@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/internal/RateLimit.d.ts

@@ -0,0 +1,190 @@
+/**
+ * Rate limits through the Workers Rate Limiting bindings that `Limits` names. Each Cloudflare
+ * location counts on its own, and counts converge eventually, so a limit bounds abuse rather than
+ * counting exactly. Better Auth bounds the guesses at each sign-in code exactly.
+ * @module
+ */
+import type { Context } from 'hono';
+import type { Env } from './Env.js';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as Limits from './Limits.js';
+declare const LimitedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "temporarily_unavailable";
+            reason: "rate_limited";
+        };
+    };
+    readonly reason: "rate_limited";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** A request exceeded one of Tempo ID's rate limits. */
+export declare class LimitedError extends LimitedError_base {
+    readonly name = "RateLimit.LimitedError";
+    constructor(options: LimitedError.Options);
+}
+export declare namespace LimitedError {
+    type Options = {
+        /** Seconds until a retry can succeed. */
+        retryAfter: number;
+    };
+}
+/** A Workers Rate Limiting binding, as the app calls it. */
+export type Limiter = {
+    /** Counts a request for `key`, and reports whether the key has requests left. */
+    limit(options: {
+        /** The counter's key. */
+        key: string;
+    }): Promise<{
+        /** Whether the request is within the limit. */
+        success: boolean;
+    }>;
+};
+declare global {
+    interface VoidGeneratedEnvBindings extends Record<Limits.Limit, Limiter> {
+    }
+}
+/**
+ * A limit as the RateLimit header fields of draft-ietf-httpapi-ratelimit-headers describe it, in
+ * `RateLimit-Policy` and `RateLimit`.
+ */
+export type Policy = {
+    /** The policy's name, such as `sign-in-ip`. */
+    name: string;
+    /** The requests a key may make within `window`. */
+    quota: number;
+    /** The window, in seconds. */
+    window: number;
+};
+/** The response headers a rate-limited route may send, which cross-origin callers need exposed. */
+export declare const headers: readonly ['RateLimit', 'RateLimit-Policy', 'Retry-After'];
+/**
+ * Counts the request against each limit in order, and returns a 429 response with `Retry-After` at
+ * the first one spent, or `undefined`. A limit without a key is skipped, and so is an
+ * {@link Limits.optional} limit without a binding, with a warning. The limits after a refusal are not
+ * counted, so a refused caller spends no narrower quota, such as an address's. The response
+ * is the same for every limit, so it reveals nothing about the key, such as whether an account
+ * exists. Every limit with a key adds its {@link policy} to `RateLimit-Policy`.
+ */
+export declare function check(c: Context<Env>, options: check.Options): Promise<(Response & import("hono").TypedResponse<{
+    error: "temporarily_unavailable";
+    reason: "rate_limited";
+    error_description: string;
+    error_uri: string;
+    field?: string | undefined;
+    meta?: {
+        readonly [x: string]: string | number;
+    } | undefined;
+    request_id?: string | undefined;
+}, 429, "json">) | undefined>;
+export declare namespace check {
+    type Options = {
+        /** The counters the request counts against, broadest first. */
+        limits: readonly {
+            /** The limiter's binding name, which sets the limit. */
+            binding: Limits.Limit;
+            /** The counter's key, or `undefined` to skip it. Keys never hold secrets, codes, or tokens. */
+            key: string | undefined;
+        }[];
+    };
+}
+export declare namespace check {
+    /** The refusal `check` returns. */
+    const errors: readonly [typeof LimitedError];
+}
+/**
+ * Adds `policy` to the response's `RateLimit-Policy`, as `"<name>";q=<quota>;w=<window>`. A
+ * response that counts against several policies lists each once. It reads no binding, so a page
+ * loader's context can call it too.
+ */
+export declare function describe(c: Context, options: describe.Options): void;
+export declare namespace describe {
+    type Options = {
+        /** The policy the request counts against. */
+        policy: Policy;
+    };
+}
+/**
+ * Returns the key for a normalized email address: its SHA-256 hash, so the counters hold no
+ * address.
+ */
+export declare function email(options: email.Options): `0x${string}`;
+export declare namespace email {
+    type Options = {
+        /** The trimmed, lowercased address. */
+        email: string;
+    };
+}
+/** Instantiates a {@link Policy}. */
+export declare function from(policy: Policy): Policy;
+/**
+ * Returns the client's key from `cf-connecting-ip`, or `undefined` for a request without one, such
+ * as an in-process call. An IPv6 address keys on its /64 prefix, since one subscriber usually holds
+ * the whole prefix and could otherwise rotate addresses within it. A Worker in another zone keys on
+ * that zone, since every such Worker arrives from the same address.
+ */
+export declare function ip(c: ip.Context): string | undefined;
+export declare namespace ip {
+    /** The request context, of which `ip` reads only the headers. */
+    type Context = {
+        req: {
+            header: (name: string) => string | undefined;
+        };
+    };
+}
+/**
+ * Returns a binding's {@link Policy}: its limit and period from `Limits`. The policy's name is the
+ * binding's name without its `_LIMIT` suffix, in kebab case, such as `sign-in-ip` for
+ * `SIGN_IN_IP_LIMIT`.
+ */
+export declare function policy(options: policy.Options): Policy;
+export declare namespace policy {
+    type Options = {
+        /** The limiter's binding name. */
+        binding: Limits.Limit;
+    };
+}
+/**
+ * Returns a 429 response with `Retry-After`, and `RateLimit` naming the spent `policy` with no
+ * quota left (`r=0`) for `retryAfter` seconds (`t`). The body names no key or limit, so it reveals
+ * nothing about the key, such as whether an account exists. It reads no binding, so a page
+ * loader's context can call it too.
+ */
+export declare function refuse(c: Context, options: refuse.Options): Response & import("hono").TypedResponse<{
+    error: "temporarily_unavailable";
+    reason: "rate_limited";
+    error_description: string;
+    error_uri: string;
+    field?: string | undefined;
+    meta?: {
+        readonly [x: string]: string | number;
+    } | undefined;
+    request_id?: string | undefined;
+}, 429, "json">;
+export declare namespace refuse {
+    type Options = {
+        /** The spent policy. */
+        policy: Policy;
+        /** Seconds until a retry can succeed, at most the policy's window. */
+        retryAfter: number;
+    };
+}
+export {};
+//# sourceMappingURL=RateLimit.d.ts.map

package/dist/internal/RateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimit.d.ts","sourceRoot":"","sources":["../../src/internal/RateLimit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIrC,wDAAwD;AACxD,qBAAa,YAAa,SAAQ,iBAAoC;IACpE,SAAkB,IAAI,4BAA2B;IAEjD,YAAY,OAAO,EAAE,YAAY,CAAC,OAAO,EAIxC;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,yCAAyC;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAQD,4DAA4D;AAC5D,MAAM,MAAM,OAAO,GAAG;IACpB,iFAAiF;IACjF,KAAK,CAAC,OAAO,EAAE;QACb,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAA;KACZ,GAAG,OAAO,CAAC;QACV,+CAA+C;QAC/C,OAAO,EAAE,OAAO,CAAA;KACjB,CAAC,CAAA;CACH,CAAA;AAGD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,wBAAyB,SAAQ,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;KAAG;CAC5E;AAED;;;GAGG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,mGAAmG;AACnG,eAAO,MAAM,OAAO,YAAI,WAAW,EAAE,kBAAkB,EAAE,aAAa,CAAU,CAAA;AAEhF;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;;;;;;;;;;8BAqClE;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,KAAK,OAAO,GAAG;QACb,+DAA+D;QAC/D,MAAM,EAAE,SAAS;YACf,wDAAwD;YACxD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAA;YACrB,+FAA+F;YAC/F,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;SACxB,EAAE,CAAA;KACJ,CAAA;CACF;AAED,yBAAiB,KAAK,CAAC;IACrB,mCAAmC;IAC5B,MAAM,MAAM,gCAA0B,CAAA;CAC9C;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,QAO7D;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,6CAA6C;QAC7C,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,iBAE3C;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,KAAK,OAAO,GAAG;QACb,uCAAuC;QACvC,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED,qCAAqC;AACrC,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;;GAKG;AACH,wBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,sBAwB/B;AAED,MAAM,CAAC,OAAO,WAAW,EAAE,CAAC;IAC1B,iEAAiE;IACjE,KAAK,OAAO,GAAG;QAAE,GAAG,EAAE;YAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;SAAE,CAAA;KAAE,CAAA;CACzE;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,UAW7C;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,kCAAkC;QAClC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAA;KACtB,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;;;;;;;;;;gBAKzD;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,wBAAwB;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,sEAAsE;QACtE,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF"}

package/dist/internal/RateLimit.js

@@ -0,0 +1,148 @@
+import { Bytes, Hash } from 'ox';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as Limits from './Limits.js';
+import * as Log from './Log.js';
+import * as Timing from './Timing.js';
+/** A request exceeded one of Tempo ID's rate limits. */
+export class LimitedError extends ErrorResponse.define('rate_limited') {
+    name = 'RateLimit.LimitedError';
+    constructor(options) {
+        super({
+            error_description: `Too many requests. Retry after ${options.retryAfter} seconds.`,
+        });
+    }
+}
+/**
+ * The address Cloudflare gives every Worker subrequest from another zone, whatever Worker sends it.
+ * Cloudflare names the calling zone in `cf-worker` instead.
+ */
+const workers = '2a06:98c0:3600::103';
+/** The response headers a rate-limited route may send, which cross-origin callers need exposed. */
+export const headers = ['RateLimit', 'RateLimit-Policy', 'Retry-After'];
+/**
+ * Counts the request against each limit in order, and returns a 429 response with `Retry-After` at
+ * the first one spent, or `undefined`. A limit without a key is skipped, and so is an
+ * {@link Limits.optional} limit without a binding, with a warning. The limits after a refusal are not
+ * counted, so a refused caller spends no narrower quota, such as an address's. The response
+ * is the same for every limit, so it reveals nothing about the key, such as whether an account
+ * exists. Every limit with a key adds its {@link policy} to `RateLimit-Policy`.
+ */
+export async function check(c, options) {
+    // A deployment whose Wrangler config predates an optional limit has no binding for it. Any other
+    // missing binding throws below, so a misconfigured deployment fails closed.
+    const bindings = c.env;
+    const limits = options.limits.flatMap((limit) => {
+        if (limit.key === undefined)
+            return [];
+        if (!bindings[limit.binding] && Limits.optional.includes(limit.binding)) {
+            Log.warn(c, {
+                fields: { binding: limit.binding },
+                message: 'A rate limit has no binding, so the request is not counted.',
+            });
+            return [];
+        }
+        return [
+            {
+                ...limit,
+                key: limit.key,
+                policy: policy({ binding: limit.binding }),
+            },
+        ];
+    });
+    for (const limit of limits)
+        describe(c, { policy: limit.policy });
+    for (const limit of limits) {
+        const outcome = await Timing.measure(c, c.env[limit.binding].limit({ key: limit.key }), 'ratelimit.limit');
+        // The binding reports no reset, and every counter restarts once a window passes.
+        if (!outcome.success)
+            return refuse(c, {
+                policy: limit.policy,
+                retryAfter: limit.policy.window,
+            });
+    }
+    return undefined;
+}
+(function (check) {
+    /** The refusal `check` returns. */
+    check.errors = [LimitedError];
+})(check || (check = {}));
+/**
+ * Adds `policy` to the response's `RateLimit-Policy`, as `"<name>";q=<quota>;w=<window>`. A
+ * response that counts against several policies lists each once. It reads no binding, so a page
+ * loader's context can call it too.
+ */
+export function describe(c, options) {
+    const { policy } = options;
+    c.header('ratelimit-policy', `"${policy.name}";q=${policy.quota};w=${policy.window}`, { append: true });
+}
+/**
+ * Returns the key for a normalized email address: its SHA-256 hash, so the counters hold no
+ * address.
+ */
+export function email(options) {
+    return Hash.sha256(Bytes.fromString(options.email), { as: 'Hex' });
+}
+/** Instantiates a {@link Policy}. */
+export function from(policy) {
+    return policy;
+}
+/**
+ * Returns the client's key from `cf-connecting-ip`, or `undefined` for a request without one, such
+ * as an in-process call. An IPv6 address keys on its /64 prefix, since one subscriber usually holds
+ * the whole prefix and could otherwise rotate addresses within it. A Worker in another zone keys on
+ * that zone, since every such Worker arrives from the same address.
+ */
+export function ip(c) {
+    const address = c.req.header('cf-connecting-ip');
+    // Only Cloudflare sends from this address, so `cf-worker` names the calling zone and is not the
+    // caller's to choose.
+    if (address === workers)
+        return `worker:${c.req.header('cf-worker') ?? ''}`;
+    // An IPv4 address, or an IPv6 address that embeds one, keys whole.
+    if (!address?.includes(':') || address.includes('.'))
+        return address;
+    const [head, tail] = address.toLowerCase().split('::');
+    const left = head ? head.split(':') : [];
+    const right = tail ? tail.split(':') : [];
+    const groups = tail === undefined
+        ? left
+        : [
+            ...left,
+            ...Array(Math.max(0, 8 - left.length - right.length)).fill('0'),
+            ...right,
+        ];
+    return `${groups
+        .slice(0, 4)
+        .map((group) => group.replace(/^0+(?=.)/, ''))
+        .join(':')}::/64`;
+}
+/**
+ * Returns a binding's {@link Policy}: its limit and period from `Limits`. The policy's name is the
+ * binding's name without its `_LIMIT` suffix, in kebab case, such as `sign-in-ip` for
+ * `SIGN_IN_IP_LIMIT`.
+ */
+export function policy(options) {
+    const { binding } = options;
+    const config = Limits.limits[binding];
+    return from({
+        name: binding
+            .replace(/_LIMIT$/, '')
+            .toLowerCase()
+            .replaceAll('_', '-'),
+        quota: config.limit,
+        window: config.period,
+    });
+}
+/**
+ * Returns a 429 response with `Retry-After`, and `RateLimit` naming the spent `policy` with no
+ * quota left (`r=0`) for `retryAfter` seconds (`t`). The body names no key or limit, so it reveals
+ * nothing about the key, such as whether an account exists. It reads no binding, so a page
+ * loader's context can call it too.
+ */
+export function refuse(c, options) {
+    const { policy, retryAfter } = options;
+    c.header('ratelimit', `"${policy.name}";r=0;t=${retryAfter}`);
+    c.header('retry-after', String(retryAfter));
+    return ErrorResponse.json(c, new LimitedError({ retryAfter }));
+}
+//# sourceMappingURL=RateLimit.js.map

package/dist/internal/RateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimit.js","sourceRoot":"","sources":["../../src/internal/RateLimit.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAEhC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC,wDAAwD;AACxD,MAAM,OAAO,YAAa,SAAQ,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC;IAClD,IAAI,GAAG,wBAAwB,CAAA;IAEjD,YAAY,OAA6B;QACvC,KAAK,CAAC;YACJ,iBAAiB,EAAE,kCAAkC,OAAO,CAAC,UAAU,WAAW;SACnF,CAAC,CAAA;IACJ,CAAC;CACF;AASD;;;GAGG;AACH,MAAM,OAAO,GAAG,qBAAqB,CAAA;AAgCrC,mGAAmG;AACnG,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,kBAAkB,EAAE,aAAa,CAAU,CAAA;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,CAAe,EAAE,OAAsB;IACjE,iGAAiG;IACjG,4EAA4E;IAC5E,MAAM,QAAQ,GAA2C,CAAC,CAAC,GAAG,CAAA;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9C,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,CAAA;QACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE;gBACV,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;gBAClC,OAAO,EAAE,6DAA6D;aACvE,CAAC,CAAA;YACF,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO;YACL;gBACE,GAAG,KAAK;gBACR,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3C;SACF,CAAA;IACH,CAAC,CAAC,CAAA;IACF,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IAEjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAClC,CAAC,EACD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,EAC9C,iBAAiB,CAClB,CAAA;QACD,iFAAiF;QACjF,IAAI,CAAC,OAAO,CAAC,OAAO;YAClB,OAAO,MAAM,CAAC,CAAC,EAAE;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;aAChC,CAAC,CAAA;IACN,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAcD,WAAiB,KAAK;IACpB,mCAAmC;IACtB,YAAM,GAAG,CAAC,YAAY,CAAU,CAAA;AAC/C,CAAC,EAHgB,KAAK,KAAL,KAAK,QAGrB;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAU,EAAE,OAAyB;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC1B,CAAC,CAAC,MAAM,CACN,kBAAkB,EAClB,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,MAAM,EAAE,EACvD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAA;AACH,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,OAAsB;IAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;AACpE,CAAC;AASD,qCAAqC;AACrC,MAAM,UAAU,IAAI,CAAC,MAAc;IACjC,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,EAAE,CAAC,CAAa;IAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAChD,gGAAgG;IAChG,sBAAsB;IACtB,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAA;IAE3E,mEAAmE;IACnE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAA;IAEpE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzC,MAAM,MAAM,GACV,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,GAAG,IAAI;YACP,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/D,GAAG,KAAK;SACT,CAAA;IACP,OAAO,GAAG,MAAM;SACb,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;SAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAA;AACrB,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,OAAuB;IAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACrC,OAAO,IAAI,CAAC;QACV,IAAI,EAAE,OAAO;aACV,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,WAAW,EAAE;aACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAA;AACJ,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,CAAU,EAAE,OAAuB;IACxD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IACtC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,WAAW,UAAU,EAAE,CAAC,CAAA;IAC7D,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAC3C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;AAChE,CAAC"}

package/dist/internal/Realm.d.ts

@@ -0,0 +1,281 @@
+/**
+ * Realms: the sets of Tempo Accounts that apps reach. The `realms` table holds each realm, and its
+ * owner configurations live in their own tables: `realm_passkeys` for its passkey relying party,
+ * `realm_privy` for its Privy app, and `realm_secp256k1` for the secp256k1 owners that Tempo ID
+ * holds. The `app_realms` table maps each OAuth app to its realms, in order. An app without rows
+ * reaches the `default` realm.
+ * @module
+ */
+import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
+import { z } from 'zod';
+import * as Schema from '../app/db/schema.js';
+import type * as Privy from './Privy.js';
+/** An app names the realm, so the realm cannot be removed. */
+export declare class InUseError extends Error {
+    readonly name = "Realm.InUseError";
+    constructor(options: {
+        id: string;
+    });
+}
+/** A realm ID, a name, a Privy app, or a list of realms is not valid. */
+export declare class InvalidError extends Error {
+    readonly name = "Realm.InvalidError";
+}
+/** No OAuth app has the client ID. */
+export declare class NotFoundAppError extends Error {
+    readonly name = "Realm.NotFoundAppError";
+    constructor(options: {
+        clientId: string;
+    });
+}
+/** No realm has the ID. */
+export declare class NotFoundError extends Error {
+    readonly name = "Realm.NotFoundError";
+    constructor(options: {
+        id: string;
+    });
+}
+/** A realm with the ID exists. */
+export declare class TakenError extends Error {
+    readonly name = "Realm.TakenError";
+    constructor(options: {
+        id: string;
+    });
+}
+/** Another realm holds the passkey relying party. A passkey belongs to exactly one relying party. */
+export declare class TakenPasskeysError extends Error {
+    readonly name = "Realm.TakenPasskeysError";
+    constructor(options: {
+        rpId: string;
+    });
+}
+/** Another realm holds the Privy app. Realms that shared one would list the same accounts. */
+export declare class TakenPrivyAppError extends Error {
+    readonly name = "Realm.TakenPrivyAppError";
+    constructor(options: {
+        appId: string;
+    });
+}
+/** A database with Tempo ID's tables, through any Postgres driver. */
+export type Database = PgDatabase<PgQueryResultHKT, typeof Schema>;
+/** One set of Tempo Accounts, which only the apps that name it reach. */
+export type Realm = {
+    /** The realm ID, such as `default` or `tempo-cash`. */
+    id: string;
+    /** The display name, which labels the realm's accounts, such as `Tempo Cash`. */
+    name: string;
+    /** The passkey relying party whose passkeys own accounts in the realm. `undefined` when the realm has none. */
+    passkeys: {
+        /** The relying party ID, a registrable domain such as `tempo.xyz`. */
+        rpId: string;
+    } | undefined;
+    /** The Privy app that holds the realm's Privy owners. `undefined` when the realm has none. */
+    privy: {
+        /** The Privy app ID. */
+        appId: string;
+    } | undefined;
+    /** Whether Tempo ID holds the realm's secp256k1 owners itself, as in the suites and local development. */
+    secp256k1: boolean;
+};
+/** The ID of the realm that every app without rows in `app_realms` reaches. */
+export declare const defaultId = "default";
+/** Zod schemas for the values that define realms. */
+export declare namespace schema {
+    /** A realm ID, in lowercase kebab case. */
+    const id: z.ZodString;
+    /** A realm, as `add` receives it. */
+    const realm: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    /** A realm's passkey relying party, as `setPasskeys` receives it. */
+    const passkeys: z.ZodObject<{
+        realmId: z.ZodString;
+        rpId: z.ZodString;
+    }, z.core.$strip>;
+    /** A realm's Privy app, as `setPrivy` receives it. */
+    const privy: z.ZodObject<{
+        appId: z.ZodString;
+        appSecret: z.ZodString;
+        realmId: z.ZodString;
+    }, z.core.$strip>;
+    /** An app's realms, in order, each named once. */
+    const realms: z.ZodArray<z.ZodString>;
+}
+/**
+ * Adds a realm without owner configurations, and returns it.
+ *
+ * Throws `InvalidError` for an invalid value, and `TakenError` when the ID exists.
+ */
+export declare function add(db: Database, options: add.Options): Promise<Realm>;
+export declare namespace add {
+    type Options = {
+        /** The realm ID, in lowercase kebab case, such as `tempo-cash`. */
+        id: string;
+        /** The display name, such as `Tempo Cash`. */
+        name: string;
+    };
+}
+/**
+ * Returns the realms of the app with `clientId`, in order, in one query. The first realm holds a
+ * user's first account. An app without rows, or an unknown client ID, reaches the `default` realm.
+ */
+export declare function forApp(db: Database, options: forApp.Options): Promise<readonly Realm[]>;
+export declare namespace forApp {
+    type Options = {
+        /** The OAuth app's client ID. */
+        clientId: string;
+    };
+}
+/**
+ * Returns the realms that a request reaches for the app with `clientId`, in order. A request that
+ * names no app reaches the `default` realm. So does a browser page that names an app from an origin
+ * none of the app's redirect URIs has, since a page cannot read another app's accounts. A native app
+ * sends no `Origin`, and Tempo ID's own pages send `own`.
+ */
+export declare function forRequest(db: Database, options: forRequest.Options): Promise<readonly Realm[]>;
+export declare namespace forRequest {
+    type Options = {
+        /** The client ID that the request names, if any. */
+        clientId?: string | undefined;
+        /** The request's `Origin`, if any. */
+        origin?: string | undefined;
+        /** Tempo ID's own origin. */
+        own: string;
+    };
+}
+/**
+ * Instantiates a {@link Realm}.
+ *
+ * @example
+ * ```ts
+ * const realm = Realm.from({
+ *   id: 'tempo-cash',
+ *   name: 'Tempo Cash',
+ *   privy: { appId: 'cm…' },
+ *   secp256k1: false,
+ * })
+ * ```
+ */
+export declare function from(value: Realm): Realm;
+/** Returns the realm with `id`. Throws `NotFoundError` when no realm has it. */
+export declare function get(db: Database, options: get.Options): Promise<Realm>;
+export declare namespace get {
+    type Options = {
+        /** The realm ID, such as `tempo-cash`. */
+        id: string;
+    };
+}
+/** Returns every realm: `default` first, then the others by ID. */
+export declare function list(db: Database): Promise<readonly Realm[]>;
+/**
+ * Returns the Privy apps of `realms`, by realm ID, with each app secret decrypted with `secret`. A
+ * realm without a Privy app has no entry. Reads every realm in one query.
+ */
+export declare function privyApps(db: Database, options: privyApps.Options): Promise<ReadonlyMap<string, Privy.App>>;
+export declare namespace privyApps {
+    type Options = {
+        /** The realms whose Privy apps to read. */
+        realms: readonly Realm[];
+        /** The `SECRET` variable, which encrypts each app secret. */
+        secret: string;
+    };
+}
+/**
+ * Removes the realm with `id`, with its owner configurations.
+ *
+ * Throws `InvalidError` for an invalid ID or `default`, `NotFoundError` when no realm has the ID,
+ * and `InUseError` while an app names the realm.
+ */
+export declare function remove(db: Database, options: remove.Options): Promise<void>;
+export declare namespace remove {
+    type Options = {
+        /** The realm ID, such as `tempo-cash`. */
+        id: string;
+    };
+}
+/**
+ * Sets the realms of the app with `clientId`, in order, and returns them. An empty list removes the
+ * app's rows, so the app reaches the `default` realm.
+ *
+ * Throws `InvalidError` for an invalid ID or a repeated realm, `NotFoundAppError` when no OAuth app
+ * has the client ID, and `NotFoundError` when no realm has one of the IDs.
+ */
+export declare function setForApp(db: Database, options: setForApp.Options): Promise<readonly Realm[]>;
+export declare namespace setForApp {
+    type Options = {
+        /** The OAuth app's client ID. */
+        clientId: string;
+        /** The realm IDs, in order, such as `['default', 'tempo-cash']`. Empty for the `default` realm alone. */
+        realms: readonly string[];
+    };
+}
+/**
+ * Sets the passkey relying party of the realm with `realmId`, and returns the realm. It replaces an
+ * earlier relying party. Passkeys of that relying party then own accounts in the realm.
+ *
+ * Throws `InvalidError` for an invalid value, `NotFoundError` when no realm has the ID, and
+ * `TakenPasskeysError` when another realm holds the relying party.
+ */
+export declare function setPasskeys(db: Database, options: setPasskeys.Options): Promise<Realm>;
+export declare namespace setPasskeys {
+    type Options = {
+        /** The realm ID, such as `default`. */
+        realmId: string;
+        /** The relying party ID, a registrable domain such as `tempo.xyz`. */
+        rpId: string;
+    };
+}
+/**
+ * Sets the Privy app that holds the Privy owners of the realm with `realmId`, and returns the realm.
+ * It replaces an earlier Privy app. The row holds the app secret encrypted with `secret`.
+ *
+ * Throws `InvalidError` for an invalid value, `NotFoundError` when no realm has the ID, and
+ * `TakenPrivyAppError` when another realm holds the Privy app.
+ */
+export declare function setPrivy(db: Database, options: setPrivy.Options): Promise<Realm>;
+export declare namespace setPrivy {
+    type Options = {
+        /** The Privy app ID. */
+        appId: string;
+        /** The Privy app secret, which the row holds only encrypted. */
+        appSecret: string;
+        /** The realm ID, such as `tempo-cash`. */
+        realmId: string;
+        /** The `SECRET` variable, which encrypts the app secret. */
+        secret: string;
+    };
+}
+/**
+ * Sets whether Tempo ID holds the secp256k1 owners of the realm with `realmId`, and returns the
+ * realm. The realm then creates a user's first account with a key that Tempo ID holds. Turning it
+ * off keeps the realm's stored keys, and lists none of them.
+ *
+ * Throws `InvalidError` for an invalid ID, and `NotFoundError` when no realm has the ID.
+ */
+export declare function setSecp256k1(db: Database, options: setSecp256k1.Options): Promise<Realm>;
+export declare namespace setSecp256k1 {
+    type Options = {
+        /** Whether Tempo ID holds the realm's secp256k1 owners. */
+        enabled: boolean;
+        /** The realm ID, such as `default`. */
+        realmId: string;
+    };
+}
+/**
+ * Returns `realms` with the relying party that each one signs in with. The `default` realm without a
+ * `realm_passkeys` row signs in with passkeys of the registrable domain of `origin`, such as
+ * `tempo.xyz` for `https://id.tempo.xyz`, so every deployment offers passkeys without configuration. A row replaces that relying party. When another realm's row holds
+ * the host or a parent domain of it, `default` has none, since that realm's passkeys sign in at the
+ * same origin.
+ */
+export declare function withDefaults(db: Database, options: withDefaults.Options): Promise<readonly Realm[]>;
+export declare namespace withDefaults {
+    type Options = {
+        /** Tempo ID's origin, such as `https://id.tempo.xyz`. */
+        origin: string;
+        /** The realms that a request reaches, in order. */
+        realms: readonly Realm[];
+    };
+}
+//# sourceMappingURL=Realm.d.ts.map

package/dist/internal/Realm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Realm.d.ts","sourceRoot":"","sources":["../../src/internal/Realm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAIvE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AAExC,8DAA8D;AAC9D,qBAAa,UAAW,SAAQ,KAAK;IACnC,SAAkB,IAAI,sBAAqB;IAE3C,YAAY,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAIlC;CACF;AAED,yEAAyE;AACzE,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,wBAAuB;CAC9C;AAED,sCAAsC;AACtC,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,4BAA2B;IAEjD,YAAY,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAExC;CACF;AAED,2BAA2B;AAC3B,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAkB,IAAI,yBAAwB;IAE9C,YAAY,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAElC;CACF;AAED,kCAAkC;AAClC,qBAAa,UAAW,SAAQ,KAAK;IACnC,SAAkB,IAAI,sBAAqB;IAE3C,YAAY,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAElC;CACF;AAED,qGAAqG;AACrG,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAkB,IAAI,8BAA6B;IAEnD,YAAY,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAIpC;CACF;AAED,8FAA8F;AAC9F,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAkB,IAAI,8BAA6B;IAEnD,YAAY,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAIrC;CACF;AAED,sEAAsE;AACtE,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,EAAE,OAAO,MAAM,CAAC,CAAA;AAElE,yEAAyE;AACzE,MAAM,MAAM,KAAK,GAAG;IAClB,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAA;IACV,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAA;IACZ,+GAA+G;IAC/G,QAAQ,EACJ;QACE,sEAAsE;QACtE,IAAI,EAAE,MAAM,CAAA;KACb,GACD,SAAS,CAAA;IACb,8FAA8F;IAC9F,KAAK,EACD;QACE,wBAAwB;QACxB,KAAK,EAAE,MAAM,CAAA;KACd,GACD,SAAS,CAAA;IACb,0GAA0G;IAC1G,SAAS,EAAE,OAAO,CAAA;CACnB,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,SAAS,YAAY,CAAA;AAElC,qDAAqD;AACrD,yBAAiB,MAAM,CAAC;IACtB,2CAA2C;IACpC,MAAM,EAAE,aAEb,CAAA;IAEF,qCAAqC;IAC9B,MAAM,KAAK;;;qBAGhB,CAAA;IAEF,qEAAqE;IAC9D,MAAM,QAAQ;;;qBAUnB,CAAA;IAEF,sDAAsD;IAC/C,MAAM,KAAK;;;;qBAIhB,CAAA;IAEF,kDAAkD;IAC3C,MAAM,MAAM,yBAIf,CAAA;CACL;AAED;;;;GAIG;AACH,wBAAsB,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,kBAiB3D;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,KAAK,OAAO,GAAG;QACb,mEAAmE;QACnE,EAAE,EAAE,MAAM,CAAA;QACV,8CAA8C;QAC9C,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAC1B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,CAAC,OAAO,GACtB,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CA0C3B;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,iCAAiC;QACjC,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,UAAU,CAAC,OAAO,GAC1B,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAmB3B;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC7B,sCAAsC;QACtC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,6BAA6B;QAC7B,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAExC;AAED,gFAAgF;AAChF,wBAAsB,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,kBAyB3D;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,KAAK,OAAO,GAAG;QACb,0CAA0C;QAC1C,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;CACF;AAED,mEAAmE;AACnE,wBAAsB,IAAI,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CA2BlE;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,SAAS,CAAC,OAAO,GACzB,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAyBzC;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,GAAG;QACb,2CAA2C;QAC3C,MAAM,EAAE,SAAS,KAAK,EAAE,CAAA;QACxB,6DAA6D;QAC7D,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,iBAuBjE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,0CAA0C;QAC1C,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,6BAsCvE;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,GAAG;QACb,iCAAiC;QACjC,QAAQ,EAAE,MAAM,CAAA;QAChB,yGAAyG;QACzG,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,kBAoB3E;AAED,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,KAAK,OAAO,GAAG;QACb,uCAAuC;QACvC,OAAO,EAAE,MAAM,CAAA;QACf,sEAAsE;QACtE,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,kBA+BrE;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,wBAAwB;QACxB,KAAK,EAAE,MAAM,CAAA;QACb,gEAAgE;QAChE,SAAS,EAAE,MAAM,CAAA;QACjB,0CAA0C;QAC1C,OAAO,EAAE,MAAM,CAAA;QACf,4DAA4D;QAC5D,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,YAAY,CAAC,OAAO,kBAqB9B;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,2DAA2D;QAC3D,OAAO,EAAE,OAAO,CAAA;QAChB,uCAAuC;QACvC,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,YAAY,CAAC,OAAO,GAC5B,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CA0C3B;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,yDAAyD;QACzD,MAAM,EAAE,MAAM,CAAA;QACd,mDAAmD;QACnD,MAAM,EAAE,SAAS,KAAK,EAAE,CAAA;KACzB,CAAA;CACF"}