@monotykamary/localterm-server 2.34.0 → 2.35.0

package/dist/identity/resolve.js

@@ -0,0 +1,57 @@
+import { getConnInfo } from "@hono/node-server/conninfo";
+import { HTTP_STATUS_UNAUTHORIZED } from "../constants.js";
+import { timingSafeEqualString } from "../utils/timing-safe-equal.js";
+// Best-effort source-IP read for an HTTP (non-WS) request. @hono/node-server's
+// conninfo reads the underlying socket's remoteAddress. Returns null when the
+// adapter doesn't expose it (or the helper throws — never 500 a request over
+// an identity read) so the caller falls back to "untrusted source" and ignores
+// any identity header.
+export const getRequestSourceIp = (context) => {
+    try {
+        const address = getConnInfo(context).remote.address;
+        return typeof address === "string" ? address : null;
+    }
+    catch {
+        return null;
+    }
+};
+// Build the per-request identity resolver. With no provider configured it
+// resolves to `null` for every request — the operator/legacy tier — so every
+// request is the single authority and the registry stays unscoped,
+// byte-identical to the no-auth behavior. Otherwise it delegates to the
+// provider, injecting the caller-resolved source IP: the WS upgrade reads it
+// from the raw socket (more authoritative than conninfo at upgrade time), HTTP
+// routes via conninfo.
+export const createIdentityResolver = (provider) => ({
+    resolve: (context, sourceIp = null) => provider ? provider.identify(context, sourceIp) : null,
+});
+export const toSessionOwner = (identity) => identity ? identity.user : null;
+// The auth gate for providers that own their own login (passkey/oidc): reject a
+// request with no valid session at the door (401) so it never reaches the
+// session registry — unlike `header`, whose no-header case is the operator
+// tier (denyUnauthenticated: false), there's no external proxy to vouch for an
+// unauthenticated caller here, so silence can't mean admin. Exempts
+// `/api/health` (readiness) and everything outside `/api` and `/ws` (the static
+// terminal app + the `/auth` login flow must load before there's a session). A
+// request carrying the daemon's operator bearer token (the CLI) is admitted as
+// the operator tier — full access, no session — since the CLI can't run a
+// WebAuthn/OIDC ceremony.
+export const createAuthGateMiddleware = (provider, resolveIdentity) => async (context, next) => {
+    if (!provider?.denyUnauthenticated)
+        return await next();
+    const requestPath = context.req.path;
+    const isProtected = (requestPath === "/ws" || requestPath.startsWith("/api/")) && requestPath !== "/api/health";
+    if (!isProtected)
+        return await next();
+    const authorization = context.req.header("authorization");
+    if (provider.operatorToken &&
+        authorization &&
+        timingSafeEqualString(authorization, `Bearer ${provider.operatorToken}`)) {
+        return await next();
+    }
+    const identity = resolveIdentity(context, getRequestSourceIp(context));
+    if (!identity)
+        return context.json({ error: "unauthorized" }, HTTP_STATUS_UNAUTHORIZED);
+    await next();
+};
+//# sourceMappingURL=resolve.js.map

package/dist/identity/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/identity/resolve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGtE,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,uBAAuB;AACvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAgB,EAAiB,EAAE;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACpD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAMF,0EAA0E;AAC1E,6EAA6E;AAC7E,mEAAmE;AACnE,wEAAwE;AACxE,6EAA6E;AAC7E,+EAA+E;AAC/E,uBAAuB;AACvB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAiC,EAAoB,EAAE,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC,OAAgB,EAAE,WAA0B,IAAI,EAAmB,EAAE,CAC7E,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAyB,EAAgB,EAAE,CACxE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAElC,gFAAgF;AAChF,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,oEAAoE;AACpE,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,0BAA0B;AAC1B,MAAM,CAAC,MAAM,wBAAwB,GACnC,CACE,QAAiC,EACjC,eAAgF,EAC7D,EAAE,CACvB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtB,IAAI,CAAC,QAAQ,EAAE,mBAAmB;QAAE,OAAO,MAAM,IAAI,EAAE,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACrC,MAAM,WAAW,GACf,CAAC,WAAW,KAAK,KAAK,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,KAAK,aAAa,CAAC;IAC9F,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,IAAI,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,IACE,QAAQ,CAAC,aAAa;QACtB,aAAa;QACb,qBAAqB,CAAC,aAAa,EAAE,UAAU,QAAQ,CAAC,aAAa,EAAE,CAAC,EACxE,CAAC;QACD,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,wBAAwB,CAAC,CAAC;IACxF,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC"}

package/dist/identity/session-cookie.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from "hono";
+import type { Identity } from "./types.js";
+export declare const generateAuthSecret: () => string;
+export declare const loadOrCreateAuthSecret: (filePath: string) => string;
+export declare const signSessionToken: (secret: string, user: string) => string;
+export declare const verifySessionToken: (secret: string, token: string) => string | null;
+export declare const setSessionCookie: (context: Context, secret: string, user: string) => void;
+export declare const clearSessionCookie: (context: Context) => void;
+export declare const readSessionIdentity: (context: Context, secret: string) => Identity | null;
+//# sourceMappingURL=session-cookie.d.ts.map

package/dist/identity/session-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie.d.ts","sourceRoot":"","sources":["../../src/identity/session-cookie.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAe3C,eAAO,MAAM,kBAAkB,QAAO,MACgB,CAAC;AAKvD,eAAO,MAAM,sBAAsB,GAAI,UAAU,MAAM,KAAG,MAazD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,MAO/D,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,MAAM,GAAG,IAmB3E,CAAC;AAsBF,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,EAAE,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,IAOjF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,IAErD,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,SAAS,OAAO,EAAE,QAAQ,MAAM,KAAG,QAAQ,GAAG,IAKjF,CAAC"}

package/dist/identity/session-cookie.js

@@ -0,0 +1,92 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { getCookie, setCookie } from "hono/cookie";
+import { AUTH_COOKIE_MAX_AGE_SECONDS, AUTH_COOKIE_NAME, AUTH_SECRET_BYTES } from "../constants.js";
+const sign = (secret, data) => createHmac("sha256", secret).update(data).digest("base64url");
+export const generateAuthSecret = () => randomBytes(AUTH_SECRET_BYTES).toString("base64url");
+// Read the persisted HMAC secret, generating + persisting a fresh one on the
+// first run. Losing this file invalidates every live session (users re-log in),
+// which is the correct failure mode — never silently reuse a weak/absent key.
+export const loadOrCreateAuthSecret = (filePath) => {
+    try {
+        const existing = fs.readFileSync(filePath, "utf8").trim();
+        if (existing)
+            return existing;
+    }
+    catch {
+        /* no file yet */
+    }
+    const secret = generateAuthSecret();
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.tmp`;
+    fs.writeFileSync(tmpPath, secret, { encoding: "utf8", mode: 0o600 });
+    fs.renameSync(tmpPath, filePath);
+    return secret;
+};
+export const signSessionToken = (secret, user) => {
+    const payload = {
+        sub: user,
+        exp: Date.now() + AUTH_COOKIE_MAX_AGE_SECONDS * 1000,
+    };
+    const data = Buffer.from(JSON.stringify(payload)).toString("base64url");
+    return `${data}.${sign(secret, data)}`;
+};
+export const verifySessionToken = (secret, token) => {
+    const dot = token.lastIndexOf(".");
+    if (dot <= 0)
+        return null;
+    const data = token.slice(0, dot);
+    const sig = token.slice(dot + 1);
+    const expected = sign(secret, data);
+    const sigBytes = Buffer.from(sig);
+    const expectedBytes = Buffer.from(expected);
+    if (sigBytes.length !== expectedBytes.length || !timingSafeEqual(sigBytes, expectedBytes)) {
+        return null;
+    }
+    try {
+        const payload = JSON.parse(Buffer.from(data, "base64url").toString("utf8"));
+        if (typeof payload?.sub !== "string" || typeof payload?.exp !== "number")
+            return null;
+        if (payload.exp < Date.now())
+            return null;
+        return payload.sub;
+    }
+    catch {
+        return null;
+    }
+};
+// A cookie is `Secure` only when the browser's own origin is https — read from
+// the `Origin` header the browser sends on the fetch (most reliable), with the
+// request URL and `x-forwarded-proto` as fallbacks for a TLS-terminating proxy.
+// On plain loopback HTTP we omit `Secure` (the cookie still works; loopback is
+// the trusted surface) so the cookie is settable on every localterm surface.
+const isSecureRequest = (context) => {
+    const origin = context.req.header("origin");
+    if (origin?.startsWith("https://"))
+        return true;
+    if (context.req.url.startsWith("https://"))
+        return true;
+    return context.req.header("x-forwarded-proto")?.includes("https") === true;
+};
+const cookieOptions = (context, maxAge) => ({
+    httpOnly: true,
+    sameSite: "Lax",
+    path: "/",
+    maxAge,
+    secure: isSecureRequest(context),
+});
+export const setSessionCookie = (context, secret, user) => {
+    setCookie(context, AUTH_COOKIE_NAME, signSessionToken(secret, user), cookieOptions(context, AUTH_COOKIE_MAX_AGE_SECONDS));
+};
+export const clearSessionCookie = (context) => {
+    setCookie(context, AUTH_COOKIE_NAME, "", cookieOptions(context, 0));
+};
+export const readSessionIdentity = (context, secret) => {
+    const token = getCookie(context, AUTH_COOKIE_NAME);
+    if (!token)
+        return null;
+    const sub = verifySessionToken(secret, token);
+    return sub ? { user: sub } : null;
+};
+//# sourceMappingURL=session-cookie.js.map

package/dist/identity/session-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie.js","sourceRoot":"","sources":["../../src/identity/session-cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAanG,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE,CACpD,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAW,EAAE,CAC7C,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEvD,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAgB,EAAU,EAAE;IACjE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAC;IAClC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACvE,MAAM,OAAO,GAAmB;QAC9B,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,2BAA2B,GAAG,IAAI;KACrD,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAiB,EAAE;IACjF,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAmB,CAAC;QAC9F,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtF,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAW,EAAE;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAC7E,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC;IAC3D,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,KAAc;IACxB,IAAI,EAAE,GAAG;IACT,MAAM;IACN,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAE,MAAc,EAAE,IAAY,EAAQ,EAAE;IACvF,SAAS,CACP,OAAO,EACP,gBAAgB,EAChB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,EAC9B,aAAa,CAAC,OAAO,EAAE,2BAA2B,CAAC,CACpD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAgB,EAAQ,EAAE;IAC3D,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAE,MAAc,EAAmB,EAAE;IACvF,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC,CAAC"}

package/dist/identity/types.d.ts

@@ -0,0 +1,49 @@
+import type { Context } from "hono";
+import type { Hono } from "hono";
+export interface Identity {
+    user: string;
+    displayName?: string;
+}
+export interface IdentityProvider {
+    readonly kind: string;
+    readonly denyUnauthenticated: boolean;
+    readonly operatorToken: string | null;
+    identify(context: Context, sourceIp: string | null): Identity | null;
+    routes?: () => Hono;
+}
+export type SessionOwner = string | null;
+export interface HeaderIdentityConfig {
+    provider: "header";
+    header?: string;
+    trustedProxy?: string;
+}
+export interface PasskeyIdentityConfig {
+    provider: "passkey";
+    rpName?: string;
+    registration?: "open" | "closed";
+    operatorToken?: string;
+}
+export interface OidcIdentityConfig {
+    provider: "oidc";
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    claim?: string;
+    scope?: string;
+    operatorToken?: string;
+}
+export type IdentityConfig = HeaderIdentityConfig | PasskeyIdentityConfig | OidcIdentityConfig;
+export type IdentityProviderKind = "header" | "passkey" | "oidc";
+export interface IdentityProviderInfo {
+    provider: IdentityProviderKind | null;
+    registration?: "open" | "closed";
+}
+export interface AuthSession {
+    user: string | null;
+}
+export interface IdentityProviderDeps {
+    secret: string;
+    getOrigin: () => string | null;
+    stateDirectory: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/identity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAKjC,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAcD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IAKtC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,CAAC;IAIrE,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAOD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,IAAI,CAAC;AAEzC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAMhB,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAGjC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IAGjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IAEjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,qBAAqB,GAAG,kBAAkB,CAAC;AAM/F,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CAClC;AAKD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAMD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;CACxB"}

package/dist/identity/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/identity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":""}

package/dist/identity/user-store.d.ts

@@ -0,0 +1,16 @@
+interface StoredUser {
+    username: string;
+    credentialIds: string[];
+}
+export declare class UserStore {
+    private readonly users;
+    private readonly filePath;
+    constructor(filePath: string);
+    get(username: string): StoredUser | null;
+    findOrCreate(username: string): StoredUser;
+    addCredential(username: string, credentialId: string): void;
+    private load;
+    private persist;
+}
+export {};
+//# sourceMappingURL=user-store.d.ts.map

package/dist/identity/user-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store.d.ts","sourceRoot":"","sources":["../../src/identity/user-store.ts"],"names":[],"mappings":"AAIA,UAAU,UAAU;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAeD,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,EAAE,MAAM;IAK5B,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAKxC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU;IAU1C,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAO3D,OAAO,CAAC,IAAI;IAyBZ,OAAO,CAAC,OAAO;CAUhB"}

package/dist/identity/user-store.js

@@ -0,0 +1,77 @@
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+const usersFileSchema = z.object({
+    version: z.literal(1).optional(),
+    users: z.record(z.string(), z.object({ username: z.string(), credentialIds: z.array(z.string()) })),
+});
+// File-backed registry of passkey users (~/.localterm/users.json): username →
+// the credential ids that authenticate them. Holds no key material (that's the
+// credential store); this just answers "which credentials belong to this user"
+// for registration exclude-lists and login allow-lists. Atomic tmp+rename write,
+// graceful fallback to empty on a missing/corrupt file.
+export class UserStore {
+    users = new Map();
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+        this.load();
+    }
+    get(username) {
+        const user = this.users.get(username);
+        return user ? { ...user, credentialIds: [...user.credentialIds] } : null;
+    }
+    findOrCreate(username) {
+        let user = this.users.get(username);
+        if (!user) {
+            user = { username, credentialIds: [] };
+            this.users.set(username, user);
+            this.persist();
+        }
+        return { ...user, credentialIds: [...user.credentialIds] };
+    }
+    addCredential(username, credentialId) {
+        const user = this.users.get(username);
+        if (!user || user.credentialIds.includes(credentialId))
+            return;
+        user.credentialIds.push(credentialId);
+        this.persist();
+    }
+    load() {
+        let raw;
+        try {
+            raw = fs.readFileSync(this.filePath, "utf8");
+        }
+        catch {
+            return;
+        }
+        let json;
+        try {
+            json = JSON.parse(raw);
+        }
+        catch {
+            console.warn(`users file invalid; ignoring (${this.filePath})`);
+            return;
+        }
+        const parsed = usersFileSchema.safeParse(json);
+        if (!parsed.success) {
+            console.warn(`users file invalid; ignoring (${this.filePath})`);
+            return;
+        }
+        this.users.clear();
+        for (const [username, user] of Object.entries(parsed.data.users)) {
+            this.users.set(username, { username: user.username, credentialIds: [...user.credentialIds] });
+        }
+    }
+    persist() {
+        fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
+        const payload = {
+            version: 1,
+            users: Object.fromEntries(this.users.entries()),
+        };
+        const tmpPath = `${this.filePath}.tmp`;
+        fs.writeFileSync(tmpPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+        fs.renameSync(tmpPath, this.filePath);
+    }
+}
+//# sourceMappingURL=user-store.js.map

package/dist/identity/user-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store.js","sourceRoot":"","sources":["../../src/identity/user-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,CACb,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CACvE;CACF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,wDAAwD;AACxD,MAAM,OAAO,SAAS;IACH,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,QAAQ,CAAS;IAElC,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,GAAG,CAAC,QAAgB;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,aAAa,CAAC,QAAgB,EAAE,YAAoB;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO;QAC/D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,IAAI;QACV,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAEO,OAAO;QACb,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;SAChD,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/index.d.ts

@@ -4,12 +4,20 @@ import { type SnapshotProcesses } from "./caffeinate-process-match.js";
 import type { DetectedBrowser } from "./cdp/detect-chromium.js";
 import { type SecretBackend } from "./secret-backend.js";
 import { type SnapshotListeners } from "./listening-ports.js";
+import type { IdentityConfig } from "./identity/types.js";
 import { SessionManager } from "./session-manager.js";
 export interface ServerOptions {
     port?: number;
     host?: string;
     staticRoot?: string | null;
     stateDirectory?: string;
+    /**
+     * Identity provider config — scopes the session registry per authenticated
+     * user. `null`/omitted = no provider (single-authority mode, byte-identical
+     * to no-auth). Overrides the config-file `identity` for tests/embedding; the
+     * provider is built once at start, so a change requires a restart.
+     */
+    identity?: IdentityConfig | null;
     /**
      * The announced REMOTE surface origin — the URL the CLI resolved best-first
      * (tailnet `https://<node>.ts.net`, portless `https://localterm.localhost`,
@@ -130,7 +138,8 @@ export type { CaffeinateControllerOptions, CaffeinateProcessHandle, } from "./ca
 export type * from "./types.js";
 export { DEFAULT_HOST, DEFAULT_PORT, WS_CLOSE_BACKPRESSURE } from "./constants.js";
 export { isLoopbackHost, isPrivateHost, isAllowedSourceIp } from "./security.js";
-export { healthSchema, cdpHealthSchema, daemonConfigSchema, updateDaemonConfigInputSchema, } from "./schemas.js";
+export { healthSchema, cdpHealthSchema, daemonConfigSchema, identityConfigSchema, oidcConfigSchema, passkeyConfigSchema, updateDaemonConfigInputSchema, } from "./schemas.js";
+export type { Identity, IdentityConfig, OidcIdentityConfig, PasskeyIdentityConfig, SessionOwner, } from "./identity/types.js";
 export { createSessionInputSchema, sessionResponseSchema, updateSessionInputSchema, sessionInputSchema, sessionResizeSchema, execInputSchema, execOneShotInputSchema, execResultSchema, capturePaneResponseSchema, sessionsListResponseSchema, } from "./schemas.js";
 export { createDefaultSecretBackend } from "./secret-backend.js";
 export type { SecretBackend } from "./secret-backend.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA4DhE,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOrF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAyB9B,OAAO,EACL,cAAc,EAKf,MAAM,sBAAsB,CAAC;AA6B9B,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,iBAAiB,CAAC;IAChD;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,YAAY,CAAC;IACtC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,iBAAiB,CAAC;IAC3C;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB;;;;;OAKG;IACH,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC1C,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AA6lCD,eAAO,MAAM,YAAY,GAAU,UAAS,aAAkB,KAAG,OAAO,CAAC,aAAa,CAs7BrF,CAAC;AAEF,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EACV,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,UAAU,EACV,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,YAAY,EACV,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,mBAAmB,YAAY,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA8DhE,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOrF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AA0B9B,OAAO,KAAK,EAEV,cAAc,EAGf,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EACL,cAAc,EAKf,MAAM,sBAAsB,CAAC;AA6B9B,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,iBAAiB,CAAC;IAChD;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,YAAY,CAAC;IACtC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,iBAAiB,CAAC;IAC3C;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB;;;;;OAKG;IACH,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC1C,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAgpCD,eAAO,MAAM,YAAY,GAAU,UAAS,aAAkB,KAAG,OAAO,CAAC,aAAa,CAq/BrF,CAAC;AAEF,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EACV,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,UAAU,EACV,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,YAAY,EACV,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,mBAAmB,YAAY,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,QAAQ,EACR,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}