@opengeni/core 2.4.0-canary.2 → 2.5.2-canary.0

package/dist/access/index.d.ts

@@ -3,6 +3,7 @@ import { type AccountGrant, type AccessContext, type AccessGrant, type Permissio
 import { type Database } from "@opengeni/db";
 import type { Context } from "hono";
 import type { ManagedAuth } from "../managed-auth-type.js";
+import type { ManagedAuthSessionAdapter } from "../managed-auth-session-sets.js";
 /**
  * Opaque, request-local proof that the canonical access resolver authorized the
  * exact account administrator named by the stamp. The random id is audit and
@@ -19,6 +20,7 @@ export type AccessDeps = {
     db: Database;
     settings: Settings;
     managedAuth?: ManagedAuth | null;
+    managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null;
 };
 export declare function requireAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext>;
 export declare function requireAccessGrant(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrant>;

package/dist/application/composer-submit.d.ts

@@ -0,0 +1,24 @@
+import type { AccessGrant, ResourceRef, SubmitComposerDraftRequest, SubmitComposerDraftResponse } from "@opengeni/contracts";
+import type { AccessGrantAuthorization } from "../access/index.js";
+import type { AcceptSessionUserMessageDependencies } from "../dependencies.js";
+export type SubmitComposerDraftForRequestOptions = {
+    authorization?: AccessGrantAuthorization | undefined;
+    /**
+     * Trusted host-owned resources admitted with this command without writing
+     * them into the actor's browser-visible draft first. The saved draft remains
+     * the exact content fence for actor-owned text, annotations, resources, and
+     * execution policy; these resources participate in the accepted command's
+     * idempotency hash, validation, turn, and durable session resource set.
+     */
+    additionalResources?: ResourceRef[] | undefined;
+};
+/**
+ * Atomically accept one established-session composer draft.
+ *
+ * This is the application boundary shared by the stock HTTP adapter and an
+ * in-process embedding host. A host may prepare its own durable business state
+ * before calling this function and project the returned receipt afterward, but
+ * OpenGeni remains the sole authority for draft validation/rotation, event
+ * append, turn creation, routing, and idempotent replay.
+ */
+export declare function submitComposerDraftForRequest(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: SubmitComposerDraftRequest, options?: SubmitComposerDraftForRequestOptions): Promise<SubmitComposerDraftResponse>;

package/dist/application/session-commands.d.ts

@@ -68,8 +68,8 @@ export declare function controlAgentSessionWorkstream(deps: {
 }): Promise<{
     receipt: SessionCommandReceiptRow;
     control: import("@opengeni/db").EffectiveSessionControl;
-    sessionControlEventId: string;
-    workspaceControlEventId: string;
+    sessionControlEventId: string | null;
+    workspaceControlEventId: string | null;
     interruptionCount: number;
     backgroundCommandCount: number;
     wakeCount: number;
@@ -80,6 +80,7 @@ export declare function controlAgentSessionWorkstream(deps: {
         eventIds: string[];
     }>;
     workflowWake: import("@opengeni/db").SessionControlWorkflowWake | null;
+    outcome: "changed" | "unchanged" | "replayed";
     replay: boolean;
     authorization: ResolvedSessionAuthorization | null;
 }>;
@@ -111,6 +112,7 @@ export declare function controlHumanSessionWorkstreamWithOutcome(deps: {
     sessionAuthorization?: SessionAuthorizationPort | null;
 } & SessionCommandPostCommitDeps, context: HumanSessionCommandContext, input: SessionControlRequest): Promise<{
     response: SessionControlResponse;
+    outcome: "changed" | "unchanged" | "replayed";
     replay: boolean;
 }>;
 /** Backward-compatible response path used by the REST control route. */

package/dist/canonical-human-identities.d.ts

@@ -1,12 +1,17 @@
 import type { Database } from "@opengeni/db";
 import type { Context } from "hono";
 import type { ManagedAuth } from "./managed-auth-type.js";
+export { getManagedAuthRequestActorAdmissionStamp, getManagedAuthRequestActorLeaseStamp, markManagedAuthRequestActorTransitionApplied, } from "./managed-session.js";
+import type { ManagedAuthSessionAdapter } from "./managed-auth-session-sets.js";
+import type { ManagedAuthSessionSetMode } from "@opengeni/contracts/managed-auth-session-sets";
 export type CanonicalHumanRequestIdentity = {
     authUserId: string;
     authSessionId: string;
 };
 export declare function requireCanonicalHumanRequestIdentity(context: Context, input: {
     db: Database;
-    managedAuth?: ManagedAuth | null;
-    allowRecovery?: boolean;
+    managedAuth?: ManagedAuth | null | undefined;
+    managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null | undefined;
+    managedAuthSessionSetMode?: ManagedAuthSessionSetMode | undefined;
+    allowRecovery?: boolean | undefined;
 }): Promise<CanonicalHumanRequestIdentity>;

package/dist/canonical-human-identities.js

@@ -1,23 +1,36 @@
 import {
-  getManagedSession
-} from "./chunk-IBOEYG6N.js";
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorLeaseStamp,
+  getManagedSession,
+  markManagedAuthRequestActorTransitionApplied
+} from "./chunk-ZVZJTMSV.js";
+import "./chunk-YGOMUGYS.js";
 
 // src/canonical-human-identities.ts
 import { HTTPException } from "hono/http-exception";
 async function requireCanonicalHumanRequestIdentity(context, input) {
   if (!input.managedAuth) {
-    throw new HTTPException(404, { message: "Canonical human identity is unavailable" });
+    throw new HTTPException(404, {
+      message: "Canonical human identity is unavailable"
+    });
   }
   const session = await getManagedSession(context, input.managedAuth, {
     db: input.db,
+    sessionAdapter: input.managedAuthSessionAdapter,
+    sessionSetMode: input.managedAuthSessionSetMode,
     ...input.allowRecovery === void 0 ? {} : { allowIdentityRecovery: input.allowRecovery }
   });
   if (!session?.user || typeof session.session?.id !== "string") {
-    throw new HTTPException(401, { message: "Managed human authentication required" });
+    throw new HTTPException(401, {
+      message: "Managed human authentication required"
+    });
   }
   return { authUserId: session.user.id, authSessionId: session.session.id };
 }
 export {
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorLeaseStamp,
+  markManagedAuthRequestActorTransitionApplied,
   requireCanonicalHumanRequestIdentity
 };
 //# sourceMappingURL=canonical-human-identities.js.map

package/dist/canonical-human-identities.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import type { Database } from \"@opengeni/db\";\nimport type { Context } from \"hono\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ManagedAuth } from \"./managed-auth-type\";\nimport { getManagedSession } from \"./managed-session\";\n\nexport type CanonicalHumanRequestIdentity = {\n  authUserId: string;\n  authSessionId: string;\n};\n\nexport async function requireCanonicalHumanRequestIdentity(\n  context: Context,\n  input: { db: Database; managedAuth?: ManagedAuth | null; allowRecovery?: boolean },\n): Promise<CanonicalHumanRequestIdentity> {\n  if (!input.managedAuth) {\n    throw new HTTPException(404, { message: \"Canonical human identity is unavailable\" });\n  }\n  const session = await getManagedSession(context, input.managedAuth, {\n    db: input.db,\n    ...(input.allowRecovery === undefined ? {} : { allowIdentityRecovery: input.allowRecovery }),\n  });\n  if (!session?.user || typeof session.session?.id !== \"string\") {\n    throw new HTTPException(401, { message: \"Managed human authentication required\" });\n  }\n  return { authUserId: session.user.id, authSessionId: session.session.id };\n}\n"],"mappings":";;;;;AAEA,SAAS,qBAAqB;AAS9B,eAAsB,qCACpB,SACA,OACwC;AACxC,MAAI,CAAC,MAAM,aAAa;AACtB,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,0CAA0C,CAAC;AAAA,EACrF;AACA,QAAM,UAAU,MAAM,kBAAkB,SAAS,MAAM,aAAa;AAAA,IAClE,IAAI,MAAM;AAAA,IACV,GAAI,MAAM,kBAAkB,SAAY,CAAC,IAAI,EAAE,uBAAuB,MAAM,cAAc;AAAA,EAC5F,CAAC;AACD,MAAI,CAAC,SAAS,QAAQ,OAAO,QAAQ,SAAS,OAAO,UAAU;AAC7D,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,wCAAwC,CAAC;AAAA,EACnF;AACA,SAAO,EAAE,YAAY,QAAQ,KAAK,IAAI,eAAe,QAAQ,QAAQ,GAAG;AAC1E;","names":[]}
+{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import type { Database } from \"@opengeni/db\";\nimport type { Context } from \"hono\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ManagedAuth } from \"./managed-auth-type\";\nimport { getManagedSession } from \"./managed-session\";\nexport {\n  getManagedAuthRequestActorAdmissionStamp,\n  getManagedAuthRequestActorLeaseStamp,\n  markManagedAuthRequestActorTransitionApplied,\n} from \"./managed-session\";\nimport type { ManagedAuthSessionAdapter } from \"./managed-auth-session-sets\";\nimport type { ManagedAuthSessionSetMode } from \"@opengeni/contracts/managed-auth-session-sets\";\n\nexport type CanonicalHumanRequestIdentity = {\n  authUserId: string;\n  authSessionId: string;\n};\n\nexport async function requireCanonicalHumanRequestIdentity(\n  context: Context,\n  input: {\n    db: Database;\n    managedAuth?: ManagedAuth | null | undefined;\n    managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null | undefined;\n    managedAuthSessionSetMode?: ManagedAuthSessionSetMode | undefined;\n    allowRecovery?: boolean | undefined;\n  },\n): Promise<CanonicalHumanRequestIdentity> {\n  if (!input.managedAuth) {\n    throw new HTTPException(404, {\n      message: \"Canonical human identity is unavailable\",\n    });\n  }\n  const session = await getManagedSession(context, input.managedAuth, {\n    db: input.db,\n    sessionAdapter: input.managedAuthSessionAdapter,\n    sessionSetMode: input.managedAuthSessionSetMode,\n    ...(input.allowRecovery === undefined ? {} : { allowIdentityRecovery: input.allowRecovery }),\n  });\n  if (!session?.user || typeof session.session?.id !== \"string\") {\n    throw new HTTPException(401, {\n      message: \"Managed human authentication required\",\n    });\n  }\n  return { authUserId: session.user.id, authSessionId: session.session.id };\n}\n"],"mappings":";;;;;;;;;AAEA,SAAS,qBAAqB;AAgB9B,eAAsB,qCACpB,SACA,OAOwC;AACxC,MAAI,CAAC,MAAM,aAAa;AACtB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,UAAU,MAAM,kBAAkB,SAAS,MAAM,aAAa;AAAA,IAClE,IAAI,MAAM;AAAA,IACV,gBAAgB,MAAM;AAAA,IACtB,gBAAgB,MAAM;AAAA,IACtB,GAAI,MAAM,kBAAkB,SAAY,CAAC,IAAI,EAAE,uBAAuB,MAAM,cAAc;AAAA,EAC5F,CAAC;AACD,MAAI,CAAC,SAAS,QAAQ,OAAO,QAAQ,SAAS,OAAO,UAAU;AAC7D,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,EAAE,YAAY,QAAQ,KAAK,IAAI,eAAe,QAAQ,QAAQ,GAAG;AAC1E;","names":[]}

package/dist/chunk-YGOMUGYS.js

@@ -0,0 +1,226 @@
+// src/managed-auth-session-sets.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+import {
+  completeManagedAuthLoginTransaction,
+  getManagedAuthSessionSetOperationReceipt,
+  getManagedAuthSessionSetSnapshot
+} from "@opengeni/db";
+var MANAGED_AUTH_SESSION_SET_COOKIE = "opengeni.session_set";
+var MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE = "opengeni.login_transaction";
+var MANAGED_AUTH_CSRF_HEADER = "x-opengeni-session-csrf";
+var MANAGED_AUTH_ACTOR_EPOCH_HEADER = "x-opengeni-actor-epoch";
+var MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE_PATH = "/v1/auth/session-set/transactions";
+var ManagedAuthActorChangeError = class extends Error {
+  name = "ManagedAuthActorChangeError";
+  code = "actor_change_required";
+  constructor() {
+    super("The selected browser actor changed");
+  }
+};
+var ManagedAuthRequestAdmissionError = class extends Error {
+  name = "ManagedAuthRequestAdmissionError";
+  code = "origin_rejected";
+};
+var ManagedAuthCompletionOutcomeUnknownError = class extends Error {
+  name = "ManagedAuthCompletionOutcomeUnknownError";
+  code = "operation_outcome_unknown";
+  constructor(options) {
+    super("The managed authentication completion outcome is unknown", options);
+  }
+};
+function requireManagedAuthActorFence(input) {
+  if (input.expectedActorEpoch !== null && input.expectedActorEpoch !== input.actorEpoch || input.expectedActorEpoch === null && (input.mode === "broker" || input.actorEpoch !== "1" || input.selectedAuthSessionId !== null && input.legacyAmbientSessionId !== input.selectedAuthSessionId)) {
+    throw new ManagedAuthActorChangeError();
+  }
+}
+function managedAuthRandomAuthority() {
+  return randomBytes(32).toString("base64url");
+}
+function managedAuthSha256(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function managedAuthCsrfHash(authority) {
+  return managedAuthSha256(`opengeni:managed-auth:csrf-authority:v1
+${authority}`);
+}
+function managedAuthCsrfToken(signingSecret, authority, generation) {
+  return createHmac("sha256", signingSecret).update(`opengeni:managed-auth:csrf:v1
+${authority}
+${generation}`, "utf8").digest("base64url");
+}
+function managedAuthTransactionSecret(signingSecret, authority, operationId) {
+  return createHmac("sha256", signingSecret).update(`opengeni:managed-auth:transaction:v1
+${authority}
+${operationId}`, "utf8").digest("base64url");
+}
+function managedAuthDerivedUuid(namespace, value) {
+  const bytes = createHash("sha256").update(`${namespace}
+${value}`, "utf8").digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`).join(",")}}`;
+}
+function managedAuthRequestDigest(value) {
+  return managedAuthSha256(canonicalJson(value));
+}
+function managedAuthSecretRequestDigest(signingSecret, value) {
+  return createHmac("sha256", signingSecret).update(`opengeni:managed-auth:request:v1
+${canonicalJson(value)}`, "utf8").digest("hex");
+}
+function withManagedAuthCsrfToken(projection, signingSecret, authority) {
+  return {
+    ...projection,
+    csrfToken: managedAuthCsrfToken(signingSecret, authority, projection.generation)
+  };
+}
+function equalSecret(left, right) {
+  const leftBytes = Buffer.from(left, "utf8");
+  const rightBytes = Buffer.from(right, "utf8");
+  return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function requireManagedAuthMutationAdmission(input) {
+  const origin = input.request.headers.get("origin");
+  const fetchSite = input.request.headers.get("sec-fetch-site");
+  const contentType = input.request.headers.get("content-type")?.split(";", 1)[0]?.trim();
+  const csrf = input.request.headers.get(MANAGED_AUTH_CSRF_HEADER);
+  const allowed = new Set(input.allowedOrigins.map((candidate) => new URL(candidate).origin));
+  const expectedCsrf = managedAuthCsrfToken(
+    input.signingSecret,
+    input.authority,
+    input.expectedGeneration
+  );
+  if (!origin || !allowed.has(origin) || fetchSite !== "same-origin" || contentType !== "application/json" || !csrf || !equalSecret(csrf, expectedCsrf)) {
+    throw new ManagedAuthRequestAdmissionError("Browser session-set mutation admission failed");
+  }
+}
+async function resolveManagedAuthSelectedSession(input) {
+  const snapshot = await getManagedAuthSessionSetSnapshot(input.db, {
+    authorityHash: managedAuthSha256(input.authority),
+    mode: input.mode,
+    includeInternal: true,
+    allowRecovery: input.allowRecovery ?? false,
+    readOnly: true
+  });
+  if (!snapshot) return null;
+  if (snapshot.projection.state === "actor_change_required") {
+    throw new ManagedAuthActorChangeError();
+  }
+  requireManagedAuthActorFence({
+    mode: input.mode,
+    actorEpoch: snapshot.projection.actorEpoch,
+    expectedActorEpoch: input.expectedActorEpoch,
+    selectedAuthSessionId: snapshot.selected?.authSessionId ?? null,
+    legacyAmbientSessionId: input.legacyAmbientSessionId ?? null
+  });
+  if (!snapshot.selected) return { session: null, projection: snapshot.projection };
+  const resolved = await input.adapter.resolveSelectedSession(snapshot.selected);
+  if (!resolved || resolved.session.id !== snapshot.selected.authSessionId || resolved.user.id !== snapshot.selected.authUserId) {
+    return { session: null, projection: snapshot.projection };
+  }
+  return { session: resolved, projection: snapshot.projection };
+}
+async function authenticateAndAdoptManagedAuthSession(input) {
+  try {
+    const existing = await getManagedAuthSessionSetOperationReceipt(input.db, {
+      authorityHash: managedAuthSha256(input.authority),
+      operationId: input.operationId,
+      requestDigest: input.requestDigest
+    });
+    if (existing) return existing;
+  } catch (error) {
+    throw new ManagedAuthCompletionOutcomeUnknownError({ cause: error });
+  }
+  const created = await input.adapter.authenticate({
+    provider: "email_password",
+    transactionId: input.transactionId,
+    credentials: { email: input.email, password: input.password },
+    headers: input.isolatedHeaders
+  });
+  let completed;
+  try {
+    completed = await completeManagedAuthLoginTransaction(input.db, {
+      authorityHash: managedAuthSha256(input.authority),
+      csrfHash: input.csrfHash,
+      operationId: input.operationId,
+      requestDigest: input.requestDigest,
+      expectedGeneration: input.expectedGeneration,
+      expectedActorEpoch: input.expectedActorEpoch,
+      transactionId: input.transactionId,
+      transactionSecretHash: managedAuthSha256(input.transactionSecret),
+      authSessionId: created.authSessionId,
+      mode: input.mode
+    });
+  } catch (error) {
+    let receipt;
+    try {
+      receipt = await getManagedAuthSessionSetOperationReceipt(input.db, {
+        authorityHash: managedAuthSha256(input.authority),
+        operationId: input.operationId,
+        requestDigest: input.requestDigest
+      });
+    } catch (receiptError) {
+      throw new ManagedAuthCompletionOutcomeUnknownError({ cause: receiptError });
+    }
+    if (receipt) {
+      await reconcileCreatedManagedAuthSession(input, created.authSessionId);
+      return receipt;
+    }
+    await input.adapter.revokeSession(created).catch(() => void 0);
+    throw error;
+  }
+  try {
+    await reconcileCreatedManagedAuthSession(input, created.authSessionId);
+  } catch (error) {
+    throw new ManagedAuthCompletionOutcomeUnknownError({ cause: error });
+  }
+  return completed;
+}
+async function reconcileCreatedManagedAuthSession(input, authSessionId) {
+  const snapshot = await getManagedAuthSessionSetSnapshot(input.db, {
+    authorityHash: managedAuthSha256(input.authority),
+    mode: input.mode,
+    includeInternal: true,
+    readOnly: true
+  });
+  if (snapshot?.internalSlots.some((slot) => slot.authSessionId === authSessionId)) return;
+  await input.adapter.revokeSession({ authSessionId });
+}
+function isolatedManagedAuthHeaders(request) {
+  const headers = new Headers(request.headers);
+  headers.delete("cookie");
+  headers.delete("authorization");
+  headers.delete("x-forwarded-user");
+  return headers;
+}
+
+export {
+  MANAGED_AUTH_SESSION_SET_COOKIE,
+  MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE,
+  MANAGED_AUTH_CSRF_HEADER,
+  MANAGED_AUTH_ACTOR_EPOCH_HEADER,
+  MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE_PATH,
+  ManagedAuthActorChangeError,
+  ManagedAuthRequestAdmissionError,
+  ManagedAuthCompletionOutcomeUnknownError,
+  requireManagedAuthActorFence,
+  managedAuthRandomAuthority,
+  managedAuthSha256,
+  managedAuthCsrfHash,
+  managedAuthCsrfToken,
+  managedAuthTransactionSecret,
+  managedAuthDerivedUuid,
+  managedAuthRequestDigest,
+  managedAuthSecretRequestDigest,
+  withManagedAuthCsrfToken,
+  requireManagedAuthMutationAdmission,
+  resolveManagedAuthSelectedSession,
+  authenticateAndAdoptManagedAuthSession,
+  isolatedManagedAuthHeaders
+};
+//# sourceMappingURL=chunk-YGOMUGYS.js.map

package/dist/chunk-YGOMUGYS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import { createHash, createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport type {\n  ManagedAuthSessionSetMode,\n  ManagedAuthSessionSetProjection,\n} from \"@opengeni/contracts/managed-auth-session-sets\";\nimport {\n  completeManagedAuthLoginTransaction,\n  getManagedAuthSessionSetOperationReceipt,\n  getManagedAuthSessionSetSnapshot,\n  type Database,\n  type ManagedAuthDatabaseProjection,\n  type ManagedAuthSelectedSession,\n} from \"@opengeni/db\";\n\nexport const MANAGED_AUTH_SESSION_SET_COOKIE = \"opengeni.session_set\" as const;\nexport const MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE = \"opengeni.login_transaction\" as const;\nexport const MANAGED_AUTH_CSRF_HEADER = \"x-opengeni-session-csrf\" as const;\nexport const MANAGED_AUTH_ACTOR_EPOCH_HEADER = \"x-opengeni-actor-epoch\" as const;\nexport const MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE_PATH =\n  \"/v1/auth/session-set/transactions\" as const;\n\nexport type ManagedAuthResolvedSession = {\n  session: { id: string; userId: string; [key: string]: unknown };\n  user: {\n    id: string;\n    email: string;\n    name: string;\n    emailVerified: boolean;\n    [key: string]: unknown;\n  };\n};\n\n/** Provider-neutral boundary; provider credentials and tokens never cross its output. */\nexport interface ManagedAuthSessionAdapter {\n  authenticate(input: {\n    provider: \"email_password\";\n    transactionId: string;\n    credentials: { email: string; password: string };\n    headers: Headers;\n  }): Promise<{ authSessionId: string }>;\n  /** Verify an ambient provider cookie without sliding expiry or emitting cookies. */\n  resolveAmbientSession(headers: Headers): Promise<ManagedAuthResolvedSession | null>;\n  resolveSelectedSession(\n    input: ManagedAuthSelectedSession,\n  ): Promise<ManagedAuthResolvedSession | null>;\n  refreshSelectedSession(\n    input: ManagedAuthSelectedSession,\n  ): Promise<ManagedAuthResolvedSession | null>;\n  revokeSession(input: { authSessionId: string }): Promise<void>;\n  /** Dual-mode exact selected-session cookie plus stale provider-cache invalidations. */\n  createLegacySelectedSessionCookies(\n    input: ManagedAuthSelectedSession | null,\n    currentCookieHeader?: string | null,\n  ): Promise<string[]>;\n}\n\nexport class ManagedAuthActorChangeError extends Error {\n  readonly name = \"ManagedAuthActorChangeError\";\n  readonly code = \"actor_change_required\";\n  constructor() {\n    super(\"The selected browser actor changed\");\n  }\n}\n\nexport class ManagedAuthRequestAdmissionError extends Error {\n  readonly name = \"ManagedAuthRequestAdmissionError\";\n  readonly code = \"origin_rejected\";\n}\n\nexport class ManagedAuthCompletionOutcomeUnknownError extends Error {\n  readonly name = \"ManagedAuthCompletionOutcomeUnknownError\";\n  readonly code = \"operation_outcome_unknown\";\n  constructor(options?: ErrorOptions) {\n    super(\"The managed authentication completion outcome is unknown\", options);\n  }\n}\n\nexport function requireManagedAuthActorFence(input: {\n  mode: ManagedAuthSessionSetMode;\n  actorEpoch: string;\n  expectedActorEpoch: string | null;\n  selectedAuthSessionId: string | null;\n  legacyAmbientSessionId?: string | null;\n}): void {\n  if (\n    (input.expectedActorEpoch !== null && input.expectedActorEpoch !== input.actorEpoch) ||\n    (input.expectedActorEpoch === null &&\n      (input.mode === \"broker\" ||\n        input.actorEpoch !== \"1\" ||\n        (input.selectedAuthSessionId !== null &&\n          input.legacyAmbientSessionId !== input.selectedAuthSessionId)))\n  ) {\n    throw new ManagedAuthActorChangeError();\n  }\n}\n\nexport function managedAuthRandomAuthority(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\nexport function managedAuthSha256(value: string): string {\n  return createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\");\n}\n\nexport function managedAuthCsrfHash(authority: string): string {\n  return managedAuthSha256(`opengeni:managed-auth:csrf-authority:v1\\n${authority}`);\n}\n\nexport function managedAuthCsrfToken(\n  signingSecret: string,\n  authority: string,\n  generation: string,\n): string {\n  return createHmac(\"sha256\", signingSecret)\n    .update(`opengeni:managed-auth:csrf:v1\\n${authority}\\n${generation}`, \"utf8\")\n    .digest(\"base64url\");\n}\n\nexport function managedAuthTransactionSecret(\n  signingSecret: string,\n  authority: string,\n  operationId: string,\n): string {\n  return createHmac(\"sha256\", signingSecret)\n    .update(`opengeni:managed-auth:transaction:v1\\n${authority}\\n${operationId}`, \"utf8\")\n    .digest(\"base64url\");\n}\n\nexport function managedAuthDerivedUuid(namespace: string, value: string): string {\n  const bytes = createHash(\"sha256\")\n    .update(`${namespace}\\n${value}`, \"utf8\")\n    .digest()\n    .subarray(0, 16);\n  bytes[6] = (bytes[6]! & 0x0f) | 0x50;\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\nfunction canonicalJson(value: unknown): string {\n  if (value === null || typeof value !== \"object\") return JSON.stringify(value);\n  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(\",\")}]`;\n  return `{${Object.entries(value as Record<string, unknown>)\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`)\n    .join(\",\")}}`;\n}\n\nexport function managedAuthRequestDigest(value: unknown): string {\n  return managedAuthSha256(canonicalJson(value));\n}\n\nexport function managedAuthSecretRequestDigest(signingSecret: string, value: unknown): string {\n  return createHmac(\"sha256\", signingSecret)\n    .update(`opengeni:managed-auth:request:v1\\n${canonicalJson(value)}`, \"utf8\")\n    .digest(\"hex\");\n}\n\nexport function withManagedAuthCsrfToken(\n  projection: ManagedAuthDatabaseProjection,\n  signingSecret: string,\n  authority: string,\n): ManagedAuthSessionSetProjection {\n  return {\n    ...projection,\n    csrfToken: managedAuthCsrfToken(signingSecret, authority, projection.generation),\n  };\n}\n\nfunction equalSecret(left: string, right: string): boolean {\n  const leftBytes = Buffer.from(left, \"utf8\");\n  const rightBytes = Buffer.from(right, \"utf8\");\n  return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);\n}\n\nexport function requireManagedAuthMutationAdmission(input: {\n  request: Request;\n  allowedOrigins: readonly string[];\n  authority: string;\n  signingSecret: string;\n  expectedGeneration: string;\n}): void {\n  const origin = input.request.headers.get(\"origin\");\n  const fetchSite = input.request.headers.get(\"sec-fetch-site\");\n  const contentType = input.request.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim();\n  const csrf = input.request.headers.get(MANAGED_AUTH_CSRF_HEADER);\n  const allowed = new Set(input.allowedOrigins.map((candidate) => new URL(candidate).origin));\n  const expectedCsrf = managedAuthCsrfToken(\n    input.signingSecret,\n    input.authority,\n    input.expectedGeneration,\n  );\n  if (\n    !origin ||\n    !allowed.has(origin) ||\n    fetchSite !== \"same-origin\" ||\n    contentType !== \"application/json\" ||\n    !csrf ||\n    !equalSecret(csrf, expectedCsrf)\n  ) {\n    throw new ManagedAuthRequestAdmissionError(\"Browser session-set mutation admission failed\");\n  }\n}\n\nexport async function resolveManagedAuthSelectedSession(input: {\n  db: Database;\n  adapter: ManagedAuthSessionAdapter;\n  authority: string;\n  mode: ManagedAuthSessionSetMode;\n  expectedActorEpoch: string | null;\n  legacyAmbientSessionId?: string | null;\n  allowRecovery?: boolean;\n}): Promise<{\n  session: ManagedAuthResolvedSession | null;\n  projection: ManagedAuthDatabaseProjection;\n} | null> {\n  const snapshot = await getManagedAuthSessionSetSnapshot(input.db, {\n    authorityHash: managedAuthSha256(input.authority),\n    mode: input.mode,\n    includeInternal: true,\n    allowRecovery: input.allowRecovery ?? false,\n    readOnly: true,\n  });\n  if (!snapshot) return null;\n  if (snapshot.projection.state === \"actor_change_required\") {\n    throw new ManagedAuthActorChangeError();\n  }\n  requireManagedAuthActorFence({\n    mode: input.mode,\n    actorEpoch: snapshot.projection.actorEpoch,\n    expectedActorEpoch: input.expectedActorEpoch,\n    selectedAuthSessionId: snapshot.selected?.authSessionId ?? null,\n    legacyAmbientSessionId: input.legacyAmbientSessionId ?? null,\n  });\n  if (!snapshot.selected) return { session: null, projection: snapshot.projection };\n  const resolved = await input.adapter.resolveSelectedSession(snapshot.selected);\n  if (\n    !resolved ||\n    resolved.session.id !== snapshot.selected.authSessionId ||\n    resolved.user.id !== snapshot.selected.authUserId\n  ) {\n    return { session: null, projection: snapshot.projection };\n  }\n  return { session: resolved, projection: snapshot.projection };\n}\n\nexport async function authenticateAndAdoptManagedAuthSession(input: {\n  db: Database;\n  adapter: ManagedAuthSessionAdapter;\n  isolatedHeaders: Headers;\n  authority: string;\n  csrfHash: string;\n  operationId: string;\n  requestDigest: string;\n  expectedGeneration: string;\n  expectedActorEpoch: string;\n  transactionId: string;\n  transactionSecret: string;\n  email: string;\n  password: string;\n  mode: ManagedAuthSessionSetMode;\n}): Promise<{ projection: ManagedAuthDatabaseProjection; returnIntent: string | null }> {\n  try {\n    const existing = await getManagedAuthSessionSetOperationReceipt(input.db, {\n      authorityHash: managedAuthSha256(input.authority),\n      operationId: input.operationId,\n      requestDigest: input.requestDigest,\n    });\n    if (existing) return existing;\n  } catch (error) {\n    // Provider authentication creates a durable session. Do not perform it\n    // while exact-replay reconciliation is unavailable.\n    throw new ManagedAuthCompletionOutcomeUnknownError({ cause: error });\n  }\n  const created = await input.adapter.authenticate({\n    provider: \"email_password\",\n    transactionId: input.transactionId,\n    credentials: { email: input.email, password: input.password },\n    headers: input.isolatedHeaders,\n  });\n  let completed: { projection: ManagedAuthDatabaseProjection; returnIntent: string | null };\n  try {\n    completed = await completeManagedAuthLoginTransaction(input.db, {\n      authorityHash: managedAuthSha256(input.authority),\n      csrfHash: input.csrfHash,\n      operationId: input.operationId,\n      requestDigest: input.requestDigest,\n      expectedGeneration: input.expectedGeneration,\n      expectedActorEpoch: input.expectedActorEpoch,\n      transactionId: input.transactionId,\n      transactionSecretHash: managedAuthSha256(input.transactionSecret),\n      authSessionId: created.authSessionId,\n      mode: input.mode,\n    });\n  } catch (error) {\n    let receipt: Awaited<ReturnType<typeof getManagedAuthSessionSetOperationReceipt>>;\n    try {\n      receipt = await getManagedAuthSessionSetOperationReceipt(input.db, {\n        authorityHash: managedAuthSha256(input.authority),\n        operationId: input.operationId,\n        requestDigest: input.requestDigest,\n      });\n    } catch (receiptError) {\n      throw new ManagedAuthCompletionOutcomeUnknownError({ cause: receiptError });\n    }\n    if (receipt) {\n      await reconcileCreatedManagedAuthSession(input, created.authSessionId);\n      return receipt;\n    }\n    await input.adapter.revokeSession(created).catch(() => undefined);\n    throw error;\n  }\n  try {\n    await reconcileCreatedManagedAuthSession(input, created.authSessionId);\n  } catch (error) {\n    throw new ManagedAuthCompletionOutcomeUnknownError({ cause: error });\n  }\n  return completed;\n}\n\nasync function reconcileCreatedManagedAuthSession(\n  input: Pick<\n    Parameters<typeof authenticateAndAdoptManagedAuthSession>[0],\n    \"db\" | \"adapter\" | \"authority\" | \"mode\"\n  >,\n  authSessionId: string,\n): Promise<void> {\n  const snapshot = await getManagedAuthSessionSetSnapshot(input.db, {\n    authorityHash: managedAuthSha256(input.authority),\n    mode: input.mode,\n    includeInternal: true,\n    readOnly: true,\n  });\n  if (snapshot?.internalSlots.some((slot) => slot.authSessionId === authSessionId)) return;\n  await input.adapter.revokeSession({ authSessionId });\n}\n\nexport function isolatedManagedAuthHeaders(request: Request): Headers {\n  const headers = new Headers(request.headers);\n  headers.delete(\"cookie\");\n  headers.delete(\"authorization\");\n  headers.delete(\"x-forwarded-user\");\n  return headers;\n}\n"],"mappings":";AAAA,SAAS,YAAY,YAAY,aAAa,uBAAuB;AAKrE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAEA,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,2BAA2B;AACjC,IAAM,kCAAkC;AACxC,IAAM,6CACX;AAqCK,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC5C,OAAO;AAAA,EACP,OAAO;AAAA,EAChB,cAAc;AACZ,UAAM,oCAAoC;AAAA,EAC5C;AACF;AAEO,IAAM,mCAAN,cAA+C,MAAM;AAAA,EACjD,OAAO;AAAA,EACP,OAAO;AAClB;AAEO,IAAM,2CAAN,cAAuD,MAAM;AAAA,EACzD,OAAO;AAAA,EACP,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,4DAA4D,OAAO;AAAA,EAC3E;AACF;AAEO,SAAS,6BAA6B,OAMpC;AACP,MACG,MAAM,uBAAuB,QAAQ,MAAM,uBAAuB,MAAM,cACxE,MAAM,uBAAuB,SAC3B,MAAM,SAAS,YACd,MAAM,eAAe,OACpB,MAAM,0BAA0B,QAC/B,MAAM,2BAA2B,MAAM,wBAC7C;AACA,UAAM,IAAI,4BAA4B;AAAA,EACxC;AACF;AAEO,SAAS,6BAAqC;AACnD,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEO,SAAS,kBAAkB,OAAuB;AACvD,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,KAAK;AAChE;AAEO,SAAS,oBAAoB,WAA2B;AAC7D,SAAO,kBAAkB;AAAA,EAA4C,SAAS,EAAE;AAClF;AAEO,SAAS,qBACd,eACA,WACA,YACQ;AACR,SAAO,WAAW,UAAU,aAAa,EACtC,OAAO;AAAA,EAAkC,SAAS;AAAA,EAAK,UAAU,IAAI,MAAM,EAC3E,OAAO,WAAW;AACvB;AAEO,SAAS,6BACd,eACA,WACA,aACQ;AACR,SAAO,WAAW,UAAU,aAAa,EACtC,OAAO;AAAA,EAAyC,SAAS;AAAA,EAAK,WAAW,IAAI,MAAM,EACnF,OAAO,WAAW;AACvB;AAEO,SAAS,uBAAuB,WAAmB,OAAuB;AAC/E,QAAM,QAAQ,WAAW,QAAQ,EAC9B,OAAO,GAAG,SAAS;AAAA,EAAK,KAAK,IAAI,MAAM,EACvC,OAAO,EACP,SAAS,GAAG,EAAE;AACjB,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC1G;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC5E,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,aAAa,EAAE,KAAK,GAAG,CAAC;AACvE,SAAO,IAAI,OAAO,QAAQ,KAAgC,EACvD,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,cAAc,KAAK,CAAC,EAAE,EACtE,KAAK,GAAG,CAAC;AACd;AAEO,SAAS,yBAAyB,OAAwB;AAC/D,SAAO,kBAAkB,cAAc,KAAK,CAAC;AAC/C;AAEO,SAAS,+BAA+B,eAAuB,OAAwB;AAC5F,SAAO,WAAW,UAAU,aAAa,EACtC,OAAO;AAAA,EAAqC,cAAc,KAAK,CAAC,IAAI,MAAM,EAC1E,OAAO,KAAK;AACjB;AAEO,SAAS,yBACd,YACA,eACA,WACiC;AACjC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,qBAAqB,eAAe,WAAW,WAAW,UAAU;AAAA,EACjF;AACF;AAEA,SAAS,YAAY,MAAc,OAAwB;AACzD,QAAM,YAAY,OAAO,KAAK,MAAM,MAAM;AAC1C,QAAM,aAAa,OAAO,KAAK,OAAO,MAAM;AAC5C,SAAO,UAAU,WAAW,WAAW,UAAU,gBAAgB,WAAW,UAAU;AACxF;AAEO,SAAS,oCAAoC,OAM3C;AACP,QAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI,QAAQ;AACjD,QAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,gBAAgB;AAC5D,QAAM,cAAc,MAAM,QAAQ,QAAQ,IAAI,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK;AACtF,QAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,wBAAwB;AAC/D,QAAM,UAAU,IAAI,IAAI,MAAM,eAAe,IAAI,CAAC,cAAc,IAAI,IAAI,SAAS,EAAE,MAAM,CAAC;AAC1F,QAAM,eAAe;AAAA,IACnB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,MACE,CAAC,UACD,CAAC,QAAQ,IAAI,MAAM,KACnB,cAAc,iBACd,gBAAgB,sBAChB,CAAC,QACD,CAAC,YAAY,MAAM,YAAY,GAC/B;AACA,UAAM,IAAI,iCAAiC,+CAA+C;AAAA,EAC5F;AACF;AAEA,eAAsB,kCAAkC,OAW9C;AACR,QAAM,WAAW,MAAM,iCAAiC,MAAM,IAAI;AAAA,IAChE,eAAe,kBAAkB,MAAM,SAAS;AAAA,IAChD,MAAM,MAAM;AAAA,IACZ,iBAAiB;AAAA,IACjB,eAAe,MAAM,iBAAiB;AAAA,IACtC,UAAU;AAAA,EACZ,CAAC;AACD,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,WAAW,UAAU,yBAAyB;AACzD,UAAM,IAAI,4BAA4B;AAAA,EACxC;AACA,+BAA6B;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,YAAY,SAAS,WAAW;AAAA,IAChC,oBAAoB,MAAM;AAAA,IAC1B,uBAAuB,SAAS,UAAU,iBAAiB;AAAA,IAC3D,wBAAwB,MAAM,0BAA0B;AAAA,EAC1D,CAAC;AACD,MAAI,CAAC,SAAS,SAAU,QAAO,EAAE,SAAS,MAAM,YAAY,SAAS,WAAW;AAChF,QAAM,WAAW,MAAM,MAAM,QAAQ,uBAAuB,SAAS,QAAQ;AAC7E,MACE,CAAC,YACD,SAAS,QAAQ,OAAO,SAAS,SAAS,iBAC1C,SAAS,KAAK,OAAO,SAAS,SAAS,YACvC;AACA,WAAO,EAAE,SAAS,MAAM,YAAY,SAAS,WAAW;AAAA,EAC1D;AACA,SAAO,EAAE,SAAS,UAAU,YAAY,SAAS,WAAW;AAC9D;AAEA,eAAsB,uCAAuC,OAe2B;AACtF,MAAI;AACF,UAAM,WAAW,MAAM,yCAAyC,MAAM,IAAI;AAAA,MACxE,eAAe,kBAAkB,MAAM,SAAS;AAAA,MAChD,aAAa,MAAM;AAAA,MACnB,eAAe,MAAM;AAAA,IACvB,CAAC;AACD,QAAI,SAAU,QAAO;AAAA,EACvB,SAAS,OAAO;AAGd,UAAM,IAAI,yCAAyC,EAAE,OAAO,MAAM,CAAC;AAAA,EACrE;AACA,QAAM,UAAU,MAAM,MAAM,QAAQ,aAAa;AAAA,IAC/C,UAAU;AAAA,IACV,eAAe,MAAM;AAAA,IACrB,aAAa,EAAE,OAAO,MAAM,OAAO,UAAU,MAAM,SAAS;AAAA,IAC5D,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,oCAAoC,MAAM,IAAI;AAAA,MAC9D,eAAe,kBAAkB,MAAM,SAAS;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,aAAa,MAAM;AAAA,MACnB,eAAe,MAAM;AAAA,MACrB,oBAAoB,MAAM;AAAA,MAC1B,oBAAoB,MAAM;AAAA,MAC1B,eAAe,MAAM;AAAA,MACrB,uBAAuB,kBAAkB,MAAM,iBAAiB;AAAA,MAChE,eAAe,QAAQ;AAAA,MACvB,MAAM,MAAM;AAAA,IACd,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,yCAAyC,MAAM,IAAI;AAAA,QACjE,eAAe,kBAAkB,MAAM,SAAS;AAAA,QAChD,aAAa,MAAM;AAAA,QACnB,eAAe,MAAM;AAAA,MACvB,CAAC;AAAA,IACH,SAAS,cAAc;AACrB,YAAM,IAAI,yCAAyC,EAAE,OAAO,aAAa,CAAC;AAAA,IAC5E;AACA,QAAI,SAAS;AACX,YAAM,mCAAmC,OAAO,QAAQ,aAAa;AACrE,aAAO;AAAA,IACT;AACA,UAAM,MAAM,QAAQ,cAAc,OAAO,EAAE,MAAM,MAAM,MAAS;AAChE,UAAM;AAAA,EACR;AACA,MAAI;AACF,UAAM,mCAAmC,OAAO,QAAQ,aAAa;AAAA,EACvE,SAAS,OAAO;AACd,UAAM,IAAI,yCAAyC,EAAE,OAAO,MAAM,CAAC;AAAA,EACrE;AACA,SAAO;AACT;AAEA,eAAe,mCACb,OAIA,eACe;AACf,QAAM,WAAW,MAAM,iCAAiC,MAAM,IAAI;AAAA,IAChE,eAAe,kBAAkB,MAAM,SAAS;AAAA,IAChD,MAAM,MAAM;AAAA,IACZ,iBAAiB;AAAA,IACjB,UAAU;AAAA,EACZ,CAAC;AACD,MAAI,UAAU,cAAc,KAAK,CAAC,SAAS,KAAK,kBAAkB,aAAa,EAAG;AAClF,QAAM,MAAM,QAAQ,cAAc,EAAE,cAAc,CAAC;AACrD;AAEO,SAAS,2BAA2B,SAA2B;AACpE,QAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,UAAQ,OAAO,QAAQ;AACvB,UAAQ,OAAO,eAAe;AAC9B,UAAQ,OAAO,kBAAkB;AACjC,SAAO;AACT;","names":[]}