@tempoxyz/id 0.0.0-stage → 0.0.0

package/dist/internal/Apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Apps.d.ts","sourceRoot":"","sources":["../../src/internal/Apps.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAClD,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AAGxC,6CAA6C;AAC7C,qBAAa,WAAY,SAAQ,KAAK;IACpC,SAAkB,IAAI,sBAAqB;IAE3C,YAAY,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAIxC;CACF;AAED,uEAAuE;AACvE,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,uBAAsB;CAC7C;AAED,sCAAsC;AACtC,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAkB,IAAI,wBAAuB;IAE7C,YAAY,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAExC;CACF;AAED,mFAAmF;AACnF,qBAAa,WAAY,SAAQ,KAAK;IACpC,SAAkB,IAAI,sBAAqB;IAE3C,YAAY,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAIxC;CACF;AAED,yDAAyD;AACzD,MAAM,MAAM,GAAG,GAAG;IAChB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAA;IAChB,gCAAgC;IAChC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAA;IACtB,gGAAgG;IAChG,MAAM,EAAE,OAAO,CAAA;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,wFAAwF;IACxF,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,yCAAyC;IACzC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,4FAA4F;IAC5F,MAAM,EAAE,OAAO,CAAA;IACf,kFAAkF;IAClF,IAAI,EAAE,OAAO,CAAA;IACb,+DAA+D;IAC/D,WAAW,EAAE,OAAO,CAAA;IACpB,uFAAuF;IACvF,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAA;CACvB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,iDAAiD,CAAA;AAEzE,kFAAkF;AAClF,eAAO,MAAM,SAAS,kBAAkB,CAAA;AAKxC;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,YAAY,CAAC,OAAO,oBAY9B;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,4CAA4C;QAC5C,QAAQ,EAAE,MAAM,CAAA;QAChB,gDAAgD;QAChD,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;;;GA2DvE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC7B;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACjC;;;WAGG;QACH,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC5B,uDAAuD;QACvD,IAAI,EAAE,MAAM,CAAA;QACZ,gFAAgF;QAChF,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;QACtD,0FAA0F;QAC1F,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;QAC5C,sFAAsF;QACtF,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC5B,4EAA4E;QAC5E,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC1B,oFAAoF;QACpF,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACjC,+CAA+C;QAC/C,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;KAC/B,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,gBAAgB,CAAC,OAAO,oBAuBlC;AAED,MAAM,CAAC,OAAO,WAAW,gBAAgB,CAAC;IACxC,KAAK,OAAO,GAAG;QACb,8BAA8B;QAC9B,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,gBAKjE;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,KAAK,OAAO,GAAG;QACb,2BAA2B;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,oEAAoE;QACpE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAC9B,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,mBAM9C;AAgBD,uCAAuC;AACvC,wBAAsB,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC,CAStE;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO;;;;;;;;;;;;;;;;YAOnC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAsBL,kBAAkB;YAClB,IAAI;YACJ,cAAc,YAAkB;gBAC9B,OAAO,EAAE,OAAO,CAAA;gBAChB,OAAO,EAAE;oBAAE,EAAE,EAAE,MAAM,CAAA;iBAAE,CAAA;gBACvB,IAAI,EAAE;oBAAE,EAAE,EAAE,MAAM,CAAA;iBAAE,CAAA;aACrB;;2CAqBqC;YACtC,SAAS,EAAE,MAAM,CAAA;YACjB,IAAI,CAAC,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,GAAG,SAAS,CAAA;YACxC,iBAAiB,CAAC,EAAE;gBAClB,KAAK,EAAE;oBACL,SAAS,EAAE,MAAM,CAAA;oBACjB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;oBACnC,iBAAiB,CAAC,EAAE,OAAO,CAAA;iBAC5B,CAAA;aACF,CAAA;SACF;;;;;;;;;;;;;;YAgCc,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAG9B;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,OAAO,GAAG;QACb;;;WAGG;QACH,WAAW,CAAC,EACR,CAAC,CAAC,OAAO,EAAE;YACT,QAAQ,EAAE,MAAM,CAAA;YAChB,OAAO,EAAE,OAAO,CAAA;YAChB,SAAS,EAAE,MAAM,CAAA;YACjB,MAAM,EAAE,MAAM,CAAA;SACf,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GACvB,SAAS,CAAA;QACb,yDAAyD;QACzD,OAAO,EAAE,MAAM,CAAA;QACf;;;WAGG;QACH,UAAU,CAAC,EACP,CAAC,CAAC,OAAO,EAAE;YACT,QAAQ,EAAE,MAAM,CAAA;YAChB,aAAa,EAAE,MAAM,CAAA;YACrB,MAAM,EAAE,MAAM,CAAA;SACf,KAAK,OAAO,CAAC,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,GACjD,SAAS,CAAA;KACd,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,gBAQvE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,2BAA2B;QAC3B,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,YAAY,CAAC,OAAO;;;GA0B9B;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,2BAA2B;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,uGAAuG;QACvG,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAClC,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,gBA6CvE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,2BAA2B;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,wBAAwB;QACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,mHAAmH;QACnH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;QACtD,wEAAwE;QACxE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;QAC5C,uDAAuD;QACvD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC1B,+DAA+D;QAC/D,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAClC,CAAA;CACF"}

package/dist/internal/Apps.js

@@ -0,0 +1,472 @@
+/**
+ * OAuth apps: the Better Auth plugins that serve them, and the operations of `tempo-id admin apps`
+ * on the `oauth_client` table. Better Auth registers clients only for a signed-in owner, so the
+ * operations write the rows that it reads, with its client ID format and its secret hash. A client
+ * secret is stored only as its hash.
+ * @module
+ */
+import { isLoopbackHost } from '@better-auth/core/utils/host';
+import { isNativePrivateUseRedirectUri } from '@better-auth/core/utils/redirect-uri';
+import { getOAuthProviderState, oauthProvider, } from '@better-auth/oauth-provider';
+import { generateRandomString } from 'better-auth/crypto';
+import { jwt } from 'better-auth/plugins/jwt';
+import { and, asc, eq, isNull, or } from 'drizzle-orm';
+import { Base64 } from 'ox';
+import * as Schema from '../app/db/schema.js';
+import * as SigningKey from './SigningKey.js';
+/** Another app already has the client ID. */
+export class ExistsError extends Error {
+    name = 'Apps.ExistsError';
+    constructor(options) {
+        super(`App ${options.clientId} already exists. Update it, or choose another client ID.`);
+    }
+}
+/** A name, a redirect URI, or another value of an app is not valid. */
+export class InvalidError extends Error {
+    name = 'Apps.InvalidError';
+}
+/** No OAuth app has the client ID. */
+export class NotFoundError extends Error {
+    name = 'Apps.NotFoundError';
+    constructor(options) {
+        super(`Unknown app ${options.clientId}. Name a registered OAuth app.`);
+    }
+}
+/** The app redeems codes with PKCE alone, so it has no client secret to rotate. */
+export class PublicError extends Error {
+    name = 'Apps.PublicError';
+    constructor(options) {
+        super(`App ${options.clientId} has no client secret. Rotate the secret of an app with a backend.`);
+    }
+}
+/** The grant type of the device grant (RFC 8628 §3.4). */
+export const deviceGrant = 'urn:ietf:params:oauth:grant-type:device_code';
+/** The scope that lets an app bind its own challenge into a key authorization. */
+export const signScope = 'tempo-id:sign';
+/** The scopes that every app may request. */
+const scopes = ['openid', 'profile', 'email', 'offline_access'];
+/**
+ * Returns whether `clientSecret` is the client secret of the enabled app with `clientId`. An
+ * unknown app, a disabled app, and an app without a client secret return `false`. Better Auth still
+ * authenticates the request itself, so a match only decides which app a rate limit counts.
+ */
+export async function authenticate(db, options) {
+    const [row] = await db
+        .select({
+        clientSecret: Schema.oauthClient.clientSecret,
+        disabled: Schema.oauthClient.disabled,
+    })
+        .from(Schema.oauthClient)
+        .where(eq(Schema.oauthClient.clientId, options.clientId))
+        .limit(1);
+    if (!row?.clientSecret || row.disabled)
+        return false;
+    return equal(await hashSecret(options.clientSecret), row.clientSecret);
+}
+/**
+ * Registers an app, and returns it with its client secret. The secret appears only in this result,
+ * since the row holds only its hash. A `clientId` or `clientSecret` keeps the values of an app that
+ * another deployment registered.
+ *
+ * Throws `InvalidError` for an invalid name, redirect URI, client ID, or client secret, or a device
+ * app with a secret, and `ExistsError` when another app has the client ID.
+ */
+export async function create(db, options) {
+    const type = options.type ?? 'web';
+    const name = parseName(options.name);
+    const postLogoutRedirectUris = parsePostLogoutRedirectUris(options.postLogoutRedirectUris ?? [], { type });
+    const device = options.device ?? false;
+    // A CLI cannot keep a secret, and the device grant's poll sends none, so a device app is public.
+    if (device && (options.secret || options.clientSecret !== undefined))
+        throw new InvalidError('Invalid app: a device app has no client secret, since a CLI cannot keep one. Leave out the secret.');
+    // A device app redirects nowhere, so it needs no redirect URI.
+    const redirectUris = device && (options.redirectUris ?? []).length === 0
+        ? []
+        : parseRedirectUris(options.redirectUris ?? [], { type });
+    const clientId = options.clientId === undefined
+        ? // Better Auth's format: 32 random letters.
+            generateRandomString(32, 'a-z', 'A-Z')
+        : parseClientId(options.clientId);
+    const clientSecret = (() => {
+        if (options.clientSecret !== undefined)
+            return parseClientSecret(options.clientSecret);
+        return options.secret ? secret() : undefined;
+    })();
+    const now = new Date();
+    const [row] = await db
+        .insert(Schema.oauthClient)
+        .values({
+        applicationType: type,
+        clientId,
+        clientSecret: clientSecret ? await hashSecret(clientSecret) : null,
+        createdAt: now,
+        // Lets the app end the session at `GET /oauth2/end-session`, and puts `sid` in its ID tokens.
+        enableEndSession: true,
+        // A device app has no authorization code grant, so `/oauth2/authorize` refuses it.
+        grantTypes: device
+            ? [deviceGrant, 'refresh_token']
+            : ['authorization_code', 'refresh_token'],
+        id: crypto.randomUUID(),
+        name,
+        postLogoutRedirectUris: [...postLogoutRedirectUris],
+        redirectUris: [...redirectUris],
+        responseTypes: ['code'],
+        scopes: scopesOf({ sign: options.sign ?? false }),
+        skipConsent: options.skipConsent ?? false,
+        // The client package sends the secret in the form body.
+        tokenEndpointAuthMethod: clientSecret ? 'client_secret_post' : 'none',
+        updatedAt: now,
+    })
+        .onConflictDoNothing({ target: Schema.oauthClient.clientId })
+        .returning();
+    if (!row)
+        throw new ExistsError({ clientId });
+    return { app: toApp(row), ...(clientSecret ? { clientSecret } : {}) };
+}
+/**
+ * Returns whether `origin` is the origin of a redirect URI of an enabled first-party app, one that
+ * skips consent. Pages on such an origin call the API with the session cookie. A disabled app,
+ * which Better Auth refuses, gives no origin. The registration rules keep production redirect URIs
+ * on `https`, so the check filters no scheme.
+ */
+export async function firstPartyOrigin(db, options) {
+    const rows = await db
+        .select({ redirectUris: Schema.oauthClient.redirectUris })
+        .from(Schema.oauthClient)
+        .where(and(eq(Schema.oauthClient.skipConsent, true), or(isNull(Schema.oauthClient.disabled), eq(Schema.oauthClient.disabled, false))));
+    return rows.some((row) => row.redirectUris.some((uri) => {
+        const url = URL.parse(uri);
+        return ((url?.protocol === 'https:' || url?.protocol === 'http:') &&
+            url.origin === options.origin);
+    }));
+}
+/**
+ * Returns the app with `clientId`. Throws `NotFoundError` when no app has it, or with `enabled`,
+ * when the app is disabled.
+ */
+export async function get(db, options) {
+    const row = await find(db, options);
+    if (options.enabled && row.disabled)
+        throw new NotFoundError({ clientId: options.clientId });
+    return toApp(row);
+}
+/**
+ * Returns the SHA-256 hash of a client secret, as base64url without padding, which the row holds.
+ * Better Auth verifies a client secret against it.
+ */
+export async function hashSecret(secret) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));
+    return Base64.fromBytes(new Uint8Array(digest), { pad: false, url: true });
+}
+/**
+ * Compares two hashes from `hashSecret` in constant time. Node's `crypto.subtle` has no
+ * `timingSafeEqual`, and the CLI runs this module in Node, so the loop reads every byte of both.
+ */
+function equal(a, b) {
+    const left = Base64.toBytes(a);
+    const right = Base64.toBytes(b);
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; index++)
+        difference |= left[index] ^ right[index];
+    return difference === 0;
+}
+/** Returns every app, oldest first. */
+export async function list(db) {
+    const rows = await db
+        .select()
+        .from(Schema.oauthClient)
+        .orderBy(asc(Schema.oauthClient.createdAt), asc(Schema.oauthClient.clientId));
+    return rows.map(toApp);
+}
+/**
+ * Returns the Better Auth plugins that serve OAuth apps: the JWT plugin, which signs tokens with
+ * RS256, and the OAuth provider. `baseURL` is Tempo ID's origin, which is `iss` and the one resource.
+ */
+export function plugins(options) {
+    const { accountStep, baseURL, pendingKey } = options;
+    return [
+        // `iss` is the configured origin, never the request's host.
+        jwt({
+            adapter: SigningKey.adapter,
+            jwks: SigningKey.jwks,
+            jwt: { issuer: baseURL },
+        }),
+        oauthProvider({
+            allowDynamicClientRegistration: false,
+            consentPage: '/authorize',
+            // Apps read the user's address from the ID token, so a grant of `email` puts it there as well
+            // as in userinfo, as OIDC Core §5.4 allows.
+            customIdTokenClaims: (info) => info.scopes.includes('email')
+                ? {
+                    email: info.user.email,
+                    email_verified: info.user.emailVerified,
+                }
+                : {},
+            // Every app may request the one resource.
+            enforcePerClientResources: false,
+            loginPage: '/login',
+            // The account step runs after sign-in and before consent, and `oauth2Continue` resumes the
+            // authorization with `postLogin`, which checks again.
+            ...(accountStep
+                ? {
+                    postLogin: {
+                        consentReferenceId: () => undefined,
+                        page: '/choose-account',
+                        shouldRedirect: async (context) => {
+                            // The authorization stores its query before it checks, so the hook reads the app.
+                            const query = (await getOAuthProviderState())?.query;
+                            const clientId = query
+                                ? new URLSearchParams(query).get('client_id')
+                                : null;
+                            if (!clientId)
+                                return false;
+                            return await accountStep({
+                                clientId,
+                                headers: context.headers,
+                                sessionId: context.session.id,
+                                userId: context.user.id,
+                            });
+                        },
+                    },
+                }
+                : {}),
+            // A code's redemption returns the key that its approval signed, once. Better Auth calls this
+            // after it checks the verifier against the code's challenge.
+            ...(pendingKey
+                ? {
+                    customTokenResponseFields: async (info) => {
+                        const query = info.verificationValue?.query;
+                        if (info.grantType !== 'authorization_code' ||
+                            !query?.code_challenge ||
+                            // Only a code whose request carried the key takes it, so a keyless code for a reused
+                            // challenge leaves it for the keyed one.
+                            query.key_authorization === undefined ||
+                            !info.user)
+                            return {};
+                        const key = await pendingKey({
+                            clientId: query.client_id,
+                            codeChallenge: query.code_challenge,
+                            userId: info.user.id,
+                        });
+                        if (!key)
+                            return {};
+                        return {
+                            account: key.account,
+                            key_authorization: key.keyAuthorization,
+                        };
+                    },
+                }
+                : {}),
+            // Every access token names one audience, so each API verifies tokens for every app the same way.
+            resources: [
+                { accessTokenTtl: 300, identifier: baseURL, name: 'Tempo ID' },
+            ],
+            // Better Auth checks a registered app's scopes against its own row, so `tempo-id:sign` stays out
+            // of this list. A row without scopes falls back to this list, and never receives the scope.
+            scopes: [...scopes],
+            // `create` and `rotateSecret` store each secret with the same hash.
+            storeClientSecret: { hash: hashSecret },
+        }),
+    ];
+}
+/**
+ * Removes the app with `clientId`, with its consents, tokens, and realms. Throws `NotFoundError`
+ * when no app has it.
+ */
+export async function remove(db, options) {
+    const removed = await db
+        .delete(Schema.oauthClient)
+        .where(eq(Schema.oauthClient.clientId, options.clientId))
+        .returning();
+    const [row] = removed;
+    if (!row)
+        throw new NotFoundError({ clientId: options.clientId });
+    return toApp(row);
+}
+/**
+ * Replaces the client secret of the app with `clientId`, and returns the app with the new secret.
+ * The earlier secret stops working at once.
+ *
+ * Throws `NotFoundError` when no app has the client ID, `PublicError` when the app has no client
+ * secret, and `InvalidError` for an invalid `clientSecret` or one that matches the current secret.
+ */
+export async function rotateSecret(db, options) {
+    const clientSecret = options.clientSecret === undefined
+        ? secret()
+        : parseClientSecret(options.clientSecret);
+    const current = await find(db, options);
+    if (!current.clientSecret)
+        throw new PublicError(options);
+    // A rotation to the same secret would leave a leaked secret working while it reports success.
+    if (equal(current.clientSecret, await hashSecret(clientSecret)))
+        throw new InvalidError('Invalid client secret: it matches the current secret. Use a new secret.');
+    const [row] = await db
+        .update(Schema.oauthClient)
+        .set({
+        clientSecret: await hashSecret(clientSecret),
+        updatedAt: new Date(),
+    })
+        .where(eq(Schema.oauthClient.clientId, options.clientId))
+        .returning();
+    // A concurrent `remove` deleted the app after the read.
+    if (!row)
+        throw new NotFoundError(options);
+    // The row, not the earlier read, since a concurrent `update` can change the app between them.
+    return { app: toApp(row), clientSecret };
+}
+/**
+ * Updates the app with `clientId`, and returns it. A value left out stays.
+ *
+ * Throws `NotFoundError` when no app has the client ID, and `InvalidError` for an invalid name or
+ * redirect URI.
+ */
+export async function update(db, options) {
+    const current = await find(db, options);
+    const app = toApp(current);
+    const name = options.name === undefined ? undefined : parseName(options.name);
+    const postLogoutRedirectUris = options.postLogoutRedirectUris === undefined
+        ? undefined
+        : parsePostLogoutRedirectUris(options.postLogoutRedirectUris, {
+            type: app.type,
+        });
+    const redirectUris = options.redirectUris === undefined
+        ? undefined
+        : parseRedirectUris(options.redirectUris, { type: app.type });
+    const [row] = await db
+        .update(Schema.oauthClient)
+        .set({
+        ...(name === undefined ? {} : { name }),
+        ...(postLogoutRedirectUris === undefined
+            ? {}
+            : { postLogoutRedirectUris: [...postLogoutRedirectUris] }),
+        // An app registered before logout existed gains it with its post-logout redirect URIs.
+        ...(postLogoutRedirectUris?.length ? { enableEndSession: true } : {}),
+        ...(redirectUris === undefined
+            ? {}
+            : { redirectUris: [...redirectUris] }),
+        ...(options.sign === undefined
+            ? {}
+            : {
+                scopes: scopesOf({
+                    scopes: current.scopes ?? undefined,
+                    sign: options.sign,
+                }),
+            }),
+        ...(options.skipConsent === undefined
+            ? {}
+            : { skipConsent: options.skipConsent }),
+        updatedAt: new Date(),
+    })
+        .where(eq(Schema.oauthClient.clientId, options.clientId))
+        .returning();
+    // A concurrent `remove` deleted the app after the read.
+    if (!row)
+        throw new NotFoundError(options);
+    return toApp(row);
+}
+/** Returns the `oauth_client` row with `clientId`. Throws `NotFoundError` when no app has it. */
+async function find(db, options) {
+    const [row] = await db
+        .select()
+        .from(Schema.oauthClient)
+        .where(eq(Schema.oauthClient.clientId, options.clientId));
+    if (!row)
+        throw new NotFoundError({ clientId: options.clientId });
+    return row;
+}
+/**
+ * Returns `clientId`. Throws `InvalidError` unless it holds 8 to 64 letters, digits, `-`, or `_`,
+ * which every URL and form carries unescaped.
+ */
+function parseClientId(clientId) {
+    if (!/^[A-Za-z0-9_-]{8,64}$/.test(clientId))
+        throw new InvalidError(`Invalid client ID: ${clientId}. Use 8 to 64 letters, digits, -, or _.`);
+    return clientId;
+}
+/** Returns `clientSecret`. Throws `InvalidError` when it holds fewer than 32 characters. */
+function parseClientSecret(clientSecret) {
+    // The message leaves the secret out, since errors never hold one.
+    if (clientSecret.length < 32)
+        throw new InvalidError('Invalid client secret: fewer than 32 characters. Use a longer secret.');
+    return clientSecret;
+}
+/** Returns `name` trimmed. Throws `InvalidError` when it is empty. */
+function parseName(name) {
+    const trimmed = name.trim();
+    if (!trimmed)
+        throw new InvalidError('Invalid app: the name is empty. Set a name.');
+    return trimmed;
+}
+/**
+ * Returns the post-logout redirect URIs `uris`, each named once. They follow the rules of
+ * `parseRedirectUris`, and may be empty. Throws `InvalidError` for an invalid URI.
+ */
+function parsePostLogoutRedirectUris(uris, options) {
+    if (uris.length === 0)
+        return [];
+    return parseRedirectUris(uris, options);
+}
+/**
+ * Returns `uris`, each named once. A web app returns to `https` URIs, and a native app to `https` or
+ * a custom scheme, such as `com.example.app:/callback`. Loopback and other `http` redirects are
+ * refused, so a CLI uses the device grant. Throws `InvalidError` for an invalid URI.
+ */
+function parseRedirectUris(uris, options) {
+    if (uris.length === 0)
+        throw new InvalidError('Invalid app: no redirect URI. Set at least one redirect URI.');
+    for (const uri of uris) {
+        const url = URL.parse(uri);
+        const reason = (() => {
+            if (!url)
+                return 'is not an absolute URI';
+            // RFC 6749 §3.1.2 bars a fragment from a redirect URI.
+            if (url.hash || uri.includes('#'))
+                return 'has a fragment';
+            if (url.username || url.password)
+                return 'holds credentials';
+            if (url.protocol === 'https:')
+                return isLoopbackHost(url.hostname) ? 'has a loopback host' : undefined;
+            if (url.protocol === 'http:')
+                return 'uses http';
+            if (options.type === 'web')
+                return 'is not https';
+            // Refuses reserved schemes, such as `javascript:` and `file:`, as Better Auth's registration does.
+            if (!isNativePrivateUseRedirectUri(url))
+                return 'is not a valid custom scheme';
+            return undefined;
+        })();
+        if (reason)
+            throw new InvalidError(`Invalid redirect URI: ${uri} ${reason}. Use an https URI${options.type === 'native' ? ', or a custom scheme such as com.example.app:/callback' : ''}.`);
+    }
+    return [...new Set(uris)];
+}
+/**
+ * Returns `scopes`, or the scopes that every app may request, with `tempo-id:sign` only when `sign`
+ * is set. Every other scope stays as it is.
+ */
+function scopesOf(options) {
+    const kept = (options.scopes ?? scopes).filter((scope) => scope !== signScope);
+    return [...kept, ...(options.sign ? [signScope] : [])];
+}
+/** Returns a new client secret: 32 random letters, as Better Auth creates by default. */
+function secret() {
+    return generateRandomString(32, 'a-z', 'A-Z');
+}
+/** Returns the app of an `oauth_client` row. */
+function toApp(row) {
+    return {
+        clientId: row.clientId,
+        createdAt: row.createdAt,
+        device: (row.grantTypes ?? []).includes(deviceGrant),
+        name: row.name,
+        postLogoutRedirectUris: row.postLogoutRedirectUris ?? [],
+        redirectUris: row.redirectUris,
+        secret: Boolean(row.clientSecret),
+        sign: (row.scopes ?? []).includes(signScope),
+        skipConsent: row.skipConsent ?? false,
+        type: row.applicationType === 'native' ? 'native' : 'web',
+    };
+}
+//# sourceMappingURL=Apps.js.map

package/dist/internal/Apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Apps.js","sourceRoot":"","sources":["../../src/internal/Apps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAA;AACpF,OAAO,EACL,qBAAqB,EACrB,aAAa,GACd,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAG7C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClB,IAAI,GAAG,kBAAkB,CAAA;IAE3C,YAAY,OAA6B;QACvC,KAAK,CACH,OAAO,OAAO,CAAC,QAAQ,0DAA0D,CAClF,CAAA;IACH,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,mBAAmB,CAAA;CAC7C;AAED,sCAAsC;AACtC,MAAM,OAAO,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,oBAAoB,CAAA;IAE7C,YAAY,OAA6B;QACvC,KAAK,CAAC,eAAe,OAAO,CAAC,QAAQ,gCAAgC,CAAC,CAAA;IACxE,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClB,IAAI,GAAG,kBAAkB,CAAA;IAE3C,YAAY,OAA6B;QACvC,KAAK,CACH,OAAO,OAAO,CAAC,QAAQ,oEAAoE,CAC5F,CAAA;IACH,CAAC;CACF;AA0BD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAG,8CAA8C,CAAA;AAEzE,kFAAkF;AAClF,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAA;AAExC,6CAA6C;AAC7C,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAA;AAExE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAkB,EAClB,OAA6B;IAE7B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY;QAC7C,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;KACtC,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;SACxD,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IACpD,OAAO,KAAK,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;AACxE,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAkB,EAAE,OAAuB;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAA;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,sBAAsB,GAAG,2BAA2B,CACxD,OAAO,CAAC,sBAAsB,IAAI,EAAE,EACpC,EAAE,IAAI,EAAE,CACT,CAAA;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAA;IACtC,iGAAiG;IACjG,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC;QAClE,MAAM,IAAI,YAAY,CACpB,oGAAoG,CACrG,CAAA;IACH,+DAA+D;IAC/D,MAAM,YAAY,GAChB,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QACjD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC5B,CAAC,CAAC,2CAA2C;YAC3C,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;QACxC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QACzB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YACpC,OAAO,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAChD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9C,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,MAAM,CAAC;QACN,eAAe,EAAE,IAAI;QACrB,QAAQ;QACR,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QAClE,SAAS,EAAE,GAAG;QACd,8FAA8F;QAC9F,gBAAgB,EAAE,IAAI;QACtB,mFAAmF;QACnF,UAAU,EAAE,MAAM;YAChB,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC;YAChC,CAAC,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC3C,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,IAAI;QACJ,sBAAsB,EAAE,CAAC,GAAG,sBAAsB,CAAC;QACnD,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;QAC/B,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;QACjD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;QACzC,wDAAwD;QACxD,uBAAuB,EAAE,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;QACrE,SAAS,EAAE,GAAG;KACf,CAAC;SACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;SAC5D,SAAS,EAAE,CAAA;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAE7C,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AACvE,CAAC;AAoCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAkB,EAClB,OAAiC;IAEjC,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;SACzD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,EACxC,EAAE,CACA,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EACnC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CACvC,CACF,CACF,CAAA;IACH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACvB,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,CACL,CAAC,GAAG,EAAE,QAAQ,KAAK,QAAQ,IAAI,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;YACzD,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAC9B,CAAA;IACH,CAAC,CAAC,CACH,CAAA;AACH,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,EAAkB,EAAE,OAAoB;IAChE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACnC,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ;QACjC,MAAM,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;AACnB,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CACjC,CAAA;IACD,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;GAGG;AACH,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC9C,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE;QAC9C,UAAU,IAAI,IAAI,CAAC,KAAK,CAAE,GAAG,KAAK,CAAC,KAAK,CAAE,CAAA;IAC5C,OAAO,UAAU,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAkB;IAC3C,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,OAAO,CACN,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,EACjC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CACjC,CAAA;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,OAAwB;IAC9C,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IACpD,OAAO;QACL,4DAA4D;QAC5D,GAAG,CAAC;YACF,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;SACzB,CAAC;QACF,aAAa,CAAC;YACZ,8BAA8B,EAAE,KAAK;YACrC,WAAW,EAAE,YAAY;YACzB,8FAA8F;YAC9F,4CAA4C;YAC5C,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC3B,CAAC,CAAC;oBACE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;oBACtB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;iBACxC;gBACH,CAAC,CAAC,EAAE;YACR,0CAA0C;YAC1C,yBAAyB,EAAE,KAAK;YAChC,SAAS,EAAE,QAAQ;YACnB,2FAA2F;YAC3F,sDAAsD;YACtD,GAAG,CAAC,WAAW;gBACb,CAAC,CAAC;oBACE,SAAS,EAAE;wBACT,kBAAkB,EAAE,GAAG,EAAE,CAAC,SAAS;wBACnC,IAAI,EAAE,iBAAiB;wBACvB,cAAc,EAAE,KAAK,EAAE,OAItB,EAAE,EAAE;4BACH,kFAAkF;4BAClF,MAAM,KAAK,GAAG,CAAC,MAAM,qBAAqB,EAAE,CAAC,EAAE,KAAK,CAAA;4BACpD,MAAM,QAAQ,GAAG,KAAK;gCACpB,CAAC,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;gCAC7C,CAAC,CAAC,IAAI,CAAA;4BACR,IAAI,CAAC,QAAQ;gCAAE,OAAO,KAAK,CAAA;4BAC3B,OAAO,MAAM,WAAW,CAAC;gCACvB,QAAQ;gCACR,OAAO,EAAE,OAAO,CAAC,OAAO;gCACxB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gCAC7B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;6BACxB,CAAC,CAAA;wBACJ,CAAC;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,6FAA6F;YAC7F,6DAA6D;YAC7D,GAAG,CAAC,UAAU;gBACZ,CAAC,CAAC;oBACE,yBAAyB,EAAE,KAAK,EAAE,IAUjC,EAAE,EAAE;wBACH,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAA;wBAC3C,IACE,IAAI,CAAC,SAAS,KAAK,oBAAoB;4BACvC,CAAC,KAAK,EAAE,cAAc;4BACtB,qFAAqF;4BACrF,yCAAyC;4BACzC,KAAK,CAAC,iBAAiB,KAAK,SAAS;4BACrC,CAAC,IAAI,CAAC,IAAI;4BAEV,OAAO,EAAE,CAAA;wBACX,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;4BAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS;4BACzB,aAAa,EAAE,KAAK,CAAC,cAAc;4BACnC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;yBACrB,CAAC,CAAA;wBACF,IAAI,CAAC,GAAG;4BAAE,OAAO,EAAE,CAAA;wBACnB,OAAO;4BACL,OAAO,EAAE,GAAG,CAAC,OAAO;4BACpB,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;yBACxC,CAAA;oBACH,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,iGAAiG;YACjG,SAAS,EAAE;gBACT,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE;aAC/D;YACD,iGAAiG;YACjG,4FAA4F;YAC5F,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;YACnB,oEAAoE;YACpE,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SACxC,CAAC;KACH,CAAA;AACH,CAAC;AAgCD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAkB,EAAE,OAAuB;IACtE,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;SACxD,SAAS,EAAE,CAAA;IACd,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;IACrB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACjE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;AACnB,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAkB,EAClB,OAA6B;IAE7B,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,EAAE;QACV,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAA;IACzD,8FAA8F;IAC9F,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,YAAY,CACpB,yEAAyE,CAC1E,CAAA;IAEH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC;QACH,YAAY,EAAE,MAAM,UAAU,CAAC,YAAY,CAAC;QAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;SACxD,SAAS,EAAE,CAAA;IACd,wDAAwD;IACxD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAC1C,8FAA8F;IAC9F,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAA;AAC1C,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAkB,EAAE,OAAuB;IACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7E,MAAM,sBAAsB,GAC1B,OAAO,CAAC,sBAAsB,KAAK,SAAS;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,sBAAsB,EAAE;YAC1D,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAA;IACR,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAEjE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC;QACH,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,sBAAsB,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,GAAG,sBAAsB,CAAC,EAAE,CAAC;QAC5D,uFAAuF;QACvF,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,YAAY,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE,QAAQ,CAAC;oBACf,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,SAAS;oBACnC,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,CAAC;aACH,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;SACxD,SAAS,EAAE,CAAA;IACd,wDAAwD;IACxD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;AACnB,CAAC;AAmBD,iGAAiG;AACjG,KAAK,UAAU,IAAI,CAAC,EAAkB,EAAE,OAA6B;IACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACjE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,YAAY,CACpB,sBAAsB,QAAQ,yCAAyC,CACxE,CAAA;IACH,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,YAAoB;IAC7C,kEAAkE;IAClE,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE;QAC1B,MAAM,IAAI,YAAY,CACpB,uEAAuE,CACxE,CAAA;IACH,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,sEAAsE;AACtE,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,YAAY,CAAC,6CAA6C,CAAC,CAAA;IACvE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,2BAA2B,CAClC,IAAuB,EACvB,OAA8B;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,IAAuB,EACvB,OAA8B;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QACnB,MAAM,IAAI,YAAY,CACpB,8DAA8D,CAC/D,CAAA;IAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;YACnB,IAAI,CAAC,GAAG;gBAAE,OAAO,wBAAwB,CAAA;YACzC,uDAAuD;YACvD,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,gBAAgB,CAAA;YAC1D,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;gBAAE,OAAO,mBAAmB,CAAA;YAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAA;YACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,WAAW,CAAA;YAChD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,cAAc,CAAA;YACjD,mGAAmG;YACnG,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC;gBACrC,OAAO,8BAA8B,CAAA;YACvC,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,MAAM;YACR,MAAM,IAAI,YAAY,CACpB,yBAAyB,GAAG,IAAI,MAAM,qBAAqB,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,EAAE,GAAG,CACxJ,CAAA;IACL,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,OAGjB;IACC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IAC9E,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,yFAAyF;AACzF,SAAS,MAAM;IACb,OAAO,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED,gDAAgD;AAChD,SAAS,KAAK,CAAC,GAA2C;IACxD,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpD,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,sBAAsB,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE;QACxD,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACjC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;QACrC,IAAI,EAAE,GAAG,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;KAC1D,CAAA;AACH,CAAC"}