@plumix/core 0.1.0

package/dist/auth/passkey/routes.js

@@ -0,0 +1,450 @@
+import * as v from "valibot";
+import { withBasePath } from "../../base-path.js";
+import { eq, isUniqueConstraintError } from "../../db/index.js";
+import { credentials } from "../../db/schema/credentials.js";
+import { users } from "../../db/schema/users.js";
+import { jsonResponse } from "../../runtime/http.js";
+import { provisionUser } from "../bootstrap.js";
+import { buildSessionDeletionCookie, isSecureRequest, readSessionCookie, } from "../cookies.js";
+import { consumeInviteToken, InviteError, validateInviteToken, } from "../invite.js";
+import { invalidateSession, validateSession } from "../sessions.js";
+import { mintSessionAndCookie } from "../sign-in.js";
+import { beginAuthentication, finishAuthentication } from "./authenticate.js";
+import { PasskeyError } from "./errors.js";
+import { beginRegistration, finishRegistration, persistCredential, } from "./register.js";
+const emailSchema = v.pipe(v.string(), v.trim(), v.toLowerCase(), v.email(), v.maxLength(255));
+const registerOptionsInputSchema = v.object({
+    email: emailSchema,
+    name: v.optional(v.pipe(v.string(), v.trim(), v.maxLength(100))),
+});
+const loginOptionsInputSchema = v.object({
+    email: v.optional(emailSchema),
+});
+// Opaque invite token (generateToken's base64url output, ~32 chars).
+// We cap generously to protect the hashToken path from pathological inputs.
+const inviteTokenSchema = v.pipe(v.string(), v.minLength(16), v.maxLength(256));
+// Defensive upper bound for credential IDs from untrusted WebAuthn responses.
+// Real credential IDs are typically tens to a few hundred bytes; 1 KiB
+// preserves compatibility while blocking pathological payloads from reaching
+// deeper parsing paths.
+const MAX_CREDENTIAL_ID_LENGTH = 1024;
+// Defensive cap for large binary WebAuthn fields that arrive base64url-encoded
+// in JSON — clientDataJSON, attestationObject, authenticatorData, signature.
+// 64 KiB is intentionally generous for interoperability while bounding memory
+// and CPU on oversized inputs so they can't reach the oslo parsers at all.
+const MAX_WEBAUTHN_FIELD_LENGTH = 65_536;
+const base64urlField = (max) => v.pipe(v.string(), v.minLength(1), v.maxLength(max));
+const credentialTransportSchema = v.picklist([
+    "usb",
+    "nfc",
+    "ble",
+    "internal",
+    "hybrid",
+]);
+const registerResponseSchema = v.object({
+    id: base64urlField(MAX_CREDENTIAL_ID_LENGTH),
+    rawId: base64urlField(MAX_CREDENTIAL_ID_LENGTH),
+    type: v.literal("public-key"),
+    response: v.object({
+        clientDataJSON: base64urlField(MAX_WEBAUTHN_FIELD_LENGTH),
+        attestationObject: base64urlField(MAX_WEBAUTHN_FIELD_LENGTH),
+        transports: v.optional(v.array(credentialTransportSchema)),
+    }),
+});
+const authenticationResponseSchema = v.object({
+    id: base64urlField(MAX_CREDENTIAL_ID_LENGTH),
+    rawId: base64urlField(MAX_CREDENTIAL_ID_LENGTH),
+    type: v.literal("public-key"),
+    response: v.object({
+        clientDataJSON: base64urlField(MAX_WEBAUTHN_FIELD_LENGTH),
+        authenticatorData: base64urlField(MAX_WEBAUTHN_FIELD_LENGTH),
+        signature: base64urlField(MAX_WEBAUTHN_FIELD_LENGTH),
+        userHandle: v.optional(v.nullable(base64urlField(MAX_WEBAUTHN_FIELD_LENGTH))),
+    }),
+});
+async function parseJson(request, schema) {
+    let body;
+    try {
+        body = await request.json();
+    }
+    catch {
+        return null;
+    }
+    const parsed = v.safeParse(schema, body);
+    return parsed.success ? parsed.output : null;
+}
+function invalidInput() {
+    return jsonResponse({ error: "invalid_input" }, { status: 400 });
+}
+function passkeyError(ctx, error) {
+    if (error.code === "invalid_origin") {
+        ctx.logger.warn("passkey: invalid_origin", { ...error.detail });
+    }
+    return jsonResponse({ error: error.code, message: error.message }, { status: 400 });
+}
+async function findOrProvisionUser(ctx, email, name) {
+    const existing = await ctx.db.query.users.findFirst({
+        where: eq(users.email, email),
+    });
+    if (existing)
+        return existing;
+    try {
+        const { user } = await provisionUser(ctx.db, {
+            email,
+            name,
+            emailVerified: true,
+        });
+        return user;
+    }
+    catch (error) {
+        if (!isUniqueConstraintError(error))
+            throw error;
+        const raced = await ctx.db.query.users.findFirst({
+            where: eq(users.email, email),
+        });
+        if (!raced)
+            throw error;
+        return raced;
+    }
+}
+export async function handlePasskeyRegisterOptions(ctx, app) {
+    const input = await parseJson(ctx.request, registerOptionsInputSchema);
+    if (!input)
+        return invalidInput();
+    const authed = await resolveAuthedUser(ctx);
+    const policy = await decideRegistrationPolicy(ctx, authed, input.email);
+    if (policy.outcome === "denied") {
+        return jsonResponse({ error: policy.reason }, { status: 403 });
+    }
+    const user = policy.outcome === "bootstrap"
+        ? await findOrProvisionUser(ctx, input.email, input.name ?? null)
+        : policy.user;
+    const excludeCredentials = policy.outcome === "add-device"
+        ? await ctx.db
+            .select()
+            .from(credentials)
+            .where(eq(credentials.userId, user.id))
+        : undefined;
+    const options = await beginRegistration(ctx.db, app.passkey, {
+        userId: user.id,
+        userEmail: user.email,
+        userDisplayName: user.name ?? user.email,
+        excludeCredentials,
+    });
+    return jsonResponse(options);
+}
+async function decideRegistrationPolicy(ctx, authed, email) {
+    if (authed) {
+        if (authed.email !== email) {
+            return { outcome: "denied", reason: "email_mismatch" };
+        }
+        return { outcome: "add-device", user: authed };
+    }
+    const userCount = await ctx.db.$count(users);
+    if (userCount === 0)
+        return { outcome: "bootstrap" };
+    return { outcome: "denied", reason: "registration_closed" };
+}
+async function resolveAuthedUser(ctx) {
+    const token = readSessionCookie(ctx.request);
+    if (!token)
+        return null;
+    const validated = await validateSession(ctx.db, token, undefined);
+    return validated?.user ?? null;
+}
+export async function handlePasskeyRegisterVerify(ctx, app) {
+    const payload = await parseJson(ctx.request, registerResponseSchema);
+    if (!payload)
+        return invalidInput();
+    try {
+        const verified = await finishRegistration(ctx.db, app.passkey, payload);
+        if (verified.userId === null) {
+            return jsonResponse({ error: "challenge_not_bound_to_user" }, { status: 400 });
+        }
+        const credential = await persistCredential(ctx.db, {
+            userId: verified.userId,
+            verified,
+            maxPerUser: app.passkey.maxCredentialsPerUser,
+        });
+        // Look up the full user row for the hook payload (createSession
+        // doesn't return one). Cheap PK lookup on a path that's already
+        // doing several writes.
+        const user = await ctx.db.query.users.findFirst({
+            where: eq(users.id, verified.userId),
+        });
+        const { cookieHeader } = await mintSessionAndCookie(ctx, app, verified.userId);
+        if (user) {
+            const userCount = await ctx.db.$count(credentials, eq(credentials.userId, user.id));
+            // First credential ever → this is the bootstrap path; subsequent
+            // verifies are "add another device". Audit-log subscribers branch
+            // on `firstSignIn` to render onboarding-specific copy.
+            const firstSignIn = userCount === 1;
+            await ctx.hooks.doAction("credential:created", {
+                id: credential.id,
+                userId: credential.userId,
+                name: credential.name,
+                deviceType: credential.deviceType,
+                isBackedUp: credential.isBackedUp,
+            }, {
+                actor: {
+                    id: user.id,
+                    email: user.email,
+                    role: user.role,
+                    meta: user.meta,
+                },
+            });
+            await ctx.hooks.doAction("user:signed_in", user, {
+                method: "passkey",
+                firstSignIn,
+            });
+        }
+        return jsonResponse({ userId: verified.userId }, {
+            status: 200,
+            headers: { "set-cookie": cookieHeader },
+        });
+    }
+    catch (error) {
+        if (error instanceof PasskeyError)
+            return passkeyError(ctx, error);
+        throw error;
+    }
+}
+export async function handlePasskeyLoginOptions(ctx, app) {
+    const input = await parseJson(ctx.request, loginOptionsInputSchema);
+    if (!input)
+        return invalidInput();
+    const user = input.email
+        ? await ctx.db.query.users.findFirst({
+            where: eq(users.email, input.email),
+        })
+        : null;
+    const allowCredentials = user
+        ? await ctx.db
+            .select()
+            .from(credentials)
+            .where(eq(credentials.userId, user.id))
+        : [];
+    const options = await beginAuthentication(ctx.db, app.passkey, {
+        allowCredentials,
+    });
+    return jsonResponse(options);
+}
+export async function handlePasskeyLoginVerify(ctx, app) {
+    const payload = await parseJson(ctx.request, authenticationResponseSchema);
+    if (!payload)
+        return invalidInput();
+    try {
+        const verified = await finishAuthentication(ctx.db, app.passkey, payload);
+        await ctx.db
+            .update(credentials)
+            .set({ counter: verified.newSignatureCounter })
+            .where(eq(credentials.id, verified.credential.id));
+        const { cookieHeader } = await mintSessionAndCookie(ctx, app, verified.credential.userId);
+        const user = await ctx.db.query.users.findFirst({
+            where: eq(users.id, verified.credential.userId),
+        });
+        if (user) {
+            await ctx.hooks.doAction("user:signed_in", user, {
+                method: "passkey",
+                firstSignIn: false,
+            });
+        }
+        return jsonResponse({ userId: verified.credential.userId }, {
+            status: 200,
+            headers: { "set-cookie": cookieHeader },
+        });
+    }
+    catch (error) {
+        if (error instanceof PasskeyError)
+            return passkeyError(ctx, error);
+        throw error;
+    }
+}
+export async function handleSignout(ctx) {
+    const token = readSessionCookie(ctx.request);
+    if (token) {
+        // Resolve the user before invalidating so the hook payload carries
+        // the row that was just signed out (for audit attribution).
+        const validated = await validateSession(ctx.db, token, undefined);
+        await invalidateSession(ctx.db, token);
+        if (validated) {
+            await ctx.hooks.doAction("user:signed_out", validated.user);
+        }
+    }
+    const cookie = buildSessionDeletionCookie({
+        secure: isSecureRequest(ctx.request),
+        sameSite: "Lax",
+        // Must match the Path the session was minted with (see mintSessionAndCookie)
+        // or the browser won't clear it.
+        path: withBasePath("/", ctx.basePath),
+    });
+    // If the configured authenticator runs an external session (CF
+    // Access, SAML), surface the IdP logout URL so the admin client can
+    // navigate there after clearing the local cookie. Without this, the
+    // next request would carry the same IdP credential and silently
+    // re-auth the user.
+    const redirectTo = sanitiseSignOutUrl(ctx.authenticator.signOutUrl?.());
+    return jsonResponse({ ok: true, redirectTo }, { status: 200, headers: { "set-cookie": cookie } });
+}
+// Defense-in-depth: the authenticator interface is operator-trusted
+// (set at config time, never request-injected), but we still validate
+// the URL shape before shipping it to the admin client. A buggy or
+// malicious authenticator returning `javascript:`, a protocol-relative
+// URL, or a string with embedded CR/LF would otherwise become a
+// trusted navigation target.
+function sanitiseSignOutUrl(value) {
+    if (typeof value !== "string" || value.length === 0)
+        return null;
+    if (/[\r\n]/.test(value))
+        return null;
+    const sameOriginPath = value.startsWith("/") && !value.startsWith("//");
+    const httpsAbsolute = value.startsWith("https://");
+    return sameOriginPath || httpsAbsolute ? value : null;
+}
+// Invite acceptance — two routes paired with the passkey register flow.
+// An invite token (from user.invite in Phase 9) unlocks registration for
+// a user row that otherwise can't sign up because decideRegistrationPolicy
+// returns "registration_closed" for post-bootstrap unauthenticated callers.
+//
+// Security model:
+//   - Token is hashed in DB (Phase 9 writes SHA-256; see auth/tokens.ts).
+//   - Single-use: consumed after the credential is persisted.
+//   - TTL checked at both options and verify time — a token could expire
+//     between the two calls on a slow client.
+//   - Target user must still exist and not be disabled — admins can cancel
+//     an invite by disabling or deleting the row.
+//   - Refuse if the user already has any credentials — the invite isn't
+//     for a re-registration; an active user should use /passkey/register
+//     (add-device) while authenticated.
+//   - Challenge binding defends against a cross-user replay: the WebAuthn
+//     challenge issued by beginRegistration is keyed to the invited user's
+//     id, so a response captured for a different user can't complete here.
+const inviteRegisterOptionsInputSchema = v.object({
+    token: inviteTokenSchema,
+    name: v.optional(v.pipe(v.string(), v.trim(), v.maxLength(100))),
+});
+const inviteRegisterVerifyInputSchema = v.object({
+    token: inviteTokenSchema,
+    response: registerResponseSchema,
+});
+export async function handleInviteRegisterOptions(ctx, app) {
+    const input = await parseJson(ctx.request, inviteRegisterOptionsInputSchema);
+    if (!input)
+        return invalidInput();
+    const target = await resolveInviteTarget(ctx, input.token);
+    if (target instanceof Response)
+        return target;
+    const { user } = target;
+    const options = await beginRegistration(ctx.db, app.passkey, {
+        userId: user.id,
+        userEmail: user.email,
+        userDisplayName: pickDisplayName(input.name, user.name, user.email),
+    });
+    return jsonResponse({
+        options,
+        invitee: { email: user.email, role: user.role, name: user.name },
+    });
+}
+export async function handleInviteRegisterVerify(ctx, app) {
+    const input = await parseJson(ctx.request, inviteRegisterVerifyInputSchema);
+    if (!input)
+        return invalidInput();
+    const target = await resolveInviteTarget(ctx, input.token);
+    if (target instanceof Response)
+        return target;
+    const { invite, user } = target;
+    try {
+        const verified = await finishRegistration(ctx.db, app.passkey, input.response);
+        // The challenge issued in register/options was bound to invite.userId.
+        // A mismatch means the response is for a different user — refuse.
+        if (verified.userId === null || verified.userId !== user.id) {
+            return jsonResponse({ error: "challenge_mismatch" }, { status: 400 });
+        }
+        const credential = await persistCredential(ctx.db, {
+            userId: user.id,
+            verified,
+            maxPerUser: app.passkey.maxCredentialsPerUser,
+        });
+        await consumeInviteToken(ctx.db, invite.tokenHash);
+        const { cookieHeader } = await mintSessionAndCookie(ctx, app, user.id);
+        // User is fully enrolled (credential persisted, token consumed,
+        // session created). Fire after the session exists so handlers that
+        // hit the DB can rely on the user being in a stable post-invite
+        // state — matches WP's `user_register` firing post-save.
+        await ctx.hooks.doAction("user:registered", user);
+        await ctx.hooks.doAction("credential:created", {
+            id: credential.id,
+            userId: credential.userId,
+            name: credential.name,
+            deviceType: credential.deviceType,
+            isBackedUp: credential.isBackedUp,
+        }, {
+            actor: {
+                id: user.id,
+                email: user.email,
+                role: user.role,
+                meta: user.meta,
+            },
+        });
+        await ctx.hooks.doAction("user:signed_in", user, {
+            method: "invite",
+            firstSignIn: true,
+        });
+        return jsonResponse({ userId: user.id }, {
+            status: 200,
+            headers: { "set-cookie": cookieHeader },
+        });
+    }
+    catch (error) {
+        if (error instanceof PasskeyError)
+            return passkeyError(ctx, error);
+        throw error;
+    }
+}
+async function resolveInvite(ctx, rawToken) {
+    try {
+        return await validateInviteToken(ctx.db, rawToken);
+    }
+    catch (error) {
+        if (error instanceof InviteError)
+            return inviteErrorResponse(error);
+        throw error;
+    }
+}
+/**
+ * Fully resolve an invite-accept target: validate the token, load the user,
+ * verify they're still enrollable (exists, not disabled, no existing
+ * credentials). Returns either a typed `{invite, user}` pair or an already-
+ * formed error Response that callers pass straight through.
+ */
+async function resolveInviteTarget(ctx, rawToken) {
+    const invite = await resolveInvite(ctx, rawToken);
+    if (invite instanceof Response)
+        return invite;
+    const user = await ctx.db.query.users.findFirst({
+        where: eq(users.id, invite.userId),
+    });
+    if (!user || user.disabledAt) {
+        return inviteErrorResponse(InviteError.invalidToken());
+    }
+    const existingCreds = await ctx.db.$count(credentials, eq(credentials.userId, user.id));
+    if (existingCreds > 0) {
+        return jsonResponse({ error: "already_registered" }, { status: 409 });
+    }
+    return { invite, user };
+}
+function inviteErrorResponse(error) {
+    const status = error.code === "token_expired" ? 410 : 404;
+    return jsonResponse({ error: error.code }, { status });
+}
+// Pick a WebAuthn display name: invitee's input > admin-set name > email.
+// Falsy check (not `??`) so empty strings fall through to the next fallback.
+function pickDisplayName(userInput, existingName, email) {
+    const trimmed = userInput?.trim();
+    if (trimmed)
+        return trimmed;
+    if (existingName)
+        return existingName;
+    return email;
+}
+//# sourceMappingURL=routes.js.map

package/dist/auth/passkey/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/auth/passkey/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAO7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CACxB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,WAAW,EAAE,EACf,CAAC,CAAC,KAAK,EAAE,EACT,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CACjB,CAAC;AAEF,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;CACjE,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;CAC/B,CAAC,CAAC;AAEH,qEAAqE;AACrE,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AAEhF,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,wBAAwB;AACxB,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,EAAE,CACrC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AAEvD,MAAM,yBAAyB,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC3C,KAAK;IACL,KAAK;IACL,KAAK;IACL,UAAU;IACV,QAAQ;CACA,CAAC,CAAC;AAEZ,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,cAAc,CAAC,wBAAwB,CAAC;IAC5C,KAAK,EAAE,cAAc,CAAC,wBAAwB,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,cAAc,EAAE,cAAc,CAAC,yBAAyB,CAAC;QACzD,iBAAiB,EAAE,cAAc,CAAC,yBAAyB,CAAC;QAC5D,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;KAC3D,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,cAAc,CAAC,wBAAwB,CAAC;IAC5C,KAAK,EAAE,cAAc,CAAC,wBAAwB,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,cAAc,EAAE,cAAc,CAAC,yBAAyB,CAAC;QACzD,iBAAiB,EAAE,cAAc,CAAC,yBAAyB,CAAC;QAC5D,SAAS,EAAE,cAAc,CAAC,yBAAyB,CAAC;QACpD,UAAU,EAAE,CAAC,CAAC,QAAQ,CACpB,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC,CACtD;KACF,CAAC;CACH,CAAC,CAAC;AAEH,KAAK,UAAU,SAAS,CAEtB,OAAgB,EAAE,MAAe;IACjC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,GAAe,EAAE,KAAmB;IACxD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAC7C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAe,EACf,KAAa,EACb,IAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE;YAC3C,KAAK;YACL,IAAI;YACJ,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,MAAM,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAe,EACf,GAAc;IAEd,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GACR,MAAM,CAAC,OAAO,KAAK,WAAW;QAC5B,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;QACjE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAElB,MAAM,kBAAkB,GACtB,MAAM,CAAC,OAAO,KAAK,YAAY;QAC7B,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;aACT,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE;QAC3D,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,eAAe,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;QACxC,kBAAkB;KACnB,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAOD,KAAK,UAAU,wBAAwB,CACrC,GAAe,EACf,MAAmB,EACnB,KAAa;IAEb,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAe;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAClE,OAAO,SAAS,EAAE,IAAI,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,GAAe,EACf,GAAc;IAEd,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO,YAAY,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,6BAA6B,EAAE,EACxC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE;YACjD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,qBAAqB;SAC9C,CAAC,CAAC;QAEH,gEAAgE;QAChE,gEAAgE;QAChE,wBAAwB;QACxB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC;SACrC,CAAC,CAAC;QAEH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAoB,CACjD,GAAG,EACH,GAAG,EACH,QAAQ,CAAC,MAAM,CAChB,CAAC;QAEF,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CACnC,WAAW,EACX,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAChC,CAAC;YACF,iEAAiE;YACjE,kEAAkE;YAClE,uDAAuD;YACvD,MAAM,WAAW,GAAG,SAAS,KAAK,CAAC,CAAC;YACpC,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CACtB,oBAAoB,EACpB;gBACE,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,EACD;gBACE,KAAK,EAAE;oBACL,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB;aACF,CACF,CAAC;YACF,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE;gBAC/C,MAAM,EAAE,SAAS;gBACjB,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAED,OAAO,YAAY,CACjB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAC3B;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE;SACxC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAe,EACf,GAAc;IAEd,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,EAAE,CAAC;IAElC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK;QACtB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YACjC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;SACpC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,IAAI;QAC3B,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;aACT,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE;QAC7D,gBAAgB;KACjB,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAe,EACf,GAAc;IAEd,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,YAAY,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,GAAG,CAAC,EAAE,EACN,GAAG,CAAC,OAAO,EACX,OAAiC,CAClC,CAAC;QACF,MAAM,GAAG,CAAC,EAAE;aACT,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,mBAAmB,EAAE,CAAC;aAC9C,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAoB,CACjD,GAAG,EACH,GAAG,EACH,QAAQ,CAAC,UAAU,CAAC,MAAM,CAC3B,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE;gBAC/C,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,YAAY,CACjB,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,EACtC;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE;SACxC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAe;IACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,EAAE,CAAC;QACV,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC;QACxC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QACpC,QAAQ,EAAE,KAAK;QACf,6EAA6E;QAC7E,iCAAiC;QACjC,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC;KACtC,CAAC,CAAC;IACH,+DAA+D;IAC/D,oEAAoE;IACpE,oEAAoE;IACpE,gEAAgE;IAChE,oBAAoB;IACpB,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,YAAY,CACjB,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EACxB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,gEAAgE;AAChE,6BAA6B;AAC7B,SAAS,kBAAkB,CAAC,KAAgC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,cAAc,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,EAAE;AACF,kBAAkB;AAClB,0EAA0E;AAC1E,8DAA8D;AAC9D,yEAAyE;AACzE,8CAA8C;AAC9C,2EAA2E;AAC3E,kDAAkD;AAClD,wEAAwE;AACxE,yEAAyE;AACzE,wCAAwC;AACxC,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAE3E,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,iBAAiB;IACxB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;CACjE,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,iBAAiB;IACxB,QAAQ,EAAE,sBAAsB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,GAAe,EACf,GAAc;IAEd,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAExB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE;QAC3D,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,eAAe,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;KACpE,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;QAClB,OAAO;QACP,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;KACjE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAe,EACf,GAAc;IAEd,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,GAAG,CAAC,EAAE,EACN,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,QAAQ,CACf,CAAC;QACF,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAC5D,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE;YACjD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,qBAAqB;SAC9C,CAAC,CAAC;QACH,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,gEAAgE;QAChE,mEAAmE;QACnE,gEAAgE;QAChE,yDAAyD;QACzD,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CACtB,oBAAoB,EACpB;YACE,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,EACD;YACE,KAAK,EAAE;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB;SACF,CACF,CAAC;QACF,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CACjB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EACnB;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE;SACxC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW;YAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAe,EACf,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,mBAAmB,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CACvC,WAAW,EACX,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAChC,CAAC;IACF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAkB;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1D,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,0EAA0E;AAC1E,6EAA6E;AAC7E,SAAS,eAAe,CACtB,SAA6B,EAC7B,YAA2B,EAC3B,KAAa;IAEb,MAAM,OAAO,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/auth/passkey/types.d.ts

@@ -0,0 +1,59 @@
+import type { CredentialTransport } from "../../db/schema/credentials.js";
+interface PublicKeyCredentialDescriptor {
+    readonly type: "public-key";
+    readonly id: string;
+    readonly transports?: readonly CredentialTransport[];
+}
+export interface RegistrationOptions {
+    readonly challenge: string;
+    readonly rp: {
+        readonly name: string;
+        readonly id: string;
+    };
+    readonly user: {
+        readonly id: string;
+        readonly name: string;
+        readonly displayName: string;
+    };
+    readonly pubKeyCredParams: readonly {
+        readonly type: "public-key";
+        readonly alg: number;
+    }[];
+    readonly timeout?: number;
+    readonly attestation: "none";
+    readonly authenticatorSelection?: {
+        readonly residentKey?: "discouraged" | "preferred" | "required";
+        readonly userVerification?: "discouraged" | "preferred" | "required";
+    };
+    readonly excludeCredentials?: readonly PublicKeyCredentialDescriptor[];
+}
+export interface AuthenticationOptions {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly timeout?: number;
+    readonly userVerification?: "discouraged" | "preferred" | "required";
+    readonly allowCredentials?: readonly PublicKeyCredentialDescriptor[];
+}
+export interface RegistrationResponse {
+    readonly id: string;
+    readonly rawId: string;
+    readonly type: "public-key";
+    readonly response: {
+        readonly clientDataJSON: string;
+        readonly attestationObject: string;
+        readonly transports?: readonly CredentialTransport[];
+    };
+}
+export interface AuthenticationResponse {
+    readonly id: string;
+    readonly rawId: string;
+    readonly type: "public-key";
+    readonly response: {
+        readonly clientDataJSON: string;
+        readonly authenticatorData: string;
+        readonly signature: string;
+        readonly userHandle?: string;
+    };
+}
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/passkey/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/passkey/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAM1E,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,gBAAgB,EAAE,SAAS;QAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,EAAE,CAAC;IACJ,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,CAAC,EAAE;QAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;QAChE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;KACtE,CAAC;IACF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;CACxE;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;IACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;CACtE;AAKD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;KACtD,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH"}

package/dist/auth/passkey/types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=types.js.map

package/dist/auth/passkey/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/passkey/types.ts"],"names":[],"mappings":""}

package/dist/auth/preview-token.d.ts

@@ -0,0 +1,21 @@
+import type { Db } from "../context/app.js";
+/** A verified preview grant: which entry it reveals, and which user minted it
+ *  (so the render can overlay that user's autosave). */
+export interface PreviewGrant {
+    readonly entryId: number;
+    readonly userId: number;
+}
+export declare function createPreviewToken(db: Db, args: {
+    readonly entryId: number;
+    readonly userId: number;
+}): Promise<string>;
+/**
+ * Resolve a raw preview token to the grant it carries (entry id + minting
+ * user), or null when the token is missing, the wrong type, expired, or
+ * malformed. Does not consume the token — preview links stay valid until
+ * they expire.
+ */
+export declare function verifyPreviewGrant(db: Db, rawToken: string): Promise<PreviewGrant | null>;
+/** The entry id a token grants draft visibility for, or null. */
+export declare function verifyPreviewToken(db: Db, rawToken: string): Promise<number | null>;
+//# sourceMappingURL=preview-token.d.ts.map

package/dist/auth/preview-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-token.d.ts","sourceRoot":"","sources":["../../src/auth/preview-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAe5C;wDACwD;AACxD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS9B;AAED,iEAAiE;AACjE,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB"}

package/dist/auth/preview-token.js

@@ -0,0 +1,43 @@
+import { and, eq } from "../db/index.js";
+import { authTokens } from "../db/schema/auth_tokens.js";
+import { generateToken, hashToken } from "./tokens.js";
+// Preview links are meant to outlive a single review sitting but not
+// linger indefinitely; entry-scoped + expiring is the whole security
+// model. Reusable until expiry (unlike single-use magic links) so a
+// reviewer can refresh and re-share.
+const PREVIEW_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export async function createPreviewToken(db, args) {
+    const token = generateToken();
+    const hash = await hashToken(token);
+    await db.insert(authTokens).values({
+        hash,
+        userId: args.userId,
+        type: "preview_link",
+        payload: { entryId: args.entryId },
+        expiresAt: new Date(Date.now() + PREVIEW_TOKEN_TTL_MS),
+    });
+    return token;
+}
+/**
+ * Resolve a raw preview token to the grant it carries (entry id + minting
+ * user), or null when the token is missing, the wrong type, expired, or
+ * malformed. Does not consume the token — preview links stay valid until
+ * they expire.
+ */
+export async function verifyPreviewGrant(db, rawToken) {
+    const hash = await hashToken(rawToken);
+    const row = await db.query.authTokens.findFirst({
+        where: and(eq(authTokens.hash, hash), eq(authTokens.type, "preview_link")),
+    });
+    if (!row || row.expiresAt.getTime() < Date.now())
+        return null;
+    const entryId = row.payload?.entryId;
+    if (typeof entryId !== "number" || row.userId === null)
+        return null;
+    return { entryId, userId: row.userId };
+}
+/** The entry id a token grants draft visibility for, or null. */
+export async function verifyPreviewToken(db, rawToken) {
+    return (await verifyPreviewGrant(db, rawToken))?.entryId ?? null;
+}
+//# sourceMappingURL=preview-token.js.map

package/dist/auth/preview-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-token.js","sourceRoot":"","sources":["../../src/auth/preview-token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvD,qEAAqE;AACrE,qEAAqE;AACrE,oEAAoE;AACpE,qCAAqC;AACrC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAarD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,IAA2D;IAE3D,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACjC,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAA2B;QAC3D,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;KACvD,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9C,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;KAC3E,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,OAAO,GAAI,GAAG,CAAC,OAAiC,EAAE,OAAO,CAAC;IAChE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,QAAgB;IAEhB,OAAO,CAAC,MAAM,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;AACnE,CAAC"}