@raybase/core 0.0.2 → 0.3.4

package/dist/auth-schema.js

@@ -0,0 +1,285 @@
+export const authUserTableName = "_auth_users";
+export const authSessionTableName = "_auth_sessions";
+export const authAccountTableName = "_auth_accounts";
+export const authVerificationTableName = "_auth_verifications";
+export const authPasskeyTableName = "_auth_passkeys";
+export const authPasswordSecretStateTableName = "_auth_password_secret_state";
+export const authPasswordProviderStateTableName = "_auth_password_provider_state";
+export const raybaseSystemTableSql = `
+CREATE TABLE IF NOT EXISTS "_auth_users" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "name" TEXT NOT NULL,
+  "email" TEXT NOT NULL,
+  "emailVerified" INTEGER NOT NULL DEFAULT false,
+  "image" TEXT,
+  "createdAt" INTEGER NOT NULL,
+  "updatedAt" INTEGER NOT NULL,
+  "operatorRole" TEXT,
+  "appRoles" TEXT,
+  "banned" INTEGER DEFAULT false,
+  "banReason" TEXT,
+  "banExpires" INTEGER
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "_auth_users_email_unique" ON "_auth_users" ("email");
+CREATE INDEX IF NOT EXISTS "_auth_users_email_idx" ON "_auth_users" ("email");
+
+CREATE TABLE IF NOT EXISTS "_auth_sessions" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "userId" TEXT NOT NULL,
+  "token" TEXT NOT NULL,
+  "expiresAt" INTEGER NOT NULL,
+  "ipAddress" TEXT,
+  "userAgent" TEXT,
+  "createdAt" INTEGER NOT NULL,
+  "updatedAt" INTEGER NOT NULL,
+  "impersonatedBy" TEXT,
+  FOREIGN KEY ("userId") REFERENCES "_auth_users"("id") ON UPDATE no action ON DELETE cascade
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "_auth_sessions_token_unique" ON "_auth_sessions" ("token");
+CREATE INDEX IF NOT EXISTS "_auth_sessions_user_id_idx" ON "_auth_sessions" ("userId");
+CREATE INDEX IF NOT EXISTS "_auth_sessions_token_idx" ON "_auth_sessions" ("token");
+
+CREATE TABLE IF NOT EXISTS "_auth_accounts" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "accountId" TEXT NOT NULL,
+  "providerId" TEXT NOT NULL,
+  "userId" TEXT NOT NULL,
+  "accessToken" TEXT,
+  "refreshToken" TEXT,
+  "idToken" TEXT,
+  "accessTokenExpiresAt" INTEGER,
+  "refreshTokenExpiresAt" INTEGER,
+  "scope" TEXT,
+  "password" TEXT,
+  "createdAt" INTEGER NOT NULL,
+  "updatedAt" INTEGER NOT NULL,
+  FOREIGN KEY ("userId") REFERENCES "_auth_users"("id") ON UPDATE no action ON DELETE cascade
+);
+
+CREATE INDEX IF NOT EXISTS "_auth_accounts_user_id_idx" ON "_auth_accounts" ("userId");
+CREATE INDEX IF NOT EXISTS "_auth_accounts_provider_idx" ON "_auth_accounts" ("providerId","accountId");
+
+CREATE TABLE IF NOT EXISTS "_auth_verifications" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "identifier" TEXT NOT NULL,
+  "value" TEXT NOT NULL,
+  "expiresAt" INTEGER NOT NULL,
+  "createdAt" INTEGER,
+  "updatedAt" INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS "_auth_verifications_identifier_idx" ON "_auth_verifications" ("identifier");
+
+CREATE TABLE IF NOT EXISTS "_auth_passkeys" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "name" TEXT,
+  "publicKey" TEXT NOT NULL,
+  "userId" TEXT NOT NULL,
+  "credentialID" TEXT NOT NULL,
+  "counter" INTEGER NOT NULL,
+  "deviceType" TEXT NOT NULL,
+  "backedUp" INTEGER NOT NULL,
+  "transports" TEXT,
+  "createdAt" INTEGER,
+  "aaguid" TEXT,
+  FOREIGN KEY ("userId") REFERENCES "_auth_users"("id") ON UPDATE no action ON DELETE cascade
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "_auth_passkeys_credentialID_unique" ON "_auth_passkeys" ("credentialID");
+CREATE INDEX IF NOT EXISTS "_auth_passkeys_user_id_idx" ON "_auth_passkeys" ("userId");
+CREATE INDEX IF NOT EXISTS "_auth_passkeys_credential_id_idx" ON "_auth_passkeys" ("credentialID");
+
+CREATE TABLE IF NOT EXISTS "_auth_password_secret_state" (
+  "userId" TEXT NOT NULL,
+  "purpose" TEXT NOT NULL,
+  "salt" TEXT NOT NULL,
+  "kdfAlgorithm" TEXT NOT NULL,
+  "kdfVersion" INTEGER NOT NULL,
+  "kdfIterations" INTEGER NOT NULL,
+  "kdfOutputBytes" INTEGER NOT NULL,
+  "passwordVersion" INTEGER NOT NULL DEFAULT 0,
+  "pendingEvent" TEXT,
+  "providerId" TEXT,
+  "providerVersion" TEXT,
+  "readiness" TEXT NOT NULL DEFAULT 'needs-login',
+  "lastSuccessEvent" TEXT,
+  "lastSuccessAt" TEXT,
+  "lastFailureCode" TEXT,
+  "lastFailureAt" TEXT,
+  "destructiveResetAt" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  PRIMARY KEY ("userId", "purpose"),
+  FOREIGN KEY ("userId") REFERENCES "_auth_users"("id") ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS "_auth_password_secret_readiness_idx"
+  ON "_auth_password_secret_state" ("providerId", "providerVersion", "readiness");
+
+CREATE TABLE IF NOT EXISTS "_auth_password_provider_state" (
+  "userId" TEXT NOT NULL,
+  "purpose" TEXT NOT NULL,
+  "providerId" TEXT NOT NULL,
+  "stateKey" TEXT NOT NULL,
+  "value" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  PRIMARY KEY ("userId", "purpose", "providerId", "stateKey"),
+  FOREIGN KEY ("userId", "purpose") REFERENCES "_auth_password_secret_state"("userId", "purpose") ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS "_invites" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "tokenHash" TEXT NOT NULL UNIQUE,
+  "email" TEXT,
+  "role" TEXT NOT NULL,
+  "roles" TEXT NOT NULL DEFAULT '["user"]',
+  "status" TEXT NOT NULL DEFAULT 'pending',
+  "createdBy" TEXT,
+  "note" TEXT,
+  "expiresAt" TEXT NOT NULL,
+  "usedAt" TEXT,
+  "createdAt" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  FOREIGN KEY ("createdBy") REFERENCES "_auth_users"("id") ON DELETE SET NULL
+);
+
+CREATE TABLE IF NOT EXISTS "_used_tokens" (
+  "jti" TEXT PRIMARY KEY NOT NULL,
+  "purpose" TEXT NOT NULL,
+  "usedAt" TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "_auth_pending" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "purpose" TEXT NOT NULL,
+  "tokenJti" TEXT NOT NULL,
+  "tokenHash" TEXT NOT NULL,
+  "providerId" TEXT NOT NULL,
+  "expectedEmail" TEXT,
+  "operatorRole" TEXT,
+  "appRoles" TEXT NOT NULL,
+  "nonceHash" TEXT NOT NULL,
+  "status" TEXT NOT NULL DEFAULT 'started',
+  "updatesChoice" TEXT,
+  "createdAt" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "expiresAt" TEXT NOT NULL,
+  "consumedAt" TEXT,
+  "error" TEXT
+);
+
+CREATE INDEX IF NOT EXISTS "_auth_pending_token_jti_idx" ON "_auth_pending" ("tokenJti");
+CREATE INDEX IF NOT EXISTS "_auth_pending_nonce_hash_idx" ON "_auth_pending" ("nonceHash");
+CREATE INDEX IF NOT EXISTS "_auth_pending_expires_at_idx" ON "_auth_pending" ("expiresAt");
+CREATE INDEX IF NOT EXISTS "_auth_pending_provider_id_idx" ON "_auth_pending" ("providerId");
+
+CREATE TABLE IF NOT EXISTS "_audit" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "actorKind" TEXT,
+  "actorId" TEXT,
+  "runAsKind" TEXT,
+  "runAsId" TEXT,
+  "action" TEXT NOT NULL,
+  "targetType" TEXT NOT NULL,
+  "targetId" TEXT,
+  "metadata" TEXT,
+  "createdAt" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  FOREIGN KEY ("actorId") REFERENCES "_auth_users"("id") ON DELETE SET NULL
+);
+
+CREATE INDEX IF NOT EXISTS "_audit_created_at_idx" ON "_audit" ("createdAt");
+CREATE INDEX IF NOT EXISTS "_audit_actor_idx" ON "_audit" ("actorId");
+
+CREATE TABLE IF NOT EXISTS "_audit_archives" (
+  "windowStart" TEXT PRIMARY KEY NOT NULL,
+  "windowEnd" TEXT NOT NULL,
+  "objectKey" TEXT NOT NULL,
+  "rowCount" INTEGER NOT NULL,
+  "firstCreatedAt" TEXT,
+  "lastCreatedAt" TEXT,
+  "sha256" TEXT NOT NULL,
+  "archivedAt" TEXT NOT NULL,
+  "prunedAt" TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "_audit_archives_object_key_idx" ON "_audit_archives" ("objectKey");
+
+CREATE TABLE IF NOT EXISTS "_changes" (
+  "seq" INTEGER PRIMARY KEY AUTOINCREMENT,
+  "tableName" TEXT NOT NULL,
+  "op" TEXT NOT NULL,
+  "rowId" TEXT NOT NULL,
+  "oldRow" TEXT,
+  "newRow" TEXT,
+  "actorId" TEXT,
+  "adminOverride" INTEGER NOT NULL DEFAULT 0,
+  "createdAt" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS "_changes_created_at_idx" ON "_changes" ("createdAt");
+CREATE INDEX IF NOT EXISTS "_changes_table_seq_idx" ON "_changes" ("tableName", "seq");
+
+CREATE TABLE IF NOT EXISTS "_state" (
+  "key" TEXT PRIMARY KEY NOT NULL,
+  "value" TEXT,
+  "updatedAt" TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "_settings" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "appId" TEXT NOT NULL,
+  "scope" TEXT NOT NULL,
+  "subjectId" TEXT NOT NULL,
+  "key" TEXT NOT NULL,
+  "valueJson" TEXT NOT NULL,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  "updatedBy" TEXT,
+  FOREIGN KEY ("updatedBy") REFERENCES "_auth_users"("id") ON DELETE SET NULL
+);
+
+CREATE INDEX IF NOT EXISTS "_settings_app_scope_subject_idx" ON "_settings" ("appId", "scope", "subjectId");
+CREATE INDEX IF NOT EXISTS "_settings_scope_subject_idx" ON "_settings" ("scope", "subjectId");
+CREATE INDEX IF NOT EXISTS "_settings_key_idx" ON "_settings" ("key");
+CREATE INDEX IF NOT EXISTS "_settings_updated_at_idx" ON "_settings" ("updatedAt");
+
+CREATE TABLE IF NOT EXISTS "_schema_versions" (
+  "targetId" TEXT PRIMARY KEY NOT NULL,
+  "kind" TEXT NOT NULL,
+  "version" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL
+);
+`;
+/**
+ * Core's non-auth system tables. A layered runtime can place these unchanged
+ * declarations in a physically isolated app store while keeping identity,
+ * session, invite, and token tables in its own control plane.
+ */
+export const raybaseApplicationSystemTableSql = raybaseSystemTableSql.slice(raybaseSystemTableSql.indexOf('CREATE TABLE IF NOT EXISTS "_audit"')).replace(/,\n  FOREIGN KEY \("(?:actorId|updatedBy)"\) REFERENCES "_auth_users"\("id"\) ON DELETE SET NULL/g, "");
+export const systemTableSql = raybaseSystemTableSql;
+export const authSchema = {
+    user: authUserTableName,
+    session: authSessionTableName,
+    account: authAccountTableName,
+    verification: authVerificationTableName,
+    passkey: authPasskeyTableName,
+    raybaseAuthPasswordSecretState: authPasswordSecretStateTableName,
+    raybaseAuthPasswordProviderState: authPasswordProviderStateTableName,
+    raybaseInvites: "_invites",
+    raybaseUsedTokens: "_used_tokens",
+    raybaseAuthPending: "_auth_pending",
+    raybaseAudit: "_audit",
+    raybaseAuditArchives: "_audit_archives",
+    raybaseChanges: "_changes",
+    raybaseState: "_state",
+    raybaseSettings: "_settings",
+    raybaseSchemaVersions: "_schema_versions"
+};
+export const betterAuthSchema = {
+    user: authUserTableName,
+    session: authSessionTableName,
+    account: authAccountTableName,
+    verification: authVerificationTableName,
+    passkey: authPasskeyTableName
+};
+//# sourceMappingURL=auth-schema.js.map

package/dist/auth-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAoFA,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,MAAM,CAAC,MAAM,gCAAgC,GAAG,6BAA6B,CAAC;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,+BAA+B,CAAC;AAElF,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoPpC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,KAAK,CACzE,qBAAqB,CAAC,OAAO,CAAC,qCAAqC,CAAC,CACrE,CAAC,OAAO,CACP,mGAAmG,EACnG,EAAE,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,oBAAoB;IAC7B,YAAY,EAAE,yBAAyB;IACvC,OAAO,EAAE,oBAAoB;IAC7B,8BAA8B,EAAE,gCAAgC;IAChE,gCAAgC,EAAE,kCAAkC;IACpE,cAAc,EAAE,UAAU;IAC1B,iBAAiB,EAAE,cAAc;IACjC,kBAAkB,EAAE,eAAe;IACnC,YAAY,EAAE,QAAQ;IACtB,oBAAoB,EAAE,iBAAiB;IACvC,cAAc,EAAE,UAAU;IAC1B,YAAY,EAAE,QAAQ;IACtB,eAAe,EAAE,WAAW;IAC5B,qBAAqB,EAAE,kBAAkB;CACjC,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,oBAAoB;IAC7B,YAAY,EAAE,yBAAyB;IACvC,OAAO,EAAE,oBAAoB;CACrB,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,321 @@
+import { type GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
+import { type BetterAuthOptions } from "better-auth";
+import { type RaybaseAdminRole } from "./admin-role.js";
+import { type RaybaseAuditContextEvent } from "./audit.js";
+import { type RaybasePasswordSecretLifecycleRegistration } from "./auth-password-secret.js";
+import { raybaseSystemTableSql, systemTableSql, type RaybaseAuthPendingRow } from "./auth-schema.js";
+import { type RaybaseDbEnv, type SqlExecutor } from "./db.js";
+import { type RaybaseAuthEmailFeature, type RaybaseEmailSendResult } from "./email.js";
+import { type RaybaseDevPersona } from "./local-dev-personas.js";
+import type { RaybaseRole, RaybaseUser } from "./policies.js";
+import { type RaybasePrincipal } from "./principal.js";
+import { type RaybaseConfig, type RaybaseExternalAuthProviderMetadata } from "./schema.js";
+export { raybaseSystemTableSql, systemTableSql };
+export declare const betterAuthSecretName = "BETTER_AUTH_SECRET";
+export declare const internalSignupHeader = "x-raybase-internal-signup";
+export declare const raybaseSignInLinkDefaultExpiresIn: number;
+export declare const raybaseSignInLinkMaximumExpiresIn: number;
+export type TokenPurpose = "owner-setup" | "invite";
+export type SignedTokenPayload = {
+    purpose: TokenPurpose;
+    jti: string;
+    exp: number;
+    email?: string;
+    role?: RaybaseRole;
+    operatorRole?: Exclude<RaybaseAdminRole, null>;
+    roles?: RaybaseRole[];
+    recovery?: boolean;
+};
+export type RaybaseAuthEnv = RaybaseDbEnv & {
+    BETTER_AUTH_SECRET?: string;
+    BETTER_AUTH_URL?: string;
+    PUBLIC_BETTER_AUTH_URL?: string;
+    BASE_URL?: string;
+    RAYBASE_AUTH_SECRET?: string;
+    RAYBASE_ENV?: string;
+};
+export type BetterAuthInstance = {
+    handler: (request: Request) => Promise<Response>;
+    api: Record<string, any>;
+};
+type BetterAuthSocialProviders = NonNullable<BetterAuthOptions["socialProviders"]>;
+export type RaybaseExternalAuthProvider = {
+    id: string;
+    label?: string;
+};
+export type RaybaseExternalBetterAuthConfig = {
+    providers?: RaybaseExternalAuthProvider[];
+    socialProviders?: BetterAuthSocialProviders;
+    genericOAuth?: GenericOAuthConfig[] | {
+        config: GenericOAuthConfig[];
+    };
+};
+export type RaybaseExternalAuthRuntime = {
+    providers?: RaybaseExternalAuthProvider[];
+    configure?: (ctx: {
+        env: RaybaseAuthEnv;
+        request?: Request;
+    }) => RaybaseExternalBetterAuthConfig | Promise<RaybaseExternalBetterAuthConfig>;
+};
+export type ResolvedRaybaseExternalAuth = RaybaseExternalBetterAuthConfig & {
+    providerIds: string[];
+};
+export type RaybaseAuthOptions = {
+    externalAuth?: ResolvedRaybaseExternalAuth;
+    passwordSecretLifecycle?: RaybasePasswordSecretLifecycleRegistration;
+    request?: Request;
+    emailQueue?: RaybaseQueuedAuthEmail[];
+    isLocal?: boolean;
+    skipEmailVerification?: boolean;
+};
+export type RaybaseCreateAuthOptions = RaybaseAuthOptions;
+export type ResolvedRaybaseSignInLinksConfig = {
+    enabled: boolean;
+    expiresIn: number;
+};
+export type RaybaseAuthPrincipal = {
+    identity: RaybaseUser;
+};
+export type RaybaseQueuedAuthEmailOutcome = {
+    status: "sent" | "skipped";
+    result: RaybaseEmailSendResult;
+} | {
+    status: "failed";
+    error: unknown;
+};
+export type RaybaseQueuedAuthEmail = {
+    task: Promise<RaybaseEmailSendResult>;
+    onSettled?: (outcome: RaybaseQueuedAuthEmailOutcome) => Promise<void> | void;
+};
+export declare function resolveRaybaseSignInLinksConfig(config: RaybaseConfig): ResolvedRaybaseSignInLinksConfig;
+export declare function assertRaybaseExternalProviderId(id: string): string;
+export declare function normalizeRaybaseExternalProviderMetadata(providers: RaybaseExternalAuthProviderMetadata[] | undefined, runtimeProviders?: RaybaseExternalAuthProvider[]): RaybaseExternalAuthProviderMetadata[];
+export declare function defineRaybaseExternalAuth(runtime: RaybaseExternalAuthRuntime): RaybaseExternalAuthRuntime;
+export declare function resolveRaybaseExternalAuth(env: RaybaseAuthEnv, runtime?: RaybaseExternalAuthRuntime, request?: Request): Promise<ResolvedRaybaseExternalAuth | undefined>;
+export declare function raybaseExternalProviderMetadata(config: RaybaseConfig, externalAuth?: ResolvedRaybaseExternalAuth): RaybaseExternalAuthProviderMetadata[];
+export declare function isRaybaseExternalProviderConfigured(config: RaybaseConfig, providerId: string, externalAuth?: ResolvedRaybaseExternalAuth): boolean;
+export declare function defaultPublicAppRoles(): RaybaseRole[];
+export type RaybaseProviderUserCreation = {
+    operatorRole: RaybaseAdminRole;
+    appRoles: RaybaseRole[];
+    source: "pending" | "public";
+};
+/**
+ * Decides whether an external provider may create a brand-new user, and with
+ * what access, for the `user.create.before` database hook.
+ *
+ * Two paths, in this order:
+ *
+ * 1. A pending row (owner setup or invite) minted by
+ *    `/api/auth/raybase/provider/setup`. It carries the roles, the expected
+ *    email and a single-use token, so it always decides when its cookie is
+ *    present — including in public signup mode. A present-but-invalid pending
+ *    cookie still fails as an invite rather than quietly downgrading to a plain
+ *    public account, which also keeps the account-create hook's
+ *    `finalizePendingExternalAuth` from ever meeting a broken pending row.
+ * 2. Public signup, when `auth.signupMode` is `"public"` or
+ *    `"provider-only"`. The visitor arrives with no pending cookie at all and
+ *    gets exactly what `signUpPublicUser` grants: no operator role and the
+ *    default app roles. The provider must be one this app configured, and
+ *    must assert a verified email — the same invariant the pending path
+ *    enforces.
+ */
+export declare function resolveProviderUserCreation(input: {
+    db: SqlExecutor;
+    secret: string;
+    config: RaybaseConfig;
+    externalAuth?: ResolvedRaybaseExternalAuth;
+    request?: Request;
+    providerId: string;
+    user: {
+        email?: unknown;
+        emailVerified?: unknown;
+    };
+}): Promise<RaybaseProviderUserCreation>;
+export declare function authSecret(env: RaybaseAuthEnv): string;
+export declare function createRaybaseAuth(env: RaybaseAuthEnv, config: RaybaseConfig, options?: RaybaseAuthOptions): BetterAuthInstance;
+export declare function authEmailConfigured(config: RaybaseConfig): boolean;
+export declare function authEmailFeatureEnabled(config: RaybaseConfig, feature: RaybaseAuthEmailFeature): boolean;
+export declare function settleQueuedAuthEmail(queued: RaybaseQueuedAuthEmail): Promise<void>;
+export declare function getRaybaseSession(request: Request, env: RaybaseAuthEnv, config: RaybaseConfig): Promise<{
+    user: RaybaseUser;
+    principal: RaybaseAuthPrincipal;
+    session: unknown;
+} | null>;
+export declare function toRaybaseUser(user: Record<string, unknown>): RaybaseUser;
+export declare function normalizeRoles(roles: Array<RaybaseRole | string | null | undefined>): RaybaseRole[];
+export declare function defaultOwnerAppRoles(config: RaybaseConfig): RaybaseRole[];
+export declare function parseStoredAppRoles(value: unknown): RaybaseRole[];
+export declare function userFromPrincipal(principal: RaybaseAuthPrincipal): RaybaseUser;
+export declare function audit(db: SqlExecutor, actorId: string | null, action: string, targetType: string, targetId?: string, metadata?: unknown): Promise<void>;
+export declare function base64url(bytes: Uint8Array): string;
+export declare function fromBase64url(value: string): Uint8Array;
+export declare function signToken(secret: string, payload: Omit<SignedTokenPayload, "jti" | "exp"> & {
+    ttlSeconds: number;
+}): Promise<string>;
+export declare function verifySignedToken(secret: string, token: string, purpose: TokenPurpose): Promise<SignedTokenPayload>;
+export declare function ownerConfigured(db: SqlExecutor): Promise<boolean>;
+export declare function consumeSignedToken(db: SqlExecutor, secret: string, token: string, purpose: TokenPurpose): Promise<SignedTokenPayload>;
+/**
+ * Undo a `consumeSignedToken` claim. A single-use token is claimed before the
+ * work it authorizes, so two concurrent redemptions cannot both succeed; when
+ * that work then fails before anything durable exists, the claim has to come
+ * back or a mistyped password would permanently destroy the invitation.
+ */
+export declare function releaseSignedToken(db: SqlExecutor, jti: string, purpose: TokenPurpose): Promise<void>;
+export declare function previewSignedToken(db: SqlExecutor, secret: string, token: string, purpose: TokenPurpose): Promise<SignedTokenPayload>;
+export declare function sha256(value: string): Promise<string>;
+export declare function createPendingExternalAuthCookie(secret: string, pendingId: string, nonce: string, expiresAt: string): Promise<string>;
+export declare function clearPendingExternalAuthCookie(): string;
+type ValidatedPendingExternalAuth = RaybaseAuthPendingRow & {
+    appRolesList: RaybaseRole[];
+};
+export declare function createPendingExternalAuth(db: SqlExecutor, secret: string, config: RaybaseConfig, input: {
+    token: string;
+    purpose: TokenPurpose;
+    providerId: string;
+    updatesChoice?: "yes" | "no" | null;
+    ttlSeconds?: number;
+}): Promise<{
+    pending: RaybaseAuthPendingRow;
+    cookie: string;
+}>;
+export declare function expirePendingExternalAuth(db: SqlExecutor, pendingId: string, reason?: string): Promise<void>;
+export declare function validatePendingExternalAuth(db: SqlExecutor, secret: string, request: Request | undefined, providerId: string, user: {
+    email?: unknown;
+    emailVerified?: unknown;
+}): Promise<ValidatedPendingExternalAuth>;
+export declare function finalizePendingExternalAuth(db: SqlExecutor, secret: string, request: Request | undefined, providerId: string, user: {
+    id: string;
+    email?: unknown;
+    emailVerified?: unknown;
+}, options?: {
+    existingUser?: boolean;
+}): Promise<ValidatedPendingExternalAuth | null>;
+export declare function createInvite(db: SqlExecutor, secret: string, input: {
+    email?: string;
+    role: RaybaseRole;
+    operatorRole?: RaybaseAdminRole;
+    roles?: RaybaseRole[];
+    createdBy?: string | null;
+    ttlSeconds?: number;
+    note?: string;
+}): Promise<{
+    id: string;
+    token: string;
+    expiresAt: string;
+}>;
+export type RaybaseInviteSummary = {
+    id: string;
+    email: string | null;
+    appRoles: RaybaseRole[];
+    status: "pending" | "accepted" | "cancelled" | "expired";
+    note: string | null;
+    expiresAt: string;
+    usedAt: string | null;
+    createdAt: string;
+};
+export declare function listInvites(db: SqlExecutor, options?: {
+    status?: RaybaseInviteSummary["status"];
+    limit?: number;
+    offset?: number;
+}): Promise<{
+    invites: RaybaseInviteSummary[];
+    total: number;
+}>;
+export declare function markInviteUsed(db: SqlExecutor, token: string): Promise<void>;
+export declare function cancelInvite(db: SqlExecutor, inviteId: string): Promise<void>;
+export type RaybaseAuthInvitesRuntime = {
+    create(input?: {
+        email?: string;
+        appRoles?: RaybaseRole[];
+        operatorRole?: never;
+        /** Positive lifetime in seconds. Defaults to seven days. */
+        expiresIn?: number;
+        note?: string;
+    }): Promise<{
+        id: string;
+        token: string;
+        path: string;
+        url?: string;
+        expiresAt: string;
+    }>;
+    list(options?: {
+        status?: RaybaseInviteSummary["status"];
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        invites: RaybaseInviteSummary[];
+        total: number;
+    }>;
+    revoke(inviteId: string): Promise<{
+        revoked: boolean;
+    }>;
+};
+export type RaybaseAuthSignInLinksRuntime = {
+    create(options?: {
+        /** Positive lifetime in seconds. Defaults to the configured lifetime. */
+        expiresIn?: number;
+        /** Root-relative path on the current origin. Defaults to `/`. */
+        redirectTo?: string;
+    }): Promise<{
+        path: string;
+        url?: string;
+        expiresAt: string;
+    }>;
+};
+export type RaybaseAuthContextRuntime = {
+    invites: RaybaseAuthInvitesRuntime;
+    signInLinks: RaybaseAuthSignInLinksRuntime;
+};
+export declare function createRaybaseAuthContextRuntime(input: {
+    db: SqlExecutor;
+    secret: string;
+    config: RaybaseConfig;
+    sessionAuthenticated: boolean;
+    principal: RaybasePrincipal;
+    request?: Request;
+    audit?: (event: RaybaseAuditContextEvent) => Promise<void>;
+}): RaybaseAuthContextRuntime;
+export declare const unsupportedRaybaseAuthContextRuntime: RaybaseAuthContextRuntime;
+export declare function csrfAllowed(request: Request): boolean;
+export declare function headersForInternalAuth(request: Request, env: RaybaseAuthEnv): Headers;
+export declare function signUpWithRaybaseToken(auth: BetterAuthInstance, request: Request, env: RaybaseAuthEnv, input: {
+    email: string;
+    name: string;
+    password: string;
+    operatorRole: RaybaseAdminRole;
+    appRoles?: RaybaseRole[];
+    emailVerified?: boolean;
+}): Promise<{
+    headers: Headers;
+    user: RaybaseUser;
+}>;
+export declare function signUpPublicUser(auth: BetterAuthInstance, request: Request, env: RaybaseAuthEnv, input: {
+    email: string;
+    name: string;
+    password: string;
+}): Promise<{
+    headers: Headers;
+    user: RaybaseUser;
+}>;
+export declare function signInWithPassword(auth: BetterAuthInstance, request: Request, env: RaybaseAuthEnv, config: RaybaseConfig, input: {
+    email: string;
+    password: string;
+}): Promise<{
+    headers: Headers;
+    user: RaybaseUser;
+}>;
+export declare function signOut(auth: BetterAuthInstance, request: Request): Promise<Headers>;
+export declare function setUserAdminRole(db: SqlExecutor, userId: string, role: RaybaseAdminRole): Promise<void>;
+export declare function setUserAppRoles(db: SqlExecutor, userId: string, appRoles: RaybaseRole[]): Promise<void>;
+export declare function setUserEmailVerified(db: SqlExecutor, userId: string, verified: boolean): Promise<void>;
+export declare function getUserByEmail(db: SqlExecutor, email: string): Promise<RaybaseUser | null>;
+export declare function getUserById(db: SqlExecutor, id: string): Promise<RaybaseUser | null>;
+export declare function getOrCreateDevUser(auth: BetterAuthInstance, request: Request, env: RaybaseAuthEnv, config: RaybaseConfig, persona?: RaybaseDevPersona): Promise<RaybaseUser>;
+export declare function createDevSession(auth: BetterAuthInstance, request: Request, env: RaybaseAuthEnv, config: RaybaseConfig): Promise<{
+    headers: Headers;
+    user: RaybaseUser;
+}>;
+export declare function raybaseAuthExecutor(env: RaybaseAuthEnv): SqlExecutor;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAG1F,OAAO,EAAwB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAG3E,OAAO,EAAgD,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACtG,OAAO,EAA8B,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEvF,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAoB,qBAAqB,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAI5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAsC,KAAK,aAAa,EAAE,KAAK,mCAAmC,EAAE,MAAM,aAAa,CAAC;AAI/H,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,CAAC;AAKjD,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AACzD,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,eAAO,MAAM,iCAAiC,QAAU,CAAC;AACzD,eAAO,MAAM,iCAAiC,QAAU,CAAC;AAEzD,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEpD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC/C,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAItB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG;IAC1C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC1B,CAAC;AAEF,KAAK,yBAAyB,GAAG,WAAW,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEnF,MAAM,MAAM,2BAA2B,GAAG;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,SAAS,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAC1C,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C,YAAY,CAAC,EAAE,kBAAkB,EAAE,GAAG;QAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;KAAE,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAC1C,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,GAAG,EAAE,cAAc,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,+BAA+B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC7I,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,+BAA+B,GAAG;IAC1E,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,CAAC,EAAE,2BAA2B,CAAC;IAC3C,uBAAuB,CAAC,EAAE,0CAA0C,CAAC;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAE1D,MAAM,MAAM,gCAAgC,GAAG;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAYF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,WAAW,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzC,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,6BAA6B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC9E,CAAC;AAYF,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,aAAa,GAAG,gCAAgC,CASvG;AAED,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAalE;AAED,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,mCAAmC,EAAE,GAAG,SAAS,EAC5D,gBAAgB,GAAE,2BAA2B,EAAO,GACnD,mCAAmC,EAAE,CAgBvC;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,0BAA0B,CAEzG;AAeD,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,cAAc,EACnB,OAAO,CAAC,EAAE,0BAA0B,EACpC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAWlD;AAED,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,aAAa,EACrB,YAAY,CAAC,EAAE,2BAA2B,GACzC,mCAAmC,EAAE,CAEvC;AAED,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,2BAA2B,GACzC,OAAO,CAKT;AAMD,wBAAgB,qBAAqB,IAAI,WAAW,EAAE,CAErD;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,YAAY,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,EAAE,EAAE,WAAW,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,CAAC,EAAE,2BAA2B,CAAC;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAavC;AAsKD,wBAAgB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAOtD;AAsPD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,kBAAuB,GAAG,kBAAkB,CAiJlI;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAElE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAExG;AAiID,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzF;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAU1F;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAUxE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,WAAW,EAAE,CAGnG;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,EAAE,CAEzE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,EAAE,CAUjE;AAkBD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,GAAG,WAAW,CAE9E;AAED,wBAAsB,KAAK,CACzB,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,OAAO,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAInD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAMvD;AAQD,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAa1I;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASzH;AAED,wBAAsB,eAAe,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAIvE;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAc3I;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3G;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAI3I;AAsBD,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3D;AAeD,wBAAsB,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1I;AAED,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAsBD,KAAK,4BAA4B,GAAG,qBAAqB,GAAG;IAC1D,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B,CAAC;AAUF,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE;IACL,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC;IAAE,OAAO,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAkD7D;AAMD,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrH;AAiBD,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACjD,OAAO,CAAC,4BAA4B,CAAC,CAoBvC;AAED,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,EAC9D,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAmB9C;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IACL,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACA,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B3D;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IACzD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAaF,wBAAsB,WAAW,CAC/B,EAAE,EAAE,WAAW,EACf,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACzF,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B7D;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;AAkCD,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,KAAK,CAAC,EAAE;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;QACzB,YAAY,CAAC,EAAE,KAAK,CAAC;QACrB,4DAA4D;QAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,OAAO,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,OAAO,CAAC,EAAE;QACf,yEAAyE;QACzE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iEAAiE;QACjE,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,yBAAyB,CAAC;IACnC,WAAW,EAAE,6BAA6B,CAAC;CAC5C,CAAC;AAEF,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,EAAE,EAAE,WAAW,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GAAG,yBAAyB,CAgH5B;AAED,eAAO,MAAM,oCAAoC,EAAE,yBAiBlD,CAAC;AAEF,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAOrD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAIrF;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1I,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CA8BlD;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvD,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CASlD;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CA6BlD;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAM1F;AAED,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7G;AAED,wBAAsB,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7G;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5G;AAYD,wBAAsB,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAGhG;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAG1F;AAQD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,oBAAuC,GAAG,OAAO,CAAC,WAAW,CAAC,CAiBrM;AAcD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAS/K;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,WAAW,CAEpE"}