@samebase/identity-broker 0.7.0 → 0.9.0

package/dist/component/schema.d.ts

@@ -35,7 +35,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "pending";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 } | {
     appId: string;
     clientId: string;
@@ -50,7 +50,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "upstream";
-    txnCookieHash?: string;
+    txnCookieHash: string;
     upstreamCodeVerifier: string;
     upstreamNonce?: string;
     upstreamStateHash: string;
@@ -68,7 +68,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "claimed";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 } | {
     appId: string;
     clientId: string;
@@ -89,7 +89,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "emailSent";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 } | {
     appId: string;
     authTime: number;
@@ -112,7 +112,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "completed";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, [import("convex/values").VObject<{
     appId: string;
     clientId: string;
@@ -126,7 +126,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "pending";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, {
     requestId: import("convex/values").VString<string, "required">;
     appId: import("convex/values").VString<string, "required">;
@@ -139,11 +139,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"pending", "required">;
@@ -161,7 +161,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "upstream";
-    txnCookieHash?: string;
+    txnCookieHash: string;
     upstreamCodeVerifier: string;
     upstreamNonce?: string;
     upstreamStateHash: string;
@@ -177,11 +177,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"upstream", "required">;
@@ -203,7 +203,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "claimed";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, {
     requestId: import("convex/values").VString<string, "required">;
     appId: import("convex/values").VString<string, "required">;
@@ -216,11 +216,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"claimed", "required">;
@@ -245,7 +245,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "emailSent";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, {
     requestId: import("convex/values").VString<string, "required">;
     appId: import("convex/values").VString<string, "required">;
@@ -258,11 +258,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"emailSent", "required">;
@@ -297,7 +297,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "completed";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, {
     requestId: import("convex/values").VString<string, "required">;
     appId: import("convex/values").VString<string, "required">;
@@ -310,11 +310,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"completed", "required">;
@@ -346,30 +346,12 @@ declare const _default: import("convex/server").SchemaDefinition<{
         appId: import("convex/values").VString<string, "required">;
         name: import("convex/values").VString<string, "required">;
         firstParty: import("convex/values").VBoolean<boolean, "required">;
-        /**
-         * Exact hosts or `*.suffix` patterns a client callback may use through `/register`, e.g.
-         * `*.convex.site`. `registerClient` does not read it.
-         */
+        /** No longer read. The rows of a hub from before 0.8.0 still hold it. */
         allowedCallbackHosts: import("convex/values").VArray<string[] | undefined, import("convex/values").VString<string, "required">, "optional">;
         createdAt: import("convex/values").VFloat64<number, "required">;
     }, "required", "allowedCallbackHosts" | "appId" | "createdAt" | "firstParty" | "name">, {
         by_app_id: ["appId", "_creationTime"];
     }, {}, {}>;
-    registrationTokens: import("convex/server").TableDefinition<import("convex/values").VObject<{
-        appId: string;
-        createdAt: number;
-        expiresAt: number;
-        tokenHash: string;
-    }, {
-        tokenHash: import("convex/values").VString<string, "required">;
-        appId: import("convex/values").VString<string, "required">;
-        expiresAt: import("convex/values").VFloat64<number, "required">;
-        createdAt: import("convex/values").VFloat64<number, "required">;
-    }, "required", "appId" | "createdAt" | "expiresAt" | "tokenHash">, {
-        by_app_id: ["appId", "_creationTime"];
-        by_expires_at: ["expiresAt", "_creationTime"];
-        by_token_hash: ["tokenHash", "_creationTime"];
-    }, {}, {}>;
     clients: import("convex/server").TableDefinition<import("convex/values").VObject<{
         appId: string;
         clientId: string;
@@ -410,7 +392,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "pending";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     } | {
         appId: string;
         clientId: string;
@@ -425,7 +407,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "upstream";
-        txnCookieHash?: string;
+        txnCookieHash: string;
         upstreamCodeVerifier: string;
         upstreamNonce?: string;
         upstreamStateHash: string;
@@ -443,7 +425,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "claimed";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     } | {
         appId: string;
         clientId: string;
@@ -464,7 +446,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "emailSent";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     } | {
         appId: string;
         authTime: number;
@@ -487,7 +469,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "completed";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, [import("convex/values").VObject<{
         appId: string;
         clientId: string;
@@ -501,7 +483,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "pending";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, {
         requestId: import("convex/values").VString<string, "required">;
         appId: import("convex/values").VString<string, "required">;
@@ -514,11 +496,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"pending", "required">;
@@ -536,7 +518,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "upstream";
-        txnCookieHash?: string;
+        txnCookieHash: string;
         upstreamCodeVerifier: string;
         upstreamNonce?: string;
         upstreamStateHash: string;
@@ -552,11 +534,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"upstream", "required">;
@@ -578,7 +560,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "claimed";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, {
         requestId: import("convex/values").VString<string, "required">;
         appId: import("convex/values").VString<string, "required">;
@@ -591,11 +573,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"claimed", "required">;
@@ -620,7 +602,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "emailSent";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, {
         requestId: import("convex/values").VString<string, "required">;
         appId: import("convex/values").VString<string, "required">;
@@ -633,11 +615,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"emailSent", "required">;
@@ -672,7 +654,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "completed";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, {
         requestId: import("convex/values").VString<string, "required">;
         appId: import("convex/values").VString<string, "required">;
@@ -685,11 +667,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"completed", "required">;

package/dist/component/schema.js

@@ -31,11 +31,11 @@ const authRequestFields = {
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: boolean(),
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: optional(string()),
+    txnCookieHash: string(),
     createdAt: number(),
     expiresAt: number(),
 };
@@ -79,22 +79,10 @@ export default defineSchema({
         appId: string(),
         name: string(),
         firstParty: boolean(),
-        /**
-         * Exact hosts or `*.suffix` patterns a client callback may use through `/register`, e.g.
-         * `*.convex.site`. `registerClient` does not read it.
-         */
+        /** No longer read. The rows of a hub from before 0.8.0 still hold it. */
         allowedCallbackHosts: optional(array(string())),
         createdAt: number(),
     }).index("by_app_id", ["appId"]),
-    registrationTokens: defineTable({
-        tokenHash: string(),
-        appId: string(),
-        expiresAt: number(),
-        createdAt: number(),
-    })
-        .index("by_token_hash", ["tokenHash"])
-        .index("by_app_id", ["appId"])
-        .index("by_expires_at", ["expiresAt"]),
     clients: defineTable({
         clientId: string(),
         appId: string(),

package/dist/component/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/component/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAElC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAC3C,OAAO,CAAC,oBAAoB,CAAC,EAC7B,OAAO,CAAC,qBAAqB,CAAC,CAC/B,CAAC;AAEF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAClC,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,aAAa,CAAC,EACtB,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,EAAE;IACnB,UAAU,EAAE,MAAM,EAAE;IACpB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE;IACvB,yFAAyF;IACzF,UAAU,EAAE,OAAO,EAAE;IACrB;;;;OAIG;IACH,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;AAC/B,iEAAiE;AACjE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAC5D,+FAA+F;AAC/F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,iBAAiB,EAAE,MAAM,EAAE;IAC3B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AACF,kGAAkG;AAClG,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AACjF,8FAA8F;AAC9F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,aAAa,EAAE,MAAM,EAAE;IACvB,kBAAkB,EAAE,MAAM,EAAE;IAC5B,kEAAkE;IAClE,aAAa,EAAE,MAAM,EAAE;IACvB,mCAAmC;IACnC,UAAU,EAAE,MAAM,EAAE;IACpB,eAAe,EAAE,MAAM,EAAE;CAC1B,CAAC;AACF,iGAAiG;AACjG,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CACH,CAAC;AAEF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB;;;WAGG;QACH,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,SAAS,EAAE,MAAM,EAAE;QACnB,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC;SACC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,OAAO,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAElD,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;SACpC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,wBAAwB,EAAE,CAAC,mBAAmB,CAAC,CAAC;SACtD,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,gGAAgG;IAChG,UAAU,EAAE,WAAW,CAAC;QACtB,4CAA4C;QAC5C,SAAS,EAAE,MAAM,EAAE;QACnB,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,sBAAsB,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,OAAO,EAAE,WAAW,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1C,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;CAC1B,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/component/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAElC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAC3C,OAAO,CAAC,oBAAoB,CAAC,EAC7B,OAAO,CAAC,qBAAqB,CAAC,CAC/B,CAAC;AAEF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAClC,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,aAAa,CAAC,EACtB,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,EAAE;IACnB,UAAU,EAAE,MAAM,EAAE;IACpB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE;IACvB,yFAAyF;IACzF,UAAU,EAAE,OAAO,EAAE;IACrB;;;;OAIG;IACH,aAAa,EAAE,MAAM,EAAE;IACvB,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;AAC/B,iEAAiE;AACjE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAC5D,+FAA+F;AAC/F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,iBAAiB,EAAE,MAAM,EAAE;IAC3B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AACF,kGAAkG;AAClG,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AACjF,8FAA8F;AAC9F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,aAAa,EAAE,MAAM,EAAE;IACvB,kBAAkB,EAAE,MAAM,EAAE;IAC5B,kEAAkE;IAClE,aAAa,EAAE,MAAM,EAAE;IACvB,mCAAmC;IACnC,UAAU,EAAE,MAAM,EAAE;IACpB,eAAe,EAAE,MAAM,EAAE;CAC1B,CAAC;AACF,iGAAiG;AACjG,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CACH,CAAC;AAEF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,yEAAyE;QACzE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAElD,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;SACpC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,wBAAwB,EAAE,CAAC,mBAAmB,CAAC,CAAC;SACtD,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,gGAAgG;IAChG,UAAU,EAAE,WAAW,CAAC;QACtB,4CAA4C;QAC5C,SAAS,EAAE,MAAM,EAAE;QACnB,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,sBAAsB,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,OAAO,EAAE,WAAW,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1C,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;CAC1B,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samebase/identity-broker",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "An OpenID Provider for Convex that holds a team's upstream sign-in connections once and keeps no user accounts.",
   "license": "Apache-2.0",
   "repository": {

package/dist/component/crypto.d.ts

@@ -1,2 +0,0 @@
-/** SHA-256 of `input`, base64url without padding: the PKCE S256 transform of RFC 7636. */
-export declare function sha256Base64Url(input: string): Promise<string>;

package/dist/component/crypto.js

@@ -1,9 +0,0 @@
-/** SHA-256 of `input`, base64url without padding: the PKCE S256 transform of RFC 7636. */
-export async function sha256Base64Url(input) {
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
-    return btoa(String.fromCharCode(...new Uint8Array(digest)))
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=+$/, "");
-}
-//# sourceMappingURL=crypto.js.map

package/dist/component/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/component/crypto.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACxD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC"}

package/dist/component/registration.d.ts

@@ -1,29 +0,0 @@
-/** Stores the hash of an initial access token (RFC 7591 section 3) that registers clients of one app. */
-export declare const mintToken: import("convex/server").RegisteredMutation<"public", {
-    appId: string;
-    createdAt: number;
-    expiresAt: number;
-    tokenHash: string;
-}, Promise<null>>;
-/** The app a live registration token belongs to, or null for an unknown or expired token. */
-export declare const readToken: import("convex/server").RegisteredQuery<"public", {
-    now: number;
-    tokenHash: string;
-}, Promise<{
-    appId: string;
-    name: string;
-    firstParty: boolean;
-    allowedCallbackHosts: string[];
-} | null>>;
-/** The tokens of one app, as hashes: the plaintext is never stored. Oldest first. */
-export declare const listTokens: import("convex/server").RegisteredQuery<"public", {
-    appId: string;
-}, Promise<{
-    tokenHash: string;
-    expiresAt: number;
-    createdAt: number;
-}[]>>;
-/** Deletes a registration token before it expires. Clients it registered stay. */
-export declare const revokeToken: import("convex/server").RegisteredMutation<"public", {
-    tokenHash: string;
-}, Promise<null>>;

package/dist/component/registration.js

@@ -1,90 +0,0 @@
-import { v } from "convex/values";
-import { mutation, query } from "./_generated/server";
-const { array, boolean, number, object, string } = v;
-/** Stores the hash of an initial access token (RFC 7591 section 3) that registers clients of one app. */
-export const mintToken = mutation({
-    args: { tokenHash: string(), appId: string(), expiresAt: number(), createdAt: number() },
-    returns: v.null(),
-    handler: async (ctx, args) => {
-        const app = await ctx.db
-            .query("apps")
-            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
-            .unique();
-        if (app === null) {
-            throw new Error(`Unknown app "${args.appId}"`);
-        }
-        await ctx.db.insert("registrationTokens", {
-            tokenHash: args.tokenHash,
-            appId: args.appId,
-            expiresAt: args.expiresAt,
-            createdAt: args.createdAt,
-        });
-        return null;
-    },
-});
-/** The app a live registration token belongs to, or null for an unknown or expired token. */
-export const readToken = query({
-    args: { tokenHash: string(), now: number() },
-    returns: v.union(object({
-        appId: string(),
-        name: string(),
-        firstParty: boolean(),
-        allowedCallbackHosts: array(string()),
-    }), v.null()),
-    handler: async (ctx, args) => {
-        const token = await ctx.db
-            .query("registrationTokens")
-            .withIndex("by_token_hash", (q) => q.eq("tokenHash", args.tokenHash))
-            .unique();
-        if (token === null || token.expiresAt <= args.now) {
-            return null;
-        }
-        const app = await ctx.db
-            .query("apps")
-            .withIndex("by_app_id", (q) => q.eq("appId", token.appId))
-            .unique();
-        if (app === null) {
-            return null;
-        }
-        return {
-            appId: app.appId,
-            name: app.name,
-            firstParty: app.firstParty,
-            allowedCallbackHosts: app.allowedCallbackHosts ?? [],
-        };
-    },
-});
-/** The tokens of one app, as hashes: the plaintext is never stored. Oldest first. */
-export const listTokens = query({
-    args: { appId: string() },
-    returns: array(object({ tokenHash: string(), expiresAt: number(), createdAt: number() })),
-    handler: async (ctx, args) => {
-        const tokens = await ctx.db
-            .query("registrationTokens")
-            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
-            .collect();
-        return tokens
-            .map((token) => ({
-            tokenHash: token.tokenHash,
-            expiresAt: token.expiresAt,
-            createdAt: token.createdAt,
-        }))
-            .sort((a, b) => a.createdAt - b.createdAt || a.tokenHash.localeCompare(b.tokenHash));
-    },
-});
-/** Deletes a registration token before it expires. Clients it registered stay. */
-export const revokeToken = mutation({
-    args: { tokenHash: string() },
-    returns: v.null(),
-    handler: async (ctx, args) => {
-        const token = await ctx.db
-            .query("registrationTokens")
-            .withIndex("by_token_hash", (q) => q.eq("tokenHash", args.tokenHash))
-            .unique();
-        if (token !== null) {
-            await ctx.db.delete("registrationTokens", token._id);
-        }
-        return null;
-    },
-});
-//# sourceMappingURL=registration.js.map

package/dist/component/registration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../src/component/registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAErD,yGAAyG;AACzG,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC;IAChC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IACxF,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,MAAM,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE;YACxC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;IAC7B,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IAC5C,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,MAAM,CAAC;QACL,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC,EACF,CAAC,CAAC,IAAI,EAAE,CACT;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;aACpE,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;aACzD,MAAM,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;SACrD,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;IAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACzB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,OAAO,EAAE,CAAC;QACb,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACzF,CAAC;CACF,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;IAClC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;aACpE,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}