}>(createContext: (event: RequestEvent) => Context<ProviderSession, AppSession>) => (event: RequestEvent) => Promise<void>;
+
+declare const login: <RequestEvent, ProviderSession, AppSession>(createContext: (event: RequestEvent) => Context<ProviderSession, AppSession>) => (event: RequestEvent) => Promise<void>;
+
+declare const signup: <RequestEvent, ProviderSession, AppSession>(createContext: (event: RequestEvent) => Context<ProviderSession, AppSession>) => (event: RequestEvent) => Promise<void>;
+
+declare const logout: <RequestEvent, ProviderSession, AppSession>(createContext: (event: RequestEvent) => Context<ProviderSession, AppSession>) => (event: RequestEvent) => Promise<void>;
+
+type Initiative<ProviderSession, AppSession> = <Return>(context: Context<ProviderSession, AppSession>) => Promise<Return>;
+
+export { type Initiative, deleteSessionCookies, login, logout, protectRoute, refresh, signup };