@run402/functions 2.9.0 → 3.1.0

package/dist/auth/index.js

@@ -0,0 +1,585 @@
+/**
+ * `auth.*` — the sole server-side auth namespace.
+ *
+ * The single import line for any consumer:
+ *
+ *     import { auth } from "@run402/functions";
+ *
+ * Surface (deliberately small):
+ *
+ *     auth.user()                          → Actor | null
+ *     auth.requireUser()                   → Actor (throws / 303 otherwise)
+ *     auth.requireRole(role)               → { user, role }
+ *     auth.requireMembership(membership)   → { user, membership }
+ *     auth.requireFresh({ maxAge, amr? })  → void (throws / 303 otherwise)
+ *     auth.identities.link({ ... })        → void
+ *     auth.fetch(input, init?)             → Response (same-origin only)
+ *     auth.csrfToken()                     → string
+ *     auth.csrfField()                     → "<input type=hidden ...>"
+ *     auth.sessions.createResponseFromIdentity({ ... }) → Response
+ *     auth.sessions.createResponseFromTenantAssertion({ tenant, user, method }) → Response
+ *     auth.sessions.endResponse()          → Response
+ *     auth.invalidCredentials()            → InvalidCredentialsError (throw it)
+ *
+ * Behaviour notes baked into the helpers:
+ *   - Calling any helper taints the cache (the response now depends on
+ *     per-request actor state). The taint is monotonic — once set, the
+ *     SSR cache layer treats the response as non-cacheable until the
+ *     request completes.
+ *   - HTML-vs-JSON failure decisions are made by the gateway middleware
+ *     (303 redirect for HTML, 401/403 envelope for JSON). The SDK throws
+ *     a typed Error subclass; framework code OR the gateway translates.
+ *   - `requireRole` / `requireMembership` always read fresh server-side
+ *     grant data — no positive cache (matches D8 + the "instant revocation"
+ *     contract). For now we route via `getRole` which the gateway sets
+ *     at the routed-function envelope; once the v1.60 grants table lands,
+ *     gate helpers will JOIN against it inside the same request.
+ *   - `requireFresh` consults the per-method `amr_times` on the Actor —
+ *     a recent password proof does NOT satisfy `{amr: ["passkey"]}`.
+ *
+ * @see openspec/changes/auth-aware-ssr/specs/auth-sdk-namespace/spec.md
+ */
+import { getCurrentContext, requireActiveContext, taintCacheBypass, } from "../runtime-context.js";
+import { config } from "../config.js";
+import jwt from "../lib/jwt.js";
+import { AuthRequiredError, FetchAbsoluteUrlError, FreshnessRequiredError, InsufficientMembershipError, InsufficientRoleError, InvalidCredentialsError, TenantSubjectInvalidError, UnknownExportError, } from "./errors.js";
+import { validateAuthFetchInput } from "./url-validation.js";
+import crypto from "node:crypto";
+// ---------------------------------------------------------------------------
+// Identity & authorization helpers
+// ---------------------------------------------------------------------------
+async function user() {
+    // Taint cache regardless of outcome — the response depends on actor
+    // state once any consumer asks. The taint is monotonic (D23).
+    taintCacheBypass();
+    const ctx = getCurrentContext();
+    if (ctx === undefined) {
+        // No active context — could be (a) module scope or (b) prerendered
+        // build. The runtime-context module distinguishes these via the
+        // `active` flag, but for `auth.user()` specifically we return null
+        // for module-scope while throwing R402_AUTH_PRERENDERED for the
+        // prerendered case. Without a context we can't tell, so return
+        // null — Astro's prerender detection runs upstream in @run402/astro.
+        return null;
+    }
+    // SSR / cookie-session path: actor populated from the verified
+    // gateway-signed envelope at runWithContext entry.
+    if (ctx.actor) {
+        return actorContextToPublicActor(ctx.actor, ctx.projectId);
+    }
+    // auth-hosted-surface-parity: for browser SSR (routed_http) the cookie
+    // envelope is the ONLY actor input. We do NOT fall back to decoding an
+    // `Authorization: Bearer` header here — otherwise a Bearer on a GET to
+    // a tenant SSR page would resolve an actor, contradicting the
+    // "cookie is the only browser actor input" invariant (Kychon finding).
+    // The fallback is preserved only for direct/machine invocations below.
+    if (ctx.invocationKind === "routed_http") {
+        return null;
+    }
+    // Direct function invocation path (Bearer JWT, no cookie envelope):
+    // fall back to decoding the Authorization header. This is the legacy
+    // getUser(req) contract — mobile / server-to-server callers send a
+    // signed JWT in the Authorization header, the function reads it.
+    // The gateway has already routed the request to this function and
+    // injected the Authorization header per the apikey/wallet-auth
+    // pipeline, so we can trust JWT_SECRET-signed claims here.
+    return actorFromAuthorizationHeader(ctx);
+}
+/** Read `Authorization: Bearer <jwt>` from the runtime context's
+ *  request headers and decode it via JWT_SECRET. Returns an `Actor`
+ *  populated from the JWT claims on success, `null` on absence /
+ *  malformed / wrong-project / verify-fail.
+ *
+ *  This is the legacy `getUser(req)` shape adapted to the v3.0 `auth.*`
+ *  surface — it preserves the direct-function-invocation contract that
+ *  the platform's own E2E suite exercises and that mobile / CI callers
+ *  rely on. The cookie-session SSR path doesn't go through here (it
+ *  populates ctx.actor at runWithContext entry via the verified
+ *  envelope). */
+function actorFromAuthorizationHeader(ctx) {
+    if (!config.JWT_SECRET)
+        return null;
+    const headers = ctx.request.headers;
+    // The runtime-context wrapper accepts either a `Headers` instance
+    // (when the gateway's buildEntryWrapper passes a Request) or a plain
+    // header object. Handle both.
+    let authHeader;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const h = headers;
+    if (typeof h?.get === "function") {
+        authHeader = h.get("authorization") ?? h.get("Authorization") ?? undefined;
+    }
+    else {
+        const raw = h?.["authorization"] ?? h?.["Authorization"];
+        authHeader = Array.isArray(raw) ? raw[0] : raw;
+    }
+    if (!authHeader || !authHeader.startsWith("Bearer "))
+        return null;
+    const token = authHeader.slice(7);
+    try {
+        const payload = jwt.verify(token, config.JWT_SECRET);
+        if (payload.project_id !== ctx.projectId)
+            return null;
+        return {
+            id: payload.sub,
+            projectId: payload.project_id,
+            sessionId: payload.session_id ?? `bearer:${payload.sub}`,
+            email: payload.email ?? "",
+            emailVerified: false,
+            authTime: payload.auth_time ?? Math.floor(Date.now() / 1000),
+            amr: Array.isArray(payload.amr) ? [...payload.amr] : [],
+            amrTimes: {},
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function requireUser() {
+    const actor = await user();
+    if (actor === null) {
+        throw new AuthRequiredError({ returnTo: currentReturnTo() });
+    }
+    return actor;
+}
+async function requireRole(role) {
+    const actor = await requireUser();
+    // For v1A wiring: read the gate-resolved role from the routed-function
+    // envelope header set by the gateway middleware. When the v1.60
+    // platform-owned grants table lands, this swaps to a fresh DB read
+    // joined to internal.role_grants.
+    const ctx = requireActiveContext("auth.requireRole");
+    const headerRole = readHeader(ctx.request.headers, "x-run402-user-role");
+    if (headerRole === role) {
+        return { user: actor, role };
+    }
+    throw new InsufficientRoleError(role);
+}
+function readHeader(headers, name) {
+    const v = headers[name] ?? headers[name.toLowerCase()] ?? headers[name.toUpperCase()];
+    return Array.isArray(v) ? v[0] : v;
+}
+async function requireMembership(membership) {
+    const actor = await requireUser();
+    // Membership shape mirrors role for v1A. The grant table for membership
+    // lands in a separate change (auth-as-sdlc); meanwhile the gateway-side
+    // gate helpers populate `x-run402-user-membership` when configured.
+    const ctx = requireActiveContext("auth.requireMembership");
+    const headerMembership = readHeader(ctx.request.headers, "x-run402-user-membership");
+    if (headerMembership === membership) {
+        return { user: actor, membership };
+    }
+    throw new InsufficientMembershipError(membership);
+}
+async function requireFresh(opts) {
+    taintCacheBypass();
+    const actor = await requireUser();
+    const maxAgeSec = parseMaxAge(opts.maxAge);
+    const nowSec = Math.floor(Date.now() / 1000);
+    if (opts.amr && opts.amr.length > 0) {
+        const ok = opts.amr.some((method) => {
+            const ts = actor.amrTimes[method];
+            return typeof ts === "number" && nowSec - ts <= maxAgeSec;
+        });
+        if (!ok) {
+            throw new FreshnessRequiredError({
+                maxAge: opts.maxAge,
+                amr: opts.amr,
+                returnTo: currentReturnTo(),
+            });
+        }
+        return;
+    }
+    if (nowSec - actor.authTime <= maxAgeSec)
+        return;
+    throw new FreshnessRequiredError({
+        maxAge: opts.maxAge,
+        amr: [],
+        returnTo: currentReturnTo(),
+    });
+}
+function parseMaxAge(raw) {
+    if (/^\d+$/.test(raw))
+        return Number(raw);
+    let total = 0;
+    const re = /(\d+)\s*([smhd])/gi;
+    let m;
+    while ((m = re.exec(raw)) !== null) {
+        const v = Number(m[1]);
+        switch (m[2].toLowerCase()) {
+            case "s":
+                total += v;
+                break;
+            case "m":
+                total += v * 60;
+                break;
+            case "h":
+                total += v * 3600;
+                break;
+            case "d":
+                total += v * 86400;
+                break;
+        }
+    }
+    return total;
+}
+// ---------------------------------------------------------------------------
+// auth.fetch — relative-only with manual-redirect default
+// ---------------------------------------------------------------------------
+async function authFetch(input, init) {
+    const ctx = requireActiveContext("auth.fetch");
+    const origin = `https://${ctx.host}`;
+    const result = validateAuthFetchInput(input, { requestOrigin: origin });
+    if (!result.ok) {
+        throw new FetchAbsoluteUrlError({
+            attempted: typeof input === "string" ? input : (input instanceof URL ? input.toString() : input.url),
+            reason: result.reason,
+        });
+    }
+    // The validated URL is same-origin. Default redirect: "manual" so
+    // follow-cross-origin redirects don't smuggle our actor context to
+    // hostile hops. If the caller opts in via init.redirect: "follow",
+    // we still re-validate each hop — but native fetch doesn't expose
+    // hop-by-hop hooks, so we emulate by doing manual redirects.
+    const headers = new Headers(init?.headers);
+    // Forward only headers the gateway expects from a same-origin SSR
+    // fetch. Actor-context propagation is automatic (the inbound envelope
+    // is propagated as a header; the SSR runtime already verified it).
+    // Cookies are NEVER forwarded — never set the Cookie header here.
+    headers.delete("cookie");
+    headers.delete("Cookie");
+    const requestInit = {
+        ...init,
+        headers,
+        redirect: init?.redirect ?? "manual",
+    };
+    return fetch(result.normalized, requestInit);
+}
+// ---------------------------------------------------------------------------
+// CSRF token helpers (double-submit token bound to the active session).
+// ---------------------------------------------------------------------------
+function csrfToken() {
+    const ctx = getCurrentContext();
+    if (!ctx || !ctx.actor) {
+        // No session ⇒ no CSRF token. Returning an empty string would let
+        // the form submit with no token at all; instead throw so the page
+        // author knows the helper should be inside `<SignedIn>`-style
+        // conditional rendering.
+        throw new AuthRequiredError();
+    }
+    // The token derivation is HMAC(session_secret, "csrf") truncated to
+    // 32 hex chars. Browsers double-submit; the gateway re-derives and
+    // compares constant-time. We use the session_id + auth_time as the
+    // poor-man's MAC input since the SDK doesn't have access to the
+    // pepper; the gateway is the authoritative verifier (cross-checks
+    // against internal.sessions via session_id). This is double-submit
+    // CSRF, not a primary control — the Origin check is.
+    const input = `${ctx.actor.sessionId}:${ctx.actor.authTime}:csrf`;
+    return crypto.createHash("sha256").update(input, "utf8").digest("hex").slice(0, 32);
+}
+function csrfField() {
+    return `<input type="hidden" name="_csrf" value="${escapeHtml(csrfToken())}">`;
+}
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+// ---------------------------------------------------------------------------
+// Session bridge — createResponseFromIdentity / endResponse.
+//
+// These delegate to the platform routes; the SDK never holds raw secrets.
+// The session-minting route lives at POST /auth/v1/sessions/from-identity
+// (gateway-internal). The endResponse helper just emits the clear-cookie
+// Set-Cookie + body and lets the gateway-side mounted CSRF/origin check
+// run on the calling capability's response.
+// ---------------------------------------------------------------------------
+async function createResponseFromIdentity(opts) {
+    const ctx = requireActiveContext("auth.sessions.createResponseFromIdentity");
+    const origin = `https://${ctx.host}`;
+    // Delegate to the platform route. The route verifies the proof
+    // against the project's registered verifier (wallet/oidc/custom) and
+    // mints the session via the internal-only primitive. The Response
+    // already carries Set-Cookie and the canonical {ok, user} body.
+    const res = await fetch(`${origin}/auth/v1/sessions/from-identity`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(opts),
+        redirect: "manual",
+    });
+    return res;
+}
+/** Header on the function's RETURNED Response that the gateway's routed-invoke
+ *  post-processor materializes into a host-bound `Set-Cookie` — AFTER it
+ *  checks the INVOKED function's declared `auth.sessionMint` capability
+ *  (server-side; service-key presence is NOT sufficient). The gateway always
+ *  strips this header before the client sees it. Kept in sync with the
+ *  gateway constant of the same name. */
+export const MINT_DIRECTIVE_HEADER = "x-run402-mint-directive";
+/**
+ * Tenant-assertion session mint (D6) — for the tenant-owned-credential case
+ * where the calling function already verified the credential against its OWN
+ * store (bcrypt, custom DB, external IdP). This is NOT a proof-based mint;
+ * the tenant is *vouching*, so it is capability-gated (`auth.sessionMint` in
+ * the function's deploy spec), audited, and host-gated — all enforced by the
+ * gateway when it materializes the directive below.
+ *
+ * The shape is agent-proof: the platform derives `issuer: "tenant:<tenant>"`
+ * and `amr` from `method` (`password` → `tenant_password`, `sso` →
+ * `tenant_sso`). Arbitrary amr is available only via `advanced.amr`.
+ *
+ * Mechanism (pattern B): the SDK never holds the session secret, so it returns
+ * a Response carrying a `x-run402-mint-directive` header. The gateway reads it,
+ * verifies the invoked function declared `auth.sessionMint` (else
+ * `R402_AUTH_UNTRUSTED_CONTEXT`), validates the subject, mints the host-bound
+ * cookie, writes an audit row, strips the directive, and rewrites the body to
+ * `{ ok, user }`. Return it directly from your handler: `return
+ * auth.sessions.createResponseFromTenantAssertion({ tenant, user, method })`.
+ */
+async function createResponseFromTenantAssertion(opts) {
+    // Must run inside a real routed invocation (not module scope / prerender).
+    requireActiveContext("auth.sessions.createResponseFromTenantAssertion");
+    // Fast SDK-side validation with the teaching fix. The gateway re-validates
+    // and additionally enforces `(project_id, issuer, user.id)` uniqueness.
+    const tenant = typeof opts?.tenant === "string" ? opts.tenant.trim() : "";
+    if (!tenant) {
+        throw new TenantSubjectInvalidError({ reason: "missing `tenant`" });
+    }
+    const user = opts?.user;
+    if (!user || typeof user !== "object") {
+        throw new TenantSubjectInvalidError({ reason: "missing `user`" });
+    }
+    const id = typeof user.id === "string" ? user.id.trim() : "";
+    if (!id) {
+        throw new TenantSubjectInvalidError({
+            reason: "`user.id` is required (a stable primary key, not a bare email)",
+        });
+    }
+    const email = typeof user.email === "string" ? user.email.trim() : "";
+    // The classic mistake: passing the email AS the id. A stable id is required.
+    if (id.includes("@") && id === email) {
+        throw new TenantSubjectInvalidError({
+            reason: "`user.id` must be a stable primary key, not the email",
+        });
+    }
+    if (opts.method !== "password" && opts.method !== "sso") {
+        throw new TenantSubjectInvalidError({
+            reason: '`method` must be "password" or "sso"',
+        });
+    }
+    const directive = {
+        v: 1,
+        tenant,
+        user: {
+            id,
+            email,
+            emailVerified: user.emailVerified === true,
+            ...(user.displayName ? { displayName: String(user.displayName) } : {}),
+            ...(user.avatarUrl ? { avatarUrl: String(user.avatarUrl) } : {}),
+        },
+        method: opts.method,
+        ...(opts.advanced?.amr ? { advanced: { amr: opts.advanced.amr } } : {}),
+    };
+    const encoded = Buffer.from(JSON.stringify(directive), "utf8").toString("base64url");
+    // The response now depends on per-request actor state — taint the SSR cache.
+    taintCacheBypass();
+    return new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: {
+            "content-type": "application/json",
+            [MINT_DIRECTIVE_HEADER]: encoded,
+        },
+    });
+}
+/** Returns the canonical invalid-credentials error for the tenant-owned
+ *  credential case. A FUNCTION, not a constructor (D9): write
+ *  `throw auth.invalidCredentials()` — never `new auth.InvalidCredentialsError()`.
+ *  Renders the canonical `R402_AUTH_INVALID_CREDENTIALS` envelope (distinct
+ *  from `R402_AUTH_MAGIC_LINK_INVALID`); no session is minted. */
+function invalidCredentials() {
+    return new InvalidCredentialsError();
+}
+async function endResponse() {
+    const ctx = requireActiveContext("auth.sessions.endResponse");
+    const origin = `https://${ctx.host}`;
+    const res = await fetch(`${origin}/auth/v1/sessions/end`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        redirect: "manual",
+    });
+    return res;
+}
+// ---------------------------------------------------------------------------
+// Identity linking.
+// ---------------------------------------------------------------------------
+async function linkIdentity(opts) {
+    const ctx = requireActiveContext("auth.identities.link");
+    await requireUser();
+    const origin = `https://${ctx.host}`;
+    const res = await fetch(`${origin}/auth/v1/identities/link`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(opts),
+        redirect: "manual",
+    });
+    if (res.status === 409) {
+        // The platform route maps unique_violation on
+        // internal.identities (project_id, provider, subject) to 409.
+        throw new (await import("./errors.js")).IdentityLinkConflictError({
+            provider: opts.provider,
+            subject: opts.subject,
+        });
+    }
+    if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        throw new (await import("./errors.js")).SessionBridgeUnverifiedError({
+            reason: body.code ?? `link failed: ${res.status}`,
+        });
+    }
+}
+// ---------------------------------------------------------------------------
+// SDK proxy intercepting hallucinated names.
+// ---------------------------------------------------------------------------
+const HALLUCINATED_NAMES = {
+    session: "auth.user() then read .sessionId / .amr / etc.",
+    getSession: "auth.user()",
+    currentUser: "auth.user()",
+    currentSession: "auth.user()",
+    requireAuth: "auth.requireUser()",
+    middleware: "auth.csrfField() / @run402/astro middleware",
+    signIn: "POST /auth/sign-in (browser form) or auth.sessions.createResponseFromIdentity({...})",
+    signout: "auth.sessions.endResponse()",
+    signOut: "auth.sessions.endResponse()",
+    logout: "auth.sessions.endResponse()",
+    login: "auth.sessions.createResponseFromIdentity({...})",
+    redirectToSignIn: "auth.requireUser() — platform redirects",
+    getUser: "auth.user()",
+    getToken: "auth.requireUser() then user.sessionId (tokens are not exposed)",
+    protect: "auth.requireUser() / auth.requireRole(...)",
+    // Section 5 — forbidden legacy mint names + common top-level typos.
+    signInResponse: "throw auth.invalidCredentials() on failure, then auth.sessions.createResponseFromTenantAssertion({ tenant, user, method })",
+    InvalidCredentialsError: "auth.invalidCredentials()",
+    createResponseFromTenantSubject: "auth.sessions.createResponseFromTenantAssertion({ tenant, user, method })",
+    createResponseFromTenantAssertion: "auth.sessions.createResponseFromTenantAssertion({ tenant, user, method })",
+    createResponseFromIdentity: "auth.sessions.createResponseFromIdentity({ provider, subject, proof, amr })",
+};
+/** `auth.sessions.*` proxy — mirrors the top-level `auth` proxy so forbidden
+ *  legacy names (`createResponseFromTenantSubject`, `signInResponse`) and
+ *  typos throw the structured unknown-export error pointing at the canonical
+ *  primitive, instead of silently returning `undefined`. */
+const SESSIONS_HALLUCINATED_NAMES = {
+    createResponseFromTenantSubject: "auth.sessions.createResponseFromTenantAssertion({ tenant, user, method })",
+    signInResponse: "auth.sessions.createResponseFromTenantAssertion({ tenant, user, method })",
+    fromIdentity: "auth.sessions.createResponseFromIdentity({ ... })",
+    fromTenantAssertion: "auth.sessions.createResponseFromTenantAssertion({ tenant, user, method })",
+};
+const baseSessions = {
+    createResponseFromIdentity,
+    createResponseFromTenantAssertion,
+    endResponse,
+};
+const sessions = new Proxy(baseSessions, {
+    get(target, prop, receiver) {
+        if (typeof prop === "string" && !(prop in target)) {
+            throw new UnknownExportError({
+                attemptedName: `auth.sessions.${prop}`,
+                canonicalName: SESSIONS_HALLUCINATED_NAMES[prop] ??
+                    "auth.sessions.createResponseFromIdentity / createResponseFromTenantAssertion / endResponse",
+            });
+        }
+        return Reflect.get(target, prop, receiver);
+    },
+});
+const baseAuth = {
+    user,
+    requireUser,
+    requireRole,
+    requireMembership,
+    requireFresh,
+    fetch: authFetch,
+    csrfToken,
+    csrfField,
+    invalidCredentials,
+    identities: {
+        link: linkIdentity,
+    },
+    sessions,
+};
+/** Hallucinated-name proxy. Property access for a name not in
+ *  `baseAuth` throws `R402_AUTH_UNKNOWN_EXPORT` with the canonical
+ *  replacement. Hot-path access (existing keys) returns the actual
+ *  helper — proxy overhead is one Reflect.has + Reflect.get. */
+export const auth = new Proxy(baseAuth, {
+    get(target, prop, receiver) {
+        if (typeof prop === "string" && !(prop in target)) {
+            const replacement = HALLUCINATED_NAMES[prop];
+            if (replacement) {
+                throw new UnknownExportError({
+                    attemptedName: `auth.${prop}`,
+                    canonicalName: replacement,
+                });
+            }
+            throw new UnknownExportError({
+                attemptedName: `auth.${prop}`,
+                canonicalName: "auth.user / auth.requireUser / auth.requireRole / auth.requireMembership",
+            });
+        }
+        return Reflect.get(target, prop, receiver);
+    },
+});
+/** Throwing-sentinel exports for the top hallucinated *bare* names.
+ *  ESM `import { getUser } from "@run402/functions"` can be intercepted
+ *  only by a real export — so we ship these as exported throwing
+ *  functions. They're marked `@deprecated` in the type JSDoc; the SDK
+ *  proxy + lint registry + `run402 doctor` scan all flag the import
+ *  before runtime if the user is running the tooling.
+ *
+ *  Excluded from public docs and AGENTS.md per the spec.
+ */
+/** @deprecated Use `auth.user()` or `auth.requireUser()`. */
+export function getSession() {
+    throw new UnknownExportError({ attemptedName: "getSession", canonicalName: "auth.user()" });
+}
+/** @deprecated Use `auth.user()`. */
+export function currentUser() {
+    throw new UnknownExportError({ attemptedName: "currentUser", canonicalName: "auth.user()" });
+}
+/** @deprecated Use `auth.user()`. */
+export function getCurrentUser() {
+    throw new UnknownExportError({ attemptedName: "getCurrentUser", canonicalName: "auth.user()" });
+}
+/** @deprecated Use `auth.user()`. */
+export function getServerSession() {
+    throw new UnknownExportError({
+        attemptedName: "getServerSession",
+        canonicalName: "auth.user()",
+    });
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+function actorContextToPublicActor(ctxActor, projectId) {
+    if (!ctxActor)
+        return null;
+    return {
+        id: ctxActor.id,
+        projectId,
+        sessionId: ctxActor.sessionId,
+        email: ctxActor.email,
+        emailVerified: ctxActor.emailVerified,
+        authTime: ctxActor.authTime,
+        amr: [...ctxActor.amr],
+        amrTimes: { ...ctxActor.amrTimes },
+    };
+}
+function currentReturnTo() {
+    const ctx = getCurrentContext();
+    if (!ctx)
+        return undefined;
+    return ctx.request.url;
+}
+export { AuthRequiredError, InsufficientRoleError, InsufficientMembershipError, FreshnessRequiredError, FetchAbsoluteUrlError, PrerenderedError, UnknownExportError, SessionBridgeUnverifiedError, IdentityLinkConflictError, UnknownIdentityError, InvalidCredentialsError, TenantSubjectInvalidError, Run402AuthError, } from "./errors.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,GAAG,MAAM,eAAe,CAAC;AAChC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EAEvB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAOrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,KAAK,UAAU,IAAI;IACjB,oEAAoE;IACpE,8DAA8D;IAC9D,gBAAgB,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,gEAAgE;QAChE,+DAA+D;QAC/D,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,+DAA+D;IAC/D,mDAAmD;IACnD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IACD,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,GAAG,CAAC,cAAc,KAAK,aAAa,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,+DAA+D;IAC/D,2DAA2D;IAC3D,OAAO,4BAA4B,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;iBAUiB;AACjB,SAAS,4BAA4B,CACnC,GAAsD;IAEtD,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IACpC,kEAAkE;IAClE,qEAAqE;IACrE,8BAA8B;IAC9B,IAAI,UAA8B,CAAC;IACnC,8DAA8D;IAC9D,MAAM,CAAC,GAAG,OAAc,CAAC;IACzB,IAAI,OAAO,CAAC,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC;QACjC,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;QACzD,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CASvB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,UAAU,KAAK,GAAG,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,GAAG;YACf,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,UAAU,OAAO,CAAC,GAAG,EAAE;YACxD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YAC1B,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC5D,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACvD,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;IAC3B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAO;IAEP,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;IAClC,uEAAuE;IACvE,gEAAgE;IAChE,mEAAmE;IACnE,kCAAkC;IAClC,MAAM,GAAG,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACzE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CACjB,OAAsD,EACtD,IAAY;IAEZ,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAa;IAEb,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;IAClC,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,GAAG,GAAG,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACrF,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAaD,KAAK,UAAU,YAAY,CAAC,IAAyB;IACnD,gBAAgB,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,SAAS,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,sBAAsB,CAAC;gBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,QAAQ,EAAE,eAAe,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS;QAAE,OAAO;IACjD,MAAM,IAAI,sBAAsB,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,EAAE;QACP,QAAQ,EAAE,eAAe,EAAE;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,EAAE,GAAG,oBAAoB,CAAC;IAChC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5B,KAAK,GAAG;gBACN,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,KAAK,GAAG;gBACN,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM;YACR,KAAK,GAAG;gBACN,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,KAAK,GAAG;gBACN,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC;gBACnB,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,KAAK,UAAU,SAAS,CACtB,KAAwB,EACxB,IAAkB;IAElB,MAAM,GAAG,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAAC;YAC9B,SAAS,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACpG,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,kEAAkE;IAClE,sEAAsE;IACtE,mEAAmE;IACnE,kEAAkE;IAClE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzB,MAAM,WAAW,GAAgB;QAC/B,GAAG,IAAI;QACP,OAAO;QACP,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,QAAQ;KACrC,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAE9E,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACvB,kEAAkE;QAClE,kEAAkE;QAClE,8DAA8D;QAC9D,yBAAyB;QACzB,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IACD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,OAAO,CAAC;IAClE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,4CAA4C,UAAU,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,4CAA4C;AAC5C,8EAA8E;AAE9E,KAAK,UAAU,0BAA0B,CACvC,IAAuC;IAEvC,MAAM,GAAG,GAAG,oBAAoB,CAAC,0CAA0C,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,+DAA+D;IAC/D,qEAAqE;IACrE,kEAAkE;IAClE,gEAAgE;IAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,iCAAiC,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;yCAKyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,iCAAiC,CAC9C,IAA8C;IAE9C,2EAA2E;IAC3E,oBAAoB,CAAC,iDAAiD,CAAC,CAAC;IAExE,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yBAAyB,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,yBAAyB,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,yBAAyB,CAAC;YAClC,MAAM,EAAE,gEAAgE;SACzE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,6EAA6E;IAC7E,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,yBAAyB,CAAC;YAClC,MAAM,EAAE,uDAAuD;SAChE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,yBAAyB,CAAC;YAClC,MAAM,EAAE,sCAAsC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG;QAChB,CAAC,EAAE,CAAU;QACb,MAAM;QACN,IAAI,EAAE;YACJ,EAAE;YACF,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI;YAC1C,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE;QACD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CACrE,WAAW,CACZ,CAAC;IACF,6EAA6E;IAC7E,gBAAgB,EAAE,CAAC;IACnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;QAChD,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,CAAC,qBAAqB,CAAC,EAAE,OAAO;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;kEAIkE;AAClE,SAAS,kBAAkB;IACzB,OAAO,IAAI,uBAAuB,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,GAAG,oBAAoB,CAAC,2BAA2B,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,uBAAuB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,YAAY,CAAC,IAAyB;IACnD,MAAM,GAAG,GAAG,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IACzD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,0BAA0B,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,8CAA8C;QAC9C,8DAA8D;QAC9D,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC;YAChE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC;YACnE,MAAM,EAAG,IAA0B,CAAC,IAAI,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,MAAM,kBAAkB,GAA2B;IACjD,OAAO,EAAE,gDAAgD;IACzD,UAAU,EAAE,aAAa;IACzB,WAAW,EAAE,aAAa;IAC1B,cAAc,EAAE,aAAa;IAC7B,WAAW,EAAE,oBAAoB;IACjC,UAAU,EAAE,6CAA6C;IACzD,MAAM,EAAE,sFAAsF;IAC9F,OAAO,EAAE,6BAA6B;IACtC,OAAO,EAAE,6BAA6B;IACtC,MAAM,EAAE,6BAA6B;IACrC,KAAK,EAAE,iDAAiD;IACxD,gBAAgB,EAAE,yCAAyC;IAC3D,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,iEAAiE;IAC3E,OAAO,EAAE,4CAA4C;IACrD,oEAAoE;IACpE,cAAc,EACZ,4HAA4H;IAC9H,uBAAuB,EAAE,2BAA2B;IACpD,+BAA+B,EAC7B,2EAA2E;IAC7E,iCAAiC,EAC/B,2EAA2E;IAC7E,0BAA0B,EACxB,6EAA6E;CAChF,CAAC;AAiCF;;;4DAG4D;AAC5D,MAAM,2BAA2B,GAA2B;IAC1D,+BAA+B,EAC7B,2EAA2E;IAC7E,cAAc,EACZ,2EAA2E;IAC7E,YAAY,EAAE,mDAAmD;IACjE,mBAAmB,EACjB,2EAA2E;CAC9E,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,0BAA0B;IAC1B,iCAAiC;IACjC,WAAW;CACZ,CAAC;AAEF,MAAM,QAAQ,GAA8B,IAAI,KAAK,CAAC,YAAY,EAAE;IAClE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;QACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,aAAa,EAAE,iBAAiB,IAAI,EAAE;gBACtC,aAAa,EACX,2BAA2B,CAAC,IAAI,CAAC;oBACjC,4FAA4F;aAC/F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAkB;IAC9B,IAAI;IACJ,WAAW;IACX,WAAW;IACX,iBAAiB;IACjB,YAAY;IACZ,KAAK,EAAE,SAAS;IAChB,SAAS;IACT,SAAS;IACT,kBAAkB;IAClB,UAAU,EAAE;QACV,IAAI,EAAE,YAAY;KACnB;IACD,QAAQ;CACT,CAAC;AAEF;;;gEAGgE;AAChE,MAAM,CAAC,MAAM,IAAI,GAAkB,IAAI,KAAK,CAAC,QAAQ,EAAE;IACrD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;QACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,aAAa,EAAE,QAAQ,IAAI,EAAE;oBAC7B,aAAa,EAAE,WAAW;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,aAAa,EAAE,QAAQ,IAAI,EAAE;gBAC7B,aAAa,EAAE,0EAA0E;aAC1F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;CACF,CAAC,CAAC;AAEH;;;;;;;;GAQG;AAEH,6DAA6D;AAC7D,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,kBAAkB,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,kBAAkB,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,kBAAkB,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,kBAAkB,CAAC;QAC3B,aAAa,EAAE,kBAAkB;QACjC,aAAa,EAAE,aAAa;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,yBAAyB,CAChC,QAA6B,EAC7B,SAAiB;IAEjB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,SAAS;QACT,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC;QACtB,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;AACzB,CAAC;AASD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,GAChB,MAAM,aAAa,CAAC"}