@raybase/api 0.0.2 → 0.1.1

package/dist/auth.js

@@ -0,0 +1,377 @@
+import { actorAuditRef, authUserTableName, nowIso, q, randomId, recordAudit } from "@raybase/core";
+import { ApiHttpError } from "./errors.js";
+import { apiKeyEventsTableName, apiKeysTableName, apiServicePrincipalsTableName } from "./system-tables.js";
+import { extractApiKeyLookupPrefix, generateApiKey, validateApiKeySecret, verifyApiKeyHash } from "./crypto.js";
+import { sha256Hex } from "@raybase/core/internal";
+export function apiKeySecret(env) {
+    return validateApiKeySecret(env.RAYBASE_API_KEY_SECRET);
+}
+export async function authenticateApiRequest(ctx, input) {
+    const token = bearerToken(ctx.request);
+    if (!token)
+        throw new ApiHttpError(401, "authentication_required", "Provide an API key as a bearer token.");
+    const prefix = extractApiKeyLookupPrefix(token);
+    if (!prefix)
+        throw new ApiHttpError(401, "invalid_api_key", "API key is invalid.");
+    const row = await ctx.control.first(`SELECT * FROM ${q(apiKeysTableName)} WHERE "prefix" = ?`, [prefix]);
+    if (!row)
+        throw new ApiHttpError(401, "invalid_api_key", "API key is invalid.");
+    const secret = apiKeySecret(ctx.env);
+    if (!(await verifyApiKeyHash(token, row.hash, secret))) {
+        await recordApiKeyEvent(ctx.control, {
+            keyId: row.id,
+            servicePrincipalId: row.servicePrincipalId,
+            ownerUserId: row.ownerUserId,
+            event: "auth.invalid_hash",
+            requestId: input.requestId,
+            metadata: { operationName: input.operationName, route: input.route }
+        });
+        throw new ApiHttpError(401, "invalid_api_key", "API key is invalid.");
+    }
+    const now = nowIso();
+    if (row.revokedAt)
+        throw new ApiHttpError(401, "invalid_api_key", "API key has been revoked.");
+    if (row.expiresAt && row.expiresAt <= now)
+        throw new ApiHttpError(401, "invalid_api_key", "API key has expired.");
+    const servicePrincipal = await ctx.control.first(`SELECT * FROM ${q(apiServicePrincipalsTableName)} WHERE "id" = ?`, [row.servicePrincipalId]);
+    if (!servicePrincipal || servicePrincipal.disabledAt) {
+        throw new ApiHttpError(401, "invalid_api_key", "API service principal is disabled.");
+    }
+    const user = await resolveUser(ctx.control, row.ownerUserId);
+    if (!user || user.disabled)
+        throw new ApiHttpError(401, "invalid_api_key", "API key owner is disabled.");
+    const scopes = parseScopes(row.scopesJson);
+    const missingScopes = input.scopes.filter((scope) => !scopes.includes(scope));
+    if (missingScopes.length) {
+        await recordApiKeyEvent(ctx.control, {
+            keyId: row.id,
+            servicePrincipalId: row.servicePrincipalId,
+            ownerUserId: row.ownerUserId,
+            event: "auth.invalid_scope",
+            requestId: input.requestId,
+            metadata: { operationName: input.operationName, route: input.route, missingScopes }
+        });
+        throw new ApiHttpError(403, "invalid_scope", "API key does not include the required scope.");
+    }
+    await updateApiKeyLastUsed(ctx.control, ctx.request, row.id);
+    return { key: row, servicePrincipal, user, scopes };
+}
+export async function listApiKeys(control) {
+    const rows = await control.all(`SELECT * FROM ${q(apiKeysTableName)} ORDER BY "createdAt" DESC LIMIT 500`);
+    return rows.map(summarizeApiKey);
+}
+export async function createApiKey(ctx, input, options = {}) {
+    const actor = ctx.requireAdmin();
+    const name = asNonEmptyString(input.name, "name");
+    const ownerUserId = asNonEmptyString(input.ownerUserId, "ownerUserId");
+    const owner = await resolveUser(ctx.control, ownerUserId);
+    if (!owner || owner.disabled)
+        throw new ApiHttpError(400, "invalid_request", "ownerUserId must reference an active Raybase user.");
+    const now = nowIso();
+    const scopes = normalizeScopes(input.scopes);
+    const expiresAt = normalizeExpiry(input.expiresAt, options, now);
+    const servicePrincipal = input.servicePrincipalId
+        ? await requireServicePrincipal(ctx.control, String(input.servicePrincipalId), ownerUserId)
+        : await createServicePrincipal(ctx.control, {
+            ownerUserId,
+            label: typeof input.principalLabel === "string" && input.principalLabel.trim() ? input.principalLabel.trim() : name,
+            description: typeof input.description === "string" ? input.description : null,
+            defaultScopes: scopes,
+            createdBy: actor.id,
+            now
+        });
+    const material = await generateApiKey({ secret: apiKeySecret(ctx.env), tokenPrefix: options.prefix });
+    const row = {
+        id: randomId("api_key"),
+        name,
+        description: typeof input.description === "string" && input.description.trim() ? input.description.trim() : null,
+        servicePrincipalId: servicePrincipal.id,
+        ownerUserId,
+        principalLabel: servicePrincipal.label,
+        prefix: material.prefix,
+        hash: material.hash,
+        scopesJson: JSON.stringify(scopes),
+        expiresAt,
+        revokedAt: null,
+        revokedBy: null,
+        revokedReason: null,
+        createdBy: actor.id,
+        createdAt: now,
+        rotatedAt: null,
+        lastUsedAt: null,
+        lastUsedIpHash: null,
+        lastUsedUserAgent: null
+    };
+    await insertApiKey(ctx.control, row);
+    await recordApiKeyEvent(ctx.control, {
+        keyId: row.id,
+        servicePrincipalId: row.servicePrincipalId,
+        ownerUserId: row.ownerUserId,
+        event: "key.created",
+        actorUserId: actor.id,
+        metadata: { scopes, expiresAt }
+    });
+    await recordAudit(ctx.control, {
+        actor: actorAuditRef(actor.id),
+        action: "api.key.created",
+        target: { type: "raybase_api_key", id: row.id },
+        metadata: {
+            servicePrincipalId: row.servicePrincipalId,
+            ownerUserId: row.ownerUserId,
+            scopes,
+            expiresAt
+        }
+    });
+    return { key: summarizeApiKey(row), token: material.token };
+}
+export async function rotateApiKey(ctx, keyId, options = {}) {
+    const actor = ctx.requireAdmin();
+    const existing = await requireApiKey(ctx.control, keyId);
+    if (existing.revokedAt) {
+        throw new ApiHttpError(409, "invalid_request", "Revoked API keys cannot be rotated.");
+    }
+    const material = await generateApiKey({ secret: apiKeySecret(ctx.env), tokenPrefix: options.prefix });
+    const now = nowIso();
+    await ctx.control.run(`UPDATE ${q(apiKeysTableName)}
+     SET "prefix" = ?, "hash" = ?, "rotatedAt" = ?, "revokedAt" = NULL, "revokedBy" = NULL, "revokedReason" = NULL
+     WHERE "id" = ?`, [material.prefix, material.hash, now, keyId]);
+    const next = { ...existing, prefix: material.prefix, hash: material.hash, rotatedAt: now, revokedAt: null, revokedBy: null, revokedReason: null };
+    await recordApiKeyEvent(ctx.control, {
+        keyId,
+        servicePrincipalId: existing.servicePrincipalId,
+        ownerUserId: existing.ownerUserId,
+        event: "key.rotated",
+        actorUserId: actor.id
+    });
+    await recordAudit(ctx.control, {
+        actor: actorAuditRef(actor.id),
+        action: "api.key.rotated",
+        target: { type: "raybase_api_key", id: keyId },
+        metadata: {
+            servicePrincipalId: existing.servicePrincipalId,
+            ownerUserId: existing.ownerUserId
+        }
+    });
+    return { key: summarizeApiKey(next), token: material.token };
+}
+export async function revokeApiKey(ctx, keyId, reason) {
+    const actor = ctx.requireAdmin();
+    const existing = await requireApiKey(ctx.control, keyId);
+    const now = nowIso();
+    const revokedReason = typeof reason === "string" && reason.trim() ? reason.trim() : null;
+    await ctx.control.run(`UPDATE ${q(apiKeysTableName)} SET "revokedAt" = ?, "revokedBy" = ?, "revokedReason" = ? WHERE "id" = ?`, [now, actor.id, revokedReason, keyId]);
+    const next = { ...existing, revokedAt: now, revokedBy: actor.id, revokedReason };
+    await recordApiKeyEvent(ctx.control, {
+        keyId,
+        servicePrincipalId: existing.servicePrincipalId,
+        ownerUserId: existing.ownerUserId,
+        event: "key.revoked",
+        actorUserId: actor.id,
+        metadata: { reason: revokedReason }
+    });
+    await recordAudit(ctx.control, {
+        actor: actorAuditRef(actor.id),
+        action: "api.key.revoked",
+        target: { type: "raybase_api_key", id: keyId },
+        metadata: {
+            servicePrincipalId: existing.servicePrincipalId,
+            ownerUserId: existing.ownerUserId,
+            reason: revokedReason
+        }
+    });
+    return { key: summarizeApiKey(next) };
+}
+export async function deleteApiKey(ctx, keyId) {
+    const actor = ctx.requireAdmin();
+    const existing = await requireApiKey(ctx.control, keyId);
+    await ctx.control.run(`DELETE FROM ${q(apiKeysTableName)} WHERE "id" = ?`, [keyId]);
+    await recordApiKeyEvent(ctx.control, {
+        keyId,
+        servicePrincipalId: existing.servicePrincipalId,
+        ownerUserId: existing.ownerUserId,
+        event: "key.deleted",
+        actorUserId: actor.id
+    });
+    await recordAudit(ctx.control, {
+        actor: actorAuditRef(actor.id),
+        action: "api.key.deleted",
+        target: { type: "raybase_api_key", id: keyId },
+        metadata: {
+            servicePrincipalId: existing.servicePrincipalId,
+            ownerUserId: existing.ownerUserId
+        }
+    });
+    return { ok: true };
+}
+export async function recordApiKeyEvent(control, input) {
+    await control.run(`INSERT INTO ${q(apiKeyEventsTableName)}
+     ("id", "keyId", "servicePrincipalId", "ownerUserId", "event", "actorUserId", "requestId", "metadataJson", "createdAt")
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+        randomId("api_evt"),
+        input.keyId,
+        input.servicePrincipalId ?? null,
+        input.ownerUserId ?? null,
+        input.event,
+        input.actorUserId ?? null,
+        input.requestId ?? null,
+        input.metadata === undefined ? null : JSON.stringify(input.metadata),
+        nowIso()
+    ]).catch(() => undefined);
+}
+export function summarizeApiKey(row) {
+    const { hash: _hash, scopesJson: _scopesJson, ...rest } = row;
+    return { ...rest, scopes: parseScopes(row.scopesJson) };
+}
+function bearerToken(request) {
+    const header = request.headers.get("authorization") ?? "";
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match?.[1]?.trim() || null;
+}
+async function resolveUser(control, id) {
+    const row = await control.first(`SELECT "id", "email", "name", "operatorRole", "appRoles", "banned" FROM ${q(authUserTableName)} WHERE "id" = ?`, [id]);
+    if (!row)
+        return null;
+    return {
+        id: String(row.id),
+        email: String(row.email ?? ""),
+        name: String(row.name ?? row.email ?? row.id),
+        operatorRole: row.operatorRole === "owner" || row.operatorRole === "admin" ? row.operatorRole : null,
+        appRoles: parseRoles(row.appRoles),
+        disabled: Boolean(row.banned)
+    };
+}
+function parseRoles(value) {
+    if (Array.isArray(value))
+        return normalizeStringArray(value).length ? normalizeStringArray(value) : ["user"];
+    if (typeof value !== "string" || !value.trim())
+        return ["user"];
+    try {
+        const parsed = JSON.parse(value);
+        if (Array.isArray(parsed))
+            return normalizeStringArray(parsed).length ? normalizeStringArray(parsed) : ["user"];
+    }
+    catch {
+        return normalizeStringArray(value.split(",")).length ? normalizeStringArray(value.split(",")) : ["user"];
+    }
+    return [value];
+}
+function parseScopes(value) {
+    if (Array.isArray(value))
+        return normalizeStoredScopes(value);
+    if (typeof value !== "string" || !value.trim())
+        throw invalidStoredScopesError();
+    try {
+        return normalizeStoredScopes(JSON.parse(value));
+    }
+    catch {
+        return normalizeStoredScopes(value.split(/[,\s]+/));
+    }
+}
+function normalizeStoredScopes(value) {
+    try {
+        return normalizeScopes(value);
+    }
+    catch {
+        throw invalidStoredScopesError();
+    }
+}
+function invalidStoredScopesError() {
+    return new ApiHttpError(500, "internal_error", "API key scope data is invalid.");
+}
+function normalizeScopes(value) {
+    const scopes = normalizeStringArray(Array.isArray(value) ? value : []);
+    if (!scopes.length)
+        throw new ApiHttpError(400, "invalid_request", "At least one API scope is required.");
+    for (const scope of scopes) {
+        if (!/^[a-z][a-z0-9_.-]{0,63}:(read|write|delete|[a-z][a-z0-9_.-]{0,31})$/.test(scope)) {
+            throw new ApiHttpError(400, "invalid_request", `Invalid API scope: ${scope}`);
+        }
+    }
+    return scopes;
+}
+function normalizeStringArray(value) {
+    return Array.from(new Set(value.map((entry) => String(entry ?? "").trim()).filter(Boolean)));
+}
+function asNonEmptyString(value, field) {
+    if (typeof value !== "string" || !value.trim())
+        throw new ApiHttpError(400, "invalid_request", `${field} is required.`);
+    return value.trim();
+}
+function normalizeExpiry(value, options, now) {
+    const maxExpiryDays = options.maxExpiryDays ?? 365;
+    if (typeof value === "string" && value.trim()) {
+        const parsed = new Date(value);
+        if (Number.isNaN(parsed.getTime()))
+            throw new ApiHttpError(400, "invalid_request", "expiresAt must be an ISO date.");
+        const max = Date.parse(now) + maxExpiryDays * 24 * 60 * 60 * 1000;
+        if (parsed.getTime() > max)
+            throw new ApiHttpError(400, "invalid_request", `expiresAt exceeds the ${maxExpiryDays} day maximum.`);
+        return parsed.toISOString();
+    }
+    const defaultExpiryDays = options.defaultExpiryDays;
+    if (!defaultExpiryDays)
+        return null;
+    const days = Math.min(defaultExpiryDays, maxExpiryDays);
+    return new Date(Date.parse(now) + days * 24 * 60 * 60 * 1000).toISOString();
+}
+async function createServicePrincipal(control, input) {
+    const row = {
+        id: randomId("api_sp"),
+        label: input.label,
+        description: input.description,
+        ownerUserId: input.ownerUserId,
+        defaultScopesJson: JSON.stringify(input.defaultScopes),
+        disabledAt: null,
+        createdBy: input.createdBy,
+        createdAt: input.now,
+        updatedAt: input.now
+    };
+    await control.run(`INSERT INTO ${q(apiServicePrincipalsTableName)}
+     ("id", "label", "description", "ownerUserId", "defaultScopesJson", "disabledAt", "createdBy", "createdAt", "updatedAt")
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [row.id, row.label, row.description, row.ownerUserId, row.defaultScopesJson, row.disabledAt, row.createdBy, row.createdAt, row.updatedAt]);
+    return row;
+}
+async function requireServicePrincipal(control, id, ownerUserId) {
+    const row = await control.first(`SELECT * FROM ${q(apiServicePrincipalsTableName)} WHERE "id" = ?`, [id]);
+    if (!row || row.ownerUserId !== ownerUserId || row.disabledAt) {
+        throw new ApiHttpError(400, "invalid_request", "servicePrincipalId must reference an active API service principal for ownerUserId.");
+    }
+    return row;
+}
+async function requireApiKey(control, keyId) {
+    const row = await control.first(`SELECT * FROM ${q(apiKeysTableName)} WHERE "id" = ?`, [keyId]);
+    if (!row)
+        throw new ApiHttpError(404, "not_found", "API key not found.");
+    return row;
+}
+async function insertApiKey(control, row) {
+    await control.run(`INSERT INTO ${q(apiKeysTableName)}
+     ("id", "name", "description", "servicePrincipalId", "ownerUserId", "principalLabel", "prefix", "hash", "scopesJson", "expiresAt", "revokedAt", "revokedBy", "revokedReason", "createdBy", "createdAt", "rotatedAt", "lastUsedAt", "lastUsedIpHash", "lastUsedUserAgent")
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+        row.id,
+        row.name,
+        row.description,
+        row.servicePrincipalId,
+        row.ownerUserId,
+        row.principalLabel,
+        row.prefix,
+        row.hash,
+        row.scopesJson,
+        row.expiresAt,
+        row.revokedAt,
+        row.revokedBy,
+        row.revokedReason,
+        row.createdBy,
+        row.createdAt,
+        row.rotatedAt,
+        row.lastUsedAt,
+        row.lastUsedIpHash,
+        row.lastUsedUserAgent
+    ]);
+}
+async function updateApiKeyLastUsed(control, request, keyId) {
+    const ip = request.headers.get("cf-connecting-ip") ?? "";
+    const userAgent = request.headers.get("user-agent") ?? "";
+    await control.run(`UPDATE ${q(apiKeysTableName)} SET "lastUsedAt" = ?, "lastUsedIpHash" = ?, "lastUsedUserAgent" = ? WHERE "id" = ?`, [nowIso(), ip ? await sha256Hex(ip) : null, userAgent.slice(0, 200) || null, keyId]).catch(() => undefined);
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,MAAM,EACN,CAAC,EACD,QAAQ,EACR,WAAW,EAIZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAC5G,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAoEnD,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,oBAAoB,CAAE,GAA4C,CAAC,sBAAsB,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAmC,EACnC,KAKC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;IAE5G,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAEnF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAe,iBAAiB,CAAC,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACvH,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE;YACnC,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;YAC1C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,KAAK,EAAE,mBAAmB;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;SACrE,CAAC,CAAC;QACH,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,IAAI,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC/F,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IAElH,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAC9C,iBAAiB,CAAC,CAAC,6BAA6B,CAAC,iBAAiB,EAClE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CACzB,CAAC;IACF,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IAEzG,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE;YACnC,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;YAC1C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,KAAK,EAAE,oBAAoB;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE;SACpF,CAAC,CAAC;QACH,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,8CAA8C,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoB;IACpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAe,iBAAiB,CAAC,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACzH,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAmC,EACnC,KAAwB,EACxB,UAAyB,EAAE;IAE3B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;IAEnI,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,KAAK,CAAC,kBAAkB;QAC/C,CAAC,CAAC,MAAM,uBAAuB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC;QAC3F,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE;YACxC,WAAW;YACX,KAAK,EAAE,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;YACnH,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;YAC7E,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,EAAE;YACnB,GAAG;SACJ,CAAC,CAAC;IACP,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtG,MAAM,GAAG,GAAiB;QACxB,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC;QACvB,IAAI;QACJ,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;QAChH,kBAAkB,EAAE,gBAAgB,CAAC,EAAE;QACvC,WAAW;QACX,cAAc,EAAE,gBAAgB,CAAC,KAAK;QACtC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAClC,SAAS;QACT,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,KAAK,CAAC,EAAE;QACnB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IACF,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE;QACnC,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,KAAK,CAAC,EAAE;QACrB,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;QAC7B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;QAC/C,QAAQ,EAAE;YACR,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;YAC1C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM;YACN,SAAS;SACV;KACF,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAmC,EACnC,KAAa,EACb,UAAyB,EAAE;IAE3B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtG,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CACnB,UAAU,CAAC,CAAC,gBAAgB,CAAC;;oBAEb,EAChB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAC7C,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAClJ,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE;QACnC,KAAK;QACL,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,KAAK,CAAC,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;QAC7B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,EAAE;QAC9C,QAAQ,EAAE;YACR,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC;KACF,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAmC,EACnC,KAAa,EACb,MAAgB;IAEhB,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,aAAa,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CACnB,UAAU,CAAC,CAAC,gBAAgB,CAAC,2EAA2E,EACxG,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,CACtC,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC;IACjF,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE;QACnC,KAAK;QACL,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,KAAK,CAAC,EAAE;QACrB,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;KACpC,CAAC,CAAC;IACH,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;QAC7B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,EAAE;QAC9C,QAAQ,EAAE;YACR,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,MAAM,EAAE,aAAa;SACtB;KACF,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAM,GAAmC,EAAE,KAAa;IACxF,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE;QACnC,KAAK;QACL,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,KAAK,CAAC,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;QAC7B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,EAAE;QAC9C,QAAQ,EAAE;YACR,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC;KACF,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAoB,EACpB,KAQC;IAED,MAAM,OAAO,CAAC,GAAG,CACf,eAAe,CAAC,CAAC,qBAAqB,CAAC;;wCAEH,EACpC;QACE,QAAQ,CAAC,SAAS,CAAC;QACnB,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,kBAAkB,IAAI,IAAI;QAChC,KAAK,CAAC,WAAW,IAAI,IAAI;QACzB,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,WAAW,IAAI,IAAI;QACzB,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;QACpE,MAAM,EAAE;KACT,CACF,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAiB;IAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAC9D,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAoB,EAAE,EAAU;IACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAC7B,2EAA2E,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,EAChH,CAAC,EAAE,CAAC,CACL,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QAC7C,YAAY,EAAE,GAAG,CAAC,YAAY,KAAK,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QACpG,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7G,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,wBAAwB,EAAE,CAAC;IACjF,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,IAAI,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAC1G,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,sBAAsB,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgB;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IACxH,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,OAAsB,EAAE,GAAW;IAC1E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;QACrH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAClE,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,aAAa,eAAe,CAAC,CAAC;QAClI,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACxD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,OAAoB,EACpB,KAOC;IAED,MAAM,GAAG,GAA8B;QACrC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC;QACtD,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,SAAS,EAAE,KAAK,CAAC,GAAG;KACrB,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,eAAe,CAAC,CAAC,6BAA6B,CAAC;;wCAEX,EACpC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAC1I,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,OAAoB,EAAE,EAAU,EAAE,WAAmB;IAC1F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAA4B,iBAAiB,CAAC,CAAC,6BAA6B,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,oFAAoF,CAAC,CAAC;IACvI,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAoB,EAAE,KAAa;IAC9D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAe,iBAAiB,CAAC,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAoB,EAAE,GAAiB;IACjE,MAAM,OAAO,CAAC,GAAG,CACf,eAAe,CAAC,CAAC,gBAAgB,CAAC;;sEAEgC,EAClE;QACE,GAAG,CAAC,EAAE;QACN,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,WAAW;QACf,GAAG,CAAC,kBAAkB;QACtB,GAAG,CAAC,WAAW;QACf,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,UAAU;QACd,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,UAAU;QACd,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,iBAAiB;KACtB,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAoB,EAAE,OAAgB,EAAE,KAAa;IACvF,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,CAAC,gBAAgB,CAAC,qFAAqF,EAClH,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,KAAK,CAAC,CACpF,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC3B,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,14 @@
+export type ApiKeyMaterial = {
+    token: string;
+    prefix: string;
+    hash: string;
+};
+export declare function validateApiKeySecret(secret: unknown): string;
+export declare function generateApiKey(input?: {
+    secret: string;
+    tokenPrefix?: string;
+}): Promise<ApiKeyMaterial>;
+export declare function extractApiKeyLookupPrefix(token: string): string | null;
+export declare function hashApiKey(token: string, secret: string): Promise<string>;
+export declare function verifyApiKeyHash(token: string, expectedHash: string, secret: string): Promise<boolean>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAIF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAK5D;AAED,wBAAsB,cAAc,CAAC,KAAK,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAQ9H;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKtE;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/E;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG5G"}

package/dist/crypto.js

@@ -0,0 +1,59 @@
+import { base64url } from "@raybase/core";
+const encoder = new TextEncoder();
+export function validateApiKeySecret(secret) {
+    if (typeof secret !== "string" || secret.length < 32) {
+        throw new Error("RAYBASE_API_KEY_SECRET must be at least 32 characters when @raybase/api is enabled.");
+    }
+    return secret;
+}
+export async function generateApiKey(input = { secret: "" }) {
+    const secret = validateApiKeySecret(input.secret);
+    const tokenPrefix = normalizeTokenPrefix(input.tokenPrefix);
+    const lookup = randomTokenPart(9);
+    const keySecret = randomTokenPart(24);
+    const prefix = `${tokenPrefix}_${lookup}`;
+    const token = `${prefix}_${keySecret}`;
+    return { token, prefix, hash: await hashApiKey(token, secret) };
+}
+export function extractApiKeyLookupPrefix(token) {
+    const trimmed = token.trim();
+    const lastUnderscore = trimmed.lastIndexOf("_");
+    if (lastUnderscore <= 0)
+        return null;
+    return trimmed.slice(0, lastUnderscore);
+}
+export async function hashApiKey(token, secret) {
+    const key = await crypto.subtle.importKey("raw", encoder.encode(validateApiKeySecret(secret)), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const digest = await crypto.subtle.sign("HMAC", key, encoder.encode(token));
+    return hex(new Uint8Array(digest));
+}
+export async function verifyApiKeyHash(token, expectedHash, secret) {
+    const actual = await hashApiKey(token, secret);
+    return timingSafeEqual(actual, expectedHash);
+}
+function normalizeTokenPrefix(prefix = "rbk_live") {
+    const normalized = prefix.trim().replace(/_+$/g, "");
+    if (!/^[A-Za-z][A-Za-z0-9_]{2,31}$/.test(normalized)) {
+        throw new Error("API key token prefix must start with a letter and contain only letters, numbers, or underscores.");
+    }
+    return normalized;
+}
+function randomTokenPart(bytes) {
+    const raw = new Uint8Array(bytes);
+    crypto.getRandomValues(raw);
+    return base64url(raw).replace(/_/g, "-");
+}
+function hex(bytes) {
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqual(left, right) {
+    const leftBytes = encoder.encode(left);
+    const rightBytes = encoder.encode(right);
+    let diff = leftBytes.length ^ rightBytes.length;
+    const length = Math.max(leftBytes.length, rightBytes.length);
+    for (let index = 0; index < length; index += 1) {
+        diff |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAS1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAkD,EAAE,MAAM,EAAE,EAAE,EAAE;IACnG,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC;IACvC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,MAAc;IAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAC5C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,YAAoB,EAAE,MAAc;IACxF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAM,GAAG,UAAU;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,9 @@
+export type ApiErrorCode = "authentication_required" | "invalid_api_key" | "invalid_scope" | "invalid_request" | "policy_denied" | "not_found" | "internal_error";
+export declare class ApiHttpError extends Error {
+    readonly status: number;
+    readonly code: ApiErrorCode;
+    constructor(status: number, code: ApiErrorCode, message: string);
+}
+export declare function apiErrorResponse(error: unknown, requestId: string): Response;
+export declare function errorMessage(error: unknown): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GACpB,yBAAyB,GACzB,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,gBAAgB,CAAC;AAErB,qBAAa,YAAa,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,YAAY;gBADlB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClC,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAc5E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD"}

package/dist/errors.js

@@ -0,0 +1,26 @@
+export class ApiHttpError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "ApiHttpError";
+    }
+}
+export function apiErrorResponse(error, requestId) {
+    const apiError = error instanceof ApiHttpError
+        ? error
+        : new ApiHttpError(500, "internal_error", "The API request could not be completed.");
+    return Response.json({
+        error: {
+            code: apiError.code,
+            message: apiError.message,
+            requestId
+        }
+    }, { status: apiError.status });
+}
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAEnB;IACA;IAFlB,YACkB,MAAc,EACd,IAAkB,EAClC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAc;QAIlC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,SAAiB;IAChE,MAAM,QAAQ,GAAG,KAAK,YAAY,YAAY;QAC5C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,yCAAyC,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,IAAI,CAClB;QACE,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS;SACV;KACF,EACD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/generated/admin-assets.d.ts

@@ -0,0 +1,5 @@
+export declare const adminAssets: {
+    js: string;
+    css: string;
+};
+//# sourceMappingURL=admin-assets.d.ts.map

package/dist/generated/admin-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-assets.d.ts","sourceRoot":"","sources":["../../src/generated/admin-assets.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW;;;CAGvB,CAAC"}

package/dist/generated/admin-assets.js

@@ -0,0 +1,5 @@
+export const adminAssets = {
+    "js": "",
+    "css": "body {\n  margin: 0;\n  background: #f7f8f5;\n  color: #171a1f;\n  font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n}\n\nmain {\n  width: min(1180px, calc(100vw - 32px));\n  margin: 0 auto;\n  padding: 32px 0 48px;\n}\n\nheader {\n  display: flex;\n  align-items: end;\n  justify-content: space-between;\n  gap: 24px;\n  margin-bottom: 24px;\n}\n\nh1,\nh2,\np {\n  margin: 0;\n}\n\nh1 {\n  font-size: 42px;\n  line-height: 1;\n}\n\nh2 {\n  margin-bottom: 12px;\n  font-size: 18px;\n}\n\na,\nbutton {\n  border: 1px solid #2c5f4a;\n  border-radius: 6px;\n  background: #2c5f4a;\n  color: #fff;\n  font: inherit;\n  font-weight: 700;\n  padding: 9px 12px;\n  text-decoration: none;\n}\n\nbutton:disabled {\n  border-color: #b7bdb7;\n  background: #dfe3df;\n  color: #6b716b;\n}\n\n.eyebrow {\n  color: #596159;\n  font-size: 13px;\n  font-weight: 700;\n  letter-spacing: .08em;\n  text-transform: uppercase;\n}\n\n.notice,\n.token-panel {\n  border: 1px solid #e1c15a;\n  border-radius: 8px;\n  background: #fff8da;\n  padding: 14px;\n  margin-bottom: 18px;\n}\n\n.token-panel code {\n  display: block;\n  margin-top: 8px;\n  overflow-wrap: anywhere;\n  font-size: 14px;\n}\n\n.layout {\n  display: grid;\n  grid-template-columns: minmax(0, 1fr) 320px;\n  gap: 24px;\n  margin-bottom: 28px;\n}\n\n.table {\n  display: grid;\n  gap: 10px;\n}\n\n.row {\n  display: grid;\n  grid-template-columns: minmax(0, 1.4fr) minmax(220px, .9fr) minmax(180px, .8fr) auto;\n  align-items: center;\n  gap: 16px;\n  border: 1px solid #d9ded8;\n  border-radius: 8px;\n  background: #fff;\n  padding: 14px;\n}\n\n.row p,\n.row small,\n.meta small {\n  color: #636b63;\n}\n\n.route {\n  display: grid;\n  gap: 4px;\n}\n\n.route span,\n.scopes span {\n  width: fit-content;\n  border-radius: 999px;\n  background: #e6efea;\n  color: #1f513e;\n  font-size: 12px;\n  font-weight: 800;\n  padding: 4px 8px;\n}\n\n.scopes {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 6px;\n}\n\n.meta,\n.actions {\n  display: grid;\n  gap: 6px;\n}\n\naside,\nsection {\n  min-width: 0;\n}\n\nform {\n  display: grid;\n  gap: 12px;\n  border: 1px solid #d9ded8;\n  border-radius: 8px;\n  background: #fff;\n  padding: 16px;\n}\n\nlabel {\n  display: grid;\n  gap: 6px;\n  color: #3e473e;\n  font-size: 13px;\n  font-weight: 700;\n}\n\ninput,\ntextarea {\n  box-sizing: border-box;\n  width: 100%;\n  border: 1px solid #cdd3cc;\n  border-radius: 6px;\n  padding: 9px 10px;\n  font: inherit;\n}\n\ntextarea {\n  min-height: 82px;\n  resize: vertical;\n}\n\n.empty {\n  border: 1px dashed #cdd3cc;\n  border-radius: 8px;\n  padding: 18px;\n  color: #636b63;\n}\n\n@media (max-width: 860px) {\n  .layout,\n  .row {\n    grid-template-columns: 1fr;\n  }\n}\n"
+};
+//# sourceMappingURL=admin-assets.js.map

package/dist/generated/admin-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-assets.js","sourceRoot":"","sources":["../../src/generated/admin-assets.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,otFAAotF;CAC5tF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./api.js";
+export * from "./auth.js";
+export * from "./crypto.js";
+export * from "./errors.js";
+export * from "./system-tables.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export * from "./api.js";
+export * from "./auth.js";
+export * from "./crypto.js";
+export * from "./errors.js";
+export * from "./system-tables.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC"}

package/dist/path.d.ts

@@ -0,0 +1,2 @@
+export declare function matchApiPath(pattern: string, pathname: string): Record<string, string> | null;
+//# sourceMappingURL=path.d.ts.map

package/dist/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAmB7F"}

package/dist/path.js

@@ -0,0 +1,25 @@
+import { ApiHttpError } from "./errors.js";
+export function matchApiPath(pattern, pathname) {
+    const patternParts = pattern.split("/").filter(Boolean);
+    const pathParts = pathname.split("/").filter(Boolean);
+    if (patternParts.length !== pathParts.length)
+        return null;
+    const params = {};
+    for (let index = 0; index < patternParts.length; index += 1) {
+        const patternPart = patternParts[index];
+        const pathPart = pathParts[index];
+        if (patternPart.startsWith(":")) {
+            try {
+                params[patternPart.slice(1)] = decodeURIComponent(pathPart);
+            }
+            catch {
+                throw new ApiHttpError(400, "invalid_request", "Path parameter encoding is invalid.");
+            }
+        }
+        else if (patternPart !== pathPart) {
+            return null;
+        }
+    }
+    return params;
+}
+//# sourceMappingURL=path.js.map

package/dist/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAE,CAAC;QACnC,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;aAAM,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/system-tables.d.ts

@@ -0,0 +1,6 @@
+import { type RaybaseSystemTable } from "@raybase/core";
+export declare const apiKeysTableName = "_api_keys";
+export declare const apiServicePrincipalsTableName = "_api_service_principals";
+export declare const apiKeyEventsTableName = "_api_key_events";
+export declare const raybaseApiSystemTables: RaybaseSystemTable[];
+//# sourceMappingURL=system-tables.d.ts.map

package/dist/system-tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-tables.d.ts","sourceRoot":"","sources":["../src/system-tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEhG,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAC5C,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AACvE,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAuEtD,CAAC"}