@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/client/app-authority.js

@@ -0,0 +1,561 @@
+import * as z from 'zod/v4';
+import { CapabilityError, valueFreeFailure } from '@vibesdotdev/kernel';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { vibesAuthClient } from "./factory.js";
+import { resolveAuthApiBaseUrl } from "../features/config/auth-api.js";
+import { attempt, failureLabel } from "../features/utils/attempt.js";
+import { decodeJWTUnsafe } from "../jwt/index.js";
+import { sessionAuthorizationHeader } from "./session-authorization.js";
+import { errorStatus, failureMessage, isTransportFailure } from "./request-failure.js";
+import { GET_SESSION_PATH, readGetSessionAnswer } from "./session-identity.js";
+import { getLogger } from '@vibesdotdev/logging';
+const FRESH_JWT_MIN_LIFETIME_MS = 30 * 1000;
+import { getVibesClient, tryGetVibesClient } from '@vibesdotdev/kernel/client';
+/**
+ * Drop the app-credential verdicts this runtime's host holds: every one, or,
+ * given the origin that refused a request, that auth origin's (an app origin
+ * that is no auth origin drops all, since any of them may have carried the
+ * credential). The next call resolves the credential afresh.
+ */
+export function dropAppCredentialVerdicts(runtime, refusingOrigin) {
+    const state = tryGetVibesClient('auth', runtime)?.authorityState;
+    if (!state)
+        return;
+    state.epoch++;
+    state.bearers.clear();
+    const verdicts = state.verdicts;
+    if (refusingOrigin === undefined) {
+        verdicts.clear();
+        return;
+    }
+    const origin = normalizeOrigin(refusingOrigin);
+    let matched = false;
+    for (const [key, slot] of verdicts) {
+        if (slot.authOrigin !== origin)
+            continue;
+        verdicts.delete(key);
+        matched = true;
+    }
+    if (!matched)
+        verdicts.clear();
+}
+function looksLikeJwt(token) {
+    return token.split('.').length === 3;
+}
+function isUnexpiredJwt(token, nowMs) {
+    if (!looksLikeJwt(token))
+        return false;
+    // An undecodable JWT (null) is not a fresh JWT; so is one with no expiry.
+    const exp = decodeJWTUnsafe(token)?.exp;
+    return exp !== undefined && exp * 1000 > nowMs + FRESH_JWT_MIN_LIFETIME_MS;
+}
+function defaultAuthClientFactory(runtime) {
+    return Promise.resolve(vibesAuthClient(runtime, { auth: { type: 'none' } }));
+}
+/** The `CapabilityError` code each app-authority failure belongs to. */
+const APP_AUTHORITY_CODE = {
+    'credential-missing': 'AUTH_REQUIRED',
+    'credential-expired': 'AUTH_REQUIRED',
+    'environment-mismatch': 'INVALID_INPUT'
+};
+/**
+ * A typed failure whose enumerable data is safe for JSON/log output: a
+ * `CapabilityError` whose `reason` is the failure code (`legacyCode` keeps the
+ * same value for readers of the old `code` field).
+ */
+export class AppAuthorityError extends CapabilityError {
+    legacyCode;
+    authority;
+    constructor(code, message, authority) {
+        super(message, APP_AUTHORITY_CODE[code], { reason: code, retryable: false });
+        this.name = 'AppAuthorityError';
+        this.legacyCode = code;
+        if (authority)
+            this.authority = authority;
+    }
+    toJSON() {
+        const result = {
+            name: this.name,
+            code: this.legacyCode,
+            message: this.message
+        };
+        if (this.authority)
+            result.authority = this.authority;
+        return result;
+    }
+}
+/** The `CapabilityError` code a mint refusal belongs to, from the HTTP status auth answered (none: the mint did not complete). */
+function mintErrorCode(status) {
+    if (status === undefined)
+        return 'UNAVAILABLE';
+    if (status === 401)
+        return 'AUTH_REQUIRED';
+    if (status === 403)
+        return 'PERMISSION_DENIED';
+    if (status === 408)
+        return 'TIMEOUT';
+    if (status === 429)
+        return 'RATE_LIMITED';
+    return status >= 500 ? 'UNAVAILABLE' : 'INTERNAL';
+}
+/**
+ * Auth did not mint a usable app JWT for the stored credential.
+ *
+ * Carries the HTTP status and auth's own one-line message, never the
+ * credential. The client error is deliberately not kept as `cause`: it holds
+ * the request, whose headers carry the session token; only its value-free
+ * facts (`valueFreeFailure`) are.
+ */
+export class AppJwtMintError extends CapabilityError {
+    status;
+    constructor(message, status, failure) {
+        const options = { reason: 'app-jwt-mint-failed', cause: failure };
+        if (status !== undefined)
+            options.details = { status };
+        super(message, mintErrorCode(status), options);
+        this.name = 'AppJwtMintError';
+        if (status !== undefined)
+            this.status = status;
+    }
+    toJSON() {
+        const result = {
+            name: this.name,
+            message: this.message
+        };
+        if (this.status !== undefined)
+            result.status = this.status;
+        return result;
+    }
+}
+function mintFailure(failure) {
+    const status = errorStatus(failure);
+    const detail = failureMessage(failure);
+    const facts = valueFreeFailure(failure);
+    if (status !== undefined) {
+        return new AppJwtMintError(`Auth answered the app-JWT mint with HTTP ${status}: ${detail}`, status, facts);
+    }
+    if (isTransportFailure(failure)) {
+        return new AppJwtMintError(`Could not reach auth to mint an app JWT: ${detail}`, undefined, facts);
+    }
+    return new AppJwtMintError(`Minting an app JWT failed: ${detail}`, undefined, facts);
+}
+function normalizeOrigin(value) {
+    return value.replace(/\/$/, '');
+}
+function authorityKind(credential) {
+    const token = credential.token ?? '';
+    if (looksLikeJwt(token))
+        return 'jwt';
+    return credential.type === 'session' ? 'session' : 'api-key';
+}
+/**
+ * Build the redacted descriptor without validating or returning a token. It
+ * carries nothing derived from the token: a digest of a short token is
+ * guessable offline, and this descriptor rides in errors and diagnostics.
+ */
+export function describeAppAuthority(credential, authOrigin) {
+    return {
+        source: credential.source ?? 'config/manifest#auth',
+        kind: authorityKind(credential),
+        environment: credential.environment ?? null,
+        origin: normalizeOrigin(authOrigin)
+    };
+}
+function authorityClient(runtime, authOrigin, fetchImpl) {
+    const overrides = {
+        baseUrl: normalizeOrigin(authOrigin),
+        auth: { type: 'none' }
+    };
+    if (fetchImpl)
+        overrides.fetch = fetchImpl;
+    return Promise.resolve(vibesAuthClient(runtime, overrides));
+}
+/**
+ * Strict credential-to-app authority resolution.
+ *
+ * This is deliberately a preflight, not a second auth framework: it binds the
+ * credential to the selected runtime environment, then delegates mint/raw-key
+ * compatibility to the existing auth-owned resolver. The live app consumer is
+ * the only validity verdict.
+ */
+export async function resolveAppAuthority(options) {
+    const state = (await getVibesClient('auth', options.runtime)).authorityState;
+    const epoch = state.epoch;
+    const credential = await options.loadCredentials();
+    if (!credential?.token) {
+        throw new AppAuthorityError('credential-missing', 'No stored auth credential is available.');
+    }
+    const authority = describeAppAuthority(credential, options.authOrigin);
+    const nowMs = (options.now ?? Date.now)();
+    if (credential.expiresAt) {
+        const expiresAtMs = Date.parse(credential.expiresAt);
+        if (Number.isFinite(expiresAtMs) && expiresAtMs <= nowMs) {
+            throw new AppAuthorityError('credential-expired', 'The stored auth credential has expired.', authority);
+        }
+    }
+    if (credential.environment &&
+        options.environment &&
+        credential.environment !== options.environment) {
+        throw new AppAuthorityError('environment-mismatch', `The stored credential belongs to ${credential.environment}, not the selected ${options.environment} environment.`, authority);
+    }
+    const token = await resolveAppJwt({
+        runtime: options.runtime,
+        environment: options.environment ?? undefined,
+        loadCredentials: options.loadCredentials,
+        // Pin the in-memory JWT cache to the same origin the client is bound to.
+        authOrigin: options.authOrigin,
+        createClient: options.createClient
+            ? () => options.createClient(options.authOrigin)
+            : () => authorityClient(options.runtime, options.authOrigin, options.fetchImpl)
+    });
+    // The preflight already proved a token exists; preserve a defensive guard in
+    // case the compatibility resolver contract changes.
+    if (!token) {
+        throw new AppAuthorityError('credential-missing', 'No stored auth credential is available.');
+    }
+    if (state.epoch !== epoch)
+        return resolveAppAuthority(options);
+    return { token, authority, exchanged: token !== credential.token };
+}
+/** What auth's `GET /api/auth/token` answers with when it mints: a non-empty `token`. */
+const mintBodySchema = z.object({ token: z.string().min(1) });
+async function mintJwt(client, headers) {
+    const minted = mintBodySchema.safeParse(await client.get('/api/auth/token', { headers }));
+    return minted.success ? minted.data.token : null;
+}
+/**
+ * Mint a new app JWT from the stored CLI credential.
+ *
+ * Unlike resolveAppJwt, this strict surface never consults the in-memory cache
+ * and never falls back to returning the raw durable credential. It is for
+ * unattended jobs whose persisted contract explicitly requires a short-lived
+ * app JWT rather than a generally compatible app bearer. It returns null only
+ * when no credential is stored. When auth cannot mint, it throws
+ * `AppJwtMintError`, so the job reports why instead of a bare "no JWT".
+ */
+export async function resolveFreshAppJwtOwned(options) {
+    const credential = await options.loadCredentials();
+    const sessionToken = credential?.token;
+    if (!sessionToken)
+        return null;
+    const nowMs = (options.now ?? Date.now)();
+    const mintedOutcome = await attempt(async () => {
+        const client = options.createClient
+            ? await options.createClient()
+            : options.authOrigin
+                ? vibesAuthClient(options.runtime, {
+                    auth: { type: 'none' },
+                    baseUrl: normalizeOrigin(options.authOrigin)
+                })
+                : await defaultAuthClientFactory(options.runtime);
+        return mintJwt(client, sessionAuthorizationHeader(sessionToken));
+    });
+    if (!mintedOutcome.ok)
+        throw mintFailure(mintedOutcome.failure);
+    const minted = mintedOutcome.value;
+    if (!minted) {
+        throw new AppJwtMintError('Auth answered the app-JWT mint without a token.');
+    }
+    if (!isUnexpiredJwt(minted, nowMs)) {
+        throw new AppJwtMintError(`Auth minted an app JWT with no expiry, or one that expires within ${FRESH_JWT_MIN_LIFETIME_MS / 1000} seconds.`);
+    }
+    return minted;
+}
+/**
+ * What auth-web's `POST /api/api-keys/validate` answers for a valid key:
+ * `valid: true`, the owner's id when known, and the scopes (an entry that is
+ * not a string is dropped, as before).
+ */
+const apiKeyValidationBodySchema = z.object({
+    valid: z.literal(true),
+    userId: z.string().optional(),
+    scopes: z
+        .array(z.union([z.string().transform((scope) => [scope]), JsonValueSchema.transform(() => [])]))
+        .transform((groups) => groups.flat())
+        .default([])
+});
+/**
+ * Validate a durable API-key credential against auth-web's public
+ * `POST /api/api-keys/validate` (identity + scopes, no org claims). A genuine
+ * API key 401s `/api/auth/token`, so this endpoint — the same one app session
+ * handles consult — is the only live signal that the key is real. Returns the
+ * server-verified identity when the key is valid, or `null` when the server
+ * rejects it. Throws on transport failure so callers can distinguish
+ * "rejected" from "could not check".
+ */
+async function validateApiKeyCredential(client, key) {
+    const body = apiKeyValidationBodySchema.safeParse(await client.post('/api/api-keys/validate', { key }));
+    if (!body.success)
+        return null;
+    const validation = { scopes: body.data.scopes };
+    if (body.data.userId !== undefined)
+        validation.userId = body.data.userId;
+    return validation;
+}
+function jwtIdentity(jwt) {
+    // An undecodable JWT contributes no claims.
+    const payload = decodeJWTUnsafe(jwt);
+    if (!payload)
+        return { userId: undefined, email: undefined, name: undefined };
+    return { userId: payload.sub ?? payload.userId, email: payload.email, name: payload.name };
+}
+/**
+ * Force a live credential verdict against auth-web. Reachability is "did the
+ * origin answer over HTTP", not "did a particular route exist". `/api/user/me`
+ * 404s on the shipping auth-web; `/api/auth/get-session` and `/api/auth/token`
+ * are the live probes. A 401 from a live origin is unauthorized, never an outage.
+ */
+export async function probeAuthCredential(runtime, createClient, loadCredentials) {
+    const creds = await loadCredentials();
+    const credential = creds?.token;
+    const origin = await resolveAuthApiBaseUrl(runtime);
+    if (!credential) {
+        return { valid: false, reason: 'unauthorized', user: null, origin };
+    }
+    const created = await attempt(() => (createClient ?? (() => defaultAuthClientFactory(runtime)))());
+    if (!created.ok) {
+        return {
+            valid: false,
+            reason: isTransportFailure(created.failure) ? 'unreachable' : 'unknown',
+            user: null,
+            origin
+        };
+    }
+    const client = created.value;
+    const headers = sessionAuthorizationHeader(credential);
+    let reachable = false;
+    let sawUnauthorized = false;
+    let sawUnknown = false;
+    const session = await attempt(async () => readGetSessionAnswer(await client.get(GET_SESSION_PATH, { headers })));
+    if (session.ok) {
+        reachable = true;
+        if (session.value.kind === 'known')
+            return { valid: true, reason: null, user: session.value.user, origin };
+    }
+    else {
+        const status = errorStatus(session.failure);
+        if (status !== undefined) {
+            reachable = true;
+            // A 5xx is an outage at a live origin; the token route below may still answer.
+            if (status === 401 || status === 403)
+                sawUnauthorized = true;
+            else if (status < 500)
+                sawUnknown = true;
+        }
+        else if (!isTransportFailure(session.failure)) {
+            sawUnknown = true;
+        }
+        // A transport failure leaves `reachable` unset; the token route below is the second look.
+    }
+    const tokenAnswer = await attempt(() => client.get('/api/auth/token', { headers }));
+    if (tokenAnswer.ok) {
+        reachable = true;
+        const minted = mintBodySchema.safeParse(tokenAnswer.value);
+        if (minted.success) {
+            const claims = jwtIdentity(minted.data.token);
+            const email = claims.email;
+            let user = null;
+            if (email) {
+                user = { email, name: claims.name ?? null };
+                if (claims.userId)
+                    user.userId = claims.userId;
+            }
+            return { valid: true, reason: null, origin, user };
+        }
+        sawUnknown = true;
+    }
+    else {
+        const status = errorStatus(tokenAnswer.failure);
+        if (status === 401 || status === 403) {
+            reachable = true;
+            sawUnauthorized = true;
+        }
+        else if (status === 404) {
+            // Retired or unused token path — not evidence the origin is down.
+            reachable = true;
+        }
+        else if (status !== undefined) {
+            reachable = true;
+            if (status < 500)
+                sawUnknown = true;
+        }
+        else if (!isTransportFailure(tokenAnswer.failure) || reachable) {
+            sawUnknown = true;
+        }
+    }
+    if (sawUnauthorized || reachable) {
+        const checked = await attempt(() => validateApiKeyCredential(client, credential));
+        if (checked.ok) {
+            reachable = true;
+            if (checked.value) {
+                const email = creds?.email;
+                let user = null;
+                if (email) {
+                    user = { email, name: creds?.name ?? null };
+                    if (checked.value.userId)
+                        user.userId = checked.value.userId;
+                }
+                return { valid: true, reason: null, origin, user };
+            }
+            sawUnauthorized = true;
+        }
+        else if (errorStatus(checked.failure) !== undefined) {
+            reachable = true;
+            sawUnknown = true;
+        }
+        else if (isTransportFailure(checked.failure) && !reachable) {
+            return { valid: false, reason: 'unreachable', user: null, origin };
+        }
+        else {
+            sawUnknown = true;
+        }
+    }
+    if (!reachable) {
+        return { valid: false, reason: 'unreachable', user: null, origin };
+    }
+    return {
+        valid: false,
+        reason: sawUnauthorized && !sawUnknown ? 'unauthorized' : 'unknown',
+        user: null,
+        origin
+    };
+}
+/**
+ * Resolve an app credential for the current CLI login: a signed app JWT when
+ * one is mintable, otherwise the raw durable credential. API keys mint no JWT —
+ * they 401 `/api/auth/token` and authenticate instead against auth-web's
+ * `/api/api-keys/validate`, which app session handles also consult — so the
+ * raw key IS a usable app credential (callers inject it as
+ * VIBES_AUTH_TOKEN / Bearer exactly like a JWT; app workers accept either).
+ * Returns `null` only when no credential is stored.
+ *
+ * This is a best-effort token provider, not a live verdict: for an
+ * authenticated/not-authenticated decision use `probeAuthCredential`, which
+ * verifies the credential (including the `/api/api-keys/validate` fallback).
+ */
+export async function resolveAppJwtOwned(deps) {
+    const logger = getLogger('auth.app-authority', deps.runtime);
+    const owner = await getVibesClient('auth', deps.runtime);
+    const state = owner.authorityState;
+    const epoch = state.epoch;
+    // The credential is loaded on every call: a login or logout (by this or
+    // another process) is seen by the very next call.
+    const creds = await deps.loadCredentials();
+    const sessionToken = creds?.token;
+    if (state.epoch !== epoch)
+        return resolveAppJwtOwned(deps);
+    if (!sessionToken)
+        return null;
+    // A5: the origin comes through infra/service (async), and
+    // resolveAuthApiBaseUrl THROWS rather than invent a bare domain. An
+    // unresolved origin degrades to returning the raw stored credential (a
+    // usable app credential) instead of contacting an invented host.
+    const origin = await attempt(async () => normalizeOrigin(deps.authOrigin ?? (await resolveAuthApiBaseUrl(deps.runtime))));
+    if (state.epoch !== epoch)
+        return resolveAppJwtOwned(deps);
+    if (!origin.ok) {
+        logger.debug('Auth origin unresolved; returning the stored credential', { failure: failureLabel(origin.failure) });
+        return sessionToken;
+    }
+    const authOrigin = origin.value;
+    const verdicts = state.verdicts;
+    const slotKey = `${deps.environment ?? ''}\u0000${authOrigin}`;
+    const mac = await owner.credentialMac(sessionToken);
+    if (state.epoch !== epoch)
+        return resolveAppJwtOwned(deps);
+    const slot = verdicts.get(slotKey);
+    const known = slot?.credentialMac === mac ? slot.verdict : undefined;
+    const remember = (verdict) => {
+        if (state.epoch !== epoch)
+            return;
+        verdicts.set(slotKey, { authOrigin, credentialMac: mac, verdict });
+    };
+    if (known?.kind === 'api-key')
+        return sessionToken;
+    if (known?.kind === 'session' && known.jwt !== undefined && isUnexpiredJwt(known.jwt, Date.now()))
+        return known.jwt;
+    // The `apiKey` slot is ambiguous, so its NAME cannot classify the credential:
+    // the device flow persists a better-auth SESSION token there, while
+    // `vibes auth api-key` stores a real opaque key. The two need opposite
+    // handling. A real key must stay opaque, because apps authorize it through
+    // auth-web's /api/api-keys/validate seam and an exchange could yield a bearer
+    // they cannot authorize. A session token must be exchanged for a JWT, because
+    // only auth-web itself honors a better-auth session — presented to an app as
+    // `Authorization: Bearer` it matches neither JWKS verification nor key
+    // validation, so every app API 401s while auth-web's own get-session still
+    // reports a healthy login. Ask the canonical validator which kind this is
+    // rather than trusting the slot, once per credential: the answer is kept
+    // (above) until the credential changes or an origin refuses it.
+    let client = null;
+    if (known === undefined && (creds.apiKey !== undefined || creds.type === 'apiKey')) {
+        // Classification is best-effort: an unreachable validator falls through to
+        // the mint path below, which still returns the raw credential when no JWT
+        // can be minted. That preserves offline and legacy-session behavior.
+        const created = await attempt(() => (deps.createClient ?? (() => authorityClient(deps.runtime, authOrigin)))());
+        if (created.ok) {
+            client = created.value;
+            const validation = await attempt(() => validateApiKeyCredential(created.value, sessionToken));
+            if (state.epoch !== epoch)
+                return resolveAppJwtOwned(deps);
+            if (validation.ok) {
+                if (validation.value) {
+                    remember({ kind: 'api-key' });
+                    return sessionToken;
+                }
+                remember({ kind: 'session' });
+            }
+            else {
+                const status = errorStatus(validation.failure);
+                if (status === 401 || status === 403)
+                    verdicts.delete(slotKey);
+                logger.debug('API-key classification failed; falling through to the mint path', {
+                    failure: failureLabel(validation.failure)
+                });
+            }
+        }
+        else {
+            logger.debug('API-key classification failed; falling through to the mint path', {
+                failure: failureLabel(created.failure)
+            });
+        }
+    }
+    const minted = await attempt(async () => {
+        const mintClient = client ??
+            (deps.createClient
+                ? await deps.createClient()
+                : vibesAuthClient(deps.runtime, { auth: { type: 'none' }, baseUrl: authOrigin }));
+        return mintJwt(mintClient, sessionAuthorizationHeader(sessionToken));
+    });
+    if (state.epoch !== epoch)
+        return resolveAppJwtOwned(deps);
+    if (!minted.ok) {
+        // The documented degradation: a refused or unreachable mint yields the raw
+        // stored credential, and nothing is kept for it. Callers that need the
+        // cause use resolveFreshAppJwt (throws AppJwtMintError) or
+        // probeAuthCredential (classifies it).
+        verdicts.delete(slotKey);
+        logger.debug('App JWT mint unavailable; returning the stored credential', { failure: failureLabel(minted.failure) });
+        return sessionToken;
+    }
+    // No JWT mintable (API keys today): return the raw key. It is not a JWT,
+    // but app workers validate it against /api/api-keys/validate, so callers
+    // inject it the same way. probeAuthCredential is the surface that
+    // decides whether that credential is actually valid.
+    if (!minted.value)
+        return sessionToken;
+    // A JWT is kept to its own `exp`; one without an expiry is not kept.
+    if (isUnexpiredJwt(minted.value, Date.now()))
+        remember({ kind: 'session', jwt: minted.value });
+    return minted.value;
+}
+/** Compatibility adapter to runtime/client#auth. */
+export async function resolveAppJwt(deps) {
+    const { runtime, ...options } = deps;
+    return (await getVibesClient('auth', runtime)).resolveAppJwt(options);
+}
+/** Compatibility adapter to runtime/client#auth. */
+export async function resolveFreshAppJwt(deps) {
+    const { runtime, ...options } = deps;
+    return (await getVibesClient('auth', runtime)).resolveFreshAppJwt(options);
+}
+//# sourceMappingURL=app-authority.js.map

package/dist/client/app-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-authority.js","sourceRoot":"","sources":["../../src/client/app-authority.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,eAAe,EACf,gBAAgB,EAKhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAmBnE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAI/E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAI/E;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAmB,EAAE,cAAuB;IACrF,MAAM,KAAK,GAAG,iBAAiB,CAAsB,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC;IACtF,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;IACR,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM;YAAE,SAAS;QACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,0EAA0E;IAC1E,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACxC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,GAAG,yBAAyB,CAAC;AAC5E,CAAC;AAID,SAAS,wBAAwB,CAAC,OAAmB;IACpD,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC;AAsBD,wEAAwE;AACxE,MAAM,kBAAkB,GAAG;IAC1B,oBAAoB,EAAE,eAAe;IACrC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;CACiC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAC5C,UAAU,CAA0B;IACpC,SAAS,CAAgB;IAElC,YAAY,IAA6B,EAAE,OAAe,EAAE,SAAwB;QACnF,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC3C,CAAC;IAED,MAAM;QACL,MAAM,MAAM,GAA0B;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACrB,CAAC;QACF,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACtD,OAAO,MAAM,CAAC;IACf,CAAC;CACD;AASD,kIAAkI;AAClI,SAAS,aAAa,CAAC,MAA0B;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAC/C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IAC3C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,mBAAmB,CAAC;IAC/C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC1C,OAAO,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,eAAgB,SAAQ,eAAe;IAC1C,MAAM,CAAU;IAEzB,YAAY,OAAe,EAAE,MAAe,EAAE,OAA6C;QAC1F,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1F,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC;QACvD,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IAChD,CAAC;IAED,MAAM;QACL,MAAM,MAAM,GAAwB;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;SACrB,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3D,OAAO,MAAM,CAAC;IACf,CAAC;CACD;AAED,SAAS,WAAW,CAAC,OAAsB;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,eAAe,CAAC,4CAA4C,MAAM,KAAK,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,eAAe,CAAC,4CAA4C,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,8BAA8B,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACtF,CAAC;AAqBD,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,UAA0B;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;IACrC,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA0B,EAAE,UAAkB;IAClF,OAAO;QACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,sBAAsB;QACnD,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC;QAC/B,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,IAAI;QAC3C,MAAM,EAAE,eAAe,CAAC,UAAU,CAAC;KACnC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACvB,OAAmB,EACnB,UAAkB,EAClB,SAAwB;IAExB,MAAM,SAAS,GAA6B;QAC3C,OAAO,EAAE,eAAe,CAAC,UAAU,CAAC;QACpC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KACtB,CAAC;IACF,IAAI,SAAS;QAAE,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAmC;IAEnC,MAAM,KAAK,GAAG,CAAC,MAAM,cAAc,CAAsB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IAClG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,iBAAiB,CAC1B,oBAAoB,EACpB,yCAAyC,CACzC,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;YAC1D,MAAM,IAAI,iBAAiB,CAC1B,oBAAoB,EACpB,yCAAyC,EACzC,SAAS,CACT,CAAC;QACH,CAAC;IACF,CAAC;IACD,IACC,UAAU,CAAC,WAAW;QACtB,OAAO,CAAC,WAAW;QACnB,UAAU,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAC7C,CAAC;QACF,MAAM,IAAI,iBAAiB,CAC1B,sBAAsB,EACtB,oCAAoC,UAAU,CAAC,WAAW,sBAAsB,OAAO,CAAC,WAAW,eAAe,EAClH,SAAS,CACT,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,SAAS;QAC7C,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,yEAAyE;QACzE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;YACjC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YACjD,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;KAChF,CAAC,CAAC;IACH,6EAA6E;IAC7E,oDAAoD;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAiB,CAC1B,oBAAoB,EACpB,yCAAyC,CACzC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC/D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;AACpE,CAAC;AAED,yFAAyF;AACzF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE9D,KAAK,UAAU,OAAO,CACrB,MAA+B,EAC/B,OAA+B;IAE/B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAkC;IAElC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,UAAU,EAAE,KAAK,CAAC;IACvC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAE1C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY;YAClC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,EAAE;YAC9B,CAAC,CAAC,OAAO,CAAC,UAAU;gBACnB,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE;oBACjC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;oBACtB,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;iBAC5C,CAAC;gBACH,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,MAAM,EAAE,0BAA0B,CAAC,YAAY,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,iDAAiD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CACxB,qEAAqE,yBAAyB,GAAG,IAAI,WAAW,CAChH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAOD;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,GAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SACzG,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SACpC,OAAO,CAAC,EAAE,CAAC;CACb,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,KAAK,UAAU,wBAAwB,CACtC,MAA+B,EAC/B,GAAW;IAEX,MAAM,IAAI,GAAG,0BAA0B,CAAC,SAAS,CAChD,MAAM,MAAM,CAAC,IAAI,CAAU,wBAAwB,EAAE,EAAE,GAAG,EAAE,CAAC,CAC7D,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,UAAU,GAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAClE,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IACzE,OAAO,UAAU,CAAC;AACnB,CAAC;AAgBD,SAAS,WAAW,CAAC,GAAW;IAC/B,4CAA4C;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC9E,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAmB,EACnB,YAA2C,EAC3C,eAAiC;IAEjC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,KAAK,EAAE,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACvE,IAAI,EAAE,IAAI;YACV,MAAM;SACN,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAE7B,MAAM,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1H,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,SAAS,GAAG,IAAI,CAAC;QACjB,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5G,CAAC;SAAM,CAAC;QACP,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS,GAAG,IAAI,CAAC;YACjB,+EAA+E;YAC/E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;gBAAE,eAAe,GAAG,IAAI,CAAC;iBACxD,IAAI,MAAM,GAAG,GAAG;gBAAE,UAAU,GAAG,IAAI,CAAC;QAC1C,CAAC;aAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,UAAU,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,0FAA0F;IAC3F,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAU,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7F,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,SAAS,GAAG,IAAI,CAAC;QACjB,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,IAAI,IAAI,GAAgC,IAAI,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACX,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC5C,IAAI,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAChD,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;IACnB,CAAC;SAAM,CAAC;QACP,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACtC,SAAS,GAAG,IAAI,CAAC;YACjB,eAAe,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3B,kEAAkE;YAClE,SAAS,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,MAAM,GAAG,GAAG;gBAAE,UAAU,GAAG,IAAI,CAAC;QACrC,CAAC;aAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;YAClE,UAAU,GAAG,IAAI,CAAC;QACnB,CAAC;IACF,CAAC;IAED,IAAI,eAAe,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QAClF,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC;gBAC3B,IAAI,IAAI,GAAgC,IAAI,CAAC;gBAC7C,IAAI,KAAK,EAAE,CAAC;oBACX,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;oBAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM;wBAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC9D,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YACD,eAAe,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACvD,SAAS,GAAG,IAAI,CAAC;YACjB,UAAU,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpE,CAAC;aAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACnB,CAAC;IACF,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpE,CAAC;IAED,OAAO;QACN,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,eAAe,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACnE,IAAI,EAAE,IAAI;QACV,MAAM;KACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,IAOC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAsB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,KAAK,EAAE,KAAK,CAAC;IAClC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,0DAA0D;IAC1D,oEAAoE;IACpE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1H,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnH,OAAO,YAAY,CAAC;IACrB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,EAAE,aAAa,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,QAAQ,GAAG,CAAC,OAA6B,EAAE,EAAE;QAClD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO;QAClC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACnD,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IACpH,8EAA8E;IAC9E,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,gEAAgE;IAChE,IAAI,MAAM,GAAmC,IAAI,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpF,2EAA2E;QAC3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;YACvB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;YAC9F,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;oBACtB,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC9B,OAAO,YAAY,CAAC;gBACrB,CAAC;gBACD,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACP,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;oBAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,CAAC,KAAK,CAAC,iEAAiE,EAAE;oBAC/E,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC;iBACzC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,iEAAiE,EAAE;gBAC/E,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;aACtC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,UAAU,GACf,MAAM;YACN,CAAC,IAAI,CAAC,YAAY;gBACjB,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE;gBAC3B,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QACpF,OAAO,OAAO,CAAC,UAAU,EAAE,0BAA0B,CAAC,YAAY,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,2EAA2E;QAC3E,uEAAuE;QACvE,2DAA2D;QAC3D,uCAAuC;QACvC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrH,OAAO,YAAY,CAAC;IACrB,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,kEAAkE;IAClE,qDAAqD;IACrD,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC;IACvC,qEAAqE;IACrE,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC,KAAK,CAAC;AACrB,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA8C;IACjF,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,MAAM,cAAc,CAAgB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AACtF,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA+B;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,MAAM,cAAc,CAAgB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC"}

package/dist/client/auth-client.d.ts

@@ -0,0 +1,21 @@
+import type { AuthClientConfig, AuthRedirectOptions } from './schemas.ts';
+export declare function createAuthClient(config: AuthClientConfig): {
+    authOrigin: string;
+    clientId: string;
+    clientOrigin: string;
+    callbackUrl: string;
+    signInUrl(options?: AuthRedirectOptions): string;
+    signUpUrl(options?: AuthRedirectOptions): string;
+    gatewayUrl(): string;
+    sessionUrl(): string;
+};
+/**
+ * Build the canonical auth entry URL without forcing a consumer to retain an
+ * auth client instance. The sign-in UI lives at auth-web's root (`/`), not at
+ * `/sign-in`; centralizing this keeps app prompts and redirects from drifting.
+ */
+export declare function buildAuthSignInUrl(config: AuthClientConfig & {
+    redirectTo?: string;
+}): string;
+export type { AuthClientConfig, AuthRedirectOptions };
+//# sourceMappingURL=auth-client.d.ts.map

package/dist/client/auth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.d.ts","sourceRoot":"","sources":["../../src/client/auth-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAwB1E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB;;;;;wBAYpC,mBAAmB;wBAMnB,mBAAmB;;;EAevC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE7F;AAED,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC"}