@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/internal/Realm.js

@@ -0,0 +1,502 @@
+import { symmetricDecrypt, symmetricEncrypt } from 'better-auth/crypto';
+import { and, asc, eq, inArray, isNull, or } from 'drizzle-orm';
+import * as Tldts from 'tldts';
+import { z } from 'zod';
+import * as Schema from '../app/db/schema.js';
+import * as Cache from './Cache.js';
+/** An app names the realm, so the realm cannot be removed. */
+export class InUseError extends Error {
+    name = 'Realm.InUseError';
+    constructor(options) {
+        super(`Realm ${options.id} is in use. Remove it from the realms of each app first.`);
+    }
+}
+/** A realm ID, a name, a Privy app, or a list of realms is not valid. */
+export class InvalidError extends Error {
+    name = 'Realm.InvalidError';
+}
+/** No OAuth app has the client ID. */
+export class NotFoundAppError extends Error {
+    name = 'Realm.NotFoundAppError';
+    constructor(options) {
+        super(`Unknown app ${options.clientId}. Name a registered OAuth app.`);
+    }
+}
+/** No realm has the ID. */
+export class NotFoundError extends Error {
+    name = 'Realm.NotFoundError';
+    constructor(options) {
+        super(`Unknown realm ${options.id}. Add it first.`);
+    }
+}
+/** A realm with the ID exists. */
+export class TakenError extends Error {
+    name = 'Realm.TakenError';
+    constructor(options) {
+        super(`Realm ${options.id} exists. Choose another ID.`);
+    }
+}
+/** Another realm holds the passkey relying party. A passkey belongs to exactly one relying party. */
+export class TakenPasskeysError extends Error {
+    name = 'Realm.TakenPasskeysError';
+    constructor(options) {
+        super(`Relying party ${options.rpId} belongs to another realm. Give each realm its own relying party.`);
+    }
+}
+/** Another realm holds the Privy app. Realms that shared one would list the same accounts. */
+export class TakenPrivyAppError extends Error {
+    name = 'Realm.TakenPrivyAppError';
+    constructor(options) {
+        super(`Privy app ${options.appId} belongs to another realm. Give each realm its own Privy app.`);
+    }
+}
+/** The ID of the realm that every app without rows in `app_realms` reaches. */
+export const defaultId = 'default';
+/** Zod schemas for the values that define realms. */
+export var schema;
+(function (schema) {
+    /** A realm ID, in lowercase kebab case. */
+    schema.id = z.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, {
+        message: 'Use lowercase kebab case, such as tempo-cash.',
+    });
+    /** A realm, as `add` receives it. */
+    schema.realm = z.object({
+        id: schema.id,
+        name: z.string().trim().min(1, { message: 'Set a name.' }),
+    });
+    /** A realm's passkey relying party, as `setPasskeys` receives it. */
+    schema.passkeys = z.object({
+        realmId: schema.id,
+        rpId: z
+            .string()
+            .regex(/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/, {
+            message: 'Use a lowercase domain, such as tempo.xyz.',
+        }),
+    });
+    /** A realm's Privy app, as `setPrivy` receives it. */
+    schema.privy = z.object({
+        appId: z.string().trim().min(1, { message: 'Set a Privy app ID.' }),
+        appSecret: z.string().min(1, { message: 'Set a Privy app secret.' }),
+        realmId: schema.id,
+    });
+    /** An app's realms, in order, each named once. */
+    schema.realms = z
+        .array(schema.id)
+        .refine((ids) => new Set(ids).size === ids.length, {
+        message: 'Name each realm once.',
+    });
+})(schema || (schema = {}));
+/**
+ * Adds a realm without owner configurations, and returns it.
+ *
+ * Throws `InvalidError` for an invalid value, and `TakenError` when the ID exists.
+ */
+export async function add(db, options) {
+    const value = parse(options, { schema: schema.realm });
+    const inserted = await db
+        .insert(Schema.realms)
+        .values(value)
+        .onConflictDoNothing()
+        .returning({ id: Schema.realms.id });
+    if (inserted.length === 0)
+        throw new TakenError({ id: value.id });
+    return from({
+        id: value.id,
+        name: value.name,
+        passkeys: undefined,
+        privy: undefined,
+        secp256k1: false,
+    });
+}
+/**
+ * Returns the realms of the app with `clientId`, in order, in one query. The first realm holds a
+ * user's first account. An app without rows, or an unknown client ID, reaches the `default` realm.
+ */
+export async function forApp(db, options) {
+    // The query returns the app's realms and the `default` realm. `position` is `null` on `default`
+    // when the app does not name it.
+    const rows = await db
+        .select({
+        appId: Schema.realmPrivy.appId,
+        id: Schema.realms.id,
+        name: Schema.realms.name,
+        position: Schema.appRealms.position,
+        rpId: Schema.realmPasskeys.rpId,
+        secp256k1: Schema.realmSecp256k1.realmId,
+    })
+        .from(Schema.realms)
+        .leftJoin(Schema.appRealms, and(eq(Schema.appRealms.realmId, Schema.realms.id), eq(Schema.appRealms.clientId, options.clientId)))
+        .leftJoin(Schema.realmPasskeys, eq(Schema.realmPasskeys.realmId, Schema.realms.id))
+        .leftJoin(Schema.realmPrivy, eq(Schema.realmPrivy.realmId, Schema.realms.id))
+        .leftJoin(Schema.realmSecp256k1, eq(Schema.realmSecp256k1.realmId, Schema.realms.id))
+        .where(or(eq(Schema.appRealms.clientId, options.clientId), eq(Schema.realms.id, defaultId)))
+        .orderBy(asc(Schema.appRealms.position));
+    const named = rows.filter((row) => row.position !== null);
+    return (named.length > 0 ? named : rows).map(toRealm);
+}
+/**
+ * Returns the realms that a request reaches for the app with `clientId`, in order. A request that
+ * names no app reaches the `default` realm. So does a browser page that names an app from an origin
+ * none of the app's redirect URIs has, since a page cannot read another app's accounts. A native app
+ * sends no `Origin`, and Tempo ID's own pages send `own`. The request's cache holds each read by
+ * client ID, never by the `Origin` that a caller chooses.
+ */
+export async function forRequest(c, options) {
+    const { clientId, db, origin, own } = options;
+    const fallback = async () => [
+        await Cache.read(c, () => get(db, { id: defaultId }), [
+            'realm.get',
+            defaultId,
+        ]),
+    ];
+    if (!clientId)
+        return await fallback();
+    // One entry holds the app's origins and realms, so the check of the `Origin` and the realms it
+    // returns come from the same read.
+    const app = await Cache.read(c, async () => {
+        const [row] = await db
+            .select({ redirectUris: Schema.oauthClient.redirectUris })
+            .from(Schema.oauthClient)
+            // A third-party app's metadata document names its own origins, so a page there names no app.
+            .where(and(eq(Schema.oauthClient.clientId, clientId), isNull(Schema.oauthClient.clientDiscoveryId)));
+        const origins = (row?.redirectUris ?? []).flatMap((uri) => {
+            const url = URL.parse(uri);
+            return url && (url.protocol === 'https:' || url.protocol === 'http:')
+                ? [url.origin]
+                : [];
+        });
+        return { origins, realms: await forApp(db, { clientId }) };
+    }, ['realm.forRequest', clientId]);
+    if (origin && origin !== own && !app.origins.includes(origin))
+        return await fallback();
+    return app.realms;
+}
+/**
+ * Instantiates a {@link Realm}.
+ *
+ * @example
+ * ```ts
+ * const realm = Realm.from({
+ *   id: 'tempo-cash',
+ *   name: 'Tempo Cash',
+ *   privy: { appId: 'cm…' },
+ *   secp256k1: false,
+ * })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+/** Returns the realm with `id`. Throws `NotFoundError` when no realm has it. */
+export async function get(db, options) {
+    const [row] = await db
+        .select({
+        appId: Schema.realmPrivy.appId,
+        id: Schema.realms.id,
+        name: Schema.realms.name,
+        rpId: Schema.realmPasskeys.rpId,
+        secp256k1: Schema.realmSecp256k1.realmId,
+    })
+        .from(Schema.realms)
+        .leftJoin(Schema.realmPasskeys, eq(Schema.realmPasskeys.realmId, Schema.realms.id))
+        .leftJoin(Schema.realmPrivy, eq(Schema.realmPrivy.realmId, Schema.realms.id))
+        .leftJoin(Schema.realmSecp256k1, eq(Schema.realmSecp256k1.realmId, Schema.realms.id))
+        .where(eq(Schema.realms.id, options.id));
+    if (!row)
+        throw new NotFoundError({ id: options.id });
+    return toRealm(row);
+}
+/** Returns every realm: `default` first, then the others by ID. */
+export async function list(db) {
+    const rows = await db
+        .select({
+        appId: Schema.realmPrivy.appId,
+        id: Schema.realms.id,
+        name: Schema.realms.name,
+        rpId: Schema.realmPasskeys.rpId,
+        secp256k1: Schema.realmSecp256k1.realmId,
+    })
+        .from(Schema.realms)
+        .leftJoin(Schema.realmPasskeys, eq(Schema.realmPasskeys.realmId, Schema.realms.id))
+        .leftJoin(Schema.realmPrivy, eq(Schema.realmPrivy.realmId, Schema.realms.id))
+        .leftJoin(Schema.realmSecp256k1, eq(Schema.realmSecp256k1.realmId, Schema.realms.id))
+        .orderBy(asc(Schema.realms.id));
+    return rows
+        .toSorted((a, b) => Number(b.id === defaultId) - Number(a.id === defaultId))
+        .map(toRealm);
+}
+/**
+ * Returns the Privy apps of `realms`, by realm ID, with each app secret decrypted with `secret`. A
+ * realm without a Privy app has no entry. Reads every realm in one query. The request's cache holds
+ * the encrypted rows, so each request decrypts the secrets again, and no plaintext secret outlives it.
+ */
+export async function privyApps(c, options) {
+    const { db } = options;
+    const ids = options.realms.flatMap((realm) => (realm.privy ? [realm.id] : []));
+    if (ids.length === 0)
+        return new Map();
+    const rows = await Cache.read(c, () => db
+        .select()
+        .from(Schema.realmPrivy)
+        .where(inArray(Schema.realmPrivy.realmId, ids)), ['realm.privyApps', ...ids]);
+    return new Map(await Promise.all(rows.map(async (row) => [
+        row.realmId,
+        {
+            appId: row.appId,
+            appSecret: await symmetricDecrypt({
+                data: row.appSecret,
+                key: options.secret,
+            }),
+        },
+    ])));
+}
+/**
+ * Removes the realm with `id`, with its owner configurations.
+ *
+ * Throws `InvalidError` for an invalid ID or `default`, `NotFoundError` when no realm has the ID,
+ * and `InUseError` while an app names the realm.
+ */
+export async function remove(db, options) {
+    const id = parse(options.id, { schema: schema.id });
+    if (id === defaultId)
+        throw new InvalidError(`Invalid id: apps without realms reach the ${defaultId} realm. Remove another realm.`);
+    const deleted = await (async () => {
+        try {
+            return await db
+                .delete(Schema.realms)
+                .where(eq(Schema.realms.id, id))
+                .returning({ id: Schema.realms.id });
+        }
+        catch (error) {
+            if (violation(error, { code: '23503' }) ===
+                'app_realms_realm_id_realms_id_fk')
+                throw new InUseError({ id });
+            throw error;
+        }
+    })();
+    if (deleted.length === 0)
+        throw new NotFoundError({ id });
+}
+/**
+ * Sets the realms of the app with `clientId`, in order, and returns them. An empty list removes the
+ * app's rows, so the app reaches the `default` realm.
+ *
+ * Throws `InvalidError` for an invalid ID or a repeated realm, `NotFoundAppError` when no OAuth app
+ * has the client ID, and `NotFoundError` when no realm has one of the IDs.
+ */
+export async function setForApp(db, options) {
+    const { clientId } = options;
+    const ids = parse(options.realms, { schema: schema.realms });
+    return await db.transaction(async (tx) => {
+        // The locks serialize concurrent changes to the app's realms, and hold each named realm until
+        // the transaction ends, so a concurrent `remove` waits and the result is this call's own.
+        const [app] = await tx
+            .select({ clientId: Schema.oauthClient.clientId })
+            .from(Schema.oauthClient)
+            .where(eq(Schema.oauthClient.clientId, clientId))
+            .for('update');
+        if (!app)
+            throw new NotFoundAppError({ clientId });
+        const rows = ids.length === 0
+            ? []
+            : await tx
+                .select({ id: Schema.realms.id })
+                .from(Schema.realms)
+                .where(inArray(Schema.realms.id, ids))
+                .for('share');
+        const known = new Set(rows.map((row) => row.id));
+        const missing = ids.find((id) => !known.has(id));
+        if (missing)
+            throw new NotFoundError({ id: missing });
+        await tx
+            .delete(Schema.appRealms)
+            .where(eq(Schema.appRealms.clientId, clientId));
+        if (ids.length > 0)
+            await tx
+                .insert(Schema.appRealms)
+                .values(ids.map((realmId, position) => ({ clientId, position, realmId })));
+        return await forApp(tx, { clientId });
+    });
+}
+/**
+ * Sets the passkey relying party of the realm with `realmId`, and returns the realm. It replaces an
+ * earlier relying party. Passkeys of that relying party then own accounts in the realm.
+ *
+ * Throws `InvalidError` for an invalid value, `NotFoundError` when no realm has the ID, and
+ * `TakenPasskeysError` when another realm holds the relying party.
+ */
+export async function setPasskeys(db, options) {
+    const value = parse(options, { schema: schema.passkeys });
+    try {
+        await db
+            .insert(Schema.realmPasskeys)
+            .values({ realmId: value.realmId, rpId: value.rpId })
+            .onConflictDoUpdate({
+            set: { rpId: value.rpId },
+            target: Schema.realmPasskeys.realmId,
+        });
+    }
+    catch (error) {
+        if (violation(error, { code: '23505' }) === 'realm_passkeys_rp_id_unique')
+            throw new TakenPasskeysError({ rpId: value.rpId });
+        if (violation(error, { code: '23503' }))
+            throw new NotFoundError({ id: value.realmId });
+        throw error;
+    }
+    return await get(db, { id: value.realmId });
+}
+/**
+ * Sets the Privy app that holds the Privy owners of the realm with `realmId`, and returns the realm.
+ * It replaces an earlier Privy app. The row holds the app secret encrypted with `secret`.
+ *
+ * Throws `InvalidError` for an invalid value, `NotFoundError` when no realm has the ID, and
+ * `TakenPrivyAppError` when another realm holds the Privy app.
+ */
+export async function setPrivy(db, options) {
+    const value = parse(options, { schema: schema.privy });
+    const appSecret = await symmetricEncrypt({
+        data: value.appSecret,
+        key: options.secret,
+    });
+    const [realm] = await db
+        .select({ id: Schema.realms.id })
+        .from(Schema.realms)
+        .where(eq(Schema.realms.id, value.realmId));
+    if (!realm)
+        throw new NotFoundError({ id: value.realmId });
+    try {
+        await db
+            .insert(Schema.realmPrivy)
+            .values({ appId: value.appId, appSecret, realmId: value.realmId })
+            .onConflictDoUpdate({
+            set: { appId: value.appId, appSecret },
+            target: Schema.realmPrivy.realmId,
+        });
+    }
+    catch (error) {
+        if (violation(error, { code: '23505' }) === 'realm_privy_app_id_unique')
+            throw new TakenPrivyAppError({ appId: value.appId });
+        // A concurrent `remove` deleted the realm after the read.
+        if (violation(error, { code: '23503' }))
+            throw new NotFoundError({ id: value.realmId });
+        throw error;
+    }
+    return await get(db, { id: value.realmId });
+}
+/**
+ * Sets whether Tempo ID holds the secp256k1 owners of the realm with `realmId`, and returns the
+ * realm. The realm then creates a user's first account with a key that Tempo ID holds. Turning it
+ * off keeps the realm's stored keys, and lists none of them.
+ *
+ * Throws `InvalidError` for an invalid ID, and `NotFoundError` when no realm has the ID.
+ */
+export async function setSecp256k1(db, options) {
+    const realmId = parse(options.realmId, { schema: schema.id });
+    if (!options.enabled)
+        await db
+            .delete(Schema.realmSecp256k1)
+            .where(eq(Schema.realmSecp256k1.realmId, realmId));
+    else
+        try {
+            await db
+                .insert(Schema.realmSecp256k1)
+                .values({ realmId })
+                .onConflictDoNothing();
+        }
+        catch (error) {
+            if (violation(error, { code: '23503' }))
+                throw new NotFoundError({ id: realmId });
+            throw error;
+        }
+    return await get(db, { id: realmId });
+}
+/**
+ * Returns `realms` with the relying party that each one signs in with. The `default` realm without a
+ * `realm_passkeys` row signs in with passkeys of the registrable domain of `origin`, such as
+ * `tempo.xyz` for `https://id.tempo.xyz`, so every deployment offers passkeys without configuration. A row replaces that relying party. When another realm's row holds
+ * the host or a parent domain of it, `default` has none, since that realm's passkeys sign in at the
+ * same origin. The request's cache holds that lookup by domain.
+ */
+export async function withDefaults(c, options) {
+    const { db, realms } = options;
+    if (!realms.some((realm) => realm.id === defaultId && !realm.passkeys))
+        return realms;
+    const host = new URL(options.origin).hostname;
+    const parsed = Tldts.parse(host, { allowPrivateDomains: true });
+    // WebAuthn refuses an IP address as a relying party.
+    if (parsed.isIp)
+        return realms;
+    // A private suffix, such as `workers.dev`, is not a registrable domain, so the host keeps its own
+    // label there. `localhost` has no registrable domain, and keeps its host.
+    const rpId = parsed.domain ?? host;
+    // A row for the host or a parent domain of it, such as `tempo.xyz` for `id.tempo.xyz`, signs in at
+    // the origin too, so the default would take that realm's sign-ins at an app that lists `default`
+    // first.
+    // A public suffix, such as `xyz`, is never a relying party, so the domains stop at `rpId`.
+    const labels = host.split('.');
+    const domains = labels
+        .map((_, index) => labels.slice(index).join('.'))
+        .filter((domain) => domain === rpId || domain.endsWith(`.${rpId}`));
+    // The realms come from an earlier read than the lookup below, so a change between the two reads
+    // could show the host as free while one of `realms` still holds it. Both checks together cover
+    // either order.
+    if (realms.some((realm) => realm.passkeys && domains.includes(realm.passkeys.rpId)))
+        return realms;
+    // Until a passkey links, the `default` realm has no row, so every sign-in reaches this lookup.
+    // The request's cache holds its answer, as it holds the realms. A cached `default` realm can
+    // predate its own row, which the first stored passkey writes, so the lookup reads that row too,
+    // and its relying party applies as a fresh read returns it.
+    const lookup = await Cache.read(c, async () => {
+        const rows = await db
+            .select({
+            realmId: Schema.realmPasskeys.realmId,
+            rpId: Schema.realmPasskeys.rpId,
+        })
+            .from(Schema.realmPasskeys)
+            .where(or(eq(Schema.realmPasskeys.realmId, defaultId), inArray(Schema.realmPasskeys.rpId, domains)));
+        const own = rows.find((row) => row.realmId === defaultId);
+        return { own: own?.rpId ?? null, taken: !own && rows.length > 0 };
+    }, ['realm.rpHolder', ...domains]);
+    if (lookup.taken)
+        return realms;
+    return realms.map((realm) => realm.id === defaultId && !realm.passkeys
+        ? from({ ...realm, passkeys: { rpId: lookup.own ?? rpId } })
+        : realm);
+}
+/** Parses `value` with `options.schema`, and throws `InvalidError` with the first issue's message. */
+function parse(value, options) {
+    const result = options.schema.safeParse(value);
+    if (result.success)
+        return result.data;
+    const issue = result.error.issues[0];
+    const path = issue.path.join('.');
+    throw new InvalidError(path
+        ? `Invalid ${path}: ${issue.message}`
+        : `Invalid realm: ${issue.message}`);
+}
+/** Returns a realm from a row of `realms` joined with its owner configurations. */
+function toRealm(row) {
+    return from({
+        id: row.id,
+        name: row.name,
+        passkeys: row.rpId === null ? undefined : { rpId: row.rpId },
+        privy: row.appId === null ? undefined : { appId: row.appId },
+        secp256k1: row.secp256k1 !== null,
+    });
+}
+/**
+ * Returns the constraint that a Postgres error with `code` names, such as `23505` for a unique
+ * violation, or `undefined` for any other error. Drizzle wraps the driver's error in `cause`.
+ */
+function violation(error, options) {
+    const { code } = options;
+    const cause = error instanceof Error && error.cause ? error.cause : error;
+    if (typeof cause !== 'object' || cause === null)
+        return undefined;
+    if (!('code' in cause) || cause.code !== code)
+        return undefined;
+    if (!('constraint' in cause) || typeof cause.constraint !== 'string')
+        return undefined;
+    return cause.constraint;
+}
+//# sourceMappingURL=Realm.js.map

package/dist/internal/Realm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Realm.js","sourceRoot":"","sources":["../../src/internal/Realm.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAGnC,8DAA8D;AAC9D,MAAM,OAAO,UAAW,SAAQ,KAAK;IACjB,IAAI,GAAG,kBAAkB,CAAA;IAE3C,YAAY,OAAuB;QACjC,KAAK,CACH,SAAS,OAAO,CAAC,EAAE,0DAA0D,CAC9E,CAAA;IACH,CAAC;CACF;AAED,yEAAyE;AACzE,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,oBAAoB,CAAA;CAC9C;AAED,sCAAsC;AACtC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,wBAAwB,CAAA;IAEjD,YAAY,OAA6B;QACvC,KAAK,CAAC,eAAe,OAAO,CAAC,QAAQ,gCAAgC,CAAC,CAAA;IACxE,CAAC;CACF;AAED,2BAA2B;AAC3B,MAAM,OAAO,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,qBAAqB,CAAA;IAE9C,YAAY,OAAuB;QACjC,KAAK,CAAC,iBAAiB,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAA;IACrD,CAAC;CACF;AAED,kCAAkC;AAClC,MAAM,OAAO,UAAW,SAAQ,KAAK;IACjB,IAAI,GAAG,kBAAkB,CAAA;IAE3C,YAAY,OAAuB;QACjC,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,6BAA6B,CAAC,CAAA;IACzD,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzB,IAAI,GAAG,0BAA0B,CAAA;IAEnD,YAAY,OAAyB;QACnC,KAAK,CACH,iBAAiB,OAAO,CAAC,IAAI,mEAAmE,CACjG,CAAA;IACH,CAAC;CACF;AAED,8FAA8F;AAC9F,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzB,IAAI,GAAG,0BAA0B,CAAA;IAEnD,YAAY,OAA0B;QACpC,KAAK,CACH,aAAa,OAAO,CAAC,KAAK,+DAA+D,CAC1F,CAAA;IACH,CAAC;CACF;AA6BD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAA;AAElC,qDAAqD;AACrD,MAAM,KAAW,MAAM,CAsCtB;AAtCD,WAAiB,MAAM;IACrB,2CAA2C;IAC9B,SAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,EAAE;QAC7D,OAAO,EAAE,+CAA+C;KACzD,CAAC,CAAA;IAEF,qCAAqC;IACxB,YAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QAC5B,EAAE,EAAF,SAAE;QACF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;KAC3D,CAAC,CAAA;IAEF,qEAAqE;IACxD,eAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,SAAE;QACX,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,KAAK,CACJ,4FAA4F,EAC5F;YACE,OAAO,EAAE,4CAA4C;SACtD,CACF;KACJ,CAAC,CAAA;IAEF,sDAAsD;IACzC,YAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;QACnE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;QACpE,OAAO,EAAE,SAAE;KACZ,CAAC,CAAA;IAEF,kDAAkD;IACrC,aAAM,GAAG,CAAC;SACpB,KAAK,CAAC,SAAE,CAAC;SACT,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE;QACjD,OAAO,EAAE,uBAAuB;KACjC,CAAC,CAAA;AACN,CAAC,EAtCgB,MAAM,KAAN,MAAM,QAsCtB;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,EAAY,EAAE,OAAoB;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;IAEtD,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC;SACb,mBAAmB,EAAE;SACrB,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjE,OAAO,IAAI,CAAC;QACV,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,KAAK;KACjB,CAAC,CAAA;AACJ,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,EAAY,EACZ,OAAuB;IAEvB,gGAAgG;IAChG,iCAAiC;IACjC,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK;QAC9B,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;QACnC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI;QAC/B,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,OAAO;KACzC,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;SACnB,QAAQ,CACP,MAAM,CAAC,SAAS,EAChB,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAC9C,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAChD,CACF;SACA,QAAQ,CACP,MAAM,CAAC,aAAa,EACpB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CACnD;SACA,QAAQ,CACP,MAAM,CAAC,UAAU,EACjB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAChD;SACA,QAAQ,CACP,MAAM,CAAC,cAAc,EACrB,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CACpD;SACA,KAAK,CACJ,EAAE,CACA,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAC/C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAChC,CACF;SACA,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;IAE1C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;IACzD,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AACvD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,CAAqB,EACrB,OAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAC7C,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;YACpD,WAAW;YACX,SAAS;SACV,CAAC;KACH,CAAA;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,QAAQ,EAAE,CAAA;IAEtC,+FAA+F;IAC/F,mCAAmC;IACnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;aACzD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACzB,6FAA6F;aAC5F,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACzC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAC7C,CACF,CAAA;QACH,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACxD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1B,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;gBACnE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;gBACd,CAAC,CAAC,EAAE,CAAA;QACR,CAAC,CAAC,CAAA;QACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;IAC5D,CAAC,EAAE,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAA;IAClC,IAAI,MAAM,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3D,OAAO,MAAM,QAAQ,EAAE,CAAA;IACzB,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC;AAeD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,IAAI,CAAC,KAAY;IAC/B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,EAAY,EAAE,OAAoB;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK;QAC9B,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI;QAC/B,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,OAAO;KACzC,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;SACnB,QAAQ,CACP,MAAM,CAAC,aAAa,EACpB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CACnD;SACA,QAAQ,CACP,MAAM,CAAC,UAAU,EACjB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAChD;SACA,QAAQ,CACP,MAAM,CAAC,cAAc,EACrB,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CACpD;SACA,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;AACrB,CAAC;AASD,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAY;IACrC,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK;QAC9B,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI;QAC/B,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,OAAO;KACzC,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;SACnB,QAAQ,CACP,MAAM,CAAC,aAAa,EACpB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CACnD;SACA,QAAQ,CACP,MAAM,CAAC,UAAU,EACjB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAChD;SACA,QAAQ,CACP,MAAM,CAAC,cAAc,EACrB,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CACpD;SACA,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IAEjC,OAAO,IAAI;SACR,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;SAC3E,GAAG,CAAC,OAAO,CAAC,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,CAAqB,EACrB,OAA0B;IAE1B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAA;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAA;IAEtC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAC3B,CAAC,EACD,GAAG,EAAE,CACH,EAAE;SACC,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;SACvB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EACnD,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,CAC5B,CAAA;IACD,OAAO,IAAI,GAAG,CACZ,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CACN,KAAK,EAAE,GAAG,EAAE,EAAE,CACZ;QACE,GAAG,CAAC,OAAO;QACX;YACE,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,MAAM,gBAAgB,CAAC;gBAChC,IAAI,EAAE,GAAG,CAAC,SAAS;gBACnB,GAAG,EAAE,OAAO,CAAC,MAAM;aACpB,CAAC;SACH;KACO,CACb,CACF,CACF,CAAA;AACH,CAAC;AAaD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAY,EAAE,OAAuB;IAChE,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,IAAI,EAAE,KAAK,SAAS;QAClB,MAAM,IAAI,YAAY,CACpB,6CAA6C,SAAS,+BAA+B,CACtF,CAAA;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE;iBACZ,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;iBACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBAC/B,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBACnC,kCAAkC;gBAElC,MAAM,IAAI,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YAC9B,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AAC3D,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAY,EAAE,OAA0B;IACtE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAE5D,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,8FAA8F;QAC9F,0FAA0F;QAC1F,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;aACjD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAChD,GAAG,CAAC,QAAQ,CAAC,CAAA;QAChB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QAElD,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,MAAM,EAAE;iBACL,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;iBAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;iBACnB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;iBACrC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAChD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAChD,IAAI,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAErD,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;QACjD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAChB,MAAM,EAAE;iBACL,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;iBACxB,MAAM,CACL,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAClE,CAAA;QAEL,OAAO,MAAM,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAY,EAAE,OAA4B;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEzD,IAAI,CAAC;QACH,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;aAC5B,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;aACpD,kBAAkB,CAAC;YAClB,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YACzB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,OAAO;SACrC,CAAC,CAAA;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,6BAA6B;YACvE,MAAM,IAAI,kBAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QACpD,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAChD,MAAM,KAAK,CAAA;IACb,CAAC;IAED,OAAO,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;AAC7C,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAY,EAAE,OAAyB;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,IAAI,EAAE,KAAK,CAAC,SAAS;QACrB,GAAG,EAAE,OAAO,CAAC,MAAM;KACpB,CAAC,CAAA;IAEF,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;SAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;SACnB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAE1D,IAAI,CAAC;QACH,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;aACzB,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aACjE,kBAAkB,CAAC;YAClB,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE;YACtC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO;SAClC,CAAC,CAAA;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,2BAA2B;YACrE,MAAM,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QACtD,0DAA0D;QAC1D,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAChD,MAAM,KAAK,CAAA;IACb,CAAC;IAED,OAAO,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;AAC7C,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAY,EACZ,OAA6B;IAE7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IAE7D,IAAI,CAAC,OAAO,CAAC,OAAO;QAClB,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;aAC7B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;;QAEpD,IAAI,CAAC;YACH,MAAM,EAAE;iBACL,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;iBAC7B,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;iBACnB,mBAAmB,EAAE,CAAA;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBACrC,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1C,MAAM,KAAK,CAAA;QACb,CAAC;IAEH,OAAO,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;AACvC,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,CAAqB,EACrB,OAA6B;IAE7B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QACpE,OAAO,MAAM,CAAA;IAEf,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAA;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,qDAAqD;IACrD,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,MAAM,CAAA;IAE9B,kGAAkG;IAClG,0EAA0E;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAA;IAClC,mGAAmG;IACnG,iGAAiG;IACjG,SAAS;IACT,2FAA2F;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,MAAM;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;IACrE,gGAAgG;IAChG,+FAA+F;IAC/F,gBAAgB;IAChB,IACE,MAAM,CAAC,IAAI,CACT,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnE;QAED,OAAO,MAAM,CAAA;IAEf,+FAA+F;IAC/F,6FAA6F;IAC7F,gGAAgG;IAChG,4DAA4D;IAC5D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC;YACN,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC,OAAO;YACrC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI;SAChC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;aAC1B,KAAK,CACJ,EAAE,CACA,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,EAC3C,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAC5C,CACF,CAAA;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAA;QACzD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAA;IACnE,CAAC,EAAE,CAAC,gBAAgB,EAAE,GAAG,OAAO,CAAC,CAAC,CAAA;IAClC,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAA;IAE/B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ;QACvC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5D,CAAC,CAAC,KAAK,CACV,CAAA;AACH,CAAC;AAaD,sGAAsG;AACtG,SAAS,KAAK,CACZ,KAAc,EACd,OAA4B;IAE5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAA;IAEtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAA;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,IAAI,YAAY,CACpB,IAAI;QACF,CAAC,CAAC,WAAW,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;QACrC,CAAC,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CACtC,CAAA;AACH,CAAC;AASD,mFAAmF;AACnF,SAAS,OAAO,CAAC,GAAgB;IAC/B,OAAO,IAAI,CAAC;QACV,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QAC5D,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,KAAK,IAAI;KAClC,CAAC,CAAA;AACJ,CAAC;AAiBD;;;GAGG;AACH,SAAS,SAAS,CAAC,KAAc,EAAE,OAA0B;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACxB,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACjE,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC/D,IAAI,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAClE,OAAO,SAAS,CAAA;IAClB,OAAO,KAAK,CAAC,UAAU,CAAA;AACzB,CAAC"}

package/dist/internal/RequestId.d.ts

@@ -0,0 +1,16 @@
+import type { Env } from './Env.js';
+/** The codes of a refusal's OAuth error body, which `Timing` logs with the request. */
+export type Refusal = {
+    /** The OAuth `error` code. */
+    error?: string | undefined;
+    /** The refusal's `reason`. */
+    reason?: string | undefined;
+};
+/** The response header that carries the request ID. */
+export declare const header = "X-Request-Id";
+/**
+ * Assigns the request ID, and returns it in {@link header} and error bodies. An error body's codes
+ * go in `c.var.refusal`. Register it right after `Timing.middleware`, before any other middleware.
+ */
+export declare function middleware(): import("hono").MiddlewareHandler<Env, string, {}, Response>;
+//# sourceMappingURL=RequestId.d.ts.map

package/dist/internal/RequestId.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestId.d.ts","sourceRoot":"","sources":["../../src/internal/RequestId.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAGnC,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG;IACpB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5B,CAAA;AAED,uDAAuD;AACvD,eAAO,MAAM,MAAM,iBAAiB,CAAA;AAEpC;;;GAGG;AACH,wBAAgB,UAAU,gEAgBzB"}

package/dist/internal/RequestId.js

@@ -0,0 +1,78 @@
+import { createMiddleware } from 'hono/factory';
+import { requestId } from 'hono/request-id';
+import * as Timing from './Timing.js';
+/** The response header that carries the request ID. */
+export const header = 'X-Request-Id';
+/**
+ * Assigns the request ID, and returns it in {@link header} and error bodies. An error body's codes
+ * go in `c.var.refusal`. Register it right after `Timing.middleware`, before any other middleware.
+ */
+export function middleware() {
+    // `headerName: ''` ignores any `X-Request-Id` the client sends, so logs only hold IDs the Worker
+    // chose. It also stops `requestId` from setting the header, which happens below instead.
+    const assign = requestId({ generator, headerName: '' });
+    return createMiddleware(async (c, next) => {
+        await assign(c, next);
+        const id = c.var.requestId;
+        const response = c.res;
+        const body = failed(response)
+            ? await Timing.measure(c, read(response), 'response.json')
+            : undefined;
+        if (body)
+            c.set('refusal', annotate(c, { body, id }));
+        c.header(header, id);
+    });
+}
+/**
+ * Replaces the response with its OAuth error `body` plus `request_id`, and returns the body's
+ * `error` and `reason` codes.
+ */
+function annotate(c, options) {
+    const response = c.res;
+    c.res = new Response(JSON.stringify({ ...options.body, request_id: options.id }), {
+        headers: response.headers,
+        status: response.status,
+        statusText: response.statusText,
+    });
+    // Hono copies the old response's headers onto the new one, including a stale length.
+    c.header('content-length', undefined);
+    // Proxied bodies can hold anything, so only code-shaped values reach the log.
+    return {
+        error: code(options.body.error),
+        reason: code(options.body.reason),
+    };
+}
+/** Returns `value` when it is a short snake-case code, such as an OAuth `error` or a `reason`. */
+function code(value) {
+    return typeof value === 'string' && /^[a-z_]{1,64}$/.test(value)
+        ? value
+        : undefined;
+}
+/** Whether `response` is a JSON error response, which may hold an OAuth error body. */
+function failed(response) {
+    return (response.status >= 400 &&
+        !!response.headers.get('content-type')?.startsWith('application/json'));
+}
+/**
+ * The Ray ID when the request carries a well-formed one, or a random UUID. Cloudflare sets `cf-ray`
+ * on every request it delivers, replacing any value the client sent.
+ */
+function generator(c) {
+    const ray = c.req.header('cf-ray');
+    return ray && /^[\da-f]{16}(?:-[A-Z]{3})?$/.test(ray)
+        ? ray
+        : crypto.randomUUID();
+}
+/** Whether `value` is a plain JSON object. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Reads a copy of `response`'s body as an OAuth error, with a string `error`. */
+async function read(response) {
+    const body = await response
+        .clone()
+        .json()
+        .catch(() => undefined);
+    return isRecord(body) && typeof body.error === 'string' ? body : undefined;
+}
+//# sourceMappingURL=RequestId.js.map

package/dist/internal/RequestId.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestId.js","sourceRoot":"","sources":["../../src/internal/RequestId.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAUrC,uDAAuD;AACvD,MAAM,CAAC,MAAM,MAAM,GAAG,cAAc,CAAA;AAEpC;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,iGAAiG;IACjG,yFAAyF;IACzF,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;IAEvD,OAAO,gBAAgB,CAAM,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7C,MAAM,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAErB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAA;QAC1B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAA;QACtB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QACrD,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,CAAe,EAAE,OAAyB;IAC1D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAA;IACtB,CAAC,CAAC,GAAG,GAAG,IAAI,QAAQ,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAC3D;QACE,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CACF,CAAA;IACD,qFAAqF;IACrF,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAA;IAErC,8EAA8E;IAC9E,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;KAClC,CAAA;AACH,CAAC;AAWD,kGAAkG;AAClG,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,uFAAuF;AACvF,SAAS,MAAM,CAAC,QAAkB;IAChC,OAAO,CACL,QAAQ,CAAC,MAAM,IAAI,GAAG;QACtB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC,CACvE,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,CAAU;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClC,OAAO,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QACnD,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;AACzB,CAAC;AAED,8CAA8C;AAC9C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,IAAI,CAAC,QAAkB;IACpC,MAAM,IAAI,GAAY,MAAM,QAAQ;SACjC,KAAK,EAAE;SACP,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACzB,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5E,CAAC"}