codexgpt 1.0.0

package/dist/auth/ownerApproval.js

@@ -0,0 +1,51 @@
+import { clientRefForId } from "./clientStore.js";
+export class OAuthOwnerApprovalService {
+    authorizations;
+    constructor(authorizations) {
+        this.authorizations = authorizations;
+    }
+    list() {
+        return this.authorizations.listSafe();
+    }
+    approve(pendingId) {
+        return this.authorizations.approve(pendingId);
+    }
+    deny(pendingId) {
+        return this.authorizations.deny(pendingId);
+    }
+}
+export class OAuthOwnerGrantService {
+    grants;
+    constructor(grants) {
+        this.grants = grants;
+    }
+    list() {
+        return this.grants.listSafe();
+    }
+    revoke(grantId) {
+        return this.grants.revokeGrant(grantId, "local");
+    }
+    revokeOwner() {
+        return this.grants.revokeOwner();
+    }
+}
+export class OAuthOwnerClientService {
+    clients;
+    grants;
+    constructor(clients, grants) {
+        this.clients = clients;
+        this.grants = grants;
+    }
+    list() {
+        return this.clients.listSafe();
+    }
+    async revoke(clientId) {
+        const clientChanged = await this.clients.revoke(clientId);
+        const grantsChanged = await this.grants?.revokeClient(clientRefForId(clientId)) ?? 0;
+        return clientChanged || grantsChanged > 0;
+    }
+    pruneUnapproved() {
+        return this.clients.pruneUnapproved();
+    }
+}
+//# sourceMappingURL=ownerApproval.js.map

package/dist/auth/ownerApproval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownerApproval.js","sourceRoot":"","sources":["../../src/auth/ownerApproval.ts"],"names":[],"mappings":"AAIA,OAAO,EAAoB,cAAc,EAA4B,MAAM,kBAAkB,CAAC;AAqB9F,MAAM,OAAO,yBAAyB;IACf;IAArB,YAAqB,cAAkC;QAAlC,mBAAc,GAAd,cAAc,CAAoB;IAAG,CAAC;IAE3D,IAAI;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,SAAiB;QACpB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IACZ;IAArB,YAAqB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAEhD,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,uBAAuB;IAEvB;IACA;IAFX,YACW,OAAyB,EACzB,MAAwB;QADxB,YAAO,GAAP,OAAO,CAAkB;QACzB,WAAM,GAAN,MAAM,CAAkB;IAChC,CAAC;IAEJ,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,OAAO,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;IACxC,CAAC;CACF"}

package/dist/auth/policyIdentity.js

@@ -0,0 +1,189 @@
+import { createHash } from "node:crypto";
+import { semanticDigest } from "../policy/authorizationFacts.js";
+import { oauthRequestIdentityV2Schema } from "../policy/schemas.js";
+import { POLICY_SCOPES_V4 } from "../policy/types.js";
+import { currentOAuthRequestContext } from "./requestContext.js";
+import { KNOWN_OAUTH_SCOPES } from "./types.js";
+const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+function base32Lower(buffer) {
+    let bits = 0;
+    let value = 0;
+    let output = "";
+    for (const byte of buffer) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+    return output;
+}
+function orderedPolicyScopes(scopes) {
+    return POLICY_SCOPES_V4.filter((scope) => scopes.has(scope));
+}
+export function knownOAuthScopes() {
+    return KNOWN_OAUTH_SCOPES;
+}
+export function oauthScopesForDeployment(config) {
+    const scopes = ["codexgpt:read"];
+    if (config.writeMode !== "off" || config.gitMode === "local")
+        scopes.push("codexgpt:write");
+    if (config.bashMode !== "off" || config.executionProfile !== "off")
+        scopes.push("codexgpt:execute");
+    return Object.freeze(scopes);
+}
+export function internalScopesForOAuth(scopes) {
+    const mapped = new Set();
+    if (scopes.includes("codexgpt:read")) {
+        mapped.add("workspace:open");
+        mapped.add("filesystem:read");
+        mapped.add("git:read");
+        mapped.add("audit:read");
+    }
+    if (scopes.includes("codexgpt:write")) {
+        mapped.add("filesystem:write");
+        mapped.add("git:write");
+        mapped.add("git:index:write");
+        mapped.add("git:refs:write");
+        mapped.add("git:commit");
+        mapped.add("git:merge");
+        mapped.add("worktree:manage");
+    }
+    if (scopes.includes("codexgpt:execute")) {
+        mapped.add("shell:verify");
+        mapped.add("shell:execute");
+        mapped.add("process:manage");
+        mapped.add("process:persistent");
+        mapped.add("network:connect");
+        mapped.add("workspace:full-access");
+        mapped.add("host:full-access");
+    }
+    return Object.freeze(orderedPolicyScopes(mapped));
+}
+export function deploymentPolicyScopes(config) {
+    const scopes = new Set([
+        "workspace:open",
+        "filesystem:read",
+        "git:read",
+        "audit:read"
+    ]);
+    if (config.writeMode !== "off")
+        scopes.add("filesystem:write");
+    if (config.gitMode === "local") {
+        scopes.add("git:write");
+        scopes.add("git:index:write");
+        scopes.add("git:refs:write");
+        scopes.add("git:commit");
+        scopes.add("git:merge");
+        scopes.add("worktree:manage");
+    }
+    if (config.bashMode === "safe" || config.bashMode === "full")
+        scopes.add("shell:verify");
+    if (config.bashMode === "full")
+        scopes.add("shell:execute");
+    if (config.executionProfile !== "off") {
+        scopes.add("shell:execute");
+        scopes.add("process:manage");
+        scopes.add("process:persistent");
+    }
+    if (config.executionProfile === "full_access") {
+        scopes.add("workspace:full-access");
+        scopes.add("host:full-access");
+        scopes.add("network:connect");
+    }
+    return Object.freeze(orderedPolicyScopes(scopes));
+}
+export function effectivePolicyScopes(config, identity) {
+    const deployment = new Set(deploymentPolicyScopes(config));
+    const requested = new Set(identity.scopes);
+    if (!(identity.schemaVersion === 2 && identity.kind === "oauth_subject")) {
+        if (config.toolContractVersion >= 3 && config.executionProfile !== "off") {
+            requested.add("shell:execute");
+            requested.add("process:manage");
+            requested.add("process:persistent");
+        }
+        if (config.toolContractVersion >= 3 && config.executionProfile === "full_access") {
+            requested.add("workspace:full-access");
+            requested.add("host:full-access");
+            requested.add("network:connect");
+        }
+        if (config.toolContractVersion >= 4 && config.gitMode === "local") {
+            requested.add("git:index:write");
+            requested.add("git:refs:write");
+            requested.add("git:commit");
+            requested.add("git:merge");
+            requested.add("worktree:manage");
+        }
+    }
+    return Object.freeze(POLICY_SCOPES_V4.filter((scope) => deployment.has(scope) && requested.has(scope)));
+}
+export function ownerIdForOAuthSubject(subject) {
+    const digest = createHash("sha256")
+        .update("codexgpt/oauth-owner/v1\0", "utf8")
+        .update(subject, "utf8")
+        .digest("hex")
+        .slice(0, 32);
+    return `owner_${digest}`;
+}
+function oauthCredentialRef(grantId) {
+    const digest = createHash("sha256")
+        .update("codexgpt/oauth-grant/v1\0", "utf8")
+        .update(grantId, "utf8")
+        .digest();
+    return `cred_${base32Lower(digest).slice(0, 26)}`;
+}
+export function createOAuthPolicyIdentity(context) {
+    return Object.freeze(oauthRequestIdentityV2Schema.parse({
+        schemaVersion: 2,
+        kind: "oauth_subject",
+        authenticationMode: "oauth2",
+        credentialRef: oauthCredentialRef(context.grantId),
+        credentialRevision: `oauth_grant_revision_${context.grantRevision}`,
+        subject: context.ownerSubject,
+        ownerId: ownerIdForOAuthSubject(context.ownerSubject),
+        tokenId: context.tokenId,
+        clientRef: context.clientRef,
+        scopes: internalScopesForOAuth(context.scopes),
+        assuranceLevel: "strong"
+    }));
+}
+export function createOAuthPolicySessionSource(input) {
+    const currentIdentity = () => createOAuthPolicyIdentity(currentOAuthRequestContext());
+    return Object.freeze({
+        transportKind: "streamable_http",
+        transportSessionId: input.transportSessionId,
+        get identity() {
+            return currentIdentity();
+        },
+        currentIdentity
+    });
+}
+export function ownerIdForPolicyIdentity(identity) {
+    if (identity.schemaVersion === 2 && identity.kind === "oauth_subject")
+        return identity.ownerId;
+    const legacySeed = `${identity.kind}\0${identity.subject ?? ""}\0${identity.credentialRef ?? ""}`;
+    return `owner_${createHash("sha256").update(legacySeed).digest("hex").slice(0, 32)}`;
+}
+export function policyIdentityOwnershipFacts(identity) {
+    if (!(identity.schemaVersion === 2 && identity.kind === "oauth_subject"))
+        return identity;
+    return Object.freeze({
+        schemaVersion: 2,
+        kind: "oauth_subject",
+        ownerId: identity.ownerId
+    });
+}
+export function credentialRevisionForCredentialRef(credentialRef) {
+    if (!credentialRef)
+        return "credential-none";
+    return semanticDigest({ credentialRef });
+}
+export function credentialRevisionForIdentity(identity) {
+    if (identity.schemaVersion === 2 && identity.kind === "oauth_subject")
+        return identity.credentialRevision;
+    return credentialRevisionForCredentialRef(identity.credentialRef);
+}
+//# sourceMappingURL=policyIdentity.js.map

package/dist/auth/policyIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyIdentity.js","sourceRoot":"","sources":["../../src/auth/policyIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EACL,gBAAgB,EAIjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAA4B,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAmB,MAAM,YAAY,CAAC;AAEjE,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAkC;IAC7D,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,MAAM,MAAM,GAAiB,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAA6B;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAgB;QACpC,gBAAgB;QAChB,iBAAiB;QACjB,UAAU;QACV,YAAY;KACb,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,aAAa,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAsB,EACtB,QAAyB;IAEzB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAgB,QAAQ,CAAC,MAAyB,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;QACzE,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;YACzE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAChC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,aAAa,EAAE,CAAC;YACjF,SAAS,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACvC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAClC,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAClE,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACjC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAChC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC5B,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC3B,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAAC;SAC3C,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAAC;SAC3C,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;SACvB,MAAM,EAAE,CAAC;IACZ,OAAO,QAAQ,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAsC;IAEtC,OAAO,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,KAAK,CAAC;QACtD,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,eAAe;QACrB,kBAAkB,EAAE,QAAQ;QAC5B,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;QAClD,kBAAkB,EAAE,wBAAwB,OAAO,CAAC,aAAa,EAAE;QACnE,OAAO,EAAE,OAAO,CAAC,YAAY;QAC7B,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,YAAY,CAAC;QACrD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9C,cAAc,EAAE,QAAQ;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAE9C;IACC,MAAM,eAAe,GAAG,GAAoB,EAAE,CAAC,yBAAyB,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,iBAA0B;QACzC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,IAAI,QAAQ;YACV,OAAO,eAAe,EAAE,CAAC;QAC3B,CAAC;QACD,eAAe;KAChB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAyB;IAChE,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC/F,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,IAAI,EAAE,KAAK,QAAQ,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;IAClG,OAAO,SAAS,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAAyB;IAKpE,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,CAAU;QACzB,IAAI,EAAE,eAAwB;QAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,aAA4B;IAC7E,IAAI,CAAC,aAAa;QAAE,OAAO,iBAAiB,CAAC;IAC7C,OAAO,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,QAAyB;IACrE,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,QAAQ,CAAC,kBAAkB,CAAC;IAC1G,OAAO,kCAAkC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACpE,CAAC"}

package/dist/auth/rateLimits.js

@@ -0,0 +1,66 @@
+export class FixedWindowRateLimiter {
+    #limit;
+    #now;
+    #maximumKeys;
+    #counters = new Map();
+    constructor(limit, options = {}) {
+        if (!Number.isInteger(limit.windowMs) || limit.windowMs < 1) {
+            throw new Error("OAuth rate-limit window is invalid.");
+        }
+        if (!Number.isInteger(limit.maximum) || limit.maximum < 1) {
+            throw new Error("OAuth rate-limit maximum is invalid.");
+        }
+        this.#limit = Object.freeze({ ...limit });
+        this.#now = options.now ?? Date.now;
+        this.#maximumKeys = options.maximumKeys ?? 256;
+        if (!Number.isInteger(this.#maximumKeys) || this.#maximumKeys < 1) {
+            throw new Error("OAuth rate-limit key capacity is invalid.");
+        }
+    }
+    consume(key) {
+        const now = this.#now();
+        this.#prune(now);
+        let counter = this.#counters.get(key);
+        if (!counter || now - counter.windowStartedAt >= this.#limit.windowMs) {
+            counter = { windowStartedAt: now, count: 0, lastSeenAt: now };
+            this.#counters.set(key, counter);
+        }
+        counter.count += 1;
+        counter.lastSeenAt = now;
+        const remainingMs = Math.max(1, this.#limit.windowMs - (now - counter.windowStartedAt));
+        return Object.freeze({
+            allowed: counter.count <= this.#limit.maximum,
+            retryAfterSeconds: Math.max(1, Math.ceil(remainingMs / 1000))
+        });
+    }
+    size() {
+        return this.#counters.size;
+    }
+    #prune(now) {
+        for (const [key, counter] of this.#counters) {
+            if (now - counter.windowStartedAt >= this.#limit.windowMs)
+                this.#counters.delete(key);
+        }
+        if (this.#counters.size < this.#maximumKeys)
+            return;
+        const oldest = [...this.#counters.entries()]
+            .sort((left, right) => left[1].lastSeenAt - right[1].lastSeenAt)
+            .slice(0, Math.max(1, this.#counters.size - this.#maximumKeys + 1));
+        for (const [key] of oldest)
+            this.#counters.delete(key);
+    }
+}
+export const CORE_OAUTH_RATE_LIMITS = Object.freeze({
+    registration: Object.freeze({ windowMs: 60 * 60 * 1000, maximum: 20 }),
+    authorizeDeployment: Object.freeze({ windowMs: 15 * 60 * 1000, maximum: 120 }),
+    authorizeClient: Object.freeze({ windowMs: 15 * 60 * 1000, maximum: 20 }),
+    statusBinding: Object.freeze({ windowMs: 5 * 60 * 1000, maximum: 180 }),
+    statusDeployment: Object.freeze({ windowMs: 5 * 60 * 1000, maximum: 4096 }),
+    continueBinding: Object.freeze({ windowMs: 5 * 60 * 1000, maximum: 4 }),
+    continueDeployment: Object.freeze({ windowMs: 5 * 60 * 1000, maximum: 256 }),
+    tokenDeployment: Object.freeze({ windowMs: 15 * 60 * 1000, maximum: 120 }),
+    tokenClient: Object.freeze({ windowMs: 15 * 60 * 1000, maximum: 30 }),
+    revokeDeployment: Object.freeze({ windowMs: 15 * 60 * 1000, maximum: 60 }),
+    revokeClient: Object.freeze({ windowMs: 15 * 60 * 1000, maximum: 20 })
+});
+//# sourceMappingURL=rateLimits.js.map

package/dist/auth/rateLimits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimits.js","sourceRoot":"","sources":["../../src/auth/rateLimits.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,sBAAsB;IACxB,MAAM,CAAmB;IACzB,IAAI,CAAe;IACnB,YAAY,CAAS;IACrB,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEhD,YACE,KAAuB,EACvB,UAAwD,EAAE;QAE1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtE,OAAO,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACnB,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAC7C,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY;YAAE,OAAO;QACpD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;aACzC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;aAC/D,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtE,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC9E,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACvE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3E,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC5E,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1E,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC1E,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;CAC9D,CAAC,CAAC"}

package/dist/auth/recovery.js

@@ -0,0 +1,275 @@
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { AtomicJsonFileStore } from "../transactions/atomicStateFile.js";
+import { authConfigurationError } from "./errors.js";
+import { DeploymentStateV1Schema, authStateIntegrity, deploymentStateFile } from "./stateStore.js";
+function release(handle) {
+    if (handle)
+        handle.release();
+}
+function deploymentLockName(bindingId) {
+    if (!/^binding_[a-f0-9]{32}$/.test(bindingId)) {
+        throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth deployment binding identifier is invalid.");
+    }
+    return `deployment_${bindingId}`;
+}
+export class AuthDeploymentCoordinator {
+    store;
+    keyManager;
+    registry;
+    locks;
+    constructor(store, keyManager, registry, locks) {
+        this.store = store;
+        this.keyManager = keyManager;
+        this.registry = registry;
+        this.locks = locks;
+    }
+    async initialize(configuration) {
+        let installationLock = null;
+        let registryLock = null;
+        let deploymentLock = null;
+        try {
+            installationLock = this.locks.acquire("installation");
+            const owner = await this.store.initializeOwner();
+            release(installationLock);
+            installationLock = null;
+            registryLock = this.locks.acquire("registry");
+            const existing = this.registry.resolve(configuration.identityKey);
+            if (existing) {
+                deploymentLock = this.locks.acquire(deploymentLockName(existing.bindingId));
+                const state = this.registry.readCurrentState(configuration.identityKey);
+                return { ownerSubject: owner.subject, state, created: false };
+            }
+            const bindingId = this.keyManager.newId("binding");
+            deploymentLock = this.locks.acquire(deploymentLockName(bindingId));
+            const initial = await this.keyManager.createInitialDeployment({
+                canonicalRoot: configuration.canonicalRoot,
+                profileId: configuration.profileId,
+                hostname: configuration.hostname,
+                issuer: configuration.issuer,
+                resource: configuration.resource,
+                bindingId,
+                owner: owner.record
+            });
+            const state = await this.store.writeDeployment(initial);
+            await this.registry.bind({ configuration, state });
+            return { ownerSubject: owner.subject, state, created: true };
+        }
+        finally {
+            release(deploymentLock);
+            release(registryLock);
+            release(installationLock);
+        }
+    }
+    async createBackup(identityKey) {
+        const entry = this.registry.resolve(identityKey);
+        if (!entry)
+            throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth deployment is not registered.");
+        const lock = this.locks.acquire(deploymentLockName(entry.bindingId));
+        try {
+            const state = this.registry.readCurrentState(identityKey);
+            return await this.store.createDeploymentBackup(state.bindingId, state.incarnationId);
+        }
+        finally {
+            lock.release();
+        }
+    }
+    async rotateSigningKey(identityKey, options = {}) {
+        const entry = this.registry.resolve(identityKey);
+        if (!entry)
+            throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth deployment is not registered.");
+        const lock = this.locks.acquire(deploymentLockName(entry.bindingId));
+        try {
+            const state = this.registry.readCurrentState(identityKey);
+            if (options.createBackup !== false) {
+                await this.store.createDeploymentBackup(state.bindingId, state.incarnationId);
+            }
+            return await this.keyManager.rotateSigningKey(this.store, state);
+        }
+        finally {
+            lock.release();
+        }
+    }
+    async rebindAsSecurityReset(identityKey, configuration, hooks = {}) {
+        let registryLock = null;
+        let deploymentLock = null;
+        try {
+            registryLock = this.locks.acquire("registry");
+            const entry = this.registry.resolve(identityKey);
+            if (!entry)
+                throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth deployment is not registered.");
+            if (configuration.identityKey !== identityKey) {
+                throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth rebind cannot change hostname, issuer, or resource.");
+            }
+            deploymentLock = this.locks.acquire(deploymentLockName(entry.bindingId));
+            const current = this.registry.readCurrentState(identityKey);
+            const owner = this.store.readOwner();
+            if (owner.ownerRef !== current.ownerRef) {
+                throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth installation owner and deployment disagree.");
+            }
+            await this.store.createDeploymentBackup(current.bindingId, current.incarnationId);
+            const reset = await this.keyManager.createInitialDeployment({
+                canonicalRoot: configuration.canonicalRoot,
+                profileId: configuration.profileId,
+                hostname: configuration.hostname,
+                issuer: configuration.issuer,
+                resource: configuration.resource,
+                bindingId: current.bindingId,
+                incarnationId: this.keyManager.newId("incarnation"),
+                recoveryEpoch: this.keyManager.newId("epoch"),
+                owner
+            });
+            const candidate = await this.store.writeDeployment({
+                ...reset,
+                generation: current.generation + 1,
+                grants: [],
+                clients: [],
+                previousPublicJwks: [],
+                auditCursorRef: null
+            }, "deployment_recovered");
+            await hooks.afterIncarnationWrite?.(candidate);
+            await this.registry.rebind({ identityKey, configuration, state: candidate });
+            await hooks.afterRegistryPublish?.(candidate);
+            return candidate;
+        }
+        finally {
+            release(deploymentLock);
+            release(registryLock);
+        }
+    }
+    async restoreAsSecurityReset(identityKey, backup, hooks = {}) {
+        let registryLock = null;
+        let deploymentLock = null;
+        try {
+            registryLock = this.locks.acquire("registry");
+            const entry = this.registry.resolve(identityKey);
+            if (!entry)
+                throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth deployment is not registered.");
+            deploymentLock = this.locks.acquire(deploymentLockName(entry.bindingId));
+            const current = this.registry.readCurrentState(identityKey);
+            const verifiedBackup = DeploymentStateV1Schema.safeParse(backup);
+            if (!verifiedBackup.success || verifiedBackup.data.integrity !== authStateIntegrity(verifiedBackup.data)) {
+                throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth recovery backup integrity verification failed.");
+            }
+            backup = verifiedBackup.data;
+            if (backup.bindingId !== current.bindingId || backup.ownerRef !== current.ownerRef) {
+                throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth recovery backup belongs to another binding.");
+            }
+            if (backup.canonicalRoot !== current.canonicalRoot || backup.profileId !== current.profileId ||
+                backup.hostname !== current.hostname || backup.issuer !== current.issuer || backup.resource !== current.resource) {
+                throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth recovery backup changes deployment identity.");
+            }
+            const owner = this.store.readOwner();
+            if (owner.ownerRef !== current.ownerRef) {
+                throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth installation owner and deployment disagree.");
+            }
+            await this.store.createDeploymentBackup(current.bindingId, current.incarnationId);
+            const reset = await this.keyManager.createInitialDeployment({
+                canonicalRoot: current.canonicalRoot,
+                profileId: current.profileId,
+                hostname: current.hostname,
+                issuer: current.issuer,
+                resource: current.resource,
+                bindingId: current.bindingId,
+                incarnationId: this.keyManager.newId("incarnation"),
+                recoveryEpoch: this.keyManager.newId("epoch"),
+                owner
+            });
+            const candidate = await this.store.writeDeployment({
+                ...reset,
+                generation: current.generation + 1,
+                grants: [],
+                previousPublicJwks: [],
+                auditCursorRef: null
+            }, "deployment_recovered");
+            await hooks.afterIncarnationWrite?.(candidate);
+            await this.registry.setCurrentIncarnation(current.bindingId, candidate.incarnationId);
+            await hooks.afterRegistryPublish?.(candidate);
+            return candidate;
+        }
+        finally {
+            release(deploymentLock);
+            release(registryLock);
+        }
+    }
+}
+const KnownDeploymentStateV0Schema = z.object({
+    schemaVersion: z.literal(0),
+    generation: z.number().int().positive(),
+    bindingId: z.string().regex(/^binding_[a-f0-9]{32}$/),
+    incarnationId: z.string().regex(/^incarnation_[a-f0-9]{32}$/),
+    recoveryEpoch: z.string().regex(/^epoch_[a-f0-9]{32}$/),
+    canonicalRoot: z.string().min(1).max(32768),
+    profileId: z.string().regex(/^[a-f0-9]{24}$/),
+    hostname: z.string().min(1).max(253),
+    issuer: z.string().url(),
+    resource: z.string().url(),
+    ownerRef: z.string().regex(/^ownerref_[a-f0-9]{32}$/),
+    credentialProvider: z.literal("windows-dpapi-current-user"),
+    protectedSigningPrivateJwk: z.string().min(4).max(131072),
+    activePublicJwk: z.unknown(),
+    protectedRefreshPepper: z.string().min(4).max(131072),
+    grants: z.array(z.unknown()).max(4096),
+    createdAt: z.string().datetime({ offset: true }),
+    updatedAt: z.string().datetime({ offset: true }),
+    integrity: z.string().regex(/^sha256:[a-f0-9]{64}$/)
+}).strict();
+export async function migrateKnownDeploymentStateV0(input) {
+    const file = deploymentStateFile(input.store.paths().root, input.bindingId, input.incarnationId);
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth state cannot be read for migration.");
+    }
+    if (raw.schemaVersion !== 0) {
+        throw authConfigurationError("OAUTH_STATE_MIGRATION_REQUIRED", "OAuth state schema is not a known migratable version.");
+    }
+    const old = KnownDeploymentStateV0Schema.parse(raw);
+    if (old.integrity !== authStateIntegrity(old)) {
+        throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth migration source integrity failed.");
+    }
+    const backupDirectory = path.join(path.dirname(file), "backups");
+    const backupFile = path.join(backupDirectory, `state-v0-generation-${old.generation}.json`);
+    const backupStore = new AtomicJsonFileStore(input.store.paths().root, KnownDeploymentStateV0Schema);
+    backupStore.write(backupFile, old);
+    const migrated = DeploymentStateV1Schema.parse({
+        ...old,
+        schemaVersion: 1,
+        generation: old.generation + 1,
+        previousPublicJwks: [],
+        recoveryRequired: false,
+        auditCursorRef: null,
+        updatedAt: new Date().toISOString(),
+        integrity: "sha256:" + "0".repeat(64)
+    });
+    const { integrity: _discarded, ...withoutIntegrity } = migrated;
+    return input.store.writeDeployment(withoutIntegrity, "state_migrated");
+}
+export function createKnownDeploymentStateV0ForTest(state) {
+    const value = {
+        schemaVersion: 0,
+        generation: state.generation,
+        bindingId: state.bindingId,
+        incarnationId: state.incarnationId,
+        recoveryEpoch: state.recoveryEpoch,
+        canonicalRoot: state.canonicalRoot,
+        profileId: state.profileId,
+        hostname: state.hostname,
+        issuer: state.issuer,
+        resource: state.resource,
+        ownerRef: state.ownerRef,
+        credentialProvider: state.credentialProvider,
+        protectedSigningPrivateJwk: state.protectedSigningPrivateJwk,
+        activePublicJwk: state.activePublicJwk,
+        protectedRefreshPepper: state.protectedRefreshPepper,
+        grants: state.grants,
+        createdAt: state.createdAt,
+        updatedAt: state.updatedAt,
+        integrity: "sha256:" + "0".repeat(64)
+    };
+    return KnownDeploymentStateV0Schema.parse({ ...value, integrity: authStateIntegrity(value) });
+}
+//# sourceMappingURL=recovery.js.map

package/dist/auth/recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../src/auth/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAKrD,OAAO,EAEL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,iBAAiB,CAAC;AAazB,SAAS,OAAO,CAAC,MAAkC;IACjD,IAAI,MAAM;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,cAAc,SAAS,EAAoC,CAAC;AACrE,CAAC;AAED,MAAM,OAAO,yBAAyB;IAEzB;IACA;IACA;IACA;IAJX,YACW,KAAqB,EACrB,UAA0B,EAC1B,QAA4B,EAC5B,KAAoB;QAHpB,UAAK,GAAL,KAAK,CAAgB;QACrB,eAAU,GAAV,UAAU,CAAgB;QAC1B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,UAAK,GAAL,KAAK,CAAe;IAC5B,CAAC;IAEJ,KAAK,CAAC,UAAU,CAAC,aAA2C;QAC1D,IAAI,gBAAgB,GAA+B,IAAI,CAAC;QACxD,IAAI,YAAY,GAA+B,IAAI,CAAC;QACpD,IAAI,cAAc,GAA+B,IAAI,CAAC;QACtD,IAAI,CAAC;YACH,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACjD,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC1B,gBAAgB,GAAG,IAAI,CAAC;YAExB,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;gBACxE,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAChE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnD,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;gBAC5D,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,CAAC;YACxB,OAAO,CAAC,YAAY,CAAC,CAAC;YACtB,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC1D,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACvF,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,UAAsC,EAAE;QAExC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC1D,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnE,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,WAAmB,EACnB,aAA2C,EAC3C,QAA2B,EAAE;QAE7B,IAAI,YAAY,GAA+B,IAAI,CAAC;QACpD,IAAI,cAAc,GAA+B,IAAI,CAAC;QACtD,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;YACxG,IAAI,aAAa,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBAC9C,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,2DAA2D,CAAC,CAAC;YACpH,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACxC,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,mDAAmD,CAAC,CAAC;YACrH,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;gBAC1D,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC;gBACnD,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC7C,KAAK;aACN,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;gBACjD,GAAG,KAAK;gBACR,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;gBAClC,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,EAAE;gBACX,kBAAkB,EAAE,EAAE;gBACtB,cAAc,EAAE,IAAI;aACrB,EAAE,sBAAsB,CAAC,CAAC;YAC3B,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7E,MAAM,KAAK,CAAC,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,CAAC;YACxB,OAAO,CAAC,YAAY,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,WAAmB,EACnB,MAAyB,EACzB,QAA2B,EAAE;QAE7B,IAAI,YAAY,GAA+B,IAAI,CAAC;QACpD,IAAI,cAAc,GAA+B,IAAI,CAAC;QACtD,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;YACxG,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,cAAc,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,KAAK,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzG,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,sDAAsD,CAAC,CAAC;YACxH,CAAC;YACD,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC;YAC7B,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACnF,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,mDAAmD,CAAC,CAAC;YAC5G,CAAC;YACD,IACE,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACxF,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAChH,CAAC;gBACD,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,oDAAoD,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACxC,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,mDAAmD,CAAC,CAAC;YACrH,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;gBAC1D,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC;gBACnD,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC7C,KAAK;aACN,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAChD;gBACE,GAAG,KAAK;gBACR,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;gBAClC,MAAM,EAAE,EAAE;gBACV,kBAAkB,EAAE,EAAE;gBACtB,cAAc,EAAE,IAAI;aACrB,EACD,sBAAsB,CACvB,CAAC;YACF,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YACtF,MAAM,KAAK,CAAC,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,CAAC;YACxB,OAAO,CAAC,YAAY,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,CAAC;IAC7D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACrD,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACzD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACrD,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACjG,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,2CAA2C,CAAC,CAAC;IAC7G,CAAC;IACD,IAAK,GAAmC,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,sBAAsB,CAC1B,gCAAgC,EAChC,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,GAAG,CAAC,SAAS,KAAK,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,0CAA0C,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,uBAAuB,GAAG,CAAC,UAAU,OAAO,CAAC,CAAC;IAC5F,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACpG,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC;QAC7C,GAAG,GAAG;QACN,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,CAAC;QAC9B,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,KAAK;QACvB,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAChE,OAAO,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAwB;IAC1E,MAAM,KAAK,GAAG;QACZ,aAAa,EAAE,CAAU;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtC,CAAC;IACF,OAAO,4BAA4B,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC"}