@raybase/core 0.0.2 → 0.3.3

package/dist/html.js

@@ -0,0 +1,634 @@
+import { publicSignupEnabled, resolveSignupMode } from "./schema.js";
+import { raybaseDevPersonaOperatorRole, resolveRaybaseDevPersonas } from "./local-dev-personas.js";
+export function escapeHtml(value) {
+    return String(value ?? "")
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+export function jsonScript(value) {
+    return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+// Letter-mark favicon as a data URI: no static asset pipeline exists for core
+// pages, and an inline icon also stops browsers requesting /favicon.ico (a 404
+// logged on every page load otherwise).
+export function faviconDataUri(appName) {
+    const letter = (appName ?? "").trim().charAt(0).toUpperCase().replace(/[^A-Z0-9]/, "") || "A";
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="14" fill="#09090b"/><text x="32" y="44" font-family="ui-sans-serif, system-ui, sans-serif" font-size="34" font-weight="600" fill="#ffffff" text-anchor="middle">${letter}</text></svg>`;
+    return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+}
+function externalAssetTags(assets, placement) {
+    if (!assets?.length)
+        return "";
+    return assets
+        .map((asset) => {
+        const integrity = asset.integrity ? ` integrity="${escapeHtml(asset.integrity)}"` : "";
+        if (placement === "head" && asset.href)
+            return `  <link rel="stylesheet" href="${escapeHtml(asset.href)}"${integrity}>`;
+        if (placement === "body" && asset.src)
+            return `<script src="${escapeHtml(asset.src)}"${integrity} defer></script>`;
+        return "";
+    })
+        .filter(Boolean)
+        .join("\n");
+}
+export function page(title, body, options = {}) {
+    const appName = options.appName ?? "Raybase";
+    const headAssets = externalAssetTags(options.assets, "head");
+    const bodyAssets = externalAssetTags(options.assets, "body");
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <link rel="icon" href="${faviconDataUri(appName)}">
+  <title>${escapeHtml(title)} - ${escapeHtml(appName)}</title>
+${options.headScript ? `  <script>${options.headScript}</script>\n` : ""}${headAssets ? `${headAssets}\n` : ""}  <style>
+    :root { color-scheme: light; --ink:#09090b; --ink-hover:#27272a; --text:#18181b; --muted:#52525b; --line:#e4e4e7; --line-strong:#d4d4d8; --page:#fafafa; --surface:#ffffff; --surface-muted:#fafafa; --placeholder:#a1a1aa; --ring:rgb(161 161 170 / 0.7); }
+    * { box-sizing: border-box; }
+    body { margin:0; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background:var(--page); color:var(--text); -webkit-font-smoothing:antialiased; }
+    .auth-shell a { color: var(--ink); }
+    button, input, select, textarea { font: inherit; }
+    /* Form-element styling is scoped to the auth pages so it never bleeds into the
+       Tailwind-styled admin SPA (unlayered rules would otherwise beat @layer utilities). */
+    .auth-shell button { border: 1px solid var(--ink); background: var(--ink); color: #fff; border-radius: 0.5rem; padding: 0.55rem 0.85rem; font-weight: 500; cursor: pointer; transition: background-color .15s ease, border-color .15s ease, color .15s ease; }
+    .auth-shell button:hover { background: var(--ink-hover); border-color: var(--ink-hover); }
+    .auth-shell button.secondary { background: var(--surface); color: var(--text); border-color: var(--line); }
+    .auth-shell button.secondary:hover { background: var(--surface-muted); border-color: var(--line-strong); }
+    .auth-shell button.danger { background: var(--surface); color: var(--text); border-color: var(--line-strong); }
+    .auth-shell button.danger:hover { background: var(--ink); color: #fff; border-color: var(--ink); }
+    .auth-shell button:disabled { opacity: 0.4; cursor: not-allowed; }
+    .auth-shell input, .auth-shell select, .auth-shell textarea { width:100%; border:1px solid var(--line); background:var(--surface); border-radius:0.5rem; padding:0.55rem 0.7rem; color:var(--text); transition: border-color .15s ease, box-shadow .15s ease; }
+    .auth-shell input::placeholder, .auth-shell textarea::placeholder { color: var(--placeholder); }
+    .auth-shell input:hover, .auth-shell textarea:hover { border-color: var(--line-strong); }
+    .auth-shell input:focus, .auth-shell select:focus, .auth-shell textarea:focus { outline:none; border-color:var(--placeholder); box-shadow:0 0 0 2px var(--ring); }
+    .auth-shell label { display:grid; gap:0.4rem; color:var(--muted); font-size:0.8125rem; font-weight:500; }
+    .auth-shell { min-height:100vh; display:grid; place-items:center; padding:2rem; background:var(--page); }
+    .auth-panel { width:min(420px, 100%); border:1px solid var(--line); background:var(--surface); border-radius:0.75rem; padding:2rem; box-shadow:0 1px 2px 0 rgb(9 9 11 / 0.04); }
+    .auth-mark { width:2.5rem; height:2.5rem; border-radius:0.75rem; background:var(--ink); color:#fff; display:grid; place-items:center; font-size:0.875rem; font-weight:600; margin:0 0 1.2rem; }
+    .auth-panel h1 { font-size:1.5rem; line-height:1.15; margin:0 0 0.4rem; font-weight:600; letter-spacing:-0.01em; color:var(--text); }
+    .auth-panel p { color:var(--muted); margin:0 0 1.5rem; line-height:1.55; font-size:0.875rem; }
+    .stack { display:grid; gap:0.9rem; }
+    .split { display:grid; grid-template-columns: 1fr 1fr; gap:0.75rem; }
+    .notice { border:1px solid var(--line); background:var(--surface-muted); padding:0.7rem 0.8rem; border-radius:0.5rem; color:var(--muted); font-size:0.8125rem; line-height:1.5; }
+    .choice-field { border:1px solid var(--line); border-radius:0.5rem; padding:0.85rem; display:grid; gap:0.7rem; }
+    .choice-field legend { padding:0 0.3rem; color:var(--text); font-size:0.875rem; font-weight:600; }
+    .choice-field p { margin:0; color:var(--muted); font-size:0.8125rem; line-height:1.5; }
+    .auth-shell .radio-option { display:flex; align-items:flex-start; gap:0.55rem; color:var(--text); font-size:0.875rem; line-height:1.4; }
+    .auth-shell .radio-option input { width:auto; margin:0.2rem 0 0; flex:none; }
+    .warning { display:flex; align-items:flex-start; gap:0.45rem; border:1px solid var(--line-strong); background:var(--surface-muted); border-radius:0.5rem; padding:0.6rem 0.7rem; color:var(--text); font-size:0.8125rem; line-height:1.45; }
+    .warning[hidden] { display:none; }
+    .warning-icon { width:14px; height:14px; flex:none; margin-top:0.1rem; background-repeat:no-repeat; background-size:14px; background-image:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='14' height='14' viewBox='0 0 24 24' fill='none' stroke='%2318181b' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M10.29 3.86 1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0Z'/%3E%3Cline x1='12' y1='9' x2='12' y2='13'/%3E%3Cline x1='12' y1='17' x2='12.01' y2='17'/%3E%3C/svg%3E"); }
+    .provider-list { display:grid; gap:0.65rem; }
+    .provider-divider { display:flex; align-items:center; gap:0.75rem; color:var(--muted); font-size:0.75rem; text-transform:uppercase; letter-spacing:0.04em; }
+    .provider-divider::before, .provider-divider::after { content:""; height:1px; background:var(--line); flex:1; }
+    .error { color:var(--text); font-weight:500; min-height:1.4rem; font-size:0.875rem; }
+    .error:not(:empty) { display:flex; align-items:center; gap:0.4rem; }
+    .error:not(:empty)::before { content:""; width:14px; height:14px; flex:none; background-repeat:no-repeat; background-size:14px; background-image:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='14' height='14' viewBox='0 0 24 24' fill='none' stroke='%2318181b' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'/%3E%3Cline x1='12' y1='8' x2='12' y2='12'/%3E%3Cline x1='12' y1='16' x2='12.01' y2='16'/%3E%3C/svg%3E"); }
+    .auth-footer { margin-top:1rem; color:var(--muted); font-size:0.8125rem; line-height:1.5; text-align:center; }
+    .auth-footer a { font-weight:500; }
+    ${options.style ?? ""}
+  </style>
+</head>
+<body>
+${body}
+${bodyAssets ? `${bodyAssets}\n` : ""}${options.script ? `<script>${options.script}</script>` : ""}
+</body>
+</html>`;
+}
+function localDevSessionButtons(config) {
+    const personas = resolveRaybaseDevPersonas(config);
+    if (personas.length === 1) {
+        return `<button id="dev-session" class="secondary" data-dev-session-email="${escapeHtml(personas[0].email)}">Use local ${escapeHtml(devPersonaLabel(personas[0]))} persona</button>`;
+    }
+    return `<div class="stack">${personas
+        .map((persona) => {
+        return `<button class="secondary" data-dev-session-email="${escapeHtml(persona.email)}">Use ${escapeHtml(persona.name)} (${escapeHtml(devPersonaLabel(persona))})</button>`;
+    })
+        .join("")}</div>`;
+}
+function devPersonaLabel(persona) {
+    const role = persona.role || "user";
+    return raybaseDevPersonaOperatorRole(persona) ? `Raybase Operator Admin - ${role}` : role;
+}
+function providerButtons(providers, divider = true) {
+    if (!providers?.length)
+        return "";
+    return `${divider ? `<div class="provider-divider">or</div>
+      ` : ""}<div class="provider-list">
+        ${providers
+        .map((provider) => `<button class="secondary external-provider" type="button" data-provider-id="${escapeHtml(provider.id)}">Continue with ${escapeHtml(provider.label)}</button>`)
+        .join("")}
+      </div>`;
+}
+export function loginPage(config, message = "", options = {}) {
+    const passwordReset = authEmailFeatureEnabled(config, "passwordReset");
+    const magicLink = authEmailFeatureEnabled(config, "magicLink");
+    const emailCode = authEmailFeatureEnabled(config, "emailCode");
+    const signupLink = publicSignupEnabled(config)
+        ? `<p class="auth-footer">Need an account? <a href="/signup">Sign up</a></p>`
+        : "";
+    return page("Sign in", `<main class="auth-shell">
+  <section class="auth-panel">
+    <div class="auth-mark">${escapeHtml((config.appName?.[0] ?? "A").toUpperCase())}</div>
+    <h1>${escapeHtml(config.appName)}</h1>
+    <p>Sign in with a passkey. Password sign-in is available as a fallback for invited users.</p>
+    <div class="stack">
+      ${options.local ? localDevSessionButtons(config) : ""}
+      ${providerButtons(options.externalProviders)}
+      <button id="passkey">Use passkey</button>
+      <form id="password" class="stack">
+        <label>Email <input name="email" type="email" autocomplete="username" required></label>
+        <label>Password <input name="password" type="password" autocomplete="current-password" required></label>
+        <button class="secondary" type="submit">Sign in with password</button>
+      </form>
+      ${magicLink ? `<form id="magic-link" class="stack">
+        <label>Email link <input name="email" type="email" autocomplete="username" required></label>
+        <button class="secondary" type="submit">Send sign-in link</button>
+      </form>` : ""}
+      ${emailCode ? `<form id="email-code" class="stack">
+        <label>Email code <input name="email" type="email" autocomplete="username" required></label>
+        <button class="secondary" type="submit">Email me a code</button>
+      </form>
+      <form id="email-code-verify" class="stack" hidden>
+        <label>Sign-in code <input name="code" inputmode="numeric" autocomplete="one-time-code" required></label>
+        <button class="secondary" type="submit">Sign in with code</button>
+      </form>` : ""}
+      ${passwordReset ? `<p><a href="/forgot-password">Forgot password?</a></p>` : ""}
+      <div class="error" id="error">${escapeHtml(message)}</div>
+    </div>
+    ${signupLink}
+  </section>
+</main>`, { appName: config.appName, script: authBrowserScript("login", { magicLink, emailCode }) });
+}
+export function forgotPasswordPage(config, message = "") {
+    return page("Reset password", `<main class="auth-shell">
+  <section class="auth-panel">
+    <div class="auth-mark">${escapeHtml((config.appName?.[0] ?? "A").toUpperCase())}</div>
+    <h1>Reset password</h1>
+    <p>Enter your email and Raybase will send a password reset link if the account exists.</p>
+    <form id="forgot-password" class="stack">
+      <label>Email <input name="email" type="email" autocomplete="username" required></label>
+      <button type="submit">Send reset link</button>
+      <div class="notice" id="notice" hidden>If that account exists, a reset link has been sent.</div>
+      <div class="error" id="error">${escapeHtml(message)}</div>
+    </form>
+  </section>
+</main>`, { appName: config.appName, script: forgotPasswordScript() });
+}
+export function resetPasswordPage(config, token = "", message = "") {
+    return page("Set new password", `<main class="auth-shell">
+  <section class="auth-panel">
+    <div class="auth-mark">${escapeHtml((config.appName?.[0] ?? "A").toUpperCase())}</div>
+    <h1>Set new password</h1>
+    <p>Choose a new password fallback for this Raybase account.</p>
+    <form id="reset-password" class="stack">
+      <input name="token" type="hidden" value="${escapeHtml(token)}">
+      <label>New password <input name="newPassword" type="password" autocomplete="new-password" minlength="10" required></label>
+      <button type="submit">Update password</button>
+      <div class="notice" id="notice" hidden>Password updated. You can sign in now.</div>
+      <div class="error" id="error">${escapeHtml(message)}</div>
+    </form>
+  </section>
+</main>`, { appName: config.appName, script: resetPasswordScript() });
+}
+export function verifyEmailPage(config, token = "", email = "", message = "") {
+    return page("Verify email", `<main class="auth-shell">
+  <section class="auth-panel">
+    <div class="auth-mark">${escapeHtml((config.appName?.[0] ?? "A").toUpperCase())}</div>
+    <h1>Verify your email</h1>
+    <p>Open the verification link from your email to finish creating your account.</p>
+    <form id="verify-email" class="stack">
+      <input name="token" type="hidden" value="${escapeHtml(token)}">
+      <label>Email <input name="email" type="email" autocomplete="username" value="${escapeHtml(email)}"></label>
+      <button type="submit">${token ? "Verify email" : "Resend verification email"}</button>
+      <div class="notice" id="notice" hidden></div>
+      <div class="error" id="error">${escapeHtml(message)}</div>
+    </form>
+    <p class="auth-footer">Already verified? <a href="/login">Sign in</a></p>
+  </section>
+</main>`, { appName: config.appName, script: verifyEmailScript() });
+}
+export function signupPage(config, message = "", options = {}) {
+    // `signupPage` is a public export, so it keeps the call shape it was released
+    // with and reads the mode itself. The `/signup` handler answers 404 before
+    // this page in invite-only mode; the page has always drawn the form for any
+    // config it is handed, and still does — except in the one mode that closes
+    // the password door.
+    const passwordSignup = resolveSignupMode(config) !== "provider-only";
+    return page("Sign up", `<main class="auth-shell">
+  <section class="auth-panel">
+    <div class="auth-mark">${escapeHtml((config.appName?.[0] ?? "A").toUpperCase())}</div>
+    <h1>Create your account</h1>
+    <p>Create an account for ${escapeHtml(config.appName)}.</p>
+    ${providerButtons(options.externalProviders, passwordSignup)}
+    ${passwordSignup ? `<form id="signup" class="stack">
+      <label>Email <input name="email" type="email" autocomplete="username" required></label>
+      <label>Name <input name="name" autocomplete="name"></label>
+      <label>Password <input name="password" type="password" autocomplete="new-password" minlength="10" required></label>
+      <div class="notice">After the account is created, this device can register a passkey.</div>
+      <button type="submit">Create account</button>
+      <div class="error" id="error">${escapeHtml(message)}</div>
+    </form>` : `${options.externalProviders?.length ? "" : `<p>No sign-in provider is configured.</p>\n    `}<div class="error" id="error">${escapeHtml(message)}</div>`}
+    <p class="auth-footer">Already have an account? <a href="/login">Sign in</a></p>
+  </section>
+</main>`, { appName: config.appName, script: authBrowserScript("signup") });
+}
+// Rendered when a signed-in non-admin navigates to /admin, a browser
+// destination where the admin wall should be a page, not a JSON error body.
+export function accessDeniedPage(config) {
+    return page("Admin access required", `<main class="auth-shell">
+  <section class="auth-panel">
+    <div class="auth-mark">${escapeHtml((config.appName?.[0] ?? "A").toUpperCase())}</div>
+    <h1>Admin access required</h1>
+    <p>You're signed in, but the admin area is reserved for admins of ${escapeHtml(config.appName)}. If you think you need access, ask the person who runs this app.</p>
+    <p><a href="/">Go to the app</a></p>
+  </section>
+</main>`, { appName: config.appName });
+}
+export function setupPage(config, token, purpose, email = "", options = {}) {
+    const title = purpose === "owner-setup" ? "Create owner account" : "Accept invite";
+    return page(title, `<main class="auth-shell">
+  <section class="auth-panel">
+    <div class="auth-mark">${escapeHtml((config.appName?.[0] ?? "A").toUpperCase())}</div>
+    <h1>${escapeHtml(title)}</h1>
+    <p>${purpose === "owner-setup" ? "This one-time link creates the first owner. It expires after 24 hours." : "Create your account to join this internal app."}</p>
+    <form id="setup" class="stack">
+      <input name="token" type="hidden" value="${escapeHtml(token)}">
+      <input name="purpose" type="hidden" value="${escapeHtml(purpose)}">
+      <label>Email <input name="email" type="email" autocomplete="username" value="${escapeHtml(email)}" required></label>
+      <label>Name <input name="name" autocomplete="name" required></label>
+      <label>Password <input name="password" type="password" autocomplete="new-password" minlength="10" required></label>
+      ${purpose === "owner-setup"
+        ? `<fieldset class="choice-field">
+        <legend>Receive important updates from Raybase?</legend>
+        <p>We'll use the owner email for important Raybase Core updates, including critical security notices.</p>
+        <label class="radio-option"><input name="raybaseUpdates" type="radio" value="yes" required> Yes, send me important updates from Raybase.</label>
+        <label class="radio-option"><input name="raybaseUpdates" type="radio" value="no" required> No, do not send me Raybase updates.</label>
+        <div class="warning" id="raybase-updates-warning" hidden><span class="warning-icon" aria-hidden="true"></span><span>This will prevent you receiving critical security updates</span></div>
+      </fieldset>`
+        : ""}
+      ${providerButtons(options.externalProviders)}
+      <div class="notice">After the account is created, Raybase will ask this device to register a passkey.</div>
+      <button type="submit">Create account</button>
+      <div class="error" id="error"></div>
+    </form>
+  </section>
+</main>`, { appName: config.appName, script: authBrowserScript("setup") });
+}
+function authBrowserScript(mode, options = {}) {
+    return `
+const errorBox = document.getElementById("error");
+const setError = (message) => { if (errorBox) errorBox.textContent = message || ""; };
+const postJson = async (url, body) => {
+  const res = await fetch(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.error || "Request failed");
+  return data;
+};
+const getJson = async (url) => {
+  const res = await fetch(url);
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.error || "Request failed");
+  return data;
+};
+const credentialToJSON = (credential) => {
+  if (credential.toJSON) return credential.toJSON();
+  const encode = (buffer) => btoa(String.fromCharCode(...new Uint8Array(buffer))).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/g, "");
+  const response = credential.response;
+  if (response.attestationObject) {
+    return {
+      id: credential.id,
+      rawId: encode(credential.rawId),
+      type: credential.type,
+      authenticatorAttachment: credential.authenticatorAttachment,
+      clientExtensionResults: credential.getClientExtensionResults(),
+      response: {
+        clientDataJSON: encode(response.clientDataJSON),
+        attestationObject: encode(response.attestationObject),
+        transports: response.getTransports ? response.getTransports() : []
+      }
+    };
+  }
+  return {
+    id: credential.id,
+    rawId: encode(credential.rawId),
+    type: credential.type,
+    authenticatorAttachment: credential.authenticatorAttachment,
+    clientExtensionResults: credential.getClientExtensionResults(),
+    response: {
+      clientDataJSON: encode(response.clientDataJSON),
+      authenticatorData: encode(response.authenticatorData),
+      signature: encode(response.signature),
+      userHandle: response.userHandle ? encode(response.userHandle) : undefined
+    }
+  };
+};
+const decode = (value) => {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes.buffer;
+};
+const creationOptions = (options) => {
+  if (window.PublicKeyCredential?.parseCreationOptionsFromJSON) return PublicKeyCredential.parseCreationOptionsFromJSON(options);
+  return { ...options, challenge: decode(options.challenge), user: { ...options.user, id: decode(options.user.id) }, excludeCredentials: (options.excludeCredentials || []).map((item) => ({ ...item, id: decode(item.id) })) };
+};
+const requestOptions = (options) => {
+  if (window.PublicKeyCredential?.parseRequestOptionsFromJSON) return PublicKeyCredential.parseRequestOptionsFromJSON(options);
+  return { ...options, challenge: decode(options.challenge), allowCredentials: (options.allowCredentials || []).map((item) => ({ ...item, id: decode(item.id) })) };
+};
+const registerPasskey = async () => {
+  if (!window.PublicKeyCredential) return;
+  const options = await getJson("/api/auth/passkey/generate-register-options");
+  const credential = await navigator.credentials.create({ publicKey: creationOptions(options) });
+  await postJson("/api/auth/passkey/verify-registration", { response: credentialToJSON(credential) });
+};
+// A next path has to be a path. The URL parser strips TAB, CR and LF before
+// parsing, so "/\\t//evil.com" would otherwise arrive as "//evil.com" and carry
+// a completed sign-in to another origin; a backslash does the same in browsers
+// that fold it to a slash.
+const nextPathPattern = /^\\/(?!\\/)[^\\\\\\x00-\\x1f\\x7f]*$/;
+const nextPath = () => {
+  const url = new URL(location.href);
+  const next = url.searchParams.get("next");
+  if (next && nextPathPattern.test(next)) return next;
+  return location.pathname === "/login" || location.pathname === "/signup" ? "/" : location.pathname + location.search;
+};
+// The same provider button on /login and /signup: one Core route starts the
+// redirect, and whether it may create an account is the app's signup mode,
+// decided server-side.
+if (${JSON.stringify(mode)} === "login" || ${JSON.stringify(mode)} === "signup") {
+  document.querySelectorAll(".external-provider").forEach((button) => button.addEventListener("click", async (event) => {
+    try {
+      setError("");
+      const providerId = event.currentTarget.dataset.providerId;
+      const result = await postJson("/api/auth/raybase/provider/login", { providerId, callbackURL: nextPath() });
+      if (!result.url) throw new Error("Provider sign-in did not return a redirect URL");
+      location.href = result.url;
+    } catch (error) {
+      setError(error.message);
+    }
+  }));
+}
+if (${JSON.stringify(mode)} === "login") {
+  document.querySelectorAll("[data-dev-session-email]").forEach((button) => button.addEventListener("click", async () => {
+    try {
+      setError("");
+      await postJson("/api/dev/session", { email: button.dataset.devSessionEmail });
+      location.href = nextPath();
+    } catch (error) {
+      setError(error.message);
+    }
+  }));
+  document.getElementById("passkey")?.addEventListener("click", async () => {
+    try {
+      setError("");
+      const options = await getJson("/api/auth/passkey/generate-authenticate-options");
+      const credential = await navigator.credentials.get({ publicKey: requestOptions(options) });
+      await postJson("/api/auth/passkey/verify-authentication", { response: credentialToJSON(credential) });
+      location.href = nextPath();
+    } catch (error) {
+      setError(error.message);
+    }
+  });
+  document.getElementById("password")?.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    try {
+      setError("");
+      const form = new FormData(event.currentTarget);
+      await postJson("/api/auth/login", Object.fromEntries(form));
+      location.href = nextPath();
+    } catch (error) {
+      setError(error.message);
+    }
+  });
+  if (${JSON.stringify(options.magicLink === true)}) {
+    document.getElementById("magic-link")?.addEventListener("submit", async (event) => {
+      event.preventDefault();
+      try {
+        setError("");
+        const form = new FormData(event.currentTarget);
+        const email = String(form.get("email") || "");
+        await postJson("/api/auth/sign-in/magic-link", { email, callbackURL: nextPath(), errorCallbackURL: "/login" });
+        setError("If that account exists, a sign-in link has been sent.");
+      } catch (error) {
+        setError(error.message);
+      }
+    });
+  }
+  if (${JSON.stringify(options.emailCode === true)}) {
+    const codeVerifyForm = document.getElementById("email-code-verify");
+    // The code is typed back here, so the address it was sent to has to survive
+    // the first step rather than being asked for twice.
+    let codeEmail = "";
+    document.getElementById("email-code")?.addEventListener("submit", async (event) => {
+      event.preventDefault();
+      try {
+        setError("");
+        const form = new FormData(event.currentTarget);
+        codeEmail = String(form.get("email") || "");
+        await postJson("/api/auth/email-otp/send-verification-otp", { email: codeEmail, type: "sign-in" });
+        if (codeVerifyForm) codeVerifyForm.hidden = false;
+        setError("If that account exists, a sign-in code has been sent.");
+      } catch (error) {
+        setError(error.message);
+      }
+    });
+    codeVerifyForm?.addEventListener("submit", async (event) => {
+      event.preventDefault();
+      try {
+        setError("");
+        const form = new FormData(event.currentTarget);
+        await postJson("/api/auth/sign-in/email-otp", { email: codeEmail, otp: String(form.get("code") || "") });
+        location.href = nextPath();
+      } catch (error) {
+        setError(error.message);
+      }
+    });
+  }
+}
+if (${JSON.stringify(mode)} === "setup") {
+  const updatesWarning = document.getElementById("raybase-updates-warning");
+  const syncUpdatesWarning = () => {
+    const choice = document.querySelector("input[name='raybaseUpdates']:checked");
+    if (updatesWarning) updatesWarning.hidden = choice?.value !== "no";
+  };
+  document.querySelectorAll("input[name='raybaseUpdates']").forEach((input) => input.addEventListener("change", syncUpdatesWarning));
+  syncUpdatesWarning();
+  document.querySelectorAll(".external-provider").forEach((button) => button.addEventListener("click", async (event) => {
+    try {
+      setError("");
+      const formElement = document.getElementById("setup");
+      const form = new FormData(formElement);
+      const result = await postJson("/api/auth/raybase/provider/setup", {
+        ...Object.fromEntries(form),
+        providerId: event.currentTarget.dataset.providerId,
+        callbackURL: "/api/auth/raybase/provider/complete"
+      });
+      if (!result.url) throw new Error("Provider setup did not return a redirect URL");
+      location.href = result.url;
+    } catch (error) {
+      setError(error.message);
+    }
+  }));
+  document.getElementById("setup")?.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    try {
+      setError("");
+      const form = new FormData(event.currentTarget);
+      const result = await postJson("/api/auth/setup", Object.fromEntries(form));
+      try { await registerPasskey(); } catch (error) { console.warn("Passkey registration skipped", error); }
+      // The server decides the landing page (admins -> /admin, users -> /);
+      // guard like nextPath so only same-origin paths are followed.
+      const target = typeof result.redirect === "string" && result.redirect.startsWith("/") && !result.redirect.startsWith("//") ? result.redirect : "/";
+      location.href = target;
+    } catch (error) {
+      setError(error.message);
+    }
+  });
+}
+if (${JSON.stringify(mode)} === "signup") {
+  document.getElementById("signup")?.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    try {
+      setError("");
+      const form = new FormData(event.currentTarget);
+      const result = await postJson("/api/auth/signup", Object.fromEntries(form));
+      try { await registerPasskey(); } catch (error) { console.warn("Passkey registration skipped", error); }
+      const target = typeof result.redirect === "string" && result.redirect.startsWith("/") && !result.redirect.startsWith("//") ? result.redirect : "/";
+      location.href = target;
+    } catch (error) {
+      setError(error.message);
+    }
+  });
+}
+`;
+}
+function forgotPasswordScript() {
+    return `
+const errorBox = document.getElementById("error");
+const notice = document.getElementById("notice");
+const setError = (message) => { if (errorBox) errorBox.textContent = message || ""; };
+document.getElementById("forgot-password")?.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  try {
+    setError("");
+    if (notice) notice.hidden = true;
+    const form = new FormData(event.currentTarget);
+    const res = await fetch("/api/auth/request-password-reset", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: String(form.get("email") || ""), redirectTo: "/reset-password" })
+    });
+    if (!res.ok) {
+      const data = await res.json().catch(() => ({}));
+      throw new Error(data.error || "Request failed");
+    }
+    if (notice) notice.hidden = false;
+  } catch (error) {
+    setError(error.message);
+  }
+});
+`;
+}
+function resetPasswordScript() {
+    return `
+const errorBox = document.getElementById("error");
+const notice = document.getElementById("notice");
+const setError = (message) => { if (errorBox) errorBox.textContent = message || ""; };
+document.getElementById("reset-password")?.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  try {
+    setError("");
+    if (notice) notice.hidden = true;
+    const url = new URL(location.href);
+    const form = new FormData(event.currentTarget);
+    const token = String(form.get("token") || url.searchParams.get("token") || "");
+    const res = await fetch("/api/auth/reset-password", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token, newPassword: String(form.get("newPassword") || "") })
+    });
+    if (!res.ok) {
+      const data = await res.json().catch(() => ({}));
+      throw new Error(data.error || "Reset failed");
+    }
+    if (notice) notice.hidden = false;
+  } catch (error) {
+    setError(error.message);
+  }
+});
+`;
+}
+function verifyEmailScript() {
+    return `
+const errorBox = document.getElementById("error");
+const notice = document.getElementById("notice");
+const setError = (message) => { if (errorBox) errorBox.textContent = message || ""; };
+const setNotice = (message) => { if (notice) { notice.textContent = message || ""; notice.hidden = !message; } };
+const verifyToken = async (token) => {
+  const res = await fetch("/api/auth/verify-email?token=" + encodeURIComponent(token));
+  if (!res.ok) {
+    const data = await res.json().catch(() => ({}));
+    throw new Error(data.error || data.message || "Verification failed");
+  }
+};
+const verifyFromLocation = async () => {
+  const url = new URL(location.href);
+  const token = url.searchParams.get("token") || "";
+  if (!token) return;
+  try {
+    setError("");
+    setNotice("");
+    await verifyToken(token);
+    setNotice("Email verified. You can sign in now.");
+  } catch (error) {
+    setError(error.message);
+  }
+};
+void verifyFromLocation();
+document.getElementById("verify-email")?.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  try {
+    setError("");
+    setNotice("");
+    const url = new URL(location.href);
+    const form = new FormData(event.currentTarget);
+    const token = String(form.get("token") || url.searchParams.get("token") || "");
+    if (token) {
+      await verifyToken(token);
+      setNotice("Email verified. You can sign in now.");
+      return;
+    }
+    const email = String(form.get("email") || "");
+    const res = await fetch("/api/auth/send-verification-email", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, callbackURL: "/" })
+    });
+    if (!res.ok) {
+      const data = await res.json().catch(() => ({}));
+      throw new Error(data.error || data.message || "Request failed");
+    }
+    setNotice("If that account exists and needs verification, a new link has been sent.");
+  } catch (error) {
+    setError(error.message);
+  }
+});
+`;
+}
+function authEmailFeatureEnabled(config, feature) {
+    const email = config.auth?.email;
+    if (email?.provider !== "cloudflare" || !email.from)
+        return false;
+    if (feature === "magicLink")
+        return email.magicLink?.enabled === true;
+    if (feature === "emailCode")
+        return email.emailCode?.enabled === true;
+    return email.passwordReset?.enabled !== false;
+}
+//# sourceMappingURL=html.js.map

package/dist/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../src/html.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAA0B,MAAM,yBAAyB,CAAC;AAO3H,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAQD,8EAA8E;AAC9E,+EAA+E;AAC/E,wCAAwC;AACxC,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC9F,MAAM,GAAG,GAAG,gQAAgQ,MAAM,eAAe,CAAC;IAClS,OAAO,sBAAsB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA+B,EAAE,SAA0B;IACpF,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,IAAI,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,kCAAkC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG,CAAC;QACxH,IAAI,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG;YAAE,OAAO,gBAAgB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,SAAS,kBAAkB,CAAC;QACnH,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,KAAa,EACb,IAAY,EACZ,UAA4G,EAAE;IAE9G,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC;IAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO;;;;;2BAKkB,cAAc,CAAC,OAAO,CAAC;WACvC,UAAU,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC;EACnD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,UAAU,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA4CxG,OAAO,CAAC,KAAK,IAAI,EAAE;;;;EAIvB,IAAI;EACJ,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,EAAE;;QAE1F,CAAC;AACT,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAqB;IACnD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,sEAAsE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACvL,CAAC;IACD,OAAO,sBAAsB,QAAQ;SAClC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,OAAO,qDAAqD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC;IAC9K,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,OAA0B;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;IACpC,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,SAAiD,EAAE,OAAO,GAAG,IAAI;IACxF,IAAI,CAAC,SAAS,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;OACf,CAAC,CAAC,CAAC,EAAE;UACF,SAAS;SACR,GAAG,CACF,CAAC,QAAQ,EAAE,EAAE,CACX,+EAA+E,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,mBAAmB,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CACjK;SACA,IAAI,CAAC,EAAE,CAAC;aACN,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAqB,EAAE,OAAO,GAAG,EAAE,EAAE,UAA+E,EAAE;IAC9I,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/D,MAAM,UAAU,GACd,mBAAmB,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,IAAI,CACT,SAAS,EACT;;6BAEyB,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;UACzE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;;;QAG5B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QACnD,eAAe,CAAC,OAAO,CAAC,iBAAiB,CAAC;;;;;;;QAO1C,SAAS,CAAC,CAAC,CAAC;;;cAGN,CAAC,CAAC,CAAC,EAAE;QACX,SAAS,CAAC,CAAC,CAAC;;;;;;;cAON,CAAC,CAAC,CAAC,EAAE;QACX,aAAa,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,EAAE;sCAC/C,UAAU,CAAC,OAAO,CAAC;;MAEnD,UAAU;;QAER,EACJ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAqB,EAAE,OAAO,GAAG,EAAE;IACpE,OAAO,IAAI,CACT,gBAAgB,EAChB;;6BAEyB,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;;;;;;;sCAO7C,UAAU,CAAC,OAAO,CAAC;;;QAGjD,EACJ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,KAAK,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE;IAC/E,OAAO,IAAI,CACT,kBAAkB,EAClB;;6BAEyB,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;;;;iDAIlC,UAAU,CAAC,KAAK,CAAC;;;;sCAI5B,UAAU,CAAC,OAAO,CAAC;;;QAGjD,EACJ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE;IACzF,OAAO,IAAI,CACT,cAAc,EACd;;6BAEyB,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;;;;iDAIlC,UAAU,CAAC,KAAK,CAAC;qFACmB,UAAU,CAAC,KAAK,CAAC;8BACxE,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,2BAA2B;;sCAE5C,UAAU,CAAC,OAAO,CAAC;;;;QAIjD,EACJ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAqB,EACrB,OAAO,GAAG,EAAE,EACZ,UAA8D,EAAE;IAEhE,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,qBAAqB;IACrB,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC;IACrE,OAAO,IAAI,CACT,SAAS,EACT;;6BAEyB,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;;+BAEpD,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;MACnD,eAAe,CAAC,OAAO,CAAC,iBAAiB,EAAE,cAAc,CAAC;MAC1D,cAAc,CAAC,CAAC,CAAC;;;;;;sCAMe,UAAU,CAAC,OAAO,CAAC;YAC7C,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iDAAiD,iCAAiC,UAAU,CAAC,OAAO,CAAC,QAAQ;;;QAGhK,EACJ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CACjE,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,IAAI,CACT,uBAAuB,EACvB;;6BAEyB,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;;wEAEX,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;;;QAG1F,EACJ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,MAAqB,EACrB,KAAa,EACb,OAAiC,EACjC,KAAK,GAAG,EAAE,EACV,UAA8D,EAAE;IAEhE,MAAM,KAAK,GAAG,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,eAAe,CAAC;IACnF,OAAO,IAAI,CACT,KAAK,EACL;;6BAEyB,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;UACzE,UAAU,CAAC,KAAK,CAAC;SAClB,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC,CAAC,gDAAgD;;iDAE/G,UAAU,CAAC,KAAK,CAAC;mDACf,UAAU,CAAC,OAAO,CAAC;qFACe,UAAU,CAAC,KAAK,CAAC;;;QAI9F,OAAO,KAAK,aAAa;QACvB,CAAC,CAAC;;;;;;kBAMM;QACR,CAAC,CAAC,EACN;QACE,eAAe,CAAC,OAAO,CAAC,iBAAiB,CAAC;;;;;;QAM1C,EACJ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAkC,EAAE,UAAwD,EAAE;IACvH,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAkFH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;;;;;;;;;;MAa3D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAgClB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC;;;;;;;;;;;;;;QAc1C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA+B5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAwCpB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;CAezB,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;CAwBR,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BR,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDR,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAqB,EAAE,OAAoD;IAC1G,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;IACjC,IAAI,KAAK,EAAE,QAAQ,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;IACtE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC,aAAa,EAAE,OAAO,KAAK,KAAK,CAAC;AAChD,CAAC"}