@tempoxyz/id 0.0.0-stage → 0.0.0

package/dist/internal/Device.d.ts

@@ -0,0 +1,371 @@
+import * as ErrorResponse from './ErrorResponse.js';
+import type * as KeyAuthorization from './KeyAuthorization.js';
+import type * as PendingKey from './PendingKey.js';
+import type * as Realm from './Realm.js';
+declare const AlreadyDecidedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "invalid_request";
+            reason: "already_decided";
+        };
+    };
+    readonly reason: "already_decided";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** The user code was already approved or denied. */
+export declare class AlreadyDecidedError extends AlreadyDecidedError_base {
+    readonly name = "Device.AlreadyDecidedError";
+    constructor();
+}
+declare const ApprovalPendingError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "authorization_pending";
+            reason: "approval_pending";
+        };
+    };
+    readonly reason: "approval_pending";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** The user did not decide the device code yet. */
+export declare class ApprovalPendingError extends ApprovalPendingError_base {
+    readonly name = "Device.ApprovalPendingError";
+    constructor();
+}
+declare const DeviceCodeExpiredError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "expired_token";
+            reason: "device_code_expired";
+        };
+    };
+    readonly reason: "device_code_expired";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** The device code is unknown, expired, or already redeemed. */
+export declare class DeviceCodeExpiredError extends DeviceCodeExpiredError_base {
+    readonly name = "Device.DeviceCodeExpiredError";
+    constructor();
+}
+declare const PollingTooFastError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "slow_down";
+            reason: "polling_too_fast";
+        };
+    };
+    readonly reason: "polling_too_fast";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** The device polled before its interval passed. */
+export declare class PollingTooFastError extends PollingTooFastError_base {
+    readonly name = "Device.PollingTooFastError";
+    constructor();
+}
+declare const RequestDeniedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "access_denied";
+            reason: "request_denied";
+        };
+    };
+    readonly reason: "request_denied";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** The user denied the device code. */
+export declare class RequestDeniedError extends RequestDeniedError_base {
+    readonly name = "Device.RequestDeniedError";
+    constructor();
+}
+declare const UnknownCodeError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "invalid_request";
+            reason: "unknown_code";
+        };
+    };
+    readonly reason: "unknown_code";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** The user code is wrong or expired. */
+export declare class UnknownCodeError extends UnknownCodeError_base {
+    readonly name = "Device.UnknownCodeError";
+    constructor();
+}
+/** What the CLI reported with a device code, and the code's state, as the device page shows them. */
+export type Request = {
+    /** The message whose EIP-191 hash is the key's witness. Absent for a request without one. */
+    challenge?: string | undefined;
+    /** The client ID of the app that requested the code. */
+    clientId: string;
+    /** When the CLI requested the code. */
+    createdAt: Date;
+    /**
+     * The name that the CLI reported, such as its hostname. Absent for a code from `POST /device/code`,
+     * which reports none.
+     */
+    device?: string | undefined;
+    /** The ID of the `device_code` row. */
+    id: string;
+    /** The CLI's IP address. Absent when it is unknown. */
+    ip?: string | undefined;
+    /**
+     * The key that the CLI requested, with every default filled and the challenge bound as its
+     * witness. Absent for a request without a key.
+     */
+    key?: KeyAuthorization.Key | undefined;
+    /** The CLI's city and country, from its IP address. Absent when they are unknown. */
+    location?: string | undefined;
+    /** Whether the user approved or denied the code. `pending` until the user decides. */
+    status: 'approved' | 'denied' | 'pending';
+    /** The user code, as the pages show it, such as `BCDF-GHJK`. */
+    userCode: string;
+    /** The ID of the user whom the code is bound to, the first to read or decide it. Absent until then. */
+    userId?: string | undefined;
+};
+/**
+ * The client ID of the app that a device grant of `/v1/device/authorize` signs in to without a
+ * `client_id`. `tempo-id login` uses it.
+ */
+export declare const clientId = "tempo-cli";
+/** The scopes of every device grant of `/v1/device/authorize`. */
+export declare const scope = "openid email offline_access";
+/** Seconds that a device code lasts. */
+export declare const lifetime: number;
+/** Seconds that a CLI waits between polls. */
+export declare const interval = 5;
+/**
+ * Returns the client ID of the app that requested the live user code `userCode`, as
+ * {@link normalize} returns it, while the code is pending and bound to no user. Returns `undefined`
+ * for any other code, so a sign-in that returns to the device page reveals nothing about a code that
+ * is unknown, expired, decided, or held. The read binds nothing.
+ */
+export declare function client(db: Realm.Database, options: client.Options): Promise<string | undefined>;
+export declare namespace client {
+    type Options = {
+        /** The user code, as {@link normalize} returns it. */
+        userCode: string;
+    };
+}
+/**
+ * Stores what the CLI reported with the device code whose row has `id`, and the key that it
+ * requested, until the code expires at `expiresAt`.
+ */
+export declare function create(db: Realm.Database, options: create.Options): Promise<void>;
+export declare namespace create {
+    type Options = {
+        /** The message whose hash becomes the key's witness. Null for a request without one. */
+        challenge: string | null;
+        /** The name that the CLI reported, such as its hostname. Null for a code from `POST /device/code`. */
+        device: string | null;
+        /** When the device code expires. */
+        expiresAt: Date;
+        /** The ID of the device code's `device_code` row. */
+        id: string;
+        /** The CLI's IP address. Null when it is unknown. */
+        ip: string | null;
+        /**
+         * The key that the CLI requested, with every default filled, before the challenge is bound.
+         * Null for a request without a key.
+         */
+        key: KeyAuthorization.Key | null;
+        /** The CLI's city and country. Null when they are unknown. */
+        location: string | null;
+    };
+}
+/**
+ * Returns `userCode` as the pages show it, in two groups of four, such as `BCDF-GHJK`. Better Auth
+ * stores the code without the hyphen.
+ */
+export declare function format(userCode: string): string;
+/**
+ * Returns the request of the live device code `userCode`, as {@link normalize} returns it, with the
+ * code's state. Returns `undefined` for an unknown or expired code.
+ */
+export declare function get(db: Realm.Database, options: get.Options): Promise<Request | undefined>;
+export declare namespace get {
+    type Options = {
+        /** The user code, as {@link normalize} returns it. */
+        userCode: string;
+    };
+}
+/**
+ * Holds `key`, which approval signed, in the request of the device code whose row has `id`, until
+ * the first redemption of the code takes it. Holds it only while the code is pending, bound to the
+ * user with `userId`, and holds no key yet, and returns whether it did. Of concurrent approvals, only
+ * the one that holds its key goes on to approve the code.
+ */
+export declare function hold(db: Realm.Database, options: hold.Options): Promise<boolean>;
+export declare namespace hold {
+    type Options = {
+        /** The ID of the device code's `device_code` row. */
+        id: string;
+        /** The signed key authorization, and the account that it acts for. */
+        key: PendingKey.PendingKey;
+        /** The ID of the user who approves the code, whom the code must be bound to. */
+        userId: string;
+    };
+}
+/**
+ * Releases `key`, which `hold` held for the device code whose row has `id`, while the code is
+ * still pending, so the approving user can approve again after a failed approval. Another
+ * approval's key stays.
+ */
+export declare function release(db: Realm.Database, options: release.Options): Promise<void>;
+export declare namespace release {
+    type Options = {
+        /** The ID of the device code's `device_code` row. */
+        id: string;
+        /** The key that `hold` held. */
+        key: PendingKey.PendingKey;
+    };
+}
+/**
+ * Returns the ID of the `device_code` row of `deviceCode`, the CLI's secret code, or `undefined`
+ * when no row holds it.
+ */
+export declare function id(db: Realm.Database, options: id.Options): Promise<string | undefined>;
+export declare namespace id {
+    type Options = {
+        /** The device code that the CLI holds. */
+        deviceCode: string;
+    };
+}
+/**
+ * Returns what a user typed as a user code, in the form that Better Auth stores: eight consonants in
+ * upper case, without the hyphen. Returns `undefined` when the value cannot be a user code.
+ */
+export declare function normalize(value: string): string | undefined;
+/** The path of the device page, the verification URI. */
+export declare const page = "/device";
+/**
+ * Returns the device page that sign-in returns the browser to, from the `return_to` value `value`:
+ * the exact path `/device`, with at most one query parameter, the user code, as `code` or
+ * `user_code`. Parses `value` against Tempo ID's own `origin`, and rebuilds the path from the
+ * normalized code. Returns `undefined` for any other value, such as another path, host, or scheme, a
+ * protocol-relative or backslash form, or another parameter, so sign-in redirects only to the
+ * device page.
+ */
+export declare function returnTo(value: string | null | undefined, options: returnTo.Options): string | undefined;
+export declare namespace returnTo {
+    type Options = {
+        /** Tempo ID's origin, such as `https://id.tempo.xyz`, which the path resolves against. */
+        origin: string;
+    };
+}
+/**
+ * Deletes the request of the device code whose row has `id`, once its redemption issued tokens, and
+ * returns the signed key that approval held in it. Returns `undefined` when it holds none, or when
+ * another redemption took it.
+ */
+export declare function take(db: Realm.Database, options: take.Options): Promise<PendingKey.PendingKey | undefined>;
+export declare namespace take {
+    type Options = {
+        /** The ID of the redeemed device code's `device_code` row. */
+        id: string;
+    };
+}
+export {};
+//# sourceMappingURL=Device.d.ts.map

package/dist/internal/Device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Device.d.ts","sourceRoot":"","sources":["../../src/internal/Device.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAClD,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAExC,oDAAoD;AACpD,qBAAa,mBAAoB,SAAQ,wBAExC;IACC,SAAkB,IAAI,gCAA+B;IAErD,cAKC;CACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,mDAAmD;AACnD,qBAAa,oBAAqB,SAAQ,yBAEzC;IACC,SAAkB,IAAI,iCAAgC;IAEtD,cAKC;CACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,gEAAgE;AAChE,qBAAa,sBAAuB,SAAQ,2BAE3C;IACC,SAAkB,IAAI,mCAAkC;IAExD,cAEC;CACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,oDAAoD;AACpD,qBAAa,mBAAoB,SAAQ,wBAExC;IACC,SAAkB,IAAI,gCAA+B;IAErD,cAIC;CACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,uCAAuC;AACvC,qBAAa,kBAAmB,SAAQ,uBAAsC;IAC5E,SAAkB,IAAI,+BAA8B;IAEpD,cAEC;CACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,yCAAyC;AACzC,qBAAa,gBAAiB,SAAQ,qBAAoC;IACxE,SAAkB,IAAI,6BAA4B;IAElD,cAMC;CACF;AAED,qGAAqG;AACrG,MAAM,MAAM,OAAO,GAAG;IACpB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,SAAS,EAAE,IAAI,CAAA;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAA;IACV,uDAAuD;IACvD,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB;;;OAGG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG,GAAG,SAAS,CAAA;IACtC,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,sFAAsF;IACtF,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAA;IACzC,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,cAAc,CAAA;AAEnC,kEAAkE;AAClE,eAAO,MAAM,KAAK,gCAAgC,CAAA;AAElD,wCAAwC;AACxC,eAAO,MAAM,QAAQ,QAAU,CAAA;AAE/B,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,IAAI,CAAA;AAKzB;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,+BAIvE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,sDAAsD;QACtD,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,iBAavE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,wFAAwF;QACxF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;QACxB,sGAAsG;QACtG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,oCAAoC;QACpC,SAAS,EAAE,IAAI,CAAA;QACf,qDAAqD;QACrD,EAAE,EAAE,MAAM,CAAA;QACV,qDAAqD;QACrD,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;QACjB;;;WAGG;QACH,GAAG,EAAE,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAA;QAChC,8DAA8D;QAC9D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KACxB,CAAA;CACF;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,UAEtC;AAED;;;GAGG;AACH,wBAAsB,GAAG,CACvB,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,GAAG,CAAC,OAAO,GACnB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAoD9B;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,KAAK,OAAO,GAAG;QACb,sDAAsD;QACtD,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,oBA0BnE;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,qDAAqD;QACrD,EAAE,EAAE,MAAM,CAAA;QACV,sEAAsE;QACtE,GAAG,EAAE,UAAU,CAAC,UAAU,CAAA;QAC1B,gFAAgF;QAChF,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,iBAsBzE;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,OAAO,GAAG;QACb,qDAAqD;QACrD,EAAE,EAAE,MAAM,CAAA;QACV,gCAAgC;QAChC,GAAG,EAAE,UAAU,CAAC,UAAU,CAAA;KAC3B,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,+BAM/D;AAED,MAAM,CAAC,OAAO,WAAW,EAAE,CAAC;IAC1B,KAAK,OAAO,GAAG;QACb,0CAA0C;QAC1C,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,sBAQtC;AAED,yDAAyD;AACzD,eAAO,MAAM,IAAI,YAAY,CAAA;AAE7B;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,QAAQ,CAAC,OAAO,sBAkB1B;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,0FAA0F;QAC1F,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CACxB,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,IAAI,CAAC,OAAO,GACpB,OAAO,CAAC,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,CAc5C;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,8DAA8D;QAC9D,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;CACF"}

package/dist/internal/Device.js

@@ -0,0 +1,271 @@
+/**
+ * The device grant (RFC 8628) for CLIs, on Better Auth's device plugin. A CLI requests a code, a
+ * signed-in user approves it on the device page from any browser, and the CLI polls until it
+ * receives tokens. Better Auth holds each code's state in `device_code`, and `device_requests` holds
+ * what the CLI reported and the key that it requested, which the page shows. Approval signs the key
+ * and holds it in the same row, and the first redemption of the device code takes it.
+ * @module
+ */
+import { and, eq, exists, gt, isNull, sql } from 'drizzle-orm';
+import { Hex } from 'ox';
+import * as Schema from '../app/db/schema.js';
+import * as Authorize from './Authorize.js';
+import * as ErrorResponse from './ErrorResponse.js';
+/** The user code was already approved or denied. */
+export class AlreadyDecidedError extends ErrorResponse.define('already_decided') {
+    name = 'Device.AlreadyDecidedError';
+    constructor() {
+        super({
+            error_description: 'Code already approved or denied.',
+            field: 'code',
+        });
+    }
+}
+/** The user did not decide the device code yet. */
+export class ApprovalPendingError extends ErrorResponse.define('approval_pending') {
+    name = 'Device.ApprovalPendingError';
+    constructor() {
+        super({
+            error_description: 'Approval pending. Poll again after `interval` seconds.',
+        });
+    }
+}
+/** The device code is unknown, expired, or already redeemed. */
+export class DeviceCodeExpiredError extends ErrorResponse.define('device_code_expired') {
+    name = 'Device.DeviceCodeExpiredError';
+    constructor() {
+        super({ error_description: 'Device code expired. Request a new code.' });
+    }
+}
+/** The device polled before its interval passed. */
+export class PollingTooFastError extends ErrorResponse.define('polling_too_fast') {
+    name = 'Device.PollingTooFastError';
+    constructor() {
+        super({
+            error_description: 'Polling too fast. Add 5 seconds to `interval`.',
+        });
+    }
+}
+/** The user denied the device code. */
+export class RequestDeniedError extends ErrorResponse.define('request_denied') {
+    name = 'Device.RequestDeniedError';
+    constructor() {
+        super({ error_description: 'The user denied the request.' });
+    }
+}
+/** The user code is wrong or expired. */
+export class UnknownCodeError extends ErrorResponse.define('unknown_code') {
+    name = 'Device.UnknownCodeError';
+    constructor() {
+        super({
+            error_description: 'Invalid or expired code. Check the code in the terminal.',
+            field: 'code',
+        });
+    }
+}
+/**
+ * The client ID of the app that a device grant of `/v1/device/authorize` signs in to without a
+ * `client_id`. `tempo-id login` uses it.
+ */
+export const clientId = 'tempo-cli';
+/** The scopes of every device grant of `/v1/device/authorize`. */
+export const scope = 'openid email offline_access';
+/** Seconds that a device code lasts. */
+export const lifetime = 10 * 60;
+/** Seconds that a CLI waits between polls. */
+export const interval = 5;
+/** Consonants only, so codes spell no words and survive being read aloud. */
+const consonants = 'BCDFGHJKLMNPQRSTVWXZ';
+/**
+ * Returns the client ID of the app that requested the live user code `userCode`, as
+ * {@link normalize} returns it, while the code is pending and bound to no user. Returns `undefined`
+ * for any other code, so a sign-in that returns to the device page reveals nothing about a code that
+ * is unknown, expired, decided, or held. The read binds nothing.
+ */
+export async function client(db, options) {
+    const found = await get(db, options);
+    if (!found || found.status !== 'pending' || found.userId)
+        return undefined;
+    return found.clientId;
+}
+/**
+ * Stores what the CLI reported with the device code whose row has `id`, and the key that it
+ * requested, until the code expires at `expiresAt`.
+ */
+export async function create(db, options) {
+    const { challenge, device, expiresAt, id, ip, location } = options;
+    // The key's bigints are stored as hex quantities, which the request schema parses back.
+    const key = options.key
+        ? JSON.parse(JSON.stringify(options.key, (_, value) => typeof value === 'bigint' ? Hex.fromNumber(value) : value))
+        : null;
+    await db
+        .insert(Schema.deviceRequests)
+        .values({ challenge, device, expiresAt, id, ip, key, location });
+}
+/**
+ * Returns `userCode` as the pages show it, in two groups of four, such as `BCDF-GHJK`. Better Auth
+ * stores the code without the hyphen.
+ */
+export function format(userCode) {
+    return `${userCode.slice(0, 4)}-${userCode.slice(4)}`;
+}
+/**
+ * Returns the request of the live device code `userCode`, as {@link normalize} returns it, with the
+ * code's state. Returns `undefined` for an unknown or expired code.
+ */
+export async function get(db, options) {
+    const [row] = await db
+        .select({
+        challenge: Schema.deviceRequests.challenge,
+        clientId: Schema.deviceCode.clientId,
+        createdAt: Schema.deviceRequests.createdAt,
+        device: Schema.deviceRequests.device,
+        expiresAt: Schema.deviceCode.expiresAt,
+        id: Schema.deviceCode.id,
+        ip: Schema.deviceRequests.ip,
+        key: Schema.deviceRequests.key,
+        location: Schema.deviceRequests.location,
+        status: Schema.deviceCode.status,
+        userCode: Schema.deviceCode.userCode,
+        userId: Schema.deviceCode.userId,
+    })
+        .from(Schema.deviceCode)
+        .leftJoin(Schema.deviceRequests, eq(Schema.deviceRequests.id, Schema.deviceCode.id))
+        .where(and(eq(Schema.deviceCode.userCode, options.userCode), gt(Schema.deviceCode.expiresAt, new Date())));
+    // Better Auth sets the client ID of every code that an app requests.
+    if (!row?.clientId)
+        return undefined;
+    // The stored key passed the same schema when the CLI requested it.
+    const key = row.key
+        ? Authorize.schema.redirect.parse({
+            challenge: row.challenge ?? undefined,
+            key_authorization: row.key,
+        })
+        : undefined;
+    return {
+        ...(row.challenge ? { challenge: row.challenge } : {}),
+        clientId: row.clientId,
+        // Tempo ID stores each code's request just after Better Auth issues the code, so a read between
+        // the two finds none. Every code lasts `lifetime` seconds.
+        createdAt: row.createdAt ?? new Date(row.expiresAt.getTime() - lifetime * 1000),
+        ...(row.device ? { device: row.device } : {}),
+        id: row.id,
+        ...(row.ip ? { ip: row.ip } : {}),
+        ...(key ? { key } : {}),
+        ...(row.location ? { location: row.location } : {}),
+        status: status(row.status),
+        userCode: format(row.userCode),
+        ...(row.userId ? { userId: row.userId } : {}),
+    };
+}
+/**
+ * Holds `key`, which approval signed, in the request of the device code whose row has `id`, until
+ * the first redemption of the code takes it. Holds it only while the code is pending, bound to the
+ * user with `userId`, and holds no key yet, and returns whether it did. Of concurrent approvals, only
+ * the one that holds its key goes on to approve the code.
+ */
+export async function hold(db, options) {
+    const { id, key, userId } = options;
+    const rows = await db
+        .update(Schema.deviceRequests)
+        .set({ account: key.account, keyAuthorization: key.keyAuthorization })
+        .where(and(eq(Schema.deviceRequests.id, id), isNull(Schema.deviceRequests.keyAuthorization), exists(db
+        .select({ id: Schema.deviceCode.id })
+        .from(Schema.deviceCode)
+        .where(and(eq(Schema.deviceCode.id, id), eq(Schema.deviceCode.status, 'pending'), eq(Schema.deviceCode.userId, userId), gt(Schema.deviceCode.expiresAt, new Date()))))))
+        .returning({ id: Schema.deviceRequests.id });
+    return rows.length > 0;
+}
+/**
+ * Releases `key`, which `hold` held for the device code whose row has `id`, while the code is
+ * still pending, so the approving user can approve again after a failed approval. Another
+ * approval's key stays.
+ */
+export async function release(db, options) {
+    const { id, key } = options;
+    await db
+        .update(Schema.deviceRequests)
+        .set({ account: null, keyAuthorization: null })
+        .where(and(eq(Schema.deviceRequests.id, id), sql `${Schema.deviceRequests.keyAuthorization} = ${JSON.stringify(key.keyAuthorization)}::jsonb`, exists(db
+        .select({ id: Schema.deviceCode.id })
+        .from(Schema.deviceCode)
+        .where(and(eq(Schema.deviceCode.id, id), eq(Schema.deviceCode.status, 'pending'))))));
+}
+/**
+ * Returns the ID of the `device_code` row of `deviceCode`, the CLI's secret code, or `undefined`
+ * when no row holds it.
+ */
+export async function id(db, options) {
+    const [row] = await db
+        .select({ id: Schema.deviceCode.id })
+        .from(Schema.deviceCode)
+        .where(eq(Schema.deviceCode.deviceCode, options.deviceCode));
+    return row?.id;
+}
+/**
+ * Returns what a user typed as a user code, in the form that Better Auth stores: eight consonants in
+ * upper case, without the hyphen. Returns `undefined` when the value cannot be a user code.
+ */
+export function normalize(value) {
+    const characters = value.toUpperCase().replace(/[^A-Z]/g, '');
+    if (characters.length !== 8 ||
+        [...characters].some((character) => !consonants.includes(character)))
+        return undefined;
+    return characters;
+}
+/** The path of the device page, the verification URI. */
+export const page = '/device';
+/**
+ * Returns the device page that sign-in returns the browser to, from the `return_to` value `value`:
+ * the exact path `/device`, with at most one query parameter, the user code, as `code` or
+ * `user_code`. Parses `value` against Tempo ID's own `origin`, and rebuilds the path from the
+ * normalized code. Returns `undefined` for any other value, such as another path, host, or scheme, a
+ * protocol-relative or backslash form, or another parameter, so sign-in redirects only to the
+ * device page.
+ */
+export function returnTo(value, options) {
+    // Only a path-absolute value names Tempo ID's own page. `//` and `/\` name another host.
+    if (!value || !value.startsWith('/') || /^\/[/\\]/.test(value))
+        return undefined;
+    const base = new URL(options.origin);
+    const url = URL.parse(value, base);
+    if (!url || url.origin !== base.origin || url.pathname !== page || url.hash)
+        return undefined;
+    const keys = [...url.searchParams.keys()];
+    if (keys.length === 0)
+        return page;
+    const [key] = keys;
+    if (keys.length > 1 || (key !== 'code' && key !== 'user_code'))
+        return undefined;
+    const userCode = normalize(url.searchParams.get(key) ?? '');
+    if (!userCode)
+        return undefined;
+    return `${page}?${new URLSearchParams({ code: format(userCode) })}`;
+}
+/**
+ * Deletes the request of the device code whose row has `id`, once its redemption issued tokens, and
+ * returns the signed key that approval held in it. Returns `undefined` when it holds none, or when
+ * another redemption took it.
+ */
+export async function take(db, options) {
+    const [row] = await db
+        .delete(Schema.deviceRequests)
+        .where(eq(Schema.deviceRequests.id, options.id))
+        .returning({
+        account: Schema.deviceRequests.account,
+        keyAuthorization: Schema.deviceRequests.keyAuthorization,
+    });
+    if (!row?.account || !row.keyAuthorization)
+        return undefined;
+    return {
+        account: row.account,
+        keyAuthorization: row.keyAuthorization,
+    };
+}
+/** Returns the state that Better Auth stores in `device_code.status`. */
+function status(value) {
+    if (value === 'approved' || value === 'denied')
+        return value;
+    return 'pending';
+}
+//# sourceMappingURL=Device.js.map

package/dist/internal/Device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Device.js","sourceRoot":"","sources":["../../src/internal/Device.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,GAAG,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAKnD,oDAAoD;AACpD,MAAM,OAAO,mBAAoB,SAAQ,aAAa,CAAC,MAAM,CAC3D,iBAAiB,CAClB;IACmB,IAAI,GAAG,4BAA4B,CAAA;IAErD;QACE,KAAK,CAAC;YACJ,iBAAiB,EAAE,kCAAkC;YACrD,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;IACJ,CAAC;CACF;AAED,mDAAmD;AACnD,MAAM,OAAO,oBAAqB,SAAQ,aAAa,CAAC,MAAM,CAC5D,kBAAkB,CACnB;IACmB,IAAI,GAAG,6BAA6B,CAAA;IAEtD;QACE,KAAK,CAAC;YACJ,iBAAiB,EACf,wDAAwD;SAC3D,CAAC,CAAA;IACJ,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,sBAAuB,SAAQ,aAAa,CAAC,MAAM,CAC9D,qBAAqB,CACtB;IACmB,IAAI,GAAG,+BAA+B,CAAA;IAExD;QACE,KAAK,CAAC,EAAE,iBAAiB,EAAE,0CAA0C,EAAE,CAAC,CAAA;IAC1E,CAAC;CACF;AAED,oDAAoD;AACpD,MAAM,OAAO,mBAAoB,SAAQ,aAAa,CAAC,MAAM,CAC3D,kBAAkB,CACnB;IACmB,IAAI,GAAG,4BAA4B,CAAA;IAErD;QACE,KAAK,CAAC;YACJ,iBAAiB,EAAE,gDAAgD;SACpE,CAAC,CAAA;IACJ,CAAC;CACF;AAED,uCAAuC;AACvC,MAAM,OAAO,kBAAmB,SAAQ,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC1D,IAAI,GAAG,2BAA2B,CAAA;IAEpD;QACE,KAAK,CAAC,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAC9D,CAAC;CACF;AAED,yCAAyC;AACzC,MAAM,OAAO,gBAAiB,SAAQ,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC;IACtD,IAAI,GAAG,yBAAyB,CAAA;IAElD;QACE,KAAK,CAAC;YACJ,iBAAiB,EACf,0DAA0D;YAC5D,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;IACJ,CAAC;CACF;AAkCD;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAA;AAEnC,kEAAkE;AAClE,MAAM,CAAC,MAAM,KAAK,GAAG,6BAA6B,CAAA;AAElD,wCAAwC;AACxC,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,CAAA;AAE/B,8CAA8C;AAC9C,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAA;AAEzB,6EAA6E;AAC7E,MAAM,UAAU,GAAG,sBAAsB,CAAA;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAkB,EAAE,OAAuB;IACtE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC1E,OAAO,KAAK,CAAC,QAAQ,CAAA;AACvB,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAkB,EAAE,OAAuB;IACtE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAClE,wFAAwF;IACxF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG;QACrB,CAAC,CAAE,IAAI,CAAC,KAAK,CACT,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAc,EAAE,EAAE,CAChD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAC1D,CACU;QACf,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;SAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;AACpE,CAAC;AAwBD;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,QAAgB;IACrC,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,EAAkB,EAClB,OAAoB;IAEpB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;QAC1C,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;QACpC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;QAC1C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;QACpC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;QACtC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG;QAC9B,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;QACxC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;QAChC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;QACpC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;KACjC,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;SACvB,QAAQ,CACP,MAAM,CAAC,cAAc,EACrB,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CACnD;SACA,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAChD,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAC5C,CACF,CAAA;IACH,qEAAqE;IACrE,IAAI,CAAC,GAAG,EAAE,QAAQ;QAAE,OAAO,SAAS,CAAA;IACpC,mEAAmE;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG;QACjB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;YACrC,iBAAiB,EAAE,GAAG,CAAC,GAAG;SAC3B,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,gGAAgG;QAChG,2DAA2D;QAC3D,SAAS,EACP,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC;QACtE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAA;AACH,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAkB,EAAE,OAAqB;IAClE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACnC,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;SAC7B,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;SACrE,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAChC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAC9C,MAAM,CACJ,EAAE;SACC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;SACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAC5B,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EACvC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAC5C,CACF,CACJ,CACF,CACF;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;AACxB,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAkB,EAAE,OAAwB;IACxE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAC3B,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;SAC7B,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;SAC9C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAChC,GAAG,CAAA,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAC/F,MAAM,CACJ,EAAE;SACC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;SACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAC5B,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CACxC,CACF,CACJ,CACF,CACF,CAAA;AACL,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAkB,EAAE,OAAmB;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;SACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAC9D,OAAO,GAAG,EAAE,EAAE,CAAA;AAChB,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC7D,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEpE,OAAO,SAAS,CAAA;IAClB,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,IAAI,GAAG,SAAS,CAAA;AAE7B;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAgC,EAChC,OAAyB;IAEzB,yFAAyF;IACzF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5D,OAAO,SAAS,CAAA;IAClB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI;QACzE,OAAO,SAAS,CAAA;IAElB,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;IAClB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,WAAW,CAAC;QAC5D,OAAO,SAAS,CAAA;IAClB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/B,OAAO,GAAG,IAAI,IAAI,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAA;AACrE,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,EAAkB,EAClB,OAAqB;IAErB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;SAC7B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;SAC/C,SAAS,CAAC;QACT,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,OAAO;QACtC,gBAAgB,EAAE,MAAM,CAAC,cAAc,CAAC,gBAAgB;KACzD,CAAC,CAAA;IACJ,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAA;IAC5D,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAwB;QACrC,gBAAgB,EACd,GAAG,CAAC,gBAA6D;KACpE,CAAA;AACH,CAAC;AASD,yEAAyE;AACzE,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC5D,OAAO,SAAS,CAAA;AAClB,CAAC"}