@vantageos/cloud-identity 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -3,6 +3,57 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+**Additive — authorize a PERSON and bind an organisation (proposed 0.8.0).**
+A connector's `/authorize` that auto-approves with no user authentication, and
+derives the code's user from a client-registration profile, makes every client
+an anonymous app. This release is the flow that replaces it: Clerk session,
+verified organisation membership, a code bound to both, and an exchange that
+re-derives nothing from the client's profile.
+
+### Added
+
+- `startAuthorize` / `resumeAuthorize` (`src/authorize-flow.ts`): request
+  validation (exact `redirect_uri`, PKCE challenge required, allowed `resource`,
+  supported scopes); no Clerk session -> redirect to sign-in with an
+  HMAC-signed, short-lived state blob and no code; verified session -> one
+  organisation auto-picked, several -> an `OrgPickerModel`, a posted `orgId`
+  honoured only if it is in the user's own membership list; `requireConsent`
+  (default ON; opt out explicitly for first-party clients only). The code is single-use, short-lived and stored as a digest
+  through a consumer-supplied `AuthorizationCodeStore` whose `consume` must be
+  atomic.
+- `exchangeAuthorizationCode` (`src/token-exchange.ts`): consumes the code
+  first, then checks expiry, client, `redirect_uri`, `resource` and the PKCE
+  verifier; returns `{ sub, org_id, org_slug, org_role, aud, client_id, scope }`.
+- `verifyClerkSessionToken` (`src/clerk-session.ts`): RS256 against a
+  consumer-supplied key set; issuer, expiry, `nbf`, optional audience and
+  authorized parties.
+- `buildDiscoveryDocument`, `buildUserInfo` (`src/oidc.ts`). The document
+  advertises only what is implemented (no id_token alg, no refresh grant, no
+  client-auth methods).
+- `AuthorizeRefusal` / `AuthorizeRefusalReason` (`{ code: "AUTHORIZE_REFUSED",
+  reason }`), `oauthErrorFor`, `pkceChallengeFromVerifier`, and the types listed
+  in the README section "Authorize a person and bind an organisation".
+- Subpath exports `/authorize`, `/token-exchange`, `/clerk-session`, `/oidc`.
+
+### Security
+
+- Consent is bound to a server-issued `consentToken` (HMAC over state, user and
+  organisation set). `approved: true` without a token valid for that state and
+  that session's user is refused with `consent-required`; a client can no
+  longer mint its own state and approve on a victim's behalf.
+
+### Changed
+
+- README: the "does not verify a signed JWT" limit now names the one exception.
+- `package.json` version set to 0.8.0 (proposed; not published).
+
+### Unchanged
+
+- Every existing export keeps its behaviour and signature; no existing test
+  was edited. No new runtime dependency (Web Crypto only).
+
 ## [0.7.0]
 
 **Additive — resolution of a PRESENTED, non-master bearer.** The published

package/README.md

@@ -275,6 +275,101 @@ want to catch by type, and `BearerPayload`, the type returned by
   // -> { tenant: "org_abc", subject: "user_123", role: "admin" }
   ```
 
+## Authorize a person and bind an organisation
+
+A connector that signs in a PERSON (a Claude or ChatGPT user) must end up with
+a token naming that person and one organisation they belong to, never an
+anonymous app. Clerk is the identity provider; this package holds the
+decisions and takes every collaborator as a parameter.
+
+```ts
+// GET /authorize
+const out = await startAuthorize(query, clerkSessionToken, cfg, deps);
+// GET /authorize/callback (the return from Clerk) and the picker's POST
+const out2 = await resumeAuthorize({ state, sessionToken, orgId, approved, consentToken }, cfg, deps);
+// POST /token (authorization_code grant)
+const res = await exchangeAuthorizationCode(
+  { code, codeVerifier, redirectUri, clientId, resource },
+  { codeStore },
+);
+```
+
+- `startAuthorize(params, sessionToken, config, deps)` validates the request
+  (registered client, exact `redirect_uri`, a PKCE challenge using the SHA-256
+  method, an allowed RFC 8707 `resource`, supported scopes). With no valid Clerk
+  session it returns `{ kind: "redirect-to-sign-in", url }` and issues nothing;
+  the return URL carries a state blob signed with HMAC (`AuthorizeConfig.stateSecret`,
+  at least 32 characters) and valid for 600 seconds by default.
+- `resumeAuthorize(input, config, deps)` rebuilds the request ONLY from that
+  signed state (a tampered or expired blob is refused), verifies the Clerk
+  session token (`verifyClerkSessionToken`: RS256 against the key set the
+  consumer supplies, issuer, expiry, optional audience and authorized parties),
+  lists the user's organisations through `deps.listMemberships`, and answers
+  with an `AuthorizeOutcome`:
+  `redirect-to-sign-in`, `org-picker` (an `OrgPickerModel` the consumer renders;
+  it lists only the user's own organisations), `redirect-to-client` (the URL
+  carrying the code and the client's `state`) or `refused`.
+  A posted `orgId` is honoured only if the verified user's own membership list
+  contains it.
+  Consent is ON by default (`requireConsent` defaults to true). What it
+  protects: a code is issued only after the person was SHOWN the picker and
+  approved it. The picker's `OrgPickerModel` carries a `consentToken`:
+  `HMAC(stateSecret, "consent-v1" NUL state NUL clerkUserId NUL sorted
+  organisation ids)`. It is bound to the exact signed state (useless for any
+  other request), to the verified user (useless under another session) and to
+  the organisation set that user was shown. `resumeAuthorize` with
+  `approved: true` refuses with `consent-required` unless the presented
+  `consentToken` verifies, compared in constant time, for that state AND the
+  session's user. Without this, a client could mint its own state (the sign-in
+  redirect hands it one), replay it with a victim's session and
+  `approved: true`, and receive a code the victim never saw a screen for.
+  The consumer renders `consentToken` as a hidden field of the picker's POST
+  form and posts it back as `consentToken`. The token IS the CSRF protection
+  for that POST, because a cross-site form cannot know it; do not add a weaker
+  substitute and do not accept the POST without it. Also set
+  `session.authorizedParties` to your own origin(s) so a Clerk session token
+  minted for another application (`azp`) is not accepted here.
+  Set `requireConsent: false` explicitly ONLY for first-party clients whose
+  redirect URIs you control; exactly one organisation is then auto-picked and
+  no token is involved.
+- The code is bound to `{ clerkUserId, orgId, orgSlug, orgRole, clientId,
+  redirectUri, codeChallenge, resource }`, stored as a digest through the
+  consumer's `AuthorizationCodeStore` (`put`, and an ATOMIC `consume`), single
+  use, 60 seconds by default. Records are `AuthorizationCodeRecord`; a consume
+  answers `ConsumeCodeResult`. `AuthorizeClient`, `ClerkOrgMembership`,
+  `AuthorizeDeps`, `ResumeInput` and `ClerkJwk` / `ClerkJwks` /
+  `VerifiedClerkSession` / `VerifyClerkSessionResult` /
+  `ClerkSessionVerifierConfig` are the shapes the consumer supplies or reads.
+- `exchangeAuthorizationCode(input, deps)` consumes the code FIRST (every
+  attempt burns it), then checks expiry, client, `redirect_uri`, resource and
+  the PKCE verifier (`pkceChallengeFromVerifier` derives a challenge). It
+  returns `AuthorizedTokenClaims`:
+  `{ sub, org_id, org_slug, org_role, aud, client_id, scope }` (`ExchangeInput`,
+  `ExchangeDeps`, `ExchangeResult`). No field comes from a client-registration
+  profile.
+- `buildDiscoveryDocument(config)` builds the discovery document
+  (`DiscoveryConfig`, `DiscoveryDocument`, `DiscoveryResult`); the issuer must
+  be https with no query. It advertises only what is implemented: the code
+  flow, PKCE, the `authorization_code` grant and UserInfo. It omits
+  `id_token_signing_alg_values_supported` (OIDC Discovery lists it as required
+  for a provider that issues id_tokens; this package issues none, so that is a
+  documented deviation), refresh tokens and client-authentication methods. A
+  consumer that implements any of them adds those keys itself. `buildUserInfo(claims, user)` returns `sub`, and
+  `email` / `email_verified` when the token carries `email`
+  (`ClerkUserLike`, `UserInfo`, `UserInfoResult`).
+- Every refusal is `{ code: "AUTHORIZE_REFUSED", reason }`
+  (`AuthorizeRefusal`, `AuthorizeRefusalReason`), the same shape as
+  `RoleRefusal`. `oauthErrorFor(refusal)` maps it to an OAuth error code and an
+  HTTP status (503 for a collaborator that failed, so an outage is not reported
+  as a bad credential). A collaborator that throws is always a refusal.
+
+Also exported as subpaths: `/authorize`, `/token-exchange`, `/clerk-session`,
+`/oidc`.
+
+Limits, stated: `redirect_uri` matching is exact (no loopback port variation);
+the package signs no access token and no id token and issues no refresh token (the consumer mints the token
+from the claims); it fetches no key set and calls no Clerk API itself.
+
 ## What this package does not do
 
 Worth reading before you rely on it.
@@ -296,10 +391,11 @@ Worth reading before you rely on it.
   a token, writing its row, marking it revoked and expiring it are yours; the
   package only insists that a row it is handed be believed in constant time,
   and refused identically however it fails.
-- **It does not verify a signed JWT.** The presented-bearer path is for an
-  OPAQUE token — one whose only meaning is the row it matches. If your
-  credential carries its own signed claims, verify that signature with a JWT
-  library first; this package exports no verifier.
+- **It does not verify an arbitrary signed JWT.** The presented-bearer path is
+  for an OPAQUE token — one whose only meaning is the row it matches. The one
+  signed token it verifies is a Clerk session token (`verifyClerkSessionToken`,
+  RS256 only). For any other signed credential, verify the signature with a
+  JWT library first.
 
 ## Upgrading to 0.4.0
 

package/dist/authorize-flow.d.ts

@@ -0,0 +1,169 @@
+import { type AuthorizeRefusal } from "./authorize-shared.js";
+import { type ClerkSessionVerifierConfig } from "./clerk-session.js";
+/**
+ * The authorize flow for a PERSON: a Clerk session, a verified organisation
+ * membership, and an authorization code bound to both. Framework-agnostic:
+ * every function takes plain values and returns a plain outcome; the consumer
+ * owns HTTP, rendering and storage.
+ *
+ * The code is bound to `{ clerkUserId, orgId, orgSlug, orgRole, clientId,
+ * redirectUri, codeChallenge, resource }`. Nothing is read from a
+ * client-registration profile: a client's own fields only decide whether the
+ * request is acceptable, never what the person may reach.
+ */
+/** A registered OAuth client, as the consumer's own registry knows it. */
+export interface AuthorizeClient {
+    clientId: string;
+    /** Exact-match list; no prefix, wildcard or partial match is ever applied. */
+    redirectUris: readonly string[];
+    clientName?: string;
+    revoked?: boolean;
+}
+/** One organisation membership, in the shape Clerk's Backend API returns. */
+export interface ClerkOrgMembership {
+    role: string;
+    organization: {
+        id: string;
+        slug: string | null;
+        name: string;
+    };
+}
+/** A stored authorization code. Only the digest of the code is stored. */
+export interface AuthorizationCodeRecord {
+    codeHash: string;
+    clerkUserId: string;
+    orgId: string;
+    orgSlug: string | null;
+    orgRole: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    resource: string;
+    scope: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+}
+export type ConsumeCodeResult = {
+    status: "ok";
+    record: AuthorizationCodeRecord;
+} | {
+    status: "unknown";
+} | {
+    status: "already-used";
+};
+/**
+ * Where codes live. `consume` MUST be atomic: of two concurrent calls for the
+ * same digest exactly one gets `ok`. A read-then-write is not an
+ * implementation of this interface.
+ */
+export interface AuthorizationCodeStore {
+    put(record: AuthorizationCodeRecord): Promise<void>;
+    consume(codeHash: string): Promise<ConsumeCodeResult>;
+}
+export interface AuthorizeConfig {
+    /** HMAC secret for the state blob; at least 32 characters. Never sent to a client. */
+    stateSecret: string;
+    /** Clerk sign-in page. The return URL travels in `redirect_url`. */
+    signInUrl: string;
+    /** The consumer's endpoint that calls `resumeAuthorize`. */
+    callbackUrl: string;
+    /** Resource identifiers (RFC 8707) this server issues codes for. Exact match. */
+    allowedResources: readonly string[];
+    /** When set, every requested scope must be listed. */
+    supportedScopes?: readonly string[];
+    /** Scope granted when the request names none. Default `"openid"`. */
+    defaultScope?: string;
+    /** Verification of the Clerk session token. */
+    session: ClerkSessionVerifierConfig;
+    /** Seconds the signed state stays valid. Default 600. */
+    stateTtlSeconds?: number;
+    /** Seconds an authorization code stays valid. Default 60. */
+    codeTtlSeconds?: number;
+    /**
+     * The person must explicitly approve (the outcome is a consent model, not a
+     * code, until `approved: true` is posted back). DEFAULT TRUE: without it, any
+     * dynamically registered client could obtain a code for a signed-in victim
+     * who merely follows a link. Set `false` explicitly only for first-party
+     * clients whose redirect URIs you control; a single organisation is then
+     * auto-picked.
+     */
+    requireConsent?: boolean;
+}
+export interface AuthorizeDeps {
+    lookupClient(clientId: string): Promise<AuthorizeClient | null>;
+    /** Clerk Backend API: the user's organisation memberships. */
+    listMemberships(clerkUserId: string): Promise<readonly ClerkOrgMembership[]>;
+    codeStore: AuthorizationCodeStore;
+    /** Epoch milliseconds. */
+    now?: () => number;
+    /** Opaque code generator; default 32 random bytes, base64url. */
+    generateCode?: () => string;
+}
+export interface OrgPickerModel {
+    /** Signed state; post it back, untouched, to `resumeAuthorize`. */
+    state: string;
+    client: {
+        clientId: string;
+        clientName: string | null;
+    };
+    resource: string;
+    scope: string;
+    /** Only organisations the verified user is a member of. */
+    organizations: readonly {
+        id: string;
+        slug: string | null;
+        name: string;
+        role: string;
+    }[];
+    /** True when the person must tick approval even with one organisation. */
+    consentRequired: boolean;
+    /**
+     * Proof that THIS picker was shown to THIS verified user for THIS state.
+     * Render it as a hidden field and post it back as `consentToken`. Absent
+     * when consent is not required.
+     */
+    consentToken: string | null;
+}
+export type AuthorizeOutcome = {
+    kind: "redirect-to-sign-in";
+    url: string;
+} | {
+    kind: "org-picker";
+    model: OrgPickerModel;
+} | {
+    kind: "redirect-to-client";
+    url: string;
+} | {
+    kind: "refused";
+    refusal: AuthorizeRefusal;
+};
+export interface ResumeInput {
+    /** The `authorize_state` query parameter on the return URL (or the picker's posted state). */
+    state: string;
+    /** The Clerk session token presented on return. */
+    sessionToken: string | undefined;
+    /** The organisation the person chose in the picker. */
+    orgId?: string;
+    /** The person's explicit approval, when `requireConsent` is on. */
+    approved?: boolean;
+    /** The `consentToken` of the picker the person was shown. Required with `approved: true` when consent is on. */
+    consentToken?: string;
+}
+/**
+ * Handles `GET /authorize`. Validates the request against the registered
+ * client, then:
+ *   - no Clerk session (absent, expired or forged) -> `redirect-to-sign-in`,
+ *     carrying a signed, short-lived state blob and issuing NO code;
+ *   - a verified session -> continues exactly as `resumeAuthorize` does.
+ * A Clerk key set that cannot be reached is a refusal (`jwks-unavailable`),
+ * never a redirect and never a grant.
+ */
+export declare function startAuthorize(params: Readonly<Record<string, string | undefined>>, sessionToken: string | undefined, cfg: AuthorizeConfig, deps: AuthorizeDeps): Promise<AuthorizeOutcome>;
+/**
+ * Handles the return from Clerk (and the picker's form post). The request is
+ * rebuilt ONLY from the signed state: no query parameter other than the blob
+ * itself is read. A tampered or expired blob is refused; the client is looked
+ * up again so a client revoked mid-flow gets no code.
+ */
+export declare function resumeAuthorize(input: ResumeInput, cfg: AuthorizeConfig, deps: AuthorizeDeps): Promise<AuthorizeOutcome>;
+//# sourceMappingURL=authorize-flow.d.ts.map

package/dist/authorize-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-flow.d.ts","sourceRoot":"","sources":["../src/authorize-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAUtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;GAUG;AAMH,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sDAAsD;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,OAAO,EAAE,0BAA0B,CAAC;IACpC,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAChE,8DAA8D;IAC9D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IAC7E,SAAS,EAAE,sBAAsB,CAAC;IAClC,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,aAAa,EAAE,SAAS;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,EAAE,CAAC;IACJ,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gHAAgH;IAChH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAmPD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACpD,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAqD3B"}

package/dist/authorize-flow.js

@@ -0,0 +1,262 @@
+import { MIN_SECRET_LENGTH, PKCE_METHOD, isWellFormedChallenge, refusal, signBlob, signMac, utf8, toBase64Url, verifyBlob, } from "./authorize-shared.js";
+import { sha256Hex, timingSafeEqual } from "./crypto.js";
+import { verifyClerkSessionToken, } from "./clerk-session.js";
+const STATE_PARAM = "authorize_state";
+const refused = (reason) => ({
+    kind: "refused",
+    refusal: refusal(reason),
+});
+function nowOf(deps) {
+    return (deps.now ?? Date.now)();
+}
+function configOk(cfg) {
+    return (typeof cfg.stateSecret === "string" &&
+        cfg.stateSecret.length >= MIN_SECRET_LENGTH &&
+        cfg.allowedResources.length > 0);
+}
+function validateRequest(params, client, cfg) {
+    if (client.revoked === true)
+        return { ok: false, reason: "unknown-client" };
+    const redirectUri = params.redirect_uri;
+    if (!redirectUri || !client.redirectUris.includes(redirectUri)) {
+        return { ok: false, reason: "redirect-uri-mismatch" };
+    }
+    if (params.response_type !== undefined && params.response_type !== "code") {
+        return { ok: false, reason: "unsupported-response-type" };
+    }
+    const challenge = params.code_challenge;
+    const method = params.code_challenge_method ?? PKCE_METHOD;
+    if (!challenge || method !== PKCE_METHOD || !isWellFormedChallenge(challenge)) {
+        return { ok: false, reason: "pkce-required" };
+    }
+    const resource = params.resource;
+    if (!resource || !cfg.allowedResources.includes(resource)) {
+        return { ok: false, reason: "resource-not-allowed" };
+    }
+    const scope = (params.scope ?? "").trim() || (cfg.defaultScope ?? "openid");
+    if (cfg.supportedScopes) {
+        const supported = cfg.supportedScopes;
+        if (!scope.split(/\s+/).every((s) => supported.includes(s))) {
+            return { ok: false, reason: "scope-not-supported" };
+        }
+    }
+    return {
+        ok: true,
+        req: {
+            clientId: client.clientId,
+            redirectUri,
+            state: params.state ?? null,
+            codeChallenge: challenge,
+            resource,
+            scope,
+        },
+    };
+}
+async function signState(req, cfg, deps) {
+    const payload = {
+        v: 1,
+        cid: req.clientId,
+        ru: req.redirectUri,
+        st: req.state,
+        cc: req.codeChallenge,
+        rs: req.resource,
+        sc: req.scope,
+        exp: nowOf(deps) + (cfg.stateTtlSeconds ?? 600) * 1000,
+    };
+    return signBlob(payload, cfg.stateSecret);
+}
+function signInRedirect(cfg, stateBlob) {
+    const back = new URL(cfg.callbackUrl);
+    back.searchParams.set(STATE_PARAM, stateBlob);
+    const url = new URL(cfg.signInUrl);
+    url.searchParams.set("redirect_url", back.toString());
+    return { kind: "redirect-to-sign-in", url: url.toString() };
+}
+async function lookupClientSafe(deps, clientId) {
+    try {
+        return { ok: true, client: await deps.lookupClient(clientId) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+async function bindAndIssue(req, stateBlob, session, clientName, choice, cfg, deps) {
+    let memberships;
+    try {
+        memberships = await deps.listMemberships(session.userId);
+    }
+    catch {
+        return refused("membership-lookup-unavailable");
+    }
+    if (memberships.length === 0)
+        return refused("no-organization");
+    let picked;
+    if (choice.orgId !== undefined) {
+        // The chosen id is a CLAIM from the browser: it is honoured only if the
+        // verified user's own membership list contains it.
+        picked = memberships.find((m) => m.organization.id === choice.orgId);
+        if (!picked)
+            return refused("org-not-a-member");
+    }
+    else if (memberships.length === 1) {
+        picked = memberships[0];
+    }
+    const consentRequired = cfg.requireConsent !== false;
+    // The token binds the picker to the verified user, the signed state and the
+    // set of organisations that user belongs to (the set is what was shown).
+    const expectedToken = consentRequired
+        ? await consentTokenFor(cfg.stateSecret, stateBlob, session.userId, memberships.map((m) => m.organization.id))
+        : null;
+    if (consentRequired && picked && choice.approved === true) {
+        // `approved: true` is a CLAIM in a POST body. An attacker client can mint
+        // its own state and replay it with a victim's session; only a token the
+        // server issued to this user for this state proves the picker was shown.
+        const presented = choice.consentToken;
+        const ok = typeof presented === "string" &&
+            expectedToken !== null &&
+            (await timingSafeEqual(utf8(presented), utf8(expectedToken)));
+        if (!ok)
+            return refused("consent-required");
+    }
+    if (!picked || (consentRequired && choice.approved !== true)) {
+        return {
+            kind: "org-picker",
+            model: {
+                state: stateBlob,
+                client: { clientId: req.clientId, clientName },
+                resource: req.resource,
+                scope: req.scope,
+                organizations: memberships.map((m) => ({
+                    id: m.organization.id,
+                    slug: m.organization.slug,
+                    name: m.organization.name,
+                    role: m.role,
+                })),
+                consentRequired,
+                consentToken: expectedToken,
+            },
+        };
+    }
+    const code = (deps.generateCode ?? randomCode)();
+    const record = {
+        codeHash: await sha256Hex(code),
+        clerkUserId: session.userId,
+        orgId: picked.organization.id,
+        orgSlug: picked.organization.slug,
+        orgRole: picked.role,
+        clientId: req.clientId,
+        redirectUri: req.redirectUri,
+        codeChallenge: req.codeChallenge,
+        resource: req.resource,
+        scope: req.scope,
+        expiresAt: nowOf(deps) + (cfg.codeTtlSeconds ?? 60) * 1000,
+    };
+    try {
+        await deps.codeStore.put(record);
+    }
+    catch {
+        return refused("code-store-unavailable");
+    }
+    const back = new URL(req.redirectUri);
+    back.searchParams.set("code", code);
+    if (req.state !== null)
+        back.searchParams.set("state", req.state);
+    return { kind: "redirect-to-client", url: back.toString() };
+}
+/**
+ * `HMAC(stateSecret, "consent-v1\0" + state + "\0" + clerkUserId + "\0" +
+ * sorted organisation ids joined by ",")`. Bound to the exact state blob (so a
+ * token for one request is useless for another), to the verified user (so it
+ * cannot be replayed under another session) and to the organisation set shown
+ * (the chosen org is separately required to be in the live membership list).
+ */
+async function consentTokenFor(secret, state, userId, orgIds) {
+    const set = [...orgIds].sort().join(",");
+    return signMac(`consent-v1\0${state}\0${userId}\0${set}`, secret);
+}
+function randomCode() {
+    return toBase64Url(crypto.getRandomValues(new Uint8Array(32)));
+}
+// ---------------------------------------------------------------------------
+// Public functions
+// ---------------------------------------------------------------------------
+/**
+ * Handles `GET /authorize`. Validates the request against the registered
+ * client, then:
+ *   - no Clerk session (absent, expired or forged) -> `redirect-to-sign-in`,
+ *     carrying a signed, short-lived state blob and issuing NO code;
+ *   - a verified session -> continues exactly as `resumeAuthorize` does.
+ * A Clerk key set that cannot be reached is a refusal (`jwks-unavailable`),
+ * never a redirect and never a grant.
+ */
+export async function startAuthorize(params, sessionToken, cfg, deps) {
+    if (!configOk(cfg))
+        return refused("server-misconfigured");
+    const clientId = params.client_id;
+    if (!clientId)
+        return refused("invalid-request");
+    const found = await lookupClientSafe(deps, clientId);
+    if (!found.ok)
+        return refused("client-lookup-unavailable");
+    if (!found.client)
+        return refused("unknown-client");
+    const v = validateRequest(params, found.client, cfg);
+    if (!v.ok)
+        return refused(v.reason);
+    const stateBlob = await signState(v.req, cfg, deps);
+    if (!sessionToken)
+        return signInRedirect(cfg, stateBlob);
+    const verified = await verifyClerkSessionToken(sessionToken, cfg.session, nowOf(deps));
+    if (!verified.ok) {
+        return verified.refusal.reason === "jwks-unavailable"
+            ? { kind: "refused", refusal: verified.refusal }
+            : signInRedirect(cfg, stateBlob);
+    }
+    return bindAndIssue(v.req, stateBlob, verified.session, found.client.clientName ?? null, {}, cfg, deps);
+}
+/**
+ * Handles the return from Clerk (and the picker's form post). The request is
+ * rebuilt ONLY from the signed state: no query parameter other than the blob
+ * itself is read. A tampered or expired blob is refused; the client is looked
+ * up again so a client revoked mid-flow gets no code.
+ */
+export async function resumeAuthorize(input, cfg, deps) {
+    if (!configOk(cfg))
+        return refused("server-misconfigured");
+    const raw = typeof input.state === "string" ? await verifyBlob(input.state, cfg.stateSecret) : null;
+    const p = raw;
+    if (!p ||
+        p.v !== 1 ||
+        typeof p.cid !== "string" ||
+        typeof p.ru !== "string" ||
+        typeof p.cc !== "string" ||
+        typeof p.rs !== "string" ||
+        typeof p.sc !== "string" ||
+        typeof p.exp !== "number" ||
+        (p.st !== null && typeof p.st !== "string")) {
+        return refused("state-invalid");
+    }
+    if (p.exp <= nowOf(deps))
+        return refused("state-expired");
+    const found = await lookupClientSafe(deps, p.cid);
+    if (!found.ok)
+        return refused("client-lookup-unavailable");
+    if (!found.client)
+        return refused("unknown-client");
+    const v = validateRequest({
+        redirect_uri: p.ru,
+        code_challenge: p.cc,
+        resource: p.rs,
+        scope: p.sc,
+        ...(p.st !== null && p.st !== undefined ? { state: p.st } : {}),
+    }, found.client, cfg);
+    if (!v.ok)
+        return refused(v.reason);
+    if (!input.sessionToken)
+        return refused("session-required");
+    const verified = await verifyClerkSessionToken(input.sessionToken, cfg.session, nowOf(deps));
+    if (!verified.ok)
+        return { kind: "refused", refusal: verified.refusal };
+    return bindAndIssue(v.req, input.state, verified.session, found.client.clientName ?? null, { orgId: input.orgId, approved: input.approved, consentToken: input.consentToken }, cfg, deps);
+}
+//# sourceMappingURL=authorize-flow.js.map

package/dist/authorize-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-flow.js","sourceRoot":"","sources":["../src/authorize-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,EACjB,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,QAAQ,EACR,OAAO,EACP,IAAI,EACJ,WAAW,EACX,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAGL,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AA+K5B,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,MAAM,OAAO,GAAG,CAAC,MAAqC,EAAoB,EAAE,CAAC,CAAC;IAC5E,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,IAAmB;IAChC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,CACL,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,iBAAiB;QAC3C,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,MAAoD,EACpD,MAAuB,EACvB,GAAoB;IAEpB,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,IAAI,WAAW,CAAC;IAC3D,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,WAAW,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE;YACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW;YACX,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;YAC3B,aAAa,EAAE,SAAS;YACxB,QAAQ;YACR,KAAK;SACN;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAqB,EACrB,GAAoB,EACpB,IAAmB;IAEnB,MAAM,OAAO,GAAiB;QAC5B,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,EAAE,EAAE,GAAG,CAAC,WAAW;QACnB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,EAAE,EAAE,GAAG,CAAC,aAAa;QACrB,EAAE,EAAE,GAAG,CAAC,QAAQ;QAChB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,IAAI;KACvD,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,SAAiB;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAmB,EACnB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAqB,EACrB,SAAiB,EACjB,OAA6B,EAC7B,UAAyB,EACzB,MAAqE,EACrE,GAAoB,EACpB,IAAmB;IAEnB,IAAI,WAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEhE,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC;IACrD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,aAAa,GAAG,eAAe;QACnC,CAAC,CAAC,MAAM,eAAe,CACnB,GAAG,CAAC,WAAW,EACf,SAAS,EACT,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAC1C;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,eAAe,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;QACtC,MAAM,EAAE,GACN,OAAO,SAAS,KAAK,QAAQ;YAC7B,aAAa,KAAK,IAAI;YACtB,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE;gBACL,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE;gBAC9C,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE;oBACrB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;oBACzB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;oBACzB,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;gBACH,eAAe;gBACf,YAAY,EAAE,aAAa;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC;IACjD,MAAM,MAAM,GAA4B;QACtC,QAAQ,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC;QAC/B,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;QAC7B,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI;QACjC,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI;KAC3D,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;QAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,KAAa,EACb,MAAc,EACd,MAAyB;IAEzB,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,eAAe,KAAK,KAAK,MAAM,KAAK,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAoD,EACpD,YAAgC,EAChC,GAAoB,EACpB,IAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,YAAY,EACZ,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,IAAI,CAAC,CACZ,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB;YACnD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;YAChD,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkB,EAClB,GAAoB,EACpB,IAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,CAAC,GAAG,GAAmC,CAAC;IAC9C,IACE,CAAC,CAAC;QACF,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAC3C,CAAC;QACD,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,eAAe,CACvB;QACE,YAAY,EAAE,CAAC,CAAC,EAAE;QAClB,cAAc,EAAE,CAAC,CAAC,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,EAAE;QACX,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,EACD,KAAK,CAAC,MAAM,EACZ,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,YAAY,EAClB,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,IAAI,CAAC,CACZ,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAExE,OAAO,YAAY,CACjB,CAAC,CAAC,GAAG,EACL,KAAK,CAAC,KAAK,EACX,QAAQ,CAAC,OAAO,EAChB,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAC/B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EAClF,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC"}