@thirdweb-dev/service-utils 0.4.38 → 0.4.39

package/dist/cjs/cf-worker/index.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeWorker = authorizeWorker;
+exports.extractAuthorizationData = extractAuthorizationData;
+exports.hashSecretKey = hashSecretKey;
+exports.deriveClientIdFromSecretKeyHash = deriveClientIdFromSecretKeyHash;
+exports.logHttpRequest = logHttpRequest;
+const tslib_1 = require("tslib");
+const index_js_1 = require("../core/authorize/index.js");
+tslib_1.__exportStar(require("./usage.js"), exports);
+tslib_1.__exportStar(require("../core/services.js"), exports);
+tslib_1.__exportStar(require("../core/rateLimit/index.js"), exports);
+tslib_1.__exportStar(require("../core/usageLimit/index.js"), exports);
+const DEFAULT_CACHE_TTL_SECONDS = 60;
+async function authorizeWorker(authInput, serviceConfig) {
+    let authData;
+    try {
+        authData = await extractAuthorizationData(authInput);
+    }
+    catch (e) {
+        if (e instanceof Error && e.message === "KEY_CONFLICT") {
+            return {
+                authorized: false,
+                status: 400,
+                errorMessage: "Please pass either a client id or a secret key.",
+                errorCode: "KEY_CONFLICT",
+            };
+        }
+        return {
+            authorized: false,
+            status: 500,
+            errorMessage: "Internal Server Error",
+            errorCode: "INTERNAL_SERVER_ERROR",
+        };
+    }
+    return await (0, index_js_1.authorize)(authData, serviceConfig, {
+        get: async (clientId) => serviceConfig.kvStore.get(clientId),
+        put: (clientId, apiKeyMeta) => serviceConfig.ctx.waitUntil(serviceConfig.kvStore.put(clientId, JSON.stringify({
+            updatedAt: Date.now(),
+            apiKeyMeta,
+        }), {
+            expirationTtl: serviceConfig.cacheTtlSeconds &&
+                serviceConfig.cacheTtlSeconds >= DEFAULT_CACHE_TTL_SECONDS
+                ? serviceConfig.cacheTtlSeconds
+                : DEFAULT_CACHE_TTL_SECONDS,
+        })),
+        cacheTtlSeconds: serviceConfig.cacheTtlSeconds ?? DEFAULT_CACHE_TTL_SECONDS,
+    });
+}
+async function extractAuthorizationData(authInput) {
+    const requestUrl = new URL(authInput.req.url);
+    const headers = authInput.req.headers;
+    const secretKey = headers.get("x-secret-key");
+    // prefer clientId that is explicitly passed in
+    let clientId = authInput.clientId ?? null;
+    if (!clientId) {
+        // next preference is clientId from header
+        clientId = headers.get("x-client-id");
+    }
+    // next preference is search param
+    if (!clientId) {
+        clientId = requestUrl.searchParams.get("clientId");
+    }
+    // bundle id from header is first preference
+    let bundleId = headers.get("x-bundle-id");
+    // next preference is search param
+    if (!bundleId) {
+        bundleId = requestUrl.searchParams.get("bundleId");
+    }
+    let origin = headers.get("origin");
+    // if origin header is not available we'll fall back to referrer;
+    if (!origin) {
+        origin = headers.get("referer");
+    }
+    // if we have an origin at this point, normalize it
+    if (origin) {
+        try {
+            origin = new URL(origin).host;
+        }
+        catch (e) {
+            console.warn("failed to parse origin", origin, e);
+        }
+    }
+    // handle if we a secret key is passed in the headers
+    let secretKeyHash = null;
+    if (secretKey) {
+        // hash the secret key
+        secretKeyHash = await hashSecretKey(secretKey);
+        // derive the client id from the secret key hash
+        const derivedClientId = deriveClientIdFromSecretKeyHash(secretKeyHash);
+        // if we already have a client id passed in we need to make sure they match
+        if (clientId && clientId !== derivedClientId) {
+            throw new Error("KEY_CONFLICT");
+        }
+        // otherwise set the client id to the derived client id (client id based off of secret key)
+        clientId = derivedClientId;
+    }
+    let jwt = null;
+    if (headers.has("authorization")) {
+        const authHeader = headers.get("authorization");
+        if (authHeader) {
+            const [type, token] = authHeader.split(" ");
+            if (type?.toLowerCase() === "bearer" && !!token) {
+                jwt = token;
+            }
+        }
+    }
+    return {
+        jwt,
+        hashedJWT: jwt ? await hashSecretKey(jwt) : null,
+        secretKey,
+        clientId,
+        origin,
+        bundleId,
+        secretKeyHash,
+        targetAddress: authInput.targetAddress,
+    };
+}
+async function hashSecretKey(secretKey) {
+    return bufferToHex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secretKey)));
+}
+function deriveClientIdFromSecretKeyHash(secretKeyHash) {
+    return secretKeyHash.slice(0, 32);
+}
+function bufferToHex(buffer) {
+    return [...new Uint8Array(buffer)]
+        .map((x) => x.toString(16).padStart(2, "0"))
+        .join("");
+}
+async function logHttpRequest({ clientId, req, res, isAuthed, statusMessage, latencyMs, }) {
+    try {
+        const authorizationData = await extractAuthorizationData({ req, clientId });
+        const headers = req.headers;
+        console.log(JSON.stringify({
+            method: req.method,
+            pathname: req.url,
+            hasSecretKey: !!authorizationData.secretKey,
+            hasClientId: !!authorizationData.clientId,
+            hasJwt: !!authorizationData.jwt,
+            clientId: authorizationData.clientId,
+            isAuthed,
+            status: res.status,
+            sdkName: headers.get("x-sdk-name") ?? undefined,
+            sdkVersion: headers.get("x-sdk-version") ?? undefined,
+            platform: headers.get("x-sdk-platform") ?? undefined,
+            os: headers.get("x-sdk-os") ?? undefined,
+            latencyMs,
+        }));
+        if (statusMessage) {
+            console.log(`statusMessage=${statusMessage}`);
+        }
+    }
+    catch { }
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/cf-worker/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cf-worker/index.ts"],"names":[],"mappings":";;AAiCA,0CA6CC;AAED,4DA6EC;AAED,sCAIC;AAED,0EAEC;AAQD,wCAwCC;;AA5MD,yDAAuD;AAKvD,qDAA2B;AAC3B,8DAAoC;AACpC,qEAA2C;AAC3C,sEAA4C;AAQ5C,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAM9B,KAAK,UAAU,eAAe,CACnC,SAAoB,EACpB,aAAkC;IAElC,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;YACvD,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,GAAG;gBACX,YAAY,EAAE,iDAAiD;gBAC/D,SAAS,EAAE,cAAc;aAC1B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,uBAAuB;YACrC,SAAS,EAAE,uBAAuB;SACnC,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAA,oBAAS,EAAC,QAAQ,EAAE,aAAa,EAAE;QAC9C,GAAG,EAAE,KAAK,EAAE,QAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpE,GAAG,EAAE,CAAC,QAAgB,EAAE,UAA4C,EAAE,EAAE,CACtE,aAAa,CAAC,GAAG,CAAC,SAAS,CACzB,aAAa,CAAC,OAAO,CAAC,GAAG,CACvB,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC;YACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,UAAU;SACX,CAAC,EACF;YACE,aAAa,EACX,aAAa,CAAC,eAAe;gBAC7B,aAAa,CAAC,eAAe,IAAI,yBAAyB;gBACxD,CAAC,CAAC,aAAa,CAAC,eAAe;gBAC/B,CAAC,CAAC,yBAAyB;SAChC,CACF,CACF;QACH,eAAe,EAAE,aAAa,CAAC,eAAe,IAAI,yBAAyB;KAC5E,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,SAAoB;IAEpB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE9C,+CAA+C;IAC/C,IAAI,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC;IAE1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,0CAA0C;QAC1C,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,4CAA4C;IAC5C,IAAI,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAE1C,kCAAkC;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,iEAAiE;IACjE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IACD,mDAAmD;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAChC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACd,sBAAsB;QACtB,aAAa,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC/C,gDAAgD;QAChD,MAAM,eAAe,GAAG,+BAA+B,CAAC,aAAa,CAAC,CAAC;QACvE,2EAA2E;QAC3E,IAAI,QAAQ,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QACD,2FAA2F;QAC3F,QAAQ,GAAG,eAAe,CAAC;IAC7B,CAAC;IAED,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,IAAI,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBAChD,GAAG,GAAG,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QAChD,SAAS;QACT,QAAQ;QACR,MAAM;QACN,QAAQ;QACR,aAAa;QACb,aAAa,EAAE,SAAS,CAAC,aAAa;KACvC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,OAAO,WAAW,CAChB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAAC,aAAqB;IACnE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,EACnC,QAAQ,EACR,GAAG,EACH,GAAG,EACH,QAAQ,EACR,aAAa,EACb,SAAS,GAQV;IACC,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAE5B,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;YACb,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,GAAG;YACjB,YAAY,EAAE,CAAC,CAAC,iBAAiB,CAAC,SAAS;YAC3C,WAAW,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ;YACzC,MAAM,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG;YAC/B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;YACpC,QAAQ;YACR,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;YAC/C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;YACrD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS;YACpD,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS;YACxC,SAAS;SACV,CAAC,CACH,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,iBAAiB,aAAa,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC"}

package/dist/cjs/cf-worker/usage.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publishUsageEvents = publishUsageEvents;
+const aws4fetch_1 = require("aws4fetch");
+const usage_js_1 = require("../core/usage.js");
+// Initialize a singleton for AWS usage.
+let _aws;
+function getAws(options) {
+    if (!_aws) {
+        _aws = new aws4fetch_1.AwsClient(options);
+    }
+    return _aws;
+}
+/**
+ * Publish usage events. Provide the relevant fields for your application.
+ *
+ * Usage in Cloudflare Workers:
+ *    ctx.waitUntil(
+ *      publishUsageEvents(
+ *        [event1, event2],
+ *        { queueUrl, accessKeyId, secretAccessKey },
+ *      )
+ *    )
+ *
+ * @param usageEvents
+ * @param config
+ */
+async function publishUsageEvents(usageEvents, config) {
+    const { queueUrl, accessKeyId, secretAccessKey, region = "us-west-2", } = config;
+    const entries = usageEvents.map((event) => {
+        // Enforce schema of usage event.
+        const parsed = usage_js_1.usageEventSchema.parse(event);
+        return {
+            Id: crypto.randomUUID(),
+            MessageBody: JSON.stringify(parsed),
+        };
+    });
+    const aws = getAws({
+        accessKeyId,
+        secretAccessKey,
+        region,
+    });
+    await aws.fetch(`https://sqs.${region}.amazonaws.com`, {
+        headers: {
+            "X-Amz-Target": "AmazonSQS.SendMessageBatch",
+            "X-Amz-Date": new Date().toISOString(),
+            "Content-Type": "application/x-amz-json-1.0",
+        },
+        body: JSON.stringify({
+            QueueUrl: queueUrl,
+            Entries: entries,
+        }),
+    });
+}
+//# sourceMappingURL=usage.js.map

package/dist/cjs/cf-worker/usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../../../src/cf-worker/usage.ts"],"names":[],"mappings":";;AAsES,gDAAkB;AAtE3B,yCAAsC;AACtC,+CAAqE;AAGrE,wCAAwC;AACxC,IAAI,IAA2B,CAAC;AAChC,SAAS,MAAM,CAAC,OAAmD;IACjE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,IAAI,qBAAS,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,kBAAkB,CAC/B,WAAyB,EACzB,MAKC;IAED,MAAM,EACJ,QAAQ,EACR,WAAW,EACX,eAAe,EACf,MAAM,GAAG,WAAW,GACrB,GAAG,MAAM,CAAC;IAEX,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,iCAAiC;QACjC,MAAM,MAAM,GAAG,2BAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SACpC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,CAAC;QACjB,WAAW;QACX,eAAe;QACf,MAAM;KACP,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,KAAK,CAAC,eAAe,MAAM,gBAAgB,EAAE;QACrD,OAAO,EAAE;YACP,cAAc,EAAE,4BAA4B;YAC5C,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,cAAc,EAAE,4BAA4B;SAC7C;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,OAAO;SACjB,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/core/api.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchKeyMetadataFromApi = fetchKeyMetadataFromApi;
+exports.fetchAccountFromApi = fetchAccountFromApi;
+exports.updateRateLimitedAt = updateRateLimitedAt;
+async function fetchKeyMetadataFromApi(clientId, config) {
+    const { apiUrl, serviceScope, serviceApiKey, checkPolicy, policyMetadata } = config;
+    const policyQuery = checkPolicy && policyMetadata
+        ? `&checkPolicy=true&policyMetadata=${encodeURIComponent(JSON.stringify(policyMetadata))}`
+        : "";
+    const url = `${apiUrl}/v1/keys/use?clientId=${clientId}&scope=${serviceScope}&includeUsage=true${policyQuery}`;
+    const response = await fetch(url, {
+        method: "GET",
+        headers: {
+            "x-service-api-key": serviceApiKey,
+            "content-type": "application/json",
+        },
+    });
+    let text = "";
+    try {
+        text = await response.text();
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`Error fetching key metadata from API: ${response.status} - ${text}`);
+    }
+}
+async function fetchAccountFromApi(jwt, config, useWalletAuth) {
+    const { apiUrl, serviceApiKey } = config;
+    const url = useWalletAuth
+        ? `${apiUrl}/v1/wallet/me?includeUsage=true`
+        : `${apiUrl}/v1/account/me?includeUsage=true`;
+    const response = await fetch(url, {
+        method: "GET",
+        headers: {
+            "x-service-api-key": serviceApiKey,
+            "content-type": "application/json",
+            authorization: `Bearer ${jwt}`,
+        },
+    });
+    let text = "";
+    try {
+        text = await response.text();
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`Error fetching account from API: ${response.status} - ${text}`);
+    }
+}
+async function updateRateLimitedAt(apiKeyId, config) {
+    const { apiUrl, serviceScope: scope, serviceApiKey } = config;
+    const url = `${apiUrl}/usage/rateLimit`;
+    await fetch(url, {
+        method: "PUT",
+        headers: {
+            "x-service-api-key": serviceApiKey,
+            "content-type": "application/json",
+        },
+        body: JSON.stringify({
+            apiKeyId,
+            scope,
+        }),
+    });
+}
+//# sourceMappingURL=api.js.map

package/dist/cjs/core/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/core/api.ts"],"names":[],"mappings":";;AAwFA,0DA8BC;AAED,kDA2BC;AAED,kDAmBC;AAhFM,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,MAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,GACxE,MAAM,CAAC;IACT,MAAM,WAAW,GACf,WAAW,IAAI,cAAc;QAC3B,CAAC,CAAC,oCAAoC,kBAAkB,CACpD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAC/B,EAAE;QACL,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,GAAG,GAAG,GAAG,MAAM,yBAAyB,QAAQ,UAAU,YAAY,qBAAqB,WAAW,EAAE,CAAC;IAC/G,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,mBAAmB,EAAE,aAAa;YAClC,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IAEH,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,GAAW,EACX,MAAyB,EACzB,aAAsB;IAEtB,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IACzC,MAAM,GAAG,GAAG,aAAa;QACvB,CAAC,CAAC,GAAG,MAAM,iCAAiC;QAC5C,CAAC,CAAC,GAAG,MAAM,kCAAkC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,mBAAmB,EAAE,aAAa;YAClC,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,GAAG,EAAE;SAC/B;KACF,CAAC,CAAC;IAEH,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,MAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAE9D,MAAM,GAAG,GAAG,GAAG,MAAM,kBAAkB,CAAC;IAExC,MAAM,KAAK,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,mBAAmB,EAAE,aAAa;YAClC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ;YACR,KAAK;SACN,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/core/authorize/client.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeClient = authorizeClient;
+exports.authorizeDomain = authorizeDomain;
+exports.authorizeBundleId = authorizeBundleId;
+function authorizeClient(authOptions, apiKeyMeta) {
+    const { origin, bundleId, secretKeyHash: providedSecretHash } = authOptions;
+    const { domains, bundleIds, secretHash } = apiKeyMeta;
+    const authResult = {
+        authorized: true,
+        apiKeyMeta,
+        accountMeta: {
+            id: apiKeyMeta.accountId,
+            // TODO update this later
+            name: "",
+            creatorWalletAddress: apiKeyMeta.creatorWalletAddress,
+            limits: apiKeyMeta.limits,
+            rateLimits: apiKeyMeta.rateLimits,
+            usage: apiKeyMeta.usage,
+        },
+    };
+    // check for public restrictions
+    if (domains.includes("*")) {
+        return authResult;
+    }
+    // check for secretHash
+    if (providedSecretHash) {
+        if (secretHash !== providedSecretHash) {
+            return {
+                authorized: false,
+                errorMessage: "Incorrect key provided. You can view your active API keys at https://thirdweb.com/dashboard/settings",
+                errorCode: "SECRET_INVALID",
+                status: 401,
+            };
+        }
+        return authResult;
+    }
+    // validate domains
+    if (origin) {
+        if (authorizeDomain({
+            domains,
+            origin,
+        })) {
+            return authResult;
+        }
+        return {
+            authorized: false,
+            errorMessage: `Invalid request: Unauthorized domain: ${origin}. You can view the restrictions on this API key at https://thirdweb.com/create-api-key`,
+            errorCode: "ORIGIN_UNAUTHORIZED",
+            status: 401,
+        };
+    }
+    // validate bundleId
+    if (bundleId) {
+        if (authorizeBundleId({
+            bundleIds,
+            bundleId,
+        })) {
+            return authResult;
+        }
+        return {
+            authorized: false,
+            errorMessage: `Invalid request: Unauthorized Bundle ID: ${bundleId}. You can view the restrictions on this API key at https://thirdweb.com/create-api-key`,
+            errorCode: "BUNDLE_UNAUTHORIZED",
+            status: 401,
+        };
+    }
+    return {
+        authorized: false,
+        errorMessage: "The keys are invalid. Please check the secret-key/clientId and try again.",
+        errorCode: "UNAUTHORIZED",
+        status: 401,
+    };
+}
+// Exposed for use in validating ecosystem partners settings
+function authorizeDomain({ domains, origin, }) {
+    // find matching domain, or if all domains allowed
+    // embedded-wallet.thirdweb(-dev).com is automatically allowed
+    // because the rpc is passed from user's domain to embedded-wallet.thirdweb.com iframe for use.
+    // Note this doesn't allow embedded-wallets from being used if it's disabled. The service check that runs after enforces that.
+    return !![
+        ...domains,
+        "embedded-wallet.thirdweb.com",
+        "embedded-wallet.thirdweb-dev.com",
+    ].find((d) => {
+        // if any domain is allowed, we'll return true
+        if (d === "*") {
+            return true;
+        }
+        // special rule for `localhost`
+        // if the domain is localhost, we'll allow any origin that starts with localhost
+        if (d === "localhost" && origin.startsWith("localhost")) {
+            return true;
+        }
+        // If the allowedDomain has a wildcard,
+        // we'll check that the ending of our domain matches the wildcard
+        if (d.startsWith("*.")) {
+            // get rid of the * and check if it ends with the `.<domain>.<tld>`
+            const domainRoot = d.slice(1);
+            return origin.endsWith(domainRoot);
+        }
+        // If there's no wildcard, we'll check for an exact match
+        return d === origin;
+    });
+}
+function authorizeBundleId({ bundleIds, bundleId, }) {
+    // find matching bundle id, or if all bundles allowed
+    return !!bundleIds.find((b) => {
+        if (b === "*") {
+            return true;
+        }
+        return b === bundleId;
+    });
+}
+//# sourceMappingURL=client.js.map

package/dist/cjs/core/authorize/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../../src/core/authorize/client.ts"],"names":[],"mappings":";;AASA,0CAsFC;AAGD,0CAmCC;AAED,8CAYC;AA1ID,SAAgB,eAAe,CAC7B,WAAuC,EACvC,UAA0B;IAE1B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,WAAW,CAAC;IAC5E,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;IAEtD,MAAM,UAAU,GAAwB;QACtC,UAAU,EAAE,IAAI;QAChB,UAAU;QACV,WAAW,EAAE;YACX,EAAE,EAAE,UAAU,CAAC,SAAS;YACxB,yBAAyB;YACzB,IAAI,EAAE,EAAE;YACR,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;YACrD,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB;KACF,CAAC;IAEF,gCAAgC;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,uBAAuB;IACvB,IAAI,kBAAkB,EAAE,CAAC;QACvB,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACtC,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,YAAY,EACV,sGAAsG;gBACxG,SAAS,EAAE,gBAAgB;gBAC3B,MAAM,EAAE,GAAG;aACZ,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,EAAE,CAAC;QACX,IACE,eAAe,CAAC;YACd,OAAO;YACP,MAAM;SACP,CAAC,EACF,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,yCAAyC,MAAM,wFAAwF;YACrJ,SAAS,EAAE,qBAAqB;YAChC,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,IAAI,QAAQ,EAAE,CAAC;QACb,IACE,iBAAiB,CAAC;YAChB,SAAS;YACT,QAAQ;SACT,CAAC,EACF,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,4CAA4C,QAAQ,wFAAwF;YAC1J,SAAS,EAAE,qBAAqB;YAChC,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,YAAY,EACV,2EAA2E;QAC7E,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,GAAG;KACZ,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,SAAgB,eAAe,CAAC,EAC9B,OAAO,EACP,MAAM,GACgC;IACtC,kDAAkD;IAClD,8DAA8D;IAC9D,+FAA+F;IAC/F,8HAA8H;IAC9H,OAAO,CAAC,CAAC;QACP,GAAG,OAAO;QACV,8BAA8B;QAC9B,kCAAkC;KACnC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACX,8CAA8C;QAC9C,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+BAA+B;QAC/B,gFAAgF;QAChF,IAAI,CAAC,KAAK,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uCAAuC;QACvC,iEAAiE;QACjE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,mEAAmE;YACnE,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,yDAAyD;QACzD,OAAO,CAAC,KAAK,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,iBAAiB,CAAC,EAChC,SAAS,EACT,QAAQ,GACkC;IAC1C,qDAAqD;IACrD,OAAO,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,KAAK,QAAQ,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/core/authorize/index.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorize = authorize;
+const api_js_1 = require("../api.js");
+const client_js_1 = require("./client.js");
+const service_js_1 = require("./service.js");
+async function authorize(authData, serviceConfig, cacheOptions) {
+    const { clientId, targetAddress, secretKeyHash, jwt, hashedJWT, useWalletAuth, } = authData;
+    const { enforceAuth } = serviceConfig;
+    // BACKWARDS COMPAT: if auth not enforced and we don't have auth credentials bypass
+    if (!enforceAuth && !clientId && !secretKeyHash) {
+        return {
+            authorized: true,
+            apiKeyMeta: null,
+            accountMeta: null,
+        };
+    }
+    // if we come in with a JWT then we only check the account is valid
+    if (jwt && hashedJWT) {
+        let accountMeta = null;
+        if (cacheOptions) {
+            try {
+                const cachedAccountInfo = await cacheOptions.get(hashedJWT);
+                if (cachedAccountInfo) {
+                    const parsed = JSON.parse(cachedAccountInfo);
+                    if ("updatedAt" in parsed) {
+                        // we want to compare the updatedAt time to the current time
+                        // if the difference is greater than the cacheTtl we want to ignore the cached data
+                        const now = Date.now();
+                        const diff = now - parsed.updatedAt;
+                        const cacheTtlMs = cacheOptions.cacheTtlSeconds * 1000;
+                        // only if the diff is less than the cacheTtl do we want to use the cached key
+                        if (diff < cacheTtlMs) {
+                            accountMeta = parsed.apiKeyMeta;
+                        }
+                    }
+                    else {
+                        accountMeta = parsed;
+                    }
+                }
+            }
+            catch {
+                // ignore errors, proceed as if not in cache
+            }
+        }
+        if (!accountMeta) {
+            try {
+                const { data, error } = await (0, api_js_1.fetchAccountFromApi)(jwt, serviceConfig, useWalletAuth?.toLowerCase() === "true");
+                if (error) {
+                    return {
+                        authorized: false,
+                        errorCode: error.code,
+                        errorMessage: error.message,
+                        status: error.statusCode,
+                    };
+                }
+                if (!data) {
+                    return {
+                        authorized: false,
+                        errorCode: "NO_ACCOUNT",
+                        errorMessage: "No error but also no account returned.",
+                        status: 500,
+                    };
+                }
+                accountMeta = data;
+                if (cacheOptions) {
+                    await cacheOptions.put(hashedJWT, accountMeta);
+                }
+            }
+            catch (err) {
+                console.warn("failed to fetch account from api", err);
+                return {
+                    authorized: false,
+                    status: 500,
+                    errorMessage: "Failed to get account information.",
+                    errorCode: "FAILED_TO_LOAD_ACCOUNT",
+                };
+            }
+        }
+        // if we still don't have an accountMeta at this point we can't authorize
+        if (!accountMeta) {
+            return {
+                authorized: false,
+                status: 401,
+                errorMessage: "Missing account information.",
+                errorCode: "MISSING_ACCOUNT",
+            };
+        }
+        // otherwise we want to return early with the accountMeta
+        return {
+            authorized: true,
+            apiKeyMeta: null,
+            accountMeta,
+        };
+    }
+    // if we don't have a client id at this point we can't authorize
+    if (!clientId) {
+        return {
+            authorized: false,
+            status: 401,
+            errorMessage: "Missing clientId or secretKey.",
+            errorCode: "MISSING_KEY",
+        };
+    }
+    let apiKeyMeta = null;
+    // if we have cache options we want to check the cache first
+    if (cacheOptions) {
+        try {
+            const cachedKey = await cacheOptions.get(clientId);
+            if (cachedKey) {
+                const parsed = JSON.parse(cachedKey);
+                if ("updatedAt" in parsed) {
+                    // we want to compare the updatedAt time to the current time
+                    // if the difference is greater than the cacheTtl we want to ignore the cached data
+                    const now = Date.now();
+                    const diff = now - parsed.updatedAt;
+                    const cacheTtlMs = cacheOptions.cacheTtlSeconds * 1000;
+                    // only if the diff is less than the cacheTtl do we want to use the cached key
+                    if (diff < cacheTtlMs) {
+                        apiKeyMeta = parsed.apiKeyMeta;
+                    }
+                }
+                else {
+                    apiKeyMeta = parsed;
+                }
+            }
+        }
+        catch {
+            // ignore errors, proceed as if not in cache
+        }
+    }
+    // if we don't have a cached key, fetch from the API
+    if (!apiKeyMeta) {
+        try {
+            const { data, error } = await (0, api_js_1.fetchKeyMetadataFromApi)(clientId, serviceConfig);
+            if (error) {
+                return {
+                    authorized: false,
+                    errorCode: error.code,
+                    errorMessage: error.message,
+                    status: error.statusCode,
+                };
+            }
+            if (!data) {
+                return {
+                    authorized: false,
+                    errorCode: "NO_KEY",
+                    errorMessage: "No error but also no key returned.",
+                    status: 500,
+                };
+            }
+            // if we have a key for sure then assign it
+            apiKeyMeta = data;
+            // cache the retrieved key if we have cache options
+            if (cacheOptions) {
+                // we await this always because it can be a promise or not
+                await cacheOptions.put(clientId, data);
+            }
+        }
+        catch (err) {
+            console.warn("failed to fetch key metadata from api", err);
+            return {
+                authorized: false,
+                status: 500,
+                errorMessage: "Failed to fetch key metadata. Please check your secret-key/clientId.",
+                errorCode: "FAILED_TO_FETCH_KEY",
+            };
+        }
+    }
+    if (!apiKeyMeta) {
+        return {
+            authorized: false,
+            status: 401,
+            errorMessage: "Key is invalid. Please check your secret-key/clientId.",
+            errorCode: "INVALID_KEY",
+        };
+    }
+    // now we can validate the key itself
+    const clientAuth = (0, client_js_1.authorizeClient)(authData, apiKeyMeta);
+    if (!clientAuth.authorized) {
+        return {
+            errorCode: clientAuth.errorCode,
+            authorized: false,
+            status: 401,
+            errorMessage: clientAuth.errorMessage,
+        };
+    }
+    // if we've made it this far we need to check service specific authorization
+    const serviceAuth = (0, service_js_1.authorizeService)(apiKeyMeta, serviceConfig, {
+        targetAddress,
+    });
+    if (!serviceAuth.authorized) {
+        return {
+            errorCode: serviceAuth.errorCode,
+            authorized: false,
+            status: 403,
+            errorMessage: serviceAuth.errorMessage,
+        };
+    }
+    // if we reach this point we are authorized!
+    return {
+        authorized: true,
+        apiKeyMeta,
+        accountMeta: {
+            id: apiKeyMeta.accountId,
+            // TODO update this later
+            name: "",
+            limits: apiKeyMeta.limits,
+            rateLimits: apiKeyMeta.rateLimits,
+            usage: apiKeyMeta.usage,
+            creatorWalletAddress: apiKeyMeta.creatorWalletAddress,
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/core/authorize/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/authorize/index.ts"],"names":[],"mappings":";;AA+CA,8BAuOC;AAtRD,sCAMmB;AACnB,2CAA8C;AAC9C,6CAAgD;AAuCzC,KAAK,UAAU,SAAS,CAC7B,QAA4B,EAC5B,aAAgC,EAChC,YAA2B;IAE3B,MAAM,EACJ,QAAQ,EACR,aAAa,EACb,aAAa,EACb,GAAG,EACH,SAAS,EACT,aAAa,GACd,GAAG,QAAQ,CAAC;IACb,MAAM,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC;IAEtC,mFAAmF;IACnF,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;QAChD,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IACD,mEAAmE;IACnE,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;QACrB,IAAI,WAAW,GAA2B,IAAI,CAAC;QAC/C,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC5D,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,iBAAiB,CACa,CAAC;oBACjC,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;wBAC1B,4DAA4D;wBAC5D,mFAAmF;wBACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;wBACvB,MAAM,IAAI,GAAG,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;wBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,eAAe,GAAG,IAAI,CAAC;wBACvD,8EAA8E;wBAC9E,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC;4BACtB,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;wBAClC,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,WAAW,GAAG,MAAM,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,4BAAmB,EAC/C,GAAG,EACH,aAAa,EACb,aAAa,EAAE,WAAW,EAAE,KAAK,MAAM,CACxC,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO;wBACL,UAAU,EAAE,KAAK;wBACjB,SAAS,EAAE,KAAK,CAAC,IAAI;wBACrB,YAAY,EAAE,KAAK,CAAC,OAAO;wBAC3B,MAAM,EAAE,KAAK,CAAC,UAAU;qBACzB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO;wBACL,UAAU,EAAE,KAAK;wBACjB,SAAS,EAAE,YAAY;wBACvB,YAAY,EAAE,wCAAwC;wBACtD,MAAM,EAAE,GAAG;qBACZ,CAAC;gBACJ,CAAC;gBACD,WAAW,GAAG,IAAI,CAAC;gBACnB,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;gBACtD,OAAO;oBACL,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,GAAG;oBACX,YAAY,EAAE,oCAAoC;oBAClD,SAAS,EAAE,wBAAwB;iBACpC,CAAC;YACJ,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,GAAG;gBACX,YAAY,EAAE,8BAA8B;gBAC5C,SAAS,EAAE,iBAAiB;aAC7B,CAAC;QACJ,CAAC;QACD,yDAAyD;QACzD,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,gCAAgC;YAC9C,SAAS,EAAE,aAAa;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,4DAA4D;IAC5D,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA+B,CAAC;gBACnE,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;oBAC1B,4DAA4D;oBAC5D,mFAAmF;oBACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACvB,MAAM,IAAI,GAAG,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;oBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,eAAe,GAAG,IAAI,CAAC;oBACvD,8EAA8E;oBAC9E,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC;wBACtB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;oBACjC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,MAAM,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,gCAAuB,EACnD,QAAQ,EACR,aAAa,CACd,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,UAAU,EAAE,KAAK;oBACjB,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,YAAY,EAAE,KAAK,CAAC,OAAO;oBAC3B,MAAM,EAAE,KAAK,CAAC,UAAU;iBACzB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;oBACL,UAAU,EAAE,KAAK;oBACjB,SAAS,EAAE,QAAQ;oBACnB,YAAY,EAAE,oCAAoC;oBAClD,MAAM,EAAE,GAAG;iBACZ,CAAC;YACJ,CAAC;YACD,2CAA2C;YAC3C,UAAU,GAAG,IAAI,CAAC;YAElB,mDAAmD;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,0DAA0D;gBAC1D,MAAM,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC3D,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,GAAG;gBACX,YAAY,EACV,sEAAsE;gBACxE,SAAS,EAAE,qBAAqB;aACjC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,wDAAwD;YACtE,SAAS,EAAE,aAAa;SACzB,CAAC;IACJ,CAAC;IACD,qCAAqC;IACrC,MAAM,UAAU,GAAG,IAAA,2BAAe,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEzD,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,OAAO;YACL,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,UAAU,CAAC,YAAY;SACtC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,MAAM,WAAW,GAAG,IAAA,6BAAgB,EAAC,UAAU,EAAE,aAAa,EAAE;QAC9D,aAAa;KACd,CAAC,CAAC;IAEH,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO;YACL,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,WAAW,CAAC,YAAY;SACvC,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,UAAU;QACV,WAAW,EAAE;YACX,EAAE,EAAE,UAAU,CAAC,SAAS;YACxB,yBAAyB;YACzB,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;SACtD;KACF,CAAC;AACJ,CAAC"}