@voyant-travel/auth 0.113.3

package/dist/cloud-admin-session.js

@@ -0,0 +1,319 @@
+import { authAccount, authUser, cloudAuthSessionLinks, cloudAuthUserLinks, } from "@voyant-travel/db/schema/iam";
+import { createAuthEndpoint } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import { and, eq } from "drizzle-orm";
+import { markCloudAuthSessionRevalidated, markCloudAuthUserRevalidated, revokeCloudAuthUserAccess, } from "./cloud-admin-session-revalidation-store.js";
+import { exchangeCloudAdminAuthCode, revalidateCloudAdminAuthAccess, verifyCloudAdminAuthCallback, } from "./cloud-broker.js";
+import { isFirstAuthUser, provisionCurrentUserProfile } from "./workspace.js";
+const VOYANT_CLOUD_PROVIDER_ID = "voyant-cloud";
+const DEFAULT_CLOUD_SESSION_REVALIDATE_AFTER_SECONDS = 15 * 60;
+export function createVoyantCloudAdminAuthPlugin(options) {
+    return {
+        id: "voyant-cloud-admin-auth",
+        endpoints: {
+            voyantCloudAdminAuthCallback: createAuthEndpoint("/cloud/callback", { method: "GET", requireRequest: true }, async (ctx) => {
+                const callback = await verifyCloudAdminAuthCallback({
+                    requestUrl: ctx.request.url,
+                    cookieHeader: ctx.headers?.get("cookie") ?? ctx.request.headers.get("cookie"),
+                    cookieSecret: options.cookieSecret,
+                });
+                ctx.setHeader("Set-Cookie", callback.clearCookie);
+                if (!callback.ok) {
+                    const status = callback.error === "cloud_error" ? 401 : 400;
+                    return ctx.json({
+                        error: callback.error,
+                        ...(callback.cloudError ? { cloudError: callback.cloudError } : {}),
+                    }, { status });
+                }
+                let assertion;
+                try {
+                    assertion = await exchangeCloudAdminAuthCode({
+                        code: callback.code,
+                        state: callback.state,
+                        config: options.exchange,
+                        ...(options.fetch ? { fetch: options.fetch } : {}),
+                    });
+                }
+                catch (error) {
+                    ctx.context.logger.error("[auth/cloud/callback] Exchange error", error);
+                    return ctx.json({ error: "Voyant Cloud auth exchange failed" }, { status: 401 });
+                }
+                const user = await upsertVoyantCloudMirrorUser(options.db, assertion, {
+                    onUserProvisioning: options.onUserProvisioning,
+                });
+                const session = (await ctx.context.internalAdapter.createSession(user.id));
+                await upsertVoyantCloudSessionLink(options.db, {
+                    assertion,
+                    session,
+                    revalidateAfterSeconds: options.revalidateAfterSeconds ?? DEFAULT_CLOUD_SESSION_REVALIDATE_AFTER_SECONDS,
+                });
+                await setSessionCookie(ctx, { session, user });
+                throw ctx.redirect(callback.state.next);
+            }),
+        },
+    };
+}
+export async function revalidateVoyantCloudAdminAuthSession({ db, sessionId, config, fetch, now = new Date(), revalidateAfterSeconds = DEFAULT_CLOUD_SESSION_REVALIDATE_AFTER_SECONDS, }) {
+    const [sessionLink] = await db
+        .select()
+        .from(cloudAuthSessionLinks)
+        .where(eq(cloudAuthSessionLinks.sessionId, sessionId))
+        .limit(1);
+    if (!sessionLink || sessionLink.revokedAt) {
+        return { ok: false, status: "revoked", reason: "missing_or_revoked_session" };
+    }
+    if (sessionLink.revalidateAfter > now) {
+        return { ok: true, status: "cached" };
+    }
+    const revalidation = await revalidateCloudAdminAuthAccess({
+        workosUserId: sessionLink.providerAccountId,
+        config,
+        ...(fetch ? { fetch } : {}),
+    });
+    if (revalidation.ok) {
+        await markCloudAuthSessionRevalidated(db, {
+            sessionId: sessionLink.sessionId,
+            userId: sessionLink.userId,
+            now,
+            revalidateAfterSeconds,
+        });
+        return { ok: true, status: "active" };
+    }
+    await revokeCloudAuthUserAccess(db, {
+        sessionId: sessionLink.sessionId,
+        userId: sessionLink.userId,
+        now,
+    });
+    return {
+        ok: false,
+        status: "revoked",
+        reason: revalidation.reason,
+    };
+}
+export async function revalidateVoyantCloudAdminAuthUser({ db, userId, config, fetch, now = new Date(), revalidateAfterSeconds = DEFAULT_CLOUD_SESSION_REVALIDATE_AFTER_SECONDS, }) {
+    const [userLink] = await db
+        .select()
+        .from(cloudAuthUserLinks)
+        .where(eq(cloudAuthUserLinks.userId, userId))
+        .limit(1);
+    if (!userLink || userLink.revokedAt) {
+        return { ok: false, status: "revoked", reason: "missing_or_revoked_user" };
+    }
+    const nextRevalidationAt = userLink.lastRevalidatedAt
+        ? new Date(userLink.lastRevalidatedAt.getTime() + revalidateAfterSeconds * 1000)
+        : null;
+    if (nextRevalidationAt && nextRevalidationAt > now) {
+        return { ok: true, status: "cached" };
+    }
+    const revalidation = await revalidateCloudAdminAuthAccess({
+        workosUserId: userLink.providerAccountId,
+        config,
+        ...(fetch ? { fetch } : {}),
+    });
+    if (revalidation.ok) {
+        await markCloudAuthUserRevalidated(db, {
+            userId: userLink.userId,
+            now,
+        });
+        return { ok: true, status: "active" };
+    }
+    await revokeCloudAuthUserAccess(db, {
+        userId: userLink.userId,
+        now,
+    });
+    return {
+        ok: false,
+        status: "revoked",
+        reason: revalidation.reason,
+    };
+}
+async function upsertVoyantCloudMirrorUser(db, assertion, options = {}) {
+    const now = new Date();
+    const providerAccountId = assertion.workosUserId;
+    const displayName = cloudAssertionDisplayName(assertion);
+    const existingUser = await findCloudMirrorUser(db, providerAccountId, assertion.email, assertion.emailVerified);
+    const isNewUser = !existingUser;
+    const userId = existingUser?.id ?? crypto.randomUUID();
+    if (existingUser) {
+        await db
+            .update(authUser)
+            .set({
+            name: displayName,
+            email: assertion.email,
+            emailVerified: assertion.emailVerified,
+            image: assertion.image ?? null,
+            updatedAt: now,
+        })
+            .where(eq(authUser.id, existingUser.id));
+    }
+    else {
+        await db.insert(authUser).values({
+            id: userId,
+            name: displayName,
+            email: assertion.email,
+            emailVerified: assertion.emailVerified,
+            image: assertion.image ?? null,
+            createdAt: now,
+            updatedAt: now,
+        });
+    }
+    await db
+        .insert(authAccount)
+        .values({
+        id: cloudAuthAccountId(providerAccountId),
+        userId,
+        accountId: providerAccountId,
+        providerId: VOYANT_CLOUD_PROVIDER_ID,
+        createdAt: now,
+        updatedAt: now,
+    })
+        .onConflictDoUpdate({
+        target: [authAccount.providerId, authAccount.accountId],
+        set: {
+            userId,
+            updatedAt: now,
+        },
+    });
+    await upsertVoyantCloudUserLink(db, userId, assertion, now);
+    await provisionCurrentUserProfile(db, {
+        userId,
+        name: displayName,
+        image: assertion.image,
+        isSuperAdmin: await isFirstAuthUser(db),
+    });
+    const [user] = await db
+        .select({
+        id: authUser.id,
+        name: authUser.name,
+        email: authUser.email,
+        emailVerified: authUser.emailVerified,
+        image: authUser.image,
+        createdAt: authUser.createdAt,
+        updatedAt: authUser.updatedAt,
+    })
+        .from(authUser)
+        .where(eq(authUser.id, userId))
+        .limit(1);
+    if (!user?.email) {
+        throw new Error("Voyant Cloud auth mirror user was not provisioned");
+    }
+    const provisionedUser = {
+        id: user.id,
+        name: user.name,
+        email: user.email,
+        emailVerified: user.emailVerified,
+        image: user.image,
+        createdAt: user.createdAt,
+        updatedAt: user.updatedAt,
+    };
+    await options.onUserProvisioning?.({
+        db,
+        assertion,
+        user: provisionedUser,
+        isNewUser,
+        provider: {
+            providerId: VOYANT_CLOUD_PROVIDER_ID,
+            providerAccountId,
+        },
+    });
+    return provisionedUser;
+}
+async function findCloudMirrorUser(db, providerAccountId, email, emailVerified) {
+    const [linked] = await db
+        .select({ id: authUser.id })
+        .from(cloudAuthUserLinks)
+        .innerJoin(authUser, eq(authUser.id, cloudAuthUserLinks.userId))
+        .where(and(eq(cloudAuthUserLinks.providerId, VOYANT_CLOUD_PROVIDER_ID), eq(cloudAuthUserLinks.providerAccountId, providerAccountId)))
+        .limit(1);
+    if (linked)
+        return linked;
+    const [account] = await db
+        .select({ id: authUser.id })
+        .from(authAccount)
+        .innerJoin(authUser, eq(authUser.id, authAccount.userId))
+        .where(and(eq(authAccount.providerId, VOYANT_CLOUD_PROVIDER_ID), eq(authAccount.accountId, providerAccountId)))
+        .limit(1);
+    if (account)
+        return account;
+    if (!email || emailVerified !== true)
+        return null;
+    const [emailUser] = await db
+        .select({ id: authUser.id })
+        .from(authUser)
+        .where(eq(authUser.email, email))
+        .limit(1);
+    return emailUser ?? null;
+}
+function cloudAuthUserLinkValues(userId, assertion, now) {
+    return {
+        userId,
+        providerId: VOYANT_CLOUD_PROVIDER_ID,
+        providerAccountId: assertion.workosUserId,
+        deploymentId: assertion.deploymentId,
+        platformOrganizationId: assertion.platformOrganizationId,
+        workosOrganizationId: assertion.workosOrganizationId,
+        membershipId: assertion.membershipId ?? null,
+        roleSlug: assertion.roleSlug ?? null,
+        roleName: assertion.roleName ?? null,
+        surfaces: assertion.surfaces ?? [],
+        lastAssertionAt: new Date(assertion.iat * 1000),
+        lastRevalidatedAt: now,
+        revokedAt: null,
+        updatedAt: now,
+    };
+}
+async function upsertVoyantCloudUserLink(db, userId, assertion, now) {
+    const values = cloudAuthUserLinkValues(userId, assertion, now);
+    const [existingForUser] = await db
+        .select({ userId: cloudAuthUserLinks.userId })
+        .from(cloudAuthUserLinks)
+        .where(eq(cloudAuthUserLinks.userId, userId))
+        .limit(1);
+    if (existingForUser) {
+        await db
+            .update(cloudAuthUserLinks)
+            .set({
+            ...values,
+            userId,
+            revokedAt: null,
+        })
+            .where(eq(cloudAuthUserLinks.userId, userId));
+        return;
+    }
+    await db
+        .insert(cloudAuthUserLinks)
+        .values(values)
+        .onConflictDoUpdate({
+        target: [cloudAuthUserLinks.providerId, cloudAuthUserLinks.providerAccountId],
+        set: {
+            ...values,
+            userId,
+            revokedAt: null,
+        },
+    });
+}
+async function upsertVoyantCloudSessionLink(db, input) {
+    const now = new Date();
+    await db.insert(cloudAuthSessionLinks).values({
+        sessionId: input.session.id,
+        userId: input.session.userId,
+        providerId: VOYANT_CLOUD_PROVIDER_ID,
+        providerAccountId: input.assertion.workosUserId,
+        deploymentId: input.assertion.deploymentId,
+        revalidateAfter: new Date(now.getTime() + input.revalidateAfterSeconds * 1000),
+        lastRevalidatedAt: now,
+        revokedAt: null,
+        updatedAt: now,
+    });
+}
+function cloudAssertionDisplayName(assertion) {
+    const fromParts = [assertion.firstName, assertion.lastName]
+        .map((part) => part?.trim())
+        .filter((part) => Boolean(part))
+        .join(" ");
+    return assertion.name?.trim() || fromParts || assertion.email;
+}
+function cloudAuthAccountId(providerAccountId) {
+    return `acc_${VOYANT_CLOUD_PROVIDER_ID}_${providerAccountId}`;
+}
+//# sourceMappingURL=cloud-admin-session.js.map

package/dist/cloud-admin-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-admin-session.js","sourceRoot":"","sources":["../src/cloud-admin-session.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAIL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAmD7E,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAC/C,MAAM,8CAA8C,GAAG,EAAE,GAAG,EAAE,CAAA;AAwC9D,MAAM,UAAU,gCAAgC,CAC9C,OAA0C;IAE1C,OAAO;QACL,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE;YACT,4BAA4B,EAAE,kBAAkB,CAC9C,iBAAiB,EACjB,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,EACvC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;oBAClD,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;oBAC3B,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAC7E,YAAY,EAAE,OAAO,CAAC,YAAY;iBACnC,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;gBAEjD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;oBAC3D,OAAO,GAAG,CAAC,IAAI,CACb;wBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACpE,EACD,EAAE,MAAM,EAAE,CACX,CAAA;gBACH,CAAC;gBAED,IAAI,SAA8B,CAAA;gBAClC,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,0BAA0B,CAAC;wBAC3C,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,MAAM,EAAE,OAAO,CAAC,QAAQ;wBACxB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnD,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;oBACvE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAClF,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE;oBACpE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;iBAC/C,CAAC,CAAA;gBACF,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAC9D,IAAI,CAAC,EAAE,CACR,CAA+B,CAAA;gBAChC,MAAM,4BAA4B,CAAC,OAAO,CAAC,EAAE,EAAE;oBAC7C,SAAS;oBACT,OAAO;oBACP,sBAAsB,EACpB,OAAO,CAAC,sBAAsB,IAAI,8CAA8C;iBACnF,CAAC,CAAA;gBACF,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;gBAE9C,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzC,CAAC,CACF;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,EAC1D,EAAE,EACF,SAAS,EACT,MAAM,EACN,KAAK,EACL,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,sBAAsB,GAAG,8CAA8C,GAC9B;IACzC,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE;SAC3B,MAAM,EAAE;SACR,IAAI,CAAC,qBAAqB,CAAC;SAC3B,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;IAC/E,CAAC;IAED,IAAI,WAAW,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,YAAY,EAAE,WAAW,CAAC,iBAAiB;QAC3C,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,+BAA+B,CAAC,EAAE,EAAE;YACxC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,GAAG;YACH,sBAAsB;SACvB,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,yBAAyB,CAAC,EAAE,EAAE;QAClC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,GAAG;KACJ,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,EACvD,EAAE,EACF,MAAM,EACN,MAAM,EACN,KAAK,EACL,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,sBAAsB,GAAG,8CAA8C,GACjC;IACtC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAA;IAC5E,CAAC;IAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,iBAAiB;QACnD,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC;QAChF,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,GAAG,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,YAAY,EAAE,QAAQ,CAAC,iBAAiB;QACxC,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,4BAA4B,CAAC,EAAE,EAAE;YACrC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG;SACJ,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,yBAAyB,CAAC,EAAE,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,GAAG;KACJ,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAA;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,EAA4B,EAC5B,SAA8B,EAC9B,UAEI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,iBAAiB,GAAG,SAAS,CAAC,YAAY,CAAA;IAChD,MAAM,WAAW,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACxD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAC5C,EAAE,EACF,iBAAiB,EACjB,SAAS,CAAC,KAAK,EACf,SAAS,CAAC,aAAa,CACxB,CAAA;IACD,MAAM,SAAS,GAAG,CAAC,YAAY,CAAA;IAC/B,MAAM,MAAM,GAAG,YAAY,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAA;IAEtD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,EAAE;aACL,MAAM,CAAC,QAAQ,CAAC;aAChB,GAAG,CAAC;YACH,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI;YAC9B,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI;YAC9B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC;QACN,EAAE,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;QACzC,MAAM;QACN,SAAS,EAAE,iBAAiB;QAC5B,UAAU,EAAE,wBAAwB;QACpC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,SAAS,CAAC;QACvD,GAAG,EAAE;YACH,MAAM;YACN,SAAS,EAAE,GAAG;SACf;KACF,CAAC,CAAA;IAEJ,MAAM,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;IAE3D,MAAM,2BAA2B,CAAC,EAAE,EAAE;QACpC,MAAM;QACN,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,YAAY,EAAE,MAAM,eAAe,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;SACD,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC9B,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAA;IAED,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACjC,EAAE;QACF,SAAS;QACT,IAAI,EAAE,eAAe;QACrB,SAAS;QACT,QAAQ,EAAE;YACR,UAAU,EAAE,wBAAwB;YACpC,iBAAiB;SAClB;KACF,CAAC,CAAA;IAEF,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAA4B,EAC5B,iBAAyB,EACzB,KAAc,EACd,aAAuB;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;SAC3B,IAAI,CAAC,kBAAkB,CAAC;SACxB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;SAC/D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,wBAAwB,CAAC,EAC3D,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAC5D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;SAC3B,IAAI,CAAC,WAAW,CAAC;SACjB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;SACxD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,wBAAwB,CAAC,EACpD,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAC7C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEjD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;SAC3B,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;SAChC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,SAAS,IAAI,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAc,EACd,SAA8B,EAC9B,GAAS;IAET,OAAO;QACL,MAAM;QACN,UAAU,EAAE,wBAAwB;QACpC,iBAAiB,EAAE,SAAS,CAAC,YAAY;QACzC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,IAAI;QAC5C,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI;QACpC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI;QACpC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;QAClC,eAAe,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC;QAC/C,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG;KACf,CAAA;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAA4B,EAC5B,MAAc,EACd,SAA8B,EAC9B,GAAS;IAET,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;IAC9D,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,EAAE;SAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC;SAC7C,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,GAAG,MAAM;YACT,MAAM;YACN,SAAS,EAAE,IAAI;SAChB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QAC/C,OAAM;IACR,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,kBAAkB,CAAC;SAC1B,MAAM,CAAC,MAAM,CAAC;SACd,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;QAC7E,GAAG,EAAE;YACH,GAAG,MAAM;YACT,MAAM;YACN,SAAS,EAAE,IAAI;SAChB;KACF,CAAC,CAAA;AACN,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,EAA4B,EAC5B,KAIC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;QAC5C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,UAAU,EAAE,wBAAwB;QACpC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;QAC/C,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;QAC1C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;QAC9E,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG;KACf,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,SAA8B;IAC/D,MAAM,SAAS,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;SACxD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;SAC3B,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAC/C,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,IAAI,SAAS,CAAC,KAAK,CAAA;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,iBAAyB;IACnD,OAAO,OAAO,wBAAwB,IAAI,iBAAiB,EAAE,CAAA;AAC/D,CAAC"}

package/dist/cloud-broker/assertion.d.ts

@@ -0,0 +1,69 @@
+import type { CloudAdminAuthState } from "./state.js";
+export declare const VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER = "https://api.voyantjs.com";
+export type CloudAdminAssertion = {
+    iss: typeof VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER;
+    aud: string;
+    sub: string;
+    email: string;
+    emailVerified: boolean;
+    name?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    image?: string | null;
+    workosUserId: string;
+    workosOrganizationId: string;
+    platformOrganizationId: string;
+    platformOrganizationSlug: string;
+    deploymentId: string;
+    appId?: string | null;
+    environment?: string | null;
+    membershipId?: string | null;
+    roleSlug?: string | null;
+    roleName?: string | null;
+    surfaces?: string[] | null;
+    nonce: string;
+    iat: number;
+    exp: number;
+};
+export type CloudAdminAuthExchangeConfig = {
+    exchangeUrl: string;
+    deploymentId: string;
+    clientToken: string;
+    assertionJwksUrl: string;
+    assertionAudience: string;
+    assertionIssuer?: typeof VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER;
+};
+export type CloudAdminAuthRevalidateConfig = {
+    revalidateUrl: string;
+    deploymentId: string;
+    clientToken: string;
+};
+export type ExchangeCloudAdminAuthCodeInput = {
+    code: string;
+    state: CloudAdminAuthState;
+    config: CloudAdminAuthExchangeConfig;
+    fetch?: typeof fetch;
+    now?: Date;
+};
+export type RevalidateCloudAdminAuthAccessInput = {
+    workosUserId: string;
+    config: CloudAdminAuthRevalidateConfig;
+    fetch?: typeof fetch;
+};
+export type CloudAdminAuthRevalidationResult = {
+    ok: boolean;
+    status: "active" | "revoked";
+    reason?: string;
+};
+export declare function exchangeCloudAdminAuthCode({ code, state, config, fetch: fetchFn, now, }: ExchangeCloudAdminAuthCodeInput): Promise<CloudAdminAssertion>;
+export declare function revalidateCloudAdminAuthAccess({ workosUserId, config, fetch: fetchFn, }: RevalidateCloudAdminAuthAccessInput): Promise<CloudAdminAuthRevalidationResult>;
+export declare function verifyCloudAdminAssertion(assertion: string, options: {
+    jwksUrl: string;
+    issuer: typeof VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER;
+    audience: string;
+    deploymentId: string;
+    nonce: string;
+    fetch?: typeof fetch;
+    now?: Date;
+}): Promise<CloudAdminAssertion>;
+//# sourceMappingURL=assertion.d.ts.map

package/dist/cloud-broker/assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertion.d.ts","sourceRoot":"","sources":["../../src/cloud-broker/assertion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGrD,eAAO,MAAM,mCAAmC,6BAA6B,CAAA;AAE7E,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,OAAO,mCAAmC,CAAA;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,CAAA;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAA;CAC7D,CAAA;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC3C,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,mBAAmB,CAAA;IAC1B,MAAM,EAAE,4BAA4B,CAAA;IACpC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,CAAA;AAED,MAAM,MAAM,mCAAmC,GAAG;IAChD,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,8BAA8B,CAAA;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC7C,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAA;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAiBD,wBAAsB,0BAA0B,CAAC,EAC/C,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,EAAE,OAAe,EACtB,GAAgB,GACjB,EAAE,+BAA+B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmChE;AAED,wBAAsB,8BAA8B,CAAC,EACnD,YAAY,EACZ,MAAM,EACN,KAAK,EAAE,OAAe,GACvB,EAAE,mCAAmC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAkCjF;AAED,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;IACP,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,mCAAmC,CAAA;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,GACA,OAAO,CAAC,mBAAmB,CAAC,CAiC9B"}

package/dist/cloud-broker/assertion.js

@@ -0,0 +1,226 @@
+import { base64UrlDecode, isRecord, normalizeAbsoluteUrl, toArrayBuffer } from "./utils.js";
+export const VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER = "https://api.voyantjs.com";
+export async function exchangeCloudAdminAuthCode({ code, state, config, fetch: fetchFn = fetch, now = new Date(), }) {
+    validateExchangeConfig(config);
+    const response = await fetchFn(config.exchangeUrl, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${config.clientToken}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            code,
+            deploymentId: config.deploymentId,
+            redirectUri: state.redirectUri,
+            nonce: state.nonce,
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`Voyant Cloud auth exchange failed with HTTP ${response.status}`);
+    }
+    const body = (await response.json());
+    if (!isRecord(body) || typeof body.assertion !== "string") {
+        throw new Error("Voyant Cloud auth exchange response is missing assertion");
+    }
+    return verifyCloudAdminAssertion(body.assertion, {
+        jwksUrl: config.assertionJwksUrl,
+        issuer: config.assertionIssuer ?? VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER,
+        audience: config.assertionAudience,
+        deploymentId: config.deploymentId,
+        nonce: state.nonce,
+        fetch: fetchFn,
+        now,
+    });
+}
+export async function revalidateCloudAdminAuthAccess({ workosUserId, config, fetch: fetchFn = fetch, }) {
+    validateRevalidateConfig(config);
+    const response = await fetchFn(config.revalidateUrl, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${config.clientToken}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            deploymentId: config.deploymentId,
+            workosUserId,
+        }),
+    });
+    const body = (await response.json().catch(() => null));
+    if (!response.ok && response.status !== 403) {
+        throw new Error(`Voyant Cloud auth revalidation failed with HTTP ${response.status}`);
+    }
+    if (!isRecord(body) ||
+        typeof body.ok !== "boolean" ||
+        (body.status !== "active" && body.status !== "revoked")) {
+        throw new Error("Voyant Cloud auth revalidation response is invalid");
+    }
+    return {
+        ok: body.ok,
+        status: body.status,
+        reason: optionalString(body.reason) ?? undefined,
+    };
+}
+export async function verifyCloudAdminAssertion(assertion, options) {
+    const { header, payload, signingInput, signature } = parseCompactJws(assertion);
+    if (header.alg !== "RS256") {
+        throw new Error(`Unsupported Voyant Cloud auth assertion algorithm: ${header.alg}`);
+    }
+    const jwk = await fetchJwksKey(options.jwksUrl, header.kid, options.fetch ?? fetch);
+    const key = await globalThis.crypto.subtle.importKey("jwk", jwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+    const verified = await globalThis.crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBuffer(signature), toArrayBuffer(new TextEncoder().encode(signingInput)));
+    if (!verified) {
+        throw new Error("Invalid Voyant Cloud auth assertion signature");
+    }
+    const assertionPayload = parseCloudAdminAssertionPayload(payload);
+    validateCloudAdminAssertionClaims(assertionPayload, {
+        issuer: options.issuer,
+        audience: options.audience,
+        deploymentId: options.deploymentId,
+        nonce: options.nonce,
+        now: options.now ?? new Date(),
+    });
+    return assertionPayload;
+}
+function validateExchangeConfig(config) {
+    normalizeAbsoluteUrl(config.exchangeUrl, "exchangeUrl");
+    normalizeAbsoluteUrl(config.assertionJwksUrl, "assertionJwksUrl");
+    if (!config.deploymentId.trim()) {
+        throw new Error("Voyant Cloud auth exchange requires deploymentId");
+    }
+    if (!config.clientToken.trim()) {
+        throw new Error("Voyant Cloud auth exchange requires clientToken");
+    }
+    if (!config.assertionAudience.trim()) {
+        throw new Error("Voyant Cloud auth exchange requires assertionAudience");
+    }
+}
+function validateRevalidateConfig(config) {
+    normalizeAbsoluteUrl(config.revalidateUrl, "revalidateUrl");
+    if (!config.deploymentId.trim()) {
+        throw new Error("Voyant Cloud auth revalidation requires deploymentId");
+    }
+    if (!config.clientToken.trim()) {
+        throw new Error("Voyant Cloud auth revalidation requires clientToken");
+    }
+}
+function parseCompactJws(assertion) {
+    const [encodedHeader, encodedPayload, encodedSignature, ...rest] = assertion.split(".");
+    if (!encodedHeader || !encodedPayload || !encodedSignature || rest.length > 0) {
+        throw new Error("Voyant Cloud auth assertion must be a compact JWS");
+    }
+    const header = JSON.parse(new TextDecoder().decode(base64UrlDecode(encodedHeader)));
+    if (!isRecord(header) || header.alg !== "RS256" || typeof header.kid !== "string") {
+        throw new Error("Voyant Cloud auth assertion header is invalid");
+    }
+    return {
+        header: { alg: header.alg, kid: header.kid, typ: optionalString(header.typ) ?? undefined },
+        payload: JSON.parse(new TextDecoder().decode(base64UrlDecode(encodedPayload))),
+        signingInput: `${encodedHeader}.${encodedPayload}`,
+        signature: base64UrlDecode(encodedSignature),
+    };
+}
+async function fetchJwksKey(jwksUrl, kid, fetchFn) {
+    const response = await fetchFn(jwksUrl);
+    if (!response.ok) {
+        throw new Error(`Voyant Cloud auth JWKS fetch failed with HTTP ${response.status}`);
+    }
+    const body = (await response.json());
+    if (!isJsonWebKeySet(body)) {
+        throw new Error("Voyant Cloud auth JWKS response is invalid");
+    }
+    const key = body.keys.find((candidate) => candidate.kid === kid);
+    if (!key) {
+        throw new Error("Voyant Cloud auth assertion key was not found in JWKS");
+    }
+    if (key.kty !== "RSA") {
+        throw new Error("Voyant Cloud auth assertion key must be RSA");
+    }
+    return key;
+}
+function parseCloudAdminAssertionPayload(payload) {
+    if (!isRecord(payload)) {
+        throw new Error("Voyant Cloud auth assertion payload is invalid");
+    }
+    return {
+        iss: payload.iss,
+        aud: requiredString(payload.aud, "aud"),
+        sub: requiredString(payload.sub, "sub"),
+        email: requiredString(payload.email, "email"),
+        emailVerified: requiredBoolean(payload.emailVerified, "emailVerified"),
+        name: optionalString(payload.name),
+        firstName: optionalString(payload.firstName),
+        lastName: optionalString(payload.lastName),
+        image: optionalString(payload.image),
+        workosUserId: requiredString(payload.workosUserId, "workosUserId"),
+        workosOrganizationId: requiredString(payload.workosOrganizationId, "workosOrganizationId"),
+        platformOrganizationId: requiredString(payload.platformOrganizationId, "platformOrganizationId"),
+        platformOrganizationSlug: requiredString(payload.platformOrganizationSlug, "platformOrganizationSlug"),
+        deploymentId: requiredString(payload.deploymentId, "deploymentId"),
+        appId: optionalString(payload.appId),
+        environment: optionalString(payload.environment),
+        membershipId: optionalString(payload.membershipId),
+        roleSlug: optionalString(payload.roleSlug),
+        roleName: optionalString(payload.roleName),
+        surfaces: optionalStringArray(payload.surfaces),
+        nonce: requiredString(payload.nonce, "nonce"),
+        iat: requiredNumber(payload.iat, "iat"),
+        exp: requiredNumber(payload.exp, "exp"),
+    };
+}
+function validateCloudAdminAssertionClaims(assertion, expected) {
+    const nowSeconds = Math.floor(expected.now.getTime() / 1000);
+    if (assertion.iss !== expected.issuer) {
+        throw new Error("Voyant Cloud auth assertion issuer mismatch");
+    }
+    if (assertion.aud !== expected.audience) {
+        throw new Error("Voyant Cloud auth assertion audience mismatch");
+    }
+    if (assertion.deploymentId !== expected.deploymentId) {
+        throw new Error("Voyant Cloud auth assertion deployment mismatch");
+    }
+    if (assertion.nonce !== expected.nonce) {
+        throw new Error("Voyant Cloud auth assertion nonce mismatch");
+    }
+    if (assertion.exp <= nowSeconds) {
+        throw new Error("Voyant Cloud auth assertion is expired");
+    }
+    if (assertion.iat > nowSeconds + 60) {
+        throw new Error("Voyant Cloud auth assertion iat is in the future");
+    }
+}
+function isJsonWebKeySet(value) {
+    return isRecord(value) && Array.isArray(value.keys) && value.keys.every(isJwksKey);
+}
+function isJwksKey(value) {
+    return isRecord(value) && typeof value.kid === "string" && typeof value.kty === "string";
+}
+function requiredString(value, field) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`Voyant Cloud auth assertion ${field} must be a string`);
+    }
+    return value;
+}
+function optionalString(value) {
+    return typeof value === "string" && value.length > 0 ? value : null;
+}
+function requiredBoolean(value, field) {
+    if (typeof value !== "boolean") {
+        throw new Error(`Voyant Cloud auth assertion ${field} must be a boolean`);
+    }
+    return value;
+}
+function requiredNumber(value, field) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        throw new Error(`Voyant Cloud auth assertion ${field} must be a number`);
+    }
+    return value;
+}
+function optionalStringArray(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+        throw new Error("Voyant Cloud auth assertion surfaces must be an array of strings");
+    }
+    return value;
+}
+//# sourceMappingURL=assertion.js.map

package/dist/cloud-broker/assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertion.js","sourceRoot":"","sources":["../../src/cloud-broker/assertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE3F,MAAM,CAAC,MAAM,mCAAmC,GAAG,0BAA0B,CAAA;AA8E7E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,EAAE,OAAO,GAAG,KAAK,EACtB,GAAG,GAAG,IAAI,IAAI,EAAE,GACgB;IAChC,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAE9B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI;YACJ,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;IAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE;QAC/C,OAAO,EAAE,MAAM,CAAC,gBAAgB;QAChC,MAAM,EAAE,MAAM,CAAC,eAAe,IAAI,mCAAmC;QACrE,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,OAAO;QACd,GAAG;KACJ,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,YAAY,EACZ,MAAM,EACN,KAAK,EAAE,OAAO,GAAG,KAAK,GACc;IACpC,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAEhC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY;SACb,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAA;IAEjE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,IACE,CAAC,QAAQ,CAAC,IAAI,CAAC;QACf,OAAO,IAAI,CAAC,EAAE,KAAK,SAAS;QAC5B,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS;KACjD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,OAQC;IAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IAC/E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAA;IACnF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,aAAa,CAAC,SAAS,CAAC,EACxB,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CACtD,CAAA;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,gBAAgB,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAA;IACjE,iCAAiC,CAAC,gBAAgB,EAAE;QAClD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE;KAC/B,CAAC,CAAA;IACF,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAoC;IAClE,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;IACvD,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAA;IAEjE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAsC;IACtE,oBAAoB,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IAE3D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IAMxC,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvF,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAY,CAAA;IAC9F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE;QAC1F,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAY;QACzF,YAAY,EAAE,GAAG,aAAa,IAAI,cAAc,EAAE;QAClD,SAAS,EAAE,eAAe,CAAC,gBAAgB,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,GAAW,EAAE,OAAqB;IAC7E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;IAC/C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,+BAA+B,CAAC,OAAgB;IACvD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAiD;QAC9D,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACvC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACvC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC;QACtE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;QAC1F,sBAAsB,EAAE,cAAc,CACpC,OAAO,CAAC,sBAAsB,EAC9B,wBAAwB,CACzB;QACD,wBAAwB,EAAE,cAAc,CACtC,OAAO,CAAC,wBAAwB,EAChC,0BAA0B,CAC3B;QACD,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC;QAChD,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;QAClD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC/C,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACvC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;KACxC,CAAA;AACH,CAAC;AAED,SAAS,iCAAiC,CACxC,SAA8B,EAC9B,QAMC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAE5D,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,SAAS,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,GAAG,UAAU,GAAG,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAA;AAC1F,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,mBAAmB,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,oBAAoB,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,mBAAmB,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}