@pwfabric/cli 0.0.0-stage → 1.0.0-rc.0

package/dist/host/local-host.js

@@ -0,0 +1,420 @@
+/**
+ * The local host — the session protocol and the data protocol, in process,
+ * for development.
+ *
+ * NOT A PRODUCTION SERVER. Records live in memory and vanish on restart; the
+ * one development user signs in without a password; the issuer stand-in mints
+ * unsigned ID tokens; there is no rate limit, no CORS, no TLS. It exists so an
+ * app that declares data and sign-in runs on a laptop with no hosted service,
+ * and so the runner's sign-in wall, account control, gate and data paths are
+ * exercised against the same addresses and answers a session server gives.
+ *
+ * Everything is mounted under `prefix` (e.g. `/_host`); `<base>` below is
+ * `<origin><prefix>`, which is also the app's own API base the runner derives
+ * from `loginUrl` (session-protocol §2).
+ *
+ *   App door (session-protocol §4, §8)
+ *     POST <base>/login, <base>/register   any credentials → the development user
+ *     POST <base>/logout                   revokes the presented token
+ *     GET  <base>/session                  the principal behind the token
+ *     GET  <base>/_auth/start/<method>     provider sign-in, through the same redirects
+ *     GET  <base>/_auth/callback/<method>  …ends here: HttpOnly cookie, back to returnTo
+ *     GET  <base>/_auth/session            the cookie's session (needs x-pwapp-request: 1)
+ *     POST <base>/_auth/logout             deletes the cookie (needs x-pwapp-request: 1)
+ *   External issuer stand-in (session-protocol §3) — see ./oidc.ts
+ *     GET  <base>/oidc/.well-known/openid-configuration, GET <base>/oidc/authorize,
+ *     POST <base>/oidc/token
+ *   Records (data-protocol §5) — see ./records.ts
+ *     GET|POST <base>/records/<T>, GET <base>/records/<T>/count, GET <base>/records/<T>/aggregate,
+ *     GET|PATCH|DELETE <base>/records/<T>/<id>
+ *   Pages
+ *     GET  <base>/surfaces/<key>.receipt.json   the receipt, entity sources rewritten to <base>,
+ *                                               refused without a session when sign-in is required
+ *
+ * Every credential is accepted on `x-app-session` or `Authorization: Bearer`.
+ * Tokens are opaque and random, kept only as hashes, and never logged.
+ */
+import { HostError, cookiesOf, credentialOf, readJsonObject, redirect, safeReturnTo, sendError, sendJson, } from './http.js';
+import { readAuth, readEntities, readReceipt, surfaceKeys, } from './definitions.js';
+import { RecordStore } from './records.js';
+import { rewriteEntitySources } from './receipts.js';
+import { DevIssuer } from './oidc.js';
+import { TokenStore } from './tokens.js';
+export const DEFAULT_DEV_USER = { id: 'dev-user', name: 'Developer', email: 'dev@localhost' };
+/** The cookie the provider round trip leaves on the app's origin. */
+export const SESSION_COOKIE = 'pwf_dev_session';
+const SESSION_TTL_MS = 8 * 3600_000;
+const TRANSACTION_TTL_MS = 5 * 60_000;
+/** The provider buttons a session server can name (envelope `auth.json` `providers[].method`). */
+const PROVIDER_METHODS = new Set(['host', 'google', 'github', 'microsoft']);
+function normalisePrefix(prefix) {
+    const trimmed = prefix.replace(/^\/+|\/+$/g, '');
+    if (!trimmed)
+        throw new Error('createLocalHost: prefix must name a path, e.g. "/_host"');
+    return `/${trimmed}`;
+}
+function providersOf(auth) {
+    return auth.methods.filter((m) => PROVIDER_METHODS.has(m));
+}
+/**
+ * The envelope `auth.json` for this declaration, pointed at `base` — the
+ * same shape a publisher writes (session-protocol §2), or `undefined` when the
+ * app has no way in.
+ *
+ *  - `external`: `oauth2-pkce` against the local issuer stand-in, keeping the
+ *    declared client id, scopes (plus `offline_access`, which is what makes a
+ *    refresh token exist) and audience.
+ *  - `app`: the password door when `password` is declared; the provider
+ *    buttons and the start address for every declared provider method; the
+ *    gateway's session and logout addresses for either; `methods` as declared.
+ */
+export function authAddresses(auth, base) {
+    if (!auth)
+        return undefined;
+    if (auth.topology === 'external') {
+        if (!auth.issuer)
+            return undefined;
+        const scopes = auth.issuer.scopes.includes('offline_access')
+            ? [...auth.issuer.scopes]
+            : [...auth.issuer.scopes, 'offline_access'];
+        return {
+            provider: 'oauth2-pkce',
+            issuer: `${base}/oidc`,
+            clientId: auth.issuer.clientId,
+            scopes,
+            ...(auth.issuer.audience ? { audience: auth.issuer.audience } : {}),
+        };
+    }
+    const door = {};
+    if (auth.methods.includes('password')) {
+        door.provider = 'password';
+        door.loginUrl = `${base}/login`;
+        door.registerUrl = `${base}/register`;
+        door.logoutUrl = `${base}/logout`;
+        door.sessionUrl = `${base}/session`;
+    }
+    const providers = providersOf(auth);
+    if (providers.length > 0) {
+        door.provider = door.provider ?? 'platform';
+        door.providers = providers.map((method) => ({ method }));
+        door.startUrl = `${base}/_auth/start`;
+        door.gatewaySessionUrl = `${base}/_auth/session`;
+        door.gatewayLogoutUrl = `${base}/_auth/logout`;
+    }
+    if (Object.keys(door).length === 0)
+        return undefined;
+    // The runner asks the gateway on every app door, not only a provider one:
+    // for a stored-nothing session on boot, and on every sign-out (it falls back
+    // to `/_auth/session` and `/_auth/logout` at the page's origin, which on
+    // `pwf dev` are not the host's). The host answers both under its base.
+    door.gatewaySessionUrl ??= `${base}/_auth/session`;
+    door.gatewayLogoutUrl ??= `${base}/_auth/logout`;
+    door.methods = [...auth.methods];
+    return door;
+}
+function segments(rest) {
+    try {
+        return rest.split('/').filter(Boolean).map((s) => decodeURIComponent(s));
+    }
+    catch {
+        throw new HostError(400, 'INVALID_PATH', 'The path is not valid percent-encoding.');
+    }
+}
+function methodNotAllowed() {
+    throw new HostError(405, 'METHOD_NOT_ALLOWED', 'This route does not take that method.');
+}
+function notFound() {
+    throw new HostError(404, 'NOT_FOUND', 'No such route on the local host.');
+}
+export const createLocalHost = (options) => {
+    const root = options.root;
+    const prefix = normalisePrefix(options.prefix);
+    const user = {
+        id: options.user?.id ?? DEFAULT_DEV_USER.id,
+        email: options.user?.email ?? DEFAULT_DEV_USER.email,
+        displayName: options.user?.name ?? DEFAULT_DEV_USER.name,
+    };
+    const bearer = new TokenStore();
+    const transactions = new TokenStore();
+    const records = new RecordStore(root, user);
+    const issuer = new DevIssuer(bearer, user);
+    const originOf = (req) => `http://${req.headers.host ?? 'localhost'}`;
+    const principalOf = (req) => bearer.get(credentialOf(req))?.principal;
+    function startSession() {
+        const expiresAt = Date.now() + SESSION_TTL_MS;
+        const token = bearer.issue({ principal: user, kind: 'session', expiresAt });
+        return { token, expiresAt: new Date(expiresAt).toISOString(), principal: user };
+    }
+    const sessionCookie = (token, maxAgeS) => `${SESSION_COOKIE}=${encodeURIComponent(token)}; Path=${prefix}/_auth; HttpOnly; SameSite=Lax; Max-Age=${maxAgeS}`;
+    function requireRunnerRequest(req) {
+        if (req.headers['x-pwapp-request'] !== '1') {
+            throw new HostError(403, 'RUNNER_REQUEST_REQUIRED', 'This address answers only the runner (x-pwapp-request: 1).');
+        }
+    }
+    // ---------------------------------------------------------------- app door
+    async function door(req, res, action) {
+        const auth = readAuth(root);
+        if (action === 'session') {
+            if (req.method !== 'GET')
+                methodNotAllowed();
+            const presented = credentialOf(req);
+            const grant = bearer.get(presented);
+            if (grant) {
+                sendJson(res, 200, { data: { principal: grant.principal } });
+                return;
+            }
+            if (presented !== undefined || auth?.required) {
+                throw new HostError(401, 'SIGN_IN_REQUIRED', 'No live session.');
+            }
+            sendJson(res, 200, { data: { principal: null } });
+            return;
+        }
+        if (req.method !== 'POST')
+            methodNotAllowed();
+        if (action === 'logout') {
+            bearer.revoke(credentialOf(req));
+            sendJson(res, 200, { data: { signedOut: true } });
+            return;
+        }
+        // login / register: the credentials are read (and must be JSON) but not
+        // checked — the development user has no password.
+        await readJsonObject(req);
+        if (!auth || auth.topology !== 'app' || !auth.methods.includes('password')) {
+            throw new HostError(404, 'NO_PASSWORD_DOOR', 'This app declares no password sign-in.');
+        }
+        sendJson(res, action === 'register' ? 201 : 200, { data: startSession() });
+    }
+    function gateway(req, res, url, parts) {
+        const [action, method] = parts;
+        if (action === 'start' || action === 'callback') {
+            if (req.method !== 'GET')
+                methodNotAllowed();
+            if (parts.length !== 2 || !method)
+                notFound();
+            if (action === 'start') {
+                const returnTo = safeReturnTo(url.searchParams.get('returnTo'));
+                const auth = readAuth(root);
+                if (!auth || auth.topology !== 'app' || !providersOf(auth).includes(method)) {
+                    redirect(res, withAuthError(returnTo, 'provider_unavailable'));
+                    return;
+                }
+                // The provider's own leg is played by the callback below: the browser
+                // still leaves the app, comes back to the callback, and lands on returnTo.
+                const tx = transactions.issue({ returnTo, method, expiresAt: Date.now() + TRANSACTION_TTL_MS });
+                redirect(res, `${prefix}/_auth/callback/${encodeURIComponent(method)}?tx=${encodeURIComponent(tx)}`);
+                return;
+            }
+            const tx = transactions.take(url.searchParams.get('tx') ?? undefined);
+            if (!tx || tx.method !== method) {
+                redirect(res, withAuthError('/', 'invalid_transaction'));
+                return;
+            }
+            const session = startSession();
+            redirect(res, tx.returnTo, [sessionCookie(session.token, SESSION_TTL_MS / 1000)]);
+            return;
+        }
+        if (parts.length !== 1)
+            notFound();
+        if (action === 'session') {
+            if (req.method !== 'GET')
+                methodNotAllowed();
+            requireRunnerRequest(req);
+            const token = cookiesOf(req)[SESSION_COOKIE];
+            const grant = bearer.get(token);
+            if (!token || !grant || grant.kind !== 'session') {
+                throw new HostError(401, 'SIGN_IN_REQUIRED', 'No session cookie.');
+            }
+            sendJson(res, 200, {
+                data: { token, expiresAt: new Date(grant.expiresAt).toISOString(), principal: grant.principal },
+            });
+            return;
+        }
+        if (action === 'logout') {
+            if (req.method !== 'POST')
+                methodNotAllowed();
+            requireRunnerRequest(req);
+            bearer.revoke(cookiesOf(req)[SESSION_COOKIE]);
+            sendJson(res, 200, { data: { signedOut: true } }, { 'set-cookie': sessionCookie('', 0) });
+            return;
+        }
+        notFound();
+    }
+    // ------------------------------------------------------------------ issuer
+    async function oidc(req, res, url, parts) {
+        const auth = readAuth(root);
+        if (!auth || auth.topology !== 'external' || !auth.issuer) {
+            throw new HostError(404, 'NO_ISSUER', 'This app declares no external issuer.');
+        }
+        const iss = DevIssuer.issuerUrl(originOf(req), prefix);
+        const route = parts.join('/');
+        if (route === '.well-known/openid-configuration') {
+            if (req.method !== 'GET')
+                methodNotAllowed();
+            issuer.discovery(res, iss);
+            return;
+        }
+        if (route === 'authorize') {
+            if (req.method !== 'GET')
+                methodNotAllowed();
+            issuer.authorize(req, res, url, auth);
+            return;
+        }
+        if (route === 'token') {
+            if (req.method !== 'POST')
+                methodNotAllowed();
+            await issuer.token(req, res, iss, auth);
+            return;
+        }
+        notFound();
+    }
+    // ----------------------------------------------------------------- records
+    function entityOf(typeId) {
+        const entity = readEntities(root).find((e) => e.typeId === typeId);
+        if (!entity)
+            throw new HostError(404, 'UNKNOWN_ENTITY_TYPE', `The app declares no entity type "${typeId}".`);
+        return entity;
+    }
+    async function data(req, res, url, parts) {
+        const [typeId, second] = parts;
+        if (!typeId || parts.length > 2)
+            notFound();
+        const target = { entity: entityOf(typeId), auth: readAuth(root), caller: { principal: principalOf(req) } };
+        const params = url.searchParams;
+        if (second === undefined) {
+            if (req.method === 'GET') {
+                sendJson(res, 200, records.list(target, params));
+                return;
+            }
+            if (req.method === 'POST') {
+                const record = records.create(target, await readJsonObject(req));
+                sendJson(res, 201, { id: record.id, data: record });
+                return;
+            }
+            methodNotAllowed();
+        }
+        if (second === 'count' || second === 'aggregate') {
+            if (req.method !== 'GET')
+                methodNotAllowed();
+            sendJson(res, 200, records.aggregate(target, params, second === 'count'));
+            return;
+        }
+        if (req.method === 'GET') {
+            const record = records.read(target, second);
+            sendJson(res, 200, { id: record.id, data: record });
+            return;
+        }
+        if (req.method === 'PATCH') {
+            const record = records.update(target, second, await readJsonObject(req));
+            sendJson(res, 200, { id: record.id, data: record });
+            return;
+        }
+        if (req.method === 'DELETE') {
+            records.remove(target, second);
+            sendJson(res, 200, { data: { id: second, deleted: true } });
+            return;
+        }
+        methodNotAllowed();
+    }
+    // ------------------------------------------------------------------- pages
+    function receiptFor(key, base) {
+        const receipt = readReceipt(root, key);
+        if (!receipt)
+            return undefined;
+        return rewriteEntitySources(receipt, base, new Set(readEntities(root).map((e) => e.typeId)));
+    }
+    function surface(req, res, parts) {
+        if (req.method !== 'GET')
+            methodNotAllowed();
+        const file = parts.length === 1 ? parts[0] : undefined;
+        if (!file || !file.endsWith('.receipt.json'))
+            notFound();
+        if (readAuth(root)?.required && !principalOf(req)) {
+            throw new HostError(401, 'SIGN_IN_REQUIRED', 'Sign in to open this page.');
+        }
+        const receipt = receiptFor(file.slice(0, -'.receipt.json'.length), originOf(req) + prefix);
+        if (!receipt)
+            notFound();
+        sendJson(res, 200, receipt);
+    }
+    // ------------------------------------------------------------------ router
+    async function route(req, res, url, rest) {
+        const [head, ...tail] = segments(rest);
+        switch (head) {
+            case 'login':
+            case 'register':
+            case 'logout':
+            case 'session':
+                if (tail.length > 0)
+                    notFound();
+                return door(req, res, head);
+            case '_auth':
+                return gateway(req, res, url, tail);
+            case 'oidc':
+                return oidc(req, res, url, tail);
+            case 'records':
+                return data(req, res, url, tail);
+            case 'surfaces':
+                return surface(req, res, tail);
+            default:
+                notFound();
+        }
+    }
+    return {
+        envelopeEntries(origin) {
+            const base = origin.replace(/\/+$/, '') + prefix;
+            const out = {};
+            const auth = authAddresses(readAuth(root), base);
+            if (auth)
+                out['auth.json'] = auth;
+            for (const key of surfaceKeys(root)) {
+                const receipt = receiptFor(key, base);
+                if (receipt)
+                    out[`surfaces/${key}.receipt.json`] = receipt;
+            }
+            return out;
+        },
+        async handle(req, res) {
+            let url;
+            try {
+                url = new URL(req.url ?? '/', 'http://localhost');
+            }
+            catch {
+                return false;
+            }
+            const path = url.pathname;
+            if (path !== prefix && !path.startsWith(`${prefix}/`))
+                return false;
+            try {
+                await route(req, res, url, path.slice(prefix.length));
+            }
+            catch (err) {
+                if (res.headersSent) {
+                    res.end();
+                }
+                else if (err instanceof HostError) {
+                    sendError(res, err);
+                }
+                else {
+                    // A broken definition file is the developer's to fix; say which.
+                    sendError(res, new HostError(500, 'HOST_ERROR', err instanceof Error ? err.message : String(err)));
+                }
+            }
+            return true;
+        },
+        reset() {
+            records.reset();
+            bearer.clear();
+            transactions.clear();
+            issuer.reset();
+        },
+    };
+};
+function withAuthError(returnTo, code) {
+    const [path, hash] = splitHash(returnTo);
+    return `${path}${path.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}${hash}`;
+}
+function splitHash(value) {
+    const at = value.indexOf('#');
+    return at === -1 ? [value, ''] : [value.slice(0, at), value.slice(at)];
+}
+//# sourceMappingURL=local-host.js.map

package/dist/host/local-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-host.js","sourceRoot":"","sources":["../../src/host/local-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,QAAQ,GACT,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,WAAW,GAGZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAe,MAAM,cAAc,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,SAAS,EAAc,MAAM,WAAW,CAAA;AACjD,OAAO,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAA;AAGxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAW,CAAA;AAEtG,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAE/C,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAA;AACnC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAA;AAErC,kGAAkG;AAClG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;AAE3E,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IAChD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IACxF,OAAO,IAAI,OAAO,EAAE,CAAA;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,IAAqB;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,IAAiC,EAAE,IAAY;IAC3E,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC1D,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;QAC7C,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,MAAM,EAAE,GAAG,IAAI,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAA;QAC1B,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,QAAQ,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,GAAG,IAAI,WAAW,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,GAAG,IAAI,SAAS,CAAA;QACjC,IAAI,CAAC,UAAU,GAAG,GAAG,IAAI,UAAU,CAAA;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAA;QAC3C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,cAAc,CAAA;QACrC,IAAI,CAAC,iBAAiB,GAAG,GAAG,IAAI,gBAAgB,CAAA;QAChD,IAAI,CAAC,gBAAgB,GAAG,GAAG,IAAI,eAAe,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACpD,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,CAAC,iBAAiB,KAAK,GAAG,IAAI,gBAAgB,CAAA;IAClD,IAAI,CAAC,gBAAgB,KAAK,GAAG,IAAI,eAAe,CAAA;IAChD,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,yCAAyC,CAAC,CAAA;IACrF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,kCAAkC,CAAC,CAAA;AAC3E,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,OAAyB,EAAa,EAAE;IACvF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAc;QACtB,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,gBAAgB,CAAC,EAAE;QAC3C,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,gBAAgB,CAAC,KAAK;QACpD,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC,IAAI;KACzD,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,EAAS,CAAA;IACtC,MAAM,YAAY,GAAG,IAAI,UAAU,EAAsF,CAAA;IACzH,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE1C,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAU,EAAE,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAA;IAE9F,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAyB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAA;IAE7G,SAAS,YAAY;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAA;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;QAC3E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IACjF,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,OAAe,EAAU,EAAE,CAC/D,GAAG,cAAc,IAAI,kBAAkB,CAAC,KAAK,CAAC,UAAU,MAAM,2CAA2C,OAAO,EAAE,CAAA;IAEpH,SAAS,oBAAoB,CAAC,GAAoB;QAChD,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,4DAA4D,CAAC,CAAA;QACnH,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,KAAK,UAAU,IAAI,CAAC,GAAoB,EAAE,GAAmB,EAAE,MAAc;QAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,gBAAgB,EAAE,CAAA;YAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACnC,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;gBAC5D,OAAM;YACR,CAAC;YACD,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAA;YAClE,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;YACjD,OAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,gBAAgB,EAAE,CAAA;QAC7C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;YAChC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;YACjD,OAAM;QACR,CAAC;QACD,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,wCAAwC,CAAC,CAAA;QACxF,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,SAAS,OAAO,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ,EAAE,KAAe;QACnF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;QAC9B,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAChD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,gBAAgB,EAAE,CAAA;YAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM;gBAAE,QAAQ,EAAE,CAAA;YAC7C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;gBAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;gBAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5E,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAA;oBAC9D,OAAM;gBACR,CAAC;gBACD,sEAAsE;gBACtE,2EAA2E;gBAC3E,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,EAAE,CAAC,CAAA;gBAC/F,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,mBAAmB,kBAAkB,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;gBACpG,OAAM;YACR,CAAC;YACD,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAA;YACrE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAA;gBACxD,OAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,EAAE,CAAA;YAC9B,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACjF,OAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,EAAE,CAAA;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,gBAAgB,EAAE,CAAA;YAC5C,oBAAoB,CAAC,GAAG,CAAC,CAAA;YACzB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAA;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;YACpE,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;aAChG,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,gBAAgB,EAAE,CAAA;YAC7C,oBAAoB,CAAC,GAAG,CAAC,CAAA;YACzB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAA;YAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;YACzF,OAAM;QACR,CAAC;QACD,QAAQ,EAAE,CAAA;IACZ,CAAC;IAED,4EAA4E;IAE5E,KAAK,UAAU,IAAI,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ,EAAE,KAAe;QACtF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,uCAAuC,CAAC,CAAA;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,KAAK,KAAK,kCAAkC,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,gBAAgB,EAAE,CAAA;YAC5C,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC1B,OAAM;QACR,CAAC;QACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,gBAAgB,EAAE,CAAA;YAC5C,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACrC,OAAM;QACR,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,gBAAgB,EAAE,CAAA;YAC7C,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACvC,OAAM;QACR,CAAC;QACD,QAAQ,EAAE,CAAA;IACZ,CAAC;IAED,4EAA4E;IAE5E,SAAS,QAAQ,CAAC,MAAc;QAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QAClE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,oCAAoC,MAAM,IAAI,CAAC,CAAA;QAC5G,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ,EAAE,KAAe;QACtF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;QAC9B,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,EAAE,CAAA;QAC3C,MAAM,MAAM,GAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;QAClH,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAA;QAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;gBAChD,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YACD,gBAAgB,EAAE,CAAA;QACpB,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,gBAAgB,EAAE,CAAA;YAC5C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAA;YACzE,OAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC3C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACnD,OAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;YACxE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACnD,OAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;YAC3D,OAAM;QACR,CAAC;QACD,gBAAgB,EAAE,CAAA;IACpB,CAAC;IAED,4EAA4E;IAE5E,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY;QAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,OAAO,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC9F,CAAC;IAED,SAAS,OAAO,CAAC,GAAoB,EAAE,GAAmB,EAAE,KAAe;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,gBAAgB,EAAE,CAAA;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACtD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,QAAQ,EAAE,CAAA;QACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,4BAA4B,CAAC,CAAA;QAC5E,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QAC1F,IAAI,CAAC,OAAO;YAAE,QAAQ,EAAE,CAAA;QACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,4EAA4E;IAE5E,KAAK,UAAU,KAAK,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ,EAAE,IAAY;QACpF,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QACtC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,OAAO,CAAC;YACb,KAAK,UAAU,CAAC;YAChB,KAAK,QAAQ,CAAC;YACd,KAAK,SAAS;gBACZ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,QAAQ,EAAE,CAAA;gBAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC7B,KAAK,OAAO;gBACV,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACrC,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAClC,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAClC,KAAK,UAAU;gBACb,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAChC;gBACE,QAAQ,EAAE,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO;QACL,eAAe,CAAC,MAAc;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAA;YAChD,MAAM,GAAG,GAA4B,EAAE,CAAA;YACvC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;YAChD,IAAI,IAAI;gBAAE,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;YACjC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;gBACrC,IAAI,OAAO;oBAAE,GAAG,CAAC,YAAY,GAAG,eAAe,CAAC,GAAG,OAAO,CAAA;YAC5D,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;YACpD,IAAI,GAAQ,CAAA;YACZ,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAA;YACzB,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAA;YACnE,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,GAAG,CAAC,GAAG,EAAE,CAAA;gBACX,CAAC;qBAAM,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;oBACpC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACrB,CAAC;qBAAM,CAAC;oBACN,iEAAiE;oBACjE,SAAS,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACpG,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAA;YACf,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,YAAY,CAAC,KAAK,EAAE,CAAA;YACpB,MAAM,CAAC,KAAK,EAAE,CAAA;QAChB,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACxC,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAA;AAChG,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;AACxE,CAAC"}

package/dist/host/oidc.d.ts

@@ -0,0 +1,47 @@
+/**
+ * A development stand-in for an external OpenID Connect issuer.
+ *
+ * When `auth.json` declares `topology: "external"`, the app's real issuer
+ * cannot be reached from a laptop without registering a redirect URI for
+ * every port `pwf dev` picks. The local host therefore plays that issuer, at
+ * `<prefix>/oidc`, with just enough of the protocol for the runner's PKCE
+ * client (session-protocol §3):
+ *
+ *   GET  <prefix>/oidc/.well-known/openid-configuration   discovery
+ *   GET  <prefix>/oidc/authorize                           code + PKCE (S256), no consent screen:
+ *                                                          the development user is signed in at once
+ *   POST <prefix>/oidc/token                               authorization_code, refresh_token
+ *                                                          (and refresh_token + scope "<audience>/.default"
+ *                                                          for the door token)
+ *
+ * The declared `clientId`, scopes and audience are kept; only the issuer
+ * address changes. Tokens are opaque; the ID token is an UNSIGNED JWT
+ * (`alg: none`), which the runner decodes and does not verify. No real
+ * issuer's keys are ever involved, and nothing here is safe to expose beyond
+ * the developer's own machine.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AuthDeclaration } from './definitions.js';
+import { TokenStore, type Principal } from './tokens.js';
+/** What a bearer credential stands for, whichever door minted it. */
+export interface Grant {
+    readonly principal: Principal;
+    readonly expiresAt: number;
+    readonly kind: 'session' | 'access' | 'door';
+}
+export declare const ACCESS_TTL_S = 3600;
+export declare class DevIssuer {
+    private readonly bearer;
+    private readonly user;
+    private readonly codes;
+    private readonly refresh;
+    constructor(bearer: TokenStore<Grant>, user: Principal);
+    reset(): void;
+    /** `<origin><prefix>/oidc` — the `iss` this issuer speaks for. */
+    static issuerUrl(origin: string, prefix: string): string;
+    discovery(res: ServerResponse, issuer: string): void;
+    authorize(req: IncomingMessage, res: ServerResponse, url: URL, auth: AuthDeclaration): void;
+    token(req: IncomingMessage, res: ServerResponse, issuer: string, auth: AuthDeclaration): Promise<void>;
+    private mint;
+}
+//# sourceMappingURL=oidc.d.ts.map

package/dist/host/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../src/host/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAA;AAExD,qEAAqE;AACrE,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;CAC7C;AAkBD,eAAO,MAAM,YAAY,OAAO,CAAA;AAUhC,qBAAa,SAAS;IAKlB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;gBAGtC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EACzB,IAAI,EAAE,SAAS;IAGlC,KAAK,IAAI,IAAI;IAKb,kEAAkE;IAClE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAIxD,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAcpD,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI;IA2CrF,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAgD5G,OAAO,CAAC,IAAI;CA6Cb"}