@vantageos/cloud-identity 0.6.0 → 0.8.0

package/dist/crypto.js

@@ -29,4 +29,22 @@ export async function timingSafeEqual(a, b) {
     }
     return diff === 0;
 }
+/**
+ * SHA-256 of a UTF-8 string as a lower-case hex digest.
+ *
+ * Exported because a consumer that STORES a bearer row must produce the digest
+ * the same way the resolver will recompute it. Without this, each consumer
+ * hashes its own way and the mismatch surfaces as "correct token refused".
+ *
+ * @security Hash the token once, store the digest, discard the token. This
+ * function is one-way; it is not a substitute for a comparison — compare
+ * digests with `timingSafeEqual`, never with `===`.
+ */
+export async function sha256Hex(input) {
+    const data = new TextEncoder().encode(input);
+    const digest = await crypto.subtle.digest("SHA-256", data);
+    return Array.from(new Uint8Array(digest))
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
 //# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAa,EACb,CAAa;IAEb,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,WAAsC,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAgC,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAa,EACb,CAAa;IAEb,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,WAAsC,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAgC,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}

package/dist/human-path.d.ts

@@ -20,10 +20,10 @@
  */
 import { z } from "zod";
 export declare const humanAccountRoleSchema: z.ZodEnum<{
+    client: "client";
     owner: "owner";
     admin: "admin";
     member: "member";
-    client: "client";
 }>;
 export type HumanAccountRole = z.infer<typeof humanAccountRoleSchema>;
 /**

package/dist/index.d.ts

@@ -5,7 +5,7 @@
  * tenant resolution, membership requirement, row filtering and bearer
  * validation.
  */
-export { timingSafeEqual } from "./crypto.js";
+export { timingSafeEqual, sha256Hex } from "./crypto.js";
 export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, type ScopeFilterable, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 export type { OAuthCtx, ScopeProfile, NamespacePrefix, FromAllowListEntry, ValidateMasterBearerResult, } from "./types.js";
@@ -15,4 +15,16 @@ export { requireTenantId, resolveTenantIdOrAbsent } from "./org-guard.js";
 export type { TenantAbsence, TenantAbsenceReason, TenantResolution, SessionIdentity, TenantSource, DeploymentMode, } from "./org-guard.js";
 export { humanAccountRoleSchema, normalizeVerifiedHumanSession, requireHumanRole, resolveHumanRoleOrRefusal, } from "./human-path.js";
 export type { RequiredHumanRole, RoleRefusal, RoleRefusalReason, RoleResolution, HumanAccountRole, ClerkSessionLike, ResolvedHumanIdentity, } from "./human-path.js";
+export { validatePresentedBearer, requireAgentScopedIdentity, storedBearerRowSchema, } from "./presented-bearer.js";
+export type { StoredBearerRow, AgentPresence, ResolvedBearerIdentity, AgentScopedIdentity, ValidatePresentedBearerResult, RequireAgentScopedResult, PresentedBearerDeps, PresentedBearerInternalReason, } from "./presented-bearer.js";
+export { startAuthorize, resumeAuthorize, } from "./authorize-flow.js";
+export type { AuthorizeClient, ClerkOrgMembership, AuthorizationCodeRecord, AuthorizationCodeStore, ConsumeCodeResult, AuthorizeConfig, AuthorizeDeps, AuthorizeOutcome, OrgPickerModel, ResumeInput, } from "./authorize-flow.js";
+export { exchangeAuthorizationCode } from "./token-exchange.js";
+export type { AuthorizedTokenClaims, ExchangeInput, ExchangeDeps, ExchangeResult, } from "./token-exchange.js";
+export { verifyClerkSessionToken } from "./clerk-session.js";
+export type { ClerkJwk, ClerkJwks, ClerkSessionVerifierConfig, VerifiedClerkSession, VerifyClerkSessionResult, } from "./clerk-session.js";
+export { buildDiscoveryDocument, buildUserInfo } from "./oidc.js";
+export type { DiscoveryConfig, DiscoveryDocument, DiscoveryResult, ClerkUserLike, UserInfo, UserInfoResult, } from "./oidc.js";
+export { oauthErrorFor, pkceChallengeFromVerifier } from "./authorize-shared.js";
+export type { AuthorizeRefusal, AuthorizeRefusalReason, } from "./authorize-shared.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -5,7 +5,7 @@
  * tenant resolution, membership requirement, row filtering and bearer
  * validation.
  */
-export { timingSafeEqual } from "./crypto.js";
+export { timingSafeEqual, sha256Hex } from "./crypto.js";
 export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 // 0.2.0 — Domain-tenancy layer (additive)
@@ -14,4 +14,15 @@ export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantCont
 export { requireTenantId, resolveTenantIdOrAbsent } from "./org-guard.js";
 // 0.4.0 — Human-path resolver (Clerk-shaped session -> { tenant, subject, role })
 export { humanAccountRoleSchema, normalizeVerifiedHumanSession, requireHumanRole, resolveHumanRoleOrRefusal, } from "./human-path.js";
+// Presented-bearer resolution — the opaque-token trust boundary for a
+// NON-MASTER credential. The package's single answer to "who is calling"
+// for a presented bearer; consumers must not keep a local variant.
+export { validatePresentedBearer, requireAgentScopedIdentity, storedBearerRowSchema, } from "./presented-bearer.js";
+// 0.8.0 — Authorize a PERSON: Clerk session -> verified organisation -> a code
+// bound to both; the exchange that redeems it; the OIDC documents.
+export { startAuthorize, resumeAuthorize, } from "./authorize-flow.js";
+export { exchangeAuthorizationCode } from "./token-exchange.js";
+export { verifyClerkSessionToken } from "./clerk-session.js";
+export { buildDiscoveryDocument, buildUserInfo } from "./oidc.js";
+export { oauthErrorFor, pkceChallengeFromVerifier } from "./authorize-shared.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,76 @@
+import { type AuthorizeRefusal } from "./authorize-shared.js";
+import type { AuthorizedTokenClaims } from "./token-exchange.js";
+/** Inputs of the discovery document. Every endpoint is an absolute URL. */
+export interface DiscoveryConfig {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksUri: string;
+    userinfoEndpoint: string;
+    registrationEndpoint?: string;
+    scopesSupported?: readonly string[];
+}
+export interface DiscoveryDocument {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    userinfo_endpoint: string;
+    registration_endpoint?: string;
+    response_types_supported: string[];
+    response_modes_supported: string[];
+    grant_types_supported: string[];
+    subject_types_supported: string[];
+    scopes_supported: string[];
+    code_challenge_methods_supported: string[];
+    claims_supported: string[];
+}
+export type DiscoveryResult = {
+    ok: true;
+    document: DiscoveryDocument;
+} | {
+    ok: false;
+    refusal: AuthorizeRefusal;
+};
+/**
+ * Builds the discovery document (OAuth authorization-server metadata with the
+ * OIDC fields this package honours). It advertises only what is implemented:
+ * the code flow, PKCE, the `authorization_code` grant, UserInfo. It does NOT
+ * advertise id_tokens, refresh tokens or client-authentication methods; the
+ * consumer may add those keys to the returned object if it implements them. The issuer must be an https URL with no query or fragment (plain
+ * http only for loopback); every endpoint must be an absolute URL.
+ */
+export declare function buildDiscoveryDocument(config: DiscoveryConfig): DiscoveryResult;
+/** The subset of a Clerk user the UserInfo helper reads. */
+export interface ClerkUserLike {
+    id: string;
+    primaryEmailAddressId?: string | null;
+    emailAddresses: readonly {
+        id: string;
+        emailAddress: string;
+        verification?: {
+            status?: string | null;
+        } | null;
+    }[];
+}
+export interface UserInfo {
+    sub: string;
+    email?: string;
+    email_verified?: boolean;
+}
+export type UserInfoResult = {
+    ok: true;
+    userinfo: UserInfo;
+} | {
+    ok: false;
+    refusal: AuthorizeRefusal;
+};
+/**
+ * Builds the UserInfo response from the Clerk user and the claims of the
+ * presented token. The token must carry `openid`; the user must be the token's
+ * subject; `email` and `email_verified` appear only when the token also
+ * carries `email` AND the user has a primary address. `email_verified` is true
+ * only for a Clerk verification status of exactly `verified`.
+ */
+export declare function buildUserInfo(claims: Pick<AuthorizedTokenClaims, "sub" | "scope">, user: ClerkUserLike): UserInfoResult;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAgB7C;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAgC/E;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,cAAc,EAAE,SAAS;QACvB,EAAE,EAAE,MAAM,CAAC;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;KAClD,EAAE,CAAC;CACL;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,GAAG,OAAO,CAAC,EACpD,IAAI,EAAE,aAAa,GAClB,cAAc,CAmBhB"}

package/dist/oidc.js

@@ -0,0 +1,83 @@
+import { PKCE_METHOD, refusal, } from "./authorize-shared.js";
+function isAbsoluteUrl(value, requireHttps) {
+    try {
+        const u = new URL(value);
+        if (u.protocol === "https:")
+            return true;
+        return (!requireHttps &&
+            u.protocol === "http:" &&
+            (u.hostname === "localhost" || u.hostname === "127.0.0.1"));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Builds the discovery document (OAuth authorization-server metadata with the
+ * OIDC fields this package honours). It advertises only what is implemented:
+ * the code flow, PKCE, the `authorization_code` grant, UserInfo. It does NOT
+ * advertise id_tokens, refresh tokens or client-authentication methods; the
+ * consumer may add those keys to the returned object if it implements them. The issuer must be an https URL with no query or fragment (plain
+ * http only for loopback); every endpoint must be an absolute URL.
+ */
+export function buildDiscoveryDocument(config) {
+    const bad = { ok: false, refusal: refusal("issuer-invalid") };
+    if (!isAbsoluteUrl(config.issuer, true))
+        return bad;
+    const issuer = new URL(config.issuer);
+    if (issuer.search !== "" || issuer.hash !== "")
+        return bad;
+    const endpoints = [
+        config.authorizationEndpoint,
+        config.tokenEndpoint,
+        config.jwksUri,
+        config.userinfoEndpoint,
+        ...(config.registrationEndpoint ? [config.registrationEndpoint] : []),
+    ];
+    if (!endpoints.every((e) => isAbsoluteUrl(e, true)))
+        return bad;
+    const document = {
+        issuer: config.issuer,
+        authorization_endpoint: config.authorizationEndpoint,
+        token_endpoint: config.tokenEndpoint,
+        jwks_uri: config.jwksUri,
+        userinfo_endpoint: config.userinfoEndpoint,
+        response_types_supported: ["code"],
+        response_modes_supported: ["query"],
+        grant_types_supported: ["authorization_code"],
+        subject_types_supported: ["public"],
+        scopes_supported: [...(config.scopesSupported ?? ["openid", "email"])],
+        code_challenge_methods_supported: [PKCE_METHOD],
+        claims_supported: ["sub", "email", "email_verified"],
+    };
+    if (config.registrationEndpoint) {
+        document.registration_endpoint = config.registrationEndpoint;
+    }
+    return { ok: true, document };
+}
+/**
+ * Builds the UserInfo response from the Clerk user and the claims of the
+ * presented token. The token must carry `openid`; the user must be the token's
+ * subject; `email` and `email_verified` appear only when the token also
+ * carries `email` AND the user has a primary address. `email_verified` is true
+ * only for a Clerk verification status of exactly `verified`.
+ */
+export function buildUserInfo(claims, user) {
+    const scopes = claims.scope.split(/\s+/);
+    if (!scopes.includes("openid")) {
+        return { ok: false, refusal: refusal("openid-scope-required") };
+    }
+    if (user.id !== claims.sub) {
+        return { ok: false, refusal: refusal("subject-mismatch") };
+    }
+    const userinfo = { sub: user.id };
+    if (scopes.includes("email")) {
+        const primary = user.emailAddresses.find((a) => a.id === user.primaryEmailAddressId);
+        if (primary) {
+            userinfo.email = primary.emailAddress;
+            userinfo.email_verified = primary.verification?.status === "verified";
+        }
+    }
+    return { ok: true, userinfo };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,OAAO,GACR,MAAM,uBAAuB,CAAC;AAkC/B,SAAS,aAAa,CAAC,KAAa,EAAE,YAAqB;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,CACL,CAAC,YAAY;YACb,CAAC,CAAC,QAAQ,KAAK,OAAO;YACtB,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAC3D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAuB;IAC5D,MAAM,GAAG,GAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAC3D,MAAM,SAAS,GAAG;QAChB,MAAM,CAAC,qBAAqB;QAC5B,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,gBAAgB;QACvB,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IAEhE,MAAM,QAAQ,GAAsB;QAClC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,sBAAsB,EAAE,MAAM,CAAC,qBAAqB;QACpD,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,iBAAiB,EAAE,MAAM,CAAC,gBAAgB;QAC1C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;QACnC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;QAC7C,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,gCAAgC,EAAE,CAAC,WAAW,CAAC;QAC/C,gBAAgB,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC;KACrD,CAAC;IACF,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,QAAQ,CAAC,qBAAqB,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAuBD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAoD,EACpD,IAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,qBAAqB,CAC3C,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;YACtC,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,KAAK,UAAU,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/dist/presented-bearer.d.ts

@@ -0,0 +1,205 @@
+/**
+ * Presented-bearer resolution — the opaque-token trust boundary.
+ * (See package.json "version" for the release this shipped in.)
+ *
+ * Closes the gap between the two credential paths the package already had:
+ *
+ *   - `validateMasterBearer` covers the MASTER credential only (one configured
+ *     secret, no datastore, no identity beyond "it was the master").
+ *   - `decodeUnverifiedBearer` says in its own name that it verifies nothing;
+ *     its payload is attacker-controlled and is not a trust boundary.
+ *
+ * Between them there was no function taking a PRESENTED, NON-MASTER bearer,
+ * hashing it, looking the row up and returning a resolved identity or a typed
+ * refusal. Consumers therefore wrote that primitive locally — a second
+ * authority answering "who is calling", which is exactly what must not exist.
+ * This module is the single one.
+ *
+ * DIVISION OF LABOUR. The package cannot query a datastore, so the row lookup
+ * arrives as a caller-supplied callback. Everything that can be got wrong
+ * stays here: the header parse, the hashing, the constant-time digest compare,
+ * revocation, expiry, row-shape validation, and the SHAPE of the refusal. The
+ * caller supplies one indexed read and nothing else.
+ *
+ * Errors are coarse-grained on purpose — callers should not surface the exact
+ * reason to remote clients beyond a generic 401/403. The vocabulary is
+ * `validateMasterBearer`'s, unchanged: "missing", "malformed", "mismatch".
+ *
+ * @security The callback is invoked with the SHA-256 HEX DIGEST of the
+ * presented token, never the token. A consumer's datastore query, query log
+ * and slow-query log therefore never see a usable secret. The raw token does
+ * not appear in any returned value, any refusal, or any logging callback.
+ */
+import { z } from "zod";
+/**
+ * Shape of the row a consumer's datastore returns for a given digest.
+ *
+ * `agentId` ABSENT (undefined or null) means an ORGANIZATION-WIDE token: it
+ * carries a tenant but no agent identity. Such a row is valid and resolves
+ * successfully; what it may NOT do is stand in for an agent. See
+ * `requireAgentScopedIdentity`.
+ *
+ * `secretHash` is the digest as stored by the consumer. It is re-compared here
+ * against the digest computed from the presented token, in constant time, so a
+ * lookup that performs a loose match (prefix, LIKE, case-folded index) or that
+ * returns the wrong row cannot become an authentication.
+ */
+export declare const storedBearerRowSchema: z.ZodObject<{
+    tenantId: z.ZodString;
+    secretHash: z.ZodString;
+    agentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    revoked: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    scopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+}, z.core.$strip>;
+export type StoredBearerRow = z.infer<typeof storedBearerRowSchema>;
+/**
+ * The agent, present or explicitly absent. A DISCRIMINATED UNION rather than a
+ * nullable `agentId?: string`, because a nullable field is a duty to remember
+ * and this one was being forgotten: `identity.agent.agentId` does not type-check
+ * until the caller has narrowed on `present`.
+ */
+export type AgentPresence = {
+    present: true;
+    agentId: string;
+} | {
+    present: false;
+    code: "AGENT_ABSENT";
+    reason: "organization-wide-token";
+};
+/**
+ * A resolved, verified caller. Carries the tenant always, and the agent as a
+ * presence-or-absence. Carries NO secret and no digest.
+ */
+export type ResolvedBearerIdentity = {
+    tenantId: string;
+    agent: AgentPresence;
+    scopes: readonly string[];
+};
+/**
+ * Brand for `AgentScopedIdentity`. Declared and NOT exported, so the branded
+ * type cannot be constructed anywhere outside this module: a per-agent surface
+ * that types its parameter as `AgentScopedIdentity` can only be reached through
+ * `requireAgentScopedIdentity`. That is what makes the organization-wide-token
+ * refusal structural rather than a convention a caller may skip.
+ */
+declare const agentScopedBrand: unique symbol;
+/**
+ * A resolved caller that HAS an agent. `agentId` is a plain non-optional
+ * string, so per-agent code needs no narrowing and has nothing to forget.
+ */
+export type AgentScopedIdentity = {
+    readonly [agentScopedBrand]: true;
+    tenantId: string;
+    agentId: string;
+    scopes: readonly string[];
+};
+/**
+ * Result of `validatePresentedBearer`.
+ *
+ *   - `ok: true` → the row was found, its digest matched in constant time, it
+ *     is neither revoked nor expired, and its shape is valid.
+ *   - `error: "missing"` → no Authorization header.
+ *   - `error: "malformed"` → header present but not parseable as
+ *     `Bearer <non-empty-token>`.
+ *   - `error: "mismatch"` → the single, COLLAPSED refusal. An unknown digest,
+ *     a revoked row, an expired row, a row of invalid shape and a row whose
+ *     stored digest does not match all produce this value and nothing else, so
+ *     a prober cannot learn from the response whether a token was ever real.
+ *   - `error: "unavailable"` → the lookup callback itself threw or rejected.
+ *     Deliberately NOT in the collapsed bucket: a caller must be able to
+ *     answer 503 rather than 401 when its datastore is down, and an attacker
+ *     cannot induce this state for one chosen token rather than another, so it
+ *     discloses nothing about any token. It is a REFUSAL like the others — a
+ *     lookup failure never falls through to a grant.
+ */
+export type ValidatePresentedBearerResult = {
+    ok: true;
+    identity: ResolvedBearerIdentity;
+    error?: undefined;
+} | {
+    ok: false;
+    error: "missing" | "malformed" | "mismatch" | "unavailable";
+    identity?: undefined;
+};
+/**
+ * Result of `requireAgentScopedIdentity`. The refusal is distinguishable from
+ * `validatePresentedBearer`'s refusals on purpose: the credential here is
+ * known-good, and the caller owes the remote client a 403 (wrong surface for
+ * this token), not a 401 (bad token).
+ */
+export type RequireAgentScopedResult = {
+    ok: true;
+    identity: AgentScopedIdentity;
+    error?: undefined;
+} | {
+    ok: false;
+    error: "no-agent-on-token";
+    identity?: undefined;
+};
+/**
+ * Why a refusal happened, for the consumer's own observability. Reported
+ * through `deps.onRefusal`; NEVER present in a returned value, because a
+ * returned distinction is a returned disclosure.
+ *
+ * @security Carries no token, no digest and no row. Only a reason word.
+ */
+export type PresentedBearerInternalReason = "no-header" | "malformed-header" | "unknown-token" | "revoked-token" | "expired-token" | "row-shape-invalid" | "stored-digest-mismatch" | "lookup-failed";
+export type PresentedBearerDeps = {
+    /**
+     * Indexed read of one row by the SHA-256 HEX DIGEST of the presented token.
+     * Returns the row, or null/undefined when no row carries that digest.
+     *
+     * @security The argument is a digest, never the token. Do not log it, and do
+     * not widen this to accept a raw secret.
+     */
+    lookupBySecretHash: (sha256HexDigest: string) => Promise<StoredBearerRow | null | undefined>;
+    /** Injectable clock. Never `Date.now()` inline, so expiry is testable. */
+    now?: () => number;
+    /** Observability sink for the collapsed refusals. Must not throw; if it does, the throw is swallowed and the refusal stands. */
+    onRefusal?: (reason: PresentedBearerInternalReason) => void;
+};
+/**
+ * Resolve an `Authorization: Bearer <token>` header presented by a NON-MASTER
+ * caller into a verified identity, or into a typed refusal.
+ *
+ * Order of operations, and why:
+ *   1. Parse the header. A missing or malformed header is refused WITHOUT
+ *      calling the lookup, so a garbage request costs no datastore read.
+ *   2. Hash the token to a SHA-256 hex digest. The raw token goes no further.
+ *   3. Look the row up BY THAT DIGEST.
+ *   4. Re-compare the row's stored digest against the computed one with
+ *      `timingSafeEqual` — never `!==` on a secret or a digest.
+ *   5. Validate the row's shape, then revocation, then expiry.
+ *   6. Resolve the tenant, and the agent as a presence or an explicit absence.
+ *
+ * Steps 3–5 all refuse with the SAME frozen value. A right is never granted by
+ * absence or by failure: there is no branch that returns `ok: true` without
+ * having passed every check above.
+ *
+ * @example
+ * ```ts
+ * const result = await validatePresentedBearer(req.headers.get("authorization"), {
+ *   lookupBySecretHash: (digest) => db.tokens.byDigest(digest),
+ * });
+ * if (!result.ok) return respond(result.error === "unavailable" ? 503 : 401);
+ * const tenantId = result.identity.tenantId;
+ * ```
+ */
+export declare function validatePresentedBearer(authHeader: string | null | undefined, deps: PresentedBearerDeps): Promise<ValidatePresentedBearerResult>;
+/**
+ * Narrow a resolved identity to a PER-AGENT surface, refusing when the token
+ * carries no agent.
+ *
+ * An organization-wide token is a legitimate credential that is simply not an
+ * agent; treating it as one would silently widen it into whichever agent the
+ * surface happened to be about. So this is a second, mandatory call, and its
+ * output type is branded: a per-agent handler declares `AgentScopedIdentity`
+ * and the only way to obtain one is here.
+ *
+ * Grants nothing on its own — it can only ever narrow an identity
+ * `validatePresentedBearer` already resolved.
+ */
+export declare function requireAgentScopedIdentity(identity: ResolvedBearerIdentity): RequireAgentScopedResult;
+export {};
+//# sourceMappingURL=presented-bearer.d.ts.map

package/dist/presented-bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presented-bearer.d.ts","sourceRoot":"","sources":["../src/presented-bearer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAOhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAEhF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B,CAAC;AAEF;;;;;;GAMG;AACH,OAAO,CAAC,MAAM,gBAAgB,EAAE,OAAO,MAAM,CAAC;AAE9C;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B,CAAC;AAMF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,6BAA6B,GACrC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,GACjE;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;IAC5D,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB,CAAC;AAEN;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,GAC9D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAMpE;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACrC,WAAW,GACX,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,wBAAwB,GACxB,eAAe,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;;;OAMG;IACH,kBAAkB,EAAE,CAClB,eAAe,EAAE,MAAM,KACpB,OAAO,CAAC,eAAe,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACjD,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gIAAgI;IAChI,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,6BAA6B,KAAK,IAAI,CAAC;CAC7D,CAAC;AAyDF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,6BAA6B,CAAC,CAkFxC;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,sBAAsB,GAC/B,wBAAwB,CAY1B"}