@raybase/core 0.0.2 → 0.3.3

package/dist/handoff-consumer.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The `kind` claim. The hub mints `sso`/`pass`; a resource owner's own signer
+ * mints `link` (a signed right, no person) and `machine` (a link-shaped pass
+ * held by an automated lease). This module owns the vocabulary because it
+ * imports nothing from Core; `handoff.ts` takes the type from here.
+ */
+export type RaybaseHandoffTokenKind = "sso" | "pass" | "link" | "machine";
+/** What a verified token turns into: a person, or a signed right. */
+export type RaybaseHandoffPrincipalKind = "identity" | "link" | "machine";
+export type RaybaseHandoffIssuer = {
+    issuer: string;
+    /** Defaults to `${issuer}/.well-known/jwks.json`. */
+    jwks?: string;
+    /** Pin a single public key instead of fetching a key set. */
+    publicJwk?: JsonWebKey;
+    /**
+     * Which kinds this issuer may mint. Defaults to `["sso", "pass"]` for the
+     * first issuer (the hub) and `["link", "machine"]` for every later one, so a
+     * second signer cannot mint memberships unless the resource says it may.
+     */
+    kinds?: RaybaseHandoffTokenKind[];
+};
+export type RaybaseHandoffConsumerConfig = {
+    resource: string;
+    /** Origin of the authorize endpoint the bounce sends strangers to. */
+    hub: string;
+    /** The hub is normally issuers[0]; a resource owner's own signer is another. */
+    issuers: RaybaseHandoffIssuer[];
+    cookieName?: string;
+    returnTo?: string;
+    clockToleranceSeconds?: number;
+};
+export type RaybaseHandoffPrincipal = {
+    kind: RaybaseHandoffPrincipalKind;
+    sub: string;
+    email?: string;
+    emailVerified?: boolean;
+    name?: string;
+    /** Only ever present on an identity principal minted from an sso handoff. */
+    roles?: string[];
+    appId?: string;
+    resource: string;
+    issuer: string;
+    exp: number;
+    jti: string;
+};
+/** The nonce that binds a consume URL to the browser that started the bounce. */
+export declare const handoffStateCookieName = "raybase_handoff_state";
+/** A bearer beats a cookie: a caller that names its token means it. */
+export declare function extractHandoffToken(request: Request, cookieName?: string): string | null;
+/**
+ * Verify a handoff token against the configured issuers. The unverified `iss`
+ * claim only selects which configured key to verify against; an issuer that is
+ * not listed is rejected before any signature check.
+ */
+export declare function verifyHandoffToken(token: string, cfg: RaybaseHandoffConsumerConfig): Promise<RaybaseHandoffPrincipal>;
+/** The request's principal, or null when it carries no usable handoff token. */
+export declare function verifyHandoff(request: Request, cfg: RaybaseHandoffConsumerConfig): Promise<RaybaseHandoffPrincipal | null>;
+export declare function serializeHandoffCookie(value: string, options: {
+    cookieName?: string;
+    requestUrl: string | URL;
+    maxAgeSeconds: number;
+}): string;
+export declare function handoffAuthorizeUrl(request: Request, cfg: RaybaseHandoffConsumerConfig, state?: string): string;
+/** A top-level navigation, which can be bounced; anything else gets JSON. */
+export declare function isHandoffNavigation(request: Request): boolean;
+/**
+ * The consume route handler: verify the token the hub redirected with, set the
+ * resource's own cookie, and send the visitor on to where they were going.
+ */
+export declare function consumeHandoff(request: Request, cfg: RaybaseHandoffConsumerConfig, hooks?: {
+    onPrincipal?(principal: RaybaseHandoffPrincipal): Promise<string | void>;
+}): Promise<Response>;
+/**
+ * The gate: null admits the request, a Response refuses it. Navigations bounce
+ * to the hub's authorize endpoint; everything else gets a 401 naming it.
+ */
+export declare function requireHandoff(request: Request, cfg: RaybaseHandoffConsumerConfig): Promise<Response | null>;
+//# sourceMappingURL=handoff-consumer.d.ts.map

package/dist/handoff-consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff-consumer.d.ts","sourceRoot":"","sources":["../src/handoff-consumer.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,qEAAqE;AACrE,MAAM,MAAM,2BAA2B,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB;;;;OAIG;IACH,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,2BAA2B,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAeF,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAyG9D,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,SAAoB,GAAG,MAAM,GAAG,IAAI,CAGnG;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmD3H;AAED,gFAAgF;AAChF,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAIhI;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAChF,MAAM,CAaR;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAM/G;AAUD,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAK7D;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,4BAA4B,EACjC,KAAK,CAAC,EAAE;IAAE,WAAW,CAAC,CAAC,SAAS,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAAE,GACnF,OAAO,CAAC,QAAQ,CAAC,CAkCnB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkBlH"}

package/dist/handoff-consumer.js

@@ -0,0 +1,300 @@
+// The resource side of the handoff. This module runs inside arbitrary Workers
+// (an Astro site, a preview deploy, a third party's edge worker), so it imports
+// `jose` and nothing else — no other Core module, no Node API. `jose` is a
+// direct dependency of @raybase/core precisely so JWS/JWK correctness is
+// amortized across every consumer instead of re-implemented per resource.
+import { createRemoteJWKSet, customFetch, decodeJwt, importJWK, jwtVerify } from "jose";
+const defaultCookieName = "raybase_handoff";
+/** The nonce that binds a consume URL to the browser that started the bounce. */
+export const handoffStateCookieName = "raybase_handoff_state";
+const defaultClockToleranceSeconds = 30;
+const stateMaxAgeSeconds = 600;
+const localHttpHosts = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+const hubIssuerKinds = ["sso", "pass"];
+const secondaryIssuerKinds = ["link", "machine"];
+// A lookup object would answer for "constructor" and every other inherited
+// key, so the mapping is a switch and nothing else.
+function principalKindFor(kind) {
+    switch (kind) {
+        case "sso":
+        case "pass":
+            return "identity";
+        case "link":
+            return "link";
+        case "machine":
+            return "machine";
+        default:
+            return null;
+    }
+}
+const remoteKeySets = new Map();
+const pinnedKeys = new Map();
+function trimIssuer(issuer) {
+    return issuer.replace(/\/$/, "");
+}
+/** Freshness for a key set whose issuer states none of its own. The hub
+ *  sends `max-age=300`; this only covers an issuer that says nothing. */
+const defaultJwksMaxAgeSeconds = 300;
+/**
+ * Fetches a key set through the edge cache when there is one.
+ *
+ * `jose` caches a fetched key set on the `createRemoteJWKSet` closure, which
+ * lives exactly as long as the isolate holding it. On a busy resource that
+ * is free; on a quiet one nearly every request arrives at a fresh isolate
+ * and re-fetches the issuer's JWKS before it can verify a single token —
+ * synchronously, on the critical path, at whatever the issuer's own latency
+ * happens to be. Measured against `itself-hub`, that put 2.3–3.9 s in front
+ * of every artifact a signed-in reader opened, and the key had not changed
+ * in days.
+ *
+ * The colo cache is the missing lifetime: shared by every isolate in the
+ * location, invisible to a rotation for no longer than the issuer's own
+ * `Cache-Control` allows. A rotation therefore heals on its own within that
+ * window rather than needing a redeploy, which is why this is a cache and
+ * not a pin.
+ *
+ * Where there is no `caches` — Node, a test runner, a non-Workers host —
+ * this is exactly `fetch`, and a cache that refuses a response is not an
+ * error: the fetch already succeeded, and the only thing lost is the
+ * saving.
+ */
+const cachingJwksFetch = async (input, init) => {
+    const request = new Request(input, init);
+    const store = globalThis.caches?.default;
+    if (!store || request.method !== "GET")
+        return await fetch(request);
+    const hit = await store.match(request).catch(() => undefined);
+    if (hit)
+        return hit;
+    const response = await fetch(request);
+    if (!response.ok)
+        return response;
+    const cacheable = new Response(response.body, response);
+    if (!cacheable.headers.has("cache-control")) {
+        cacheable.headers.set("cache-control", `public, max-age=${defaultJwksMaxAgeSeconds}`);
+    }
+    await store.put(request, cacheable.clone()).catch(() => undefined);
+    return cacheable;
+};
+function remoteKeySet(url) {
+    let keySet = remoteKeySets.get(url);
+    if (!keySet) {
+        keySet = createRemoteJWKSet(new URL(url), { [customFetch]: cachingJwksFetch });
+        remoteKeySets.set(url, keySet);
+    }
+    return keySet;
+}
+function pinnedKey(jwk) {
+    const cacheKey = JSON.stringify(jwk);
+    let key = pinnedKeys.get(cacheKey);
+    if (!key) {
+        key = importJWK(jwk, "ES256");
+        pinnedKeys.set(cacheKey, key);
+    }
+    return key;
+}
+// Everything exported below is deliberate public API for resource owners:
+// most resources mount consumeHandoff/requireHandoff, but a Worker that gates
+// its own way composes extractHandoffToken, verifyHandoffToken,
+// isHandoffNavigation, handoffAuthorizeUrl and serializeHandoffCookie itself.
+function readCookie(request, name) {
+    const cookie = request.headers.get("cookie") ?? "";
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const match = cookie.match(new RegExp(`(?:^|;\\s*)${escaped}=([^;]+)`));
+    return match?.[1] ? decodeURIComponent(match[1]) : null;
+}
+/** A bearer beats a cookie: a caller that names its token means it. */
+export function extractHandoffToken(request, cookieName = defaultCookieName) {
+    const bearer = request.headers.get("authorization")?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();
+    return bearer || readCookie(request, cookieName);
+}
+/**
+ * Verify a handoff token against the configured issuers. The unverified `iss`
+ * claim only selects which configured key to verify against; an issuer that is
+ * not listed is rejected before any signature check.
+ */
+export async function verifyHandoffToken(token, cfg) {
+    if (!cfg.resource)
+        throw new Error("Handoff consumer config requires a resource id");
+    if (!cfg.issuers?.length)
+        throw new Error("Handoff consumer config requires at least one issuer");
+    let claimedIssuer;
+    try {
+        claimedIssuer = trimIssuer(String(decodeJwt(token).iss ?? ""));
+    }
+    catch {
+        throw new Error("Handoff token is malformed");
+    }
+    const index = cfg.issuers.findIndex((candidate) => trimIssuer(candidate.issuer) === claimedIssuer);
+    if (index < 0)
+        throw new Error(`Handoff token issuer "${claimedIssuer}" is not a configured issuer`);
+    const issuer = cfg.issuers[index];
+    const options = {
+        issuer: trimIssuer(issuer.issuer),
+        audience: `raybase-handoff:${cfg.resource}`,
+        clockTolerance: cfg.clockToleranceSeconds ?? defaultClockToleranceSeconds
+    };
+    const { payload } = issuer.publicJwk
+        ? await jwtVerify(token, await pinnedKey(issuer.publicJwk), options)
+        : await jwtVerify(token, remoteKeySet(issuer.jwks ?? `${trimIssuer(issuer.issuer)}/.well-known/jwks.json`), options);
+    if (payload.resource !== cfg.resource)
+        throw new Error("Handoff token names a different resource");
+    if (!payload.sub)
+        throw new Error("Handoff token is missing a subject");
+    if (!payload.jti)
+        throw new Error("Handoff token is missing a token id");
+    if (typeof payload.exp !== "number")
+        throw new Error("Handoff token is missing an expiry");
+    // What this issuer is allowed to say, before anything is made of what it said.
+    const allowedKinds = issuer.kinds ?? (index === 0 ? hubIssuerKinds : secondaryIssuerKinds);
+    if (typeof payload.kind !== "string" || !allowedKinds.includes(payload.kind)) {
+        throw new Error(`Handoff token issuer "${claimedIssuer}" may not mint kind "${String(payload.kind)}"`);
+    }
+    const kind = principalKindFor(payload.kind);
+    if (!kind)
+        throw new Error(`Handoff token has an unknown kind "${payload.kind}"`);
+    // The hard rule: a pass never carries roles and never enrolls anyone. Roles
+    // ride only on the SSO front channel, where a membership backs them.
+    if (payload.roles !== undefined && payload.kind !== "sso")
+        throw new Error("Handoff token carries roles but is not an SSO handoff");
+    return {
+        kind,
+        sub: payload.sub,
+        ...(payload.email ? { email: payload.email } : {}),
+        ...(payload.email_verified === undefined ? {} : { emailVerified: payload.email_verified === true }),
+        ...(payload.name ? { name: payload.name } : {}),
+        ...(payload.kind === "sso" ? { roles: Array.isArray(payload.roles) ? payload.roles.map(String) : [] } : {}),
+        ...(payload.appId ? { appId: payload.appId } : {}),
+        resource: cfg.resource,
+        issuer: trimIssuer(issuer.issuer),
+        exp: payload.exp,
+        jti: payload.jti
+    };
+}
+/** The request's principal, or null when it carries no usable handoff token. */
+export async function verifyHandoff(request, cfg) {
+    const token = extractHandoffToken(request, cfg.cookieName ?? defaultCookieName);
+    if (!token)
+        return null;
+    return await verifyHandoffToken(token, cfg).catch(() => null);
+}
+export function serializeHandoffCookie(value, options) {
+    const requestUrl = typeof options.requestUrl === "string" ? new URL(options.requestUrl) : options.requestUrl;
+    const attributes = [
+        `${options.cookieName ?? defaultCookieName}=${encodeURIComponent(value)}`,
+        "Path=/",
+        `Max-Age=${Math.max(0, Math.trunc(options.maxAgeSeconds))}`,
+        "HttpOnly"
+    ];
+    if (!(requestUrl.protocol === "http:" && localHttpHosts.has(requestUrl.hostname)))
+        attributes.push("Secure");
+    // Lax, not Strict: the hub's 302 back into the resource is a cross-site
+    // top-level navigation and must arrive carrying the cookie just set.
+    attributes.push("SameSite=Lax");
+    return attributes.join("; ");
+}
+export function handoffAuthorizeUrl(request, cfg, state) {
+    const url = new URL("/api/handoff/authorize", cfg.hub);
+    url.searchParams.set("resource", cfg.resource);
+    url.searchParams.set("return", request.url);
+    if (state)
+        url.searchParams.set("state", state);
+    return url.toString();
+}
+/** 32 random bytes, base64url: the nonce the hub echoes back through consume. */
+function newHandoffState() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+/** A top-level navigation, which can be bounced; anything else gets JSON. */
+export function isHandoffNavigation(request) {
+    if (request.method !== "GET" && request.method !== "HEAD")
+        return false;
+    const mode = request.headers.get("sec-fetch-mode")?.toLowerCase();
+    if (mode)
+        return mode === "navigate";
+    return (request.headers.get("accept")?.toLowerCase() ?? "").includes("text/html");
+}
+/**
+ * The consume route handler: verify the token the hub redirected with, set the
+ * resource's own cookie, and send the visitor on to where they were going.
+ */
+export async function consumeHandoff(request, cfg, hooks) {
+    const url = new URL(request.url);
+    const token = url.searchParams.get("token");
+    if (!token)
+        return handoffJson({ error: "handoff_token_missing" }, 400);
+    // A consume URL is only good in the browser that started the bounce: the
+    // nonce this resource minted must come back in both the query and its own
+    // cookie. Without it, a token captured or planted anywhere would sign the
+    // visitor in as somebody else the moment they followed a link.
+    const state = url.searchParams.get("state");
+    const expectedState = readCookie(request, handoffStateCookieName);
+    if (!state || !expectedState || state.length !== expectedState.length || state !== expectedState) {
+        return handoffJson({ error: "handoff_state_mismatch" }, 401);
+    }
+    let principal;
+    try {
+        principal = await verifyHandoffToken(token, cfg);
+    }
+    catch {
+        // Never echo token internals back to the browser: a failed consume is a
+        // stale or forged token and the visitor's next step is the bounce.
+        return handoffJson({ error: "handoff_token_invalid" }, 401);
+    }
+    const fallback = safeHandoffPath(cfg.returnTo, "/");
+    const override = await hooks?.onPrincipal?.(principal);
+    const location = safeHandoffPath(override ?? url.searchParams.get("return"), fallback);
+    // Real time, not the app clock: the cookie must die with the token, and the
+    // token's expiry was signed against the wall clock.
+    const maxAgeSeconds = principal.exp - Math.floor(Date.now() / 1000);
+    const headers = new Headers({ location, "cache-control": "no-store", "referrer-policy": "no-referrer" });
+    headers.append("set-cookie", serializeHandoffCookie(token, { cookieName: cfg.cookieName, requestUrl: url, maxAgeSeconds }));
+    headers.append("set-cookie", serializeHandoffCookie("", { cookieName: handoffStateCookieName, requestUrl: url, maxAgeSeconds: 0 }));
+    return new Response(null, { status: 302, headers });
+}
+/**
+ * The gate: null admits the request, a Response refuses it. Navigations bounce
+ * to the hub's authorize endpoint; everything else gets a 401 naming it.
+ */
+export async function requireHandoff(request, cfg) {
+    if (await verifyHandoff(request, cfg))
+        return null;
+    // The nonce goes out with the bounce and comes home through consume, which
+    // is what ties the round trip to this browser.
+    const state = newHandoffState();
+    const authorize = handoffAuthorizeUrl(request, cfg, state);
+    const stateCookie = serializeHandoffCookie(state, {
+        cookieName: handoffStateCookieName,
+        requestUrl: new URL(request.url),
+        maxAgeSeconds: stateMaxAgeSeconds
+    });
+    if (isHandoffNavigation(request)) {
+        return new Response(null, {
+            status: 302,
+            headers: { location: authorize, "set-cookie": stateCookie, "cache-control": "no-store", "referrer-policy": "no-referrer" }
+        });
+    }
+    return handoffJson({ error: "handoff_required", authorize }, 401, stateCookie);
+}
+function handoffJson(body, status, setCookie) {
+    const headers = new Headers({ "content-type": "application/json", "cache-control": "no-store" });
+    if (setCookie)
+        headers.append("set-cookie", setCookie);
+    return new Response(JSON.stringify(body), { status, headers });
+}
+/**
+ * The canonical Raybase path rule, and the only place it is spelled out: a
+ * single leading slash, no backslash, and no control character at all. The
+ * WHATWG URL parser strips TAB/CR/LF before parsing, so "/\t//evil.example"
+ * would otherwise reach a browser as a protocol-relative URL and leave the
+ * resource entirely.
+ */
+const handoffPathPattern = /^\/(?!\/)[^\\\x00-\x1f\x7f]*$/;
+function safeHandoffPath(value, fallback) {
+    return typeof value === "string" && handoffPathPattern.test(value) ? value : fallback;
+}
+//# sourceMappingURL=handoff-consumer.js.map

package/dist/handoff-consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff-consumer.js","sourceRoot":"","sources":["../src/handoff-consumer.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAA6B,MAAM,MAAM,CAAC;AAiEnH,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAC5C,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAC9D,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3E,MAAM,cAAc,GAA8B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAClE,MAAM,oBAAoB,GAA8B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC5E,2EAA2E;AAC3E,oDAAoD;AACpD,SAAS,gBAAgB,CAAC,IAAY;IACpC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC;QACX,KAAK,MAAM;YACT,OAAO,UAAU,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAiD,CAAC;AAC/E,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0D,CAAC;AAErF,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;yEACyE;AACzE,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,gBAAgB,GAAiB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAoB,EAAE,IAAmB,CAAC,CAAC;IACvE,MAAM,KAAK,GAAI,UAA+C,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/E,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAEpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,SAAS,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,wBAAwB,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAe;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,SAAS,CAAC,GAAU,EAAE,OAAO,CAAC,CAAC;QACrC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E;AAC9E,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,OAAO,UAAU,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,UAAU,GAAG,iBAAiB;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5F,OAAO,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,GAAiC;IACvF,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAElG,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,CAAC;IACnG,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,aAAa,8BAA8B,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QACjC,QAAQ,EAAE,mBAAmB,GAAG,CAAC,QAAQ,EAAE;QAC3C,cAAc,EAAE,GAAG,CAAC,qBAAqB,IAAI,4BAA4B;KAC1E,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,SAAS;QAClC,CAAC,CAAC,MAAM,SAAS,CAAsB,KAAK,EAAE,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QACzF,CAAC,CAAC,MAAM,SAAS,CAAsB,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC,CAAC;IAE5I,IAAI,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACnG,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC3F,+EAA+E;IAC/E,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAC3F,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,yBAAyB,aAAa,wBAAwB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAClF,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAEpI,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACnG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,GAAiC;IACrF,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,OAAiF;IAEjF,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC7G,MAAM,UAAU,GAAG;QACjB,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACzE,QAAQ;QACR,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE;QAC3D,UAAU;KACX,CAAC;IACF,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7G,wEAAwE;IACxE,qEAAqE;IACrE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,GAAiC,EAAE,KAAc;IACrG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe;IACtB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC;IAClE,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,UAAU,CAAC;IACrC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,GAAiC,EACjC,KAAoF;IAEpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IAExE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACjG,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,SAAkC,CAAC;IACvC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IACvF,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;IACzG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAC5H,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,GAAiC;IACtF,IAAI,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,2EAA2E;IAC3E,+CAA+C;IAC/C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,EAAE;QAChD,UAAU,EAAE,sBAAsB;QAClC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QAChC,aAAa,EAAE,kBAAkB;KAClC,CAAC,CAAC;IACH,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE;SAC3H,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B,EAAE,MAAc,EAAE,SAAkB;IACpF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACjG,IAAI,SAAS;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACvD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACjE,CAAC;AAGD;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D,SAAS,eAAe,CAAC,KAAc,EAAE,QAAgB;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACxF,CAAC"}

package/dist/handoff.d.ts

@@ -0,0 +1,70 @@
+import type { RaybaseConfig } from "./schema.js";
+import type { RaybaseHandoffTokenKind } from "./handoff-consumer.js";
+import type { RaybaseUser } from "./policies.js";
+export type RaybaseHandoffResourceConfig = NonNullable<RaybaseConfig["handoff"]>["resources"][number];
+/** What a registered resource is: a thing you belong to, or a thing you are shown. */
+export type RaybaseHandoffKind = Extract<RaybaseHandoffTokenKind, "sso" | "pass">;
+export type { RaybaseHandoffTokenKind };
+export type RaybaseHandoffJwtPayload = {
+    iss: string;
+    aud: string;
+    sub: string;
+    email: string;
+    email_verified: boolean;
+    name: string;
+    appId?: string;
+    resource: string;
+    kind: RaybaseHandoffTokenKind;
+    /** Present only for `kind: "sso"`. A pass never carries roles. */
+    roles?: string[];
+    iat: number;
+    exp: number;
+    jti: string;
+};
+type JsonWebKeyRecord = JsonWebKey & Record<string, unknown>;
+export declare function handoffEnabled(config: RaybaseConfig): boolean;
+export declare function handoffTokenTtlSeconds(config: RaybaseConfig): number;
+export declare function handoffResourceById(config: RaybaseConfig, id: string): RaybaseHandoffResourceConfig | null;
+/**
+ * The `iss` the hub signs with. Configure `handoff.issuer` when the hub is
+ * reachable under more than one hostname: consumers pin one issuer string, so
+ * whichever hostname a visitor arrived on, the token must say the same thing.
+ */
+export declare function handoffIssuer(config: RaybaseConfig, requestOrigin: string): string;
+export declare function handoffResourceConsumePath(resource: RaybaseHandoffResourceConfig): string;
+export declare function handoffResourceOriginForEnv(config: RaybaseConfig, resource: RaybaseHandoffResourceConfig, env: {
+    RAYBASE_SITE_ORIGIN?: string;
+}): string;
+/**
+ * Every issue that would make the registry unusable at runtime. Called by the
+ * worker factory (so a bad registry fails loudly at startup) and by
+ * `raybase doctor`.
+ */
+export declare function validateHandoffConfig(config: RaybaseConfig): string[];
+export declare function parseHandoffPrivateJwk(raw: string | undefined): JsonWebKeyRecord;
+export declare function publicJwkFromPrivate(raw: string | undefined): Promise<JsonWebKeyRecord>;
+export declare function handoffJwks(raw: string | undefined): Promise<{
+    keys: JsonWebKeyRecord[];
+}>;
+export declare function signHandoffToken(input: {
+    privateJwk: string | undefined;
+    issuer: string;
+    resource: RaybaseHandoffResourceConfig;
+    user: RaybaseUser;
+    appId?: string;
+    ttlSeconds: number;
+}): Promise<{
+    token: string;
+    payload: RaybaseHandoffJwtPayload;
+    expiresAt: string;
+}>;
+export declare function handoffConsumeUrl(resource: RaybaseHandoffResourceConfig, origin: string, token: string, returnTo: string, state?: string): string;
+/** Path-only, so a return value can never send a browser off the resource. */
+export declare function sanitizeHandoffReturnTo(value: unknown, fallback: string): string;
+/**
+ * Reduce a caller-supplied return target to a path on the resource. An absolute
+ * URL is accepted only when it is on the resource's own origin, so the bounce
+ * can hand back the URL the visitor actually asked for.
+ */
+export declare function handoffReturnPath(resource: RaybaseHandoffResourceConfig, origin: string, value: unknown): string;
+//# sourceMappingURL=handoff.d.ts.map

package/dist/handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../src/handoff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAKjD,MAAM,MAAM,4BAA4B,GAAG,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtG,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;AAElF,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAExC,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,uBAAuB,CAAC;IAC9B,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,KAAK,gBAAgB,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAQ7D,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAGpE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,GAAG,4BAA4B,GAAG,IAAI,CAE1G;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAGlF;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,4BAA4B,GAAG,MAAM,CAEzF;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,4BAA4B,EACtC,GAAG,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,MAAM,CAgBR;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CA0BrE;AAgCD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAYhF;AAED,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS7F;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CAEhG;AAgBD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCnF;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,4BAA4B,EACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAOR;AAED,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,4BAA4B,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAYhH"}