gemi 0.116.0 → 0.118.0

package/dist/app/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{Ha as a}from"../chunk-tw5kwbx4.js";import"../chunk-d9mar37g.js";import"../chunk-vw8849ys.js";export{a as App};
+import{Ia as a}from"../chunk-bz8xssrc.js";import"../chunk-jf6qqzat.js";import"../chunk-hm9cjxy2.js";export{a as App};
 
-//# debugId=288F3EAB17F12DE464756E2164756E21
+//# debugId=361A054EB09C885C64756E2164756E21

package/dist/app/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "288F3EAB17F12DE464756E2164756E21",
+  "debugId": "361A054EB09C885C64756E2164756E21",
   "names": []
 }

package/dist/auth/AuthServiceProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthServiceProvider.d.ts","sourceRoot":"","sources":["../../auth/AuthServiceProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAI7D,qBAAa,mBAAoB,SAAQ,eAAe;IACtD,QAAQ;CAMT"}
+{"version":3,"file":"AuthServiceProvider.d.ts","sourceRoot":"","sources":["../../auth/AuthServiceProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAK7D,qBAAa,mBAAoB,SAAQ,eAAe;IACtD,QAAQ;CAaT"}

package/dist/auth/config.d.ts

@@ -1,6 +1,9 @@
 import type { HttpRequest } from "../http/HttpRequest";
 import type { SessionWithUser, User } from "./types";
 import type { OAuthProvider } from "./oauth/OAuthProvider";
+import type { ConnectionStore } from "./connections/ConnectionStore";
+import type { ProviderConnection } from "./connections/ConnectionManager";
+import type { OAuthConnectionProvider } from "./connections/OAuthConnectionProvider";
 import type { CodeRateLimits } from "./oneTimeCode";
 /** What `emailCode.send` is handed. */
 export interface EmailCodeSendArgs {
@@ -76,6 +79,14 @@ export interface EmailCodeConfig {
      */
     send?: (args: EmailCodeSendArgs) => Promise<void> | void;
 }
+/** What `onConnected` is handed. */
+export interface ConnectedArgs {
+    user: User;
+    /** The key under `auth.connections`. */
+    provider: string;
+    connection: ProviderConnection;
+    req: HttpRequest<any, any>;
+}
 /** What `onAuthenticated` is handed. */
 export interface AuthenticatedArgs {
     user: User;
@@ -161,6 +172,22 @@ export interface AuthConfig {
      * instead.
      */
     oauthFailurePath?: string | null;
+    /**
+     * Providers a user can connect their account to, to call the provider's API
+     * on their behalf (as opposed to `oauthProviders`, which sign in). The key
+     * is the provider's name in `/auth/connections/<name>` and in
+     * `Connections.for(user, name)`. See "OAuth connections" in
+     * docs/authentication.md.
+     */
+    connections?: Record<string, OAuthConnectionProvider>;
+    /**
+     * Where connections are kept. Default: the `gemi_oauth_connections` table on
+     * the default database connection, tokens encrypted with the app's
+     * encryption keys.
+     */
+    connectionStore?: ConnectionStore | (() => ConnectionStore) | null;
+    /** After a connection is stored by the connect callback. */
+    onConnected?: (args: ConnectedArgs) => Promise<void> | void;
     verifyPassword?: (password: string, hash: string) => Promise<boolean>;
     hashPassword?: (password: string) => Promise<string>;
     generateForgotPasswordToken?: (user: User) => Promise<string>;

package/dist/auth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../auth/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,GAAG,CAAC;IACb,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC;IAC3D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE;IACH,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,KACE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAGhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAEvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAEpD,aAAa,CAAC,EAAE,UAAU,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,2BAA2B,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAGrE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,IAAI,EACV,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,CACT,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,CACjB,IAAI,EAAE,GAAG,EACT,iBAAiB,EAAE,MAAM,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,kBAAkB,CAAC,EAAE,CACnB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B,gGAAgG;IAChG,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAEpE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrE;AAcD,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,eAAoB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAiCzF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAE/D;AAID,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,UAAe,GACtB,QAAQ,CAAC,UAAU,CAAC,CA6CtB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../auth/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAErF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,GAAG,CAAC;IACb,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC;IAC3D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE;IACH,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,KACE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAGhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAEvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAEpD,aAAa,CAAC,EAAE,UAAU,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACtD;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,IAAI,CAAC;IACnE,4DAA4D;IAC5D,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE5D,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,2BAA2B,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAGrE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,IAAI,EACV,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,CACT,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,CACjB,IAAI,EAAE,GAAG,EACT,iBAAiB,EAAE,MAAM,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,kBAAkB,CAAC,EAAE,CACnB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B,gGAAgG;IAChG,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAEpE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrE;AAcD,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,eAAoB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAiCzF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAE/D;AAID,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,UAAe,GACtB,QAAQ,CAAC,UAAU,CAAC,CAgDtB"}

package/dist/auth/connections/ConnectionManager.d.ts

@@ -0,0 +1,133 @@
+import { type ConnectionRecord, type ConnectionStore } from "./ConnectionStore";
+import { type OAuthConnectionProvider, type OAuthTokenSet } from "./OAuthConnectionProvider";
+/** A user, as far as a connection is concerned: anything with an `id`. */
+export type ConnectionOwner = {
+    id: string | number;
+} | string | number;
+/** What `Connections.fake` answers an API request with. */
+export type FakeConnectionHandler = (request: Request) => Response | Promise<Response>;
+export interface ConnectionManagerOptions {
+    providers: Record<string, OAuthConnectionProvider>;
+    /** Default: a `DatabaseConnectionStore` on the default database connection. */
+    store?: ConnectionStore | (() => ConnectionStore);
+}
+/**
+ * The OAuth connections a user has made, and the one place their tokens are
+ * read, refreshed and spent. Reached through the `Connections` facade.
+ */
+export declare class ConnectionManager {
+    private readonly options;
+    static token: string;
+    private resolvedStore;
+    private readonly refreshing;
+    private fakes;
+    private fakeStore;
+    readonly fakeRequests: Request[];
+    constructor(options: ConnectionManagerOptions);
+    get providers(): Record<string, OAuthConnectionProvider>;
+    /** The store connections are kept in. */
+    get store(): ConnectionStore;
+    provider(name: string): OAuthConnectionProvider;
+    /** The user's connection to `provider`, or `null` when they have not connected it. */
+    for(user: ConnectionOwner, provider: string): Promise<ProviderConnection | null>;
+    /** Every connection the user has. */
+    list(user: ConnectionOwner): Promise<ProviderConnection[]>;
+    /**
+     * Stores tokens for the user, replacing any earlier connection to the same
+     * provider. The connect callback calls this; call it yourself for tokens
+     * obtained some other way.
+     */
+    save(user: ConnectionOwner, provider: string, tokens: Partial<OAuthTokenSet> & {
+        accessToken: string;
+    }): Promise<ProviderConnection>;
+    /**
+     * Fakes every provider's API: connections live in memory, `fetch` answers
+     * through `handlers[provider]` (recorded in `fakeRequests`), and nothing
+     * reaches a token or revocation endpoint. Returns `this` so a test can
+     * `save` a connection to start from.
+     */
+    fake(handlers?: Record<string, FakeConnectionHandler>): this;
+    /** Undoes `fake`. */
+    restore(): void;
+    get faked(): boolean;
+    /** @internal */
+    send(provider: string, request: Request): Promise<Response>;
+    /**
+     * A record whose access token is not the one at `staleRevision`: refreshed
+     * by this call, or by whoever refreshed it first. Serialised per connection
+     * in this process (concurrent callers share one refresh) and, through the
+     * app's lock store, across processes — a rotating refresh token must be
+     * spent exactly once.
+     *
+     * @internal
+     */
+    refresh(record: ConnectionRecord): Promise<ConnectionRecord>;
+    private refreshOnce;
+    private withLock;
+}
+/**
+ * One user's connection to one provider. Never exposes a token as a property,
+ * and serialises (`toJSON`, `console.log`) without them.
+ */
+export declare class ProviderConnection {
+    private readonly manager;
+    private record;
+    constructor(manager: ConnectionManager, record: ConnectionRecord);
+    get provider(): string;
+    get userId(): string;
+    get providerAccountId(): string | null;
+    /** The scopes the provider granted. */
+    get scopes(): readonly string[];
+    get expiresAt(): Date | null;
+    /** A refresh was refused: the user has to connect again. */
+    get needsReconnect(): boolean;
+    get connectedAt(): Date;
+    /** Whether every one of `scopes` was granted. */
+    hasScopes(...scopes: string[]): boolean;
+    /**
+     * `fetch`, as the user: adds `Authorization: Bearer <token>`, refreshes the
+     * token first when it is about to expire, and after a 401 refreshes and
+     * retries once. A refresh the provider refuses marks the connection and
+     * throws `OAuthReconnectRequiredError`.
+     *
+     * A path is resolved against the provider's `apiBaseUrl`, and a URL on any
+     * other origin is refused (`OAuthConnectionError`,
+     * `forbidden_url`), so the token only ever goes to the provider. Redirects
+     * are followed by hand: the token is dropped on one that leaves the origin.
+     * A streamed request body cannot be sent twice, so a 401 for one is
+     * returned rather than retried.
+     */
+    fetch(input: string | URL, init?: RequestInit): Promise<Response>;
+    /**
+     * A valid access token, refreshed first if it is about to expire — for an
+     * SDK that wants the token itself. Prefer `fetch`, which also retries a 401.
+     */
+    accessToken(): Promise<string>;
+    /** Refreshes now, whatever the expiry says. */
+    refresh(): Promise<void>;
+    /**
+     * Revokes the grant at the provider (the refresh token when there is one,
+     * which ends the whole grant, else the access token) and deletes the
+     * connection. If the provider refuses, nothing is deleted and
+     * `OAuthConnectionError` (`revoke_failed`) is thrown — call `disconnect()`
+     * to forget the tokens anyway. A provider without a `revokeUrl` throws
+     * `revoke_unsupported`; use `disconnect()`.
+     */
+    revoke(): Promise<void>;
+    /** Forgets the tokens locally without telling the provider. */
+    disconnect(): Promise<void>;
+    toJSON(): {
+        provider: string;
+        providerAccountId: string;
+        scopes: string[];
+        expiresAt: Date;
+        needsReconnect: boolean;
+        connectedAt: Date;
+    };
+    private current;
+    private refreshFrom;
+    private resolveUrl;
+    private send;
+    private request;
+}
+//# sourceMappingURL=ConnectionManager.d.ts.map

package/dist/auth/connections/ConnectionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectionManager.d.ts","sourceRoot":"","sources":["../../../auth/connections/ConnectionManager.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAGrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAc,MAAM,2BAA2B,CAAC;AAEzG,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,MAAM,CAAC;AAExE,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvF,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD,+EAA+E;IAC/E,KAAK,CAAC,EAAE,eAAe,GAAG,CAAC,MAAM,eAAe,CAAC,CAAC;CACnD;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAShB,OAAO,CAAC,QAAQ,CAAC,OAAO;IARpC,MAAM,CAAC,KAAK,SAAsB;IAElC,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgD;IAC3E,OAAO,CAAC,KAAK,CAAiD;IAC9D,OAAO,CAAC,SAAS,CAAoC;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,CAAM;gBAET,OAAO,EAAE,wBAAwB;IAE9D,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAEvD;IAED,yCAAyC;IACzC,IAAI,KAAK,IAAI,eAAe,CAW3B;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB;IAa/C,sFAAsF;IAChF,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAMtF,qCAAqC;IAC/B,IAAI,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAOhE;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,kBAAkB,CAAC;IAe9B;;;;;OAKG;IACH,IAAI,CAAC,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAM,GAAG,IAAI;IAOhE,qBAAqB;IACrB,OAAO,IAAI,IAAI;IAMf,IAAI,KAAK,IAAI,OAAO,CAEnB;IAID,gBAAgB;IACV,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAUjE;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAU9C,WAAW;YAyCX,QAAQ;CAcvB;AAED;;;GAGG;AACH,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,MAAM;gBADG,OAAO,EAAE,iBAAiB,EACnC,MAAM,EAAE,gBAAgB;IAGlC,IAAI,QAAQ,IAAI,MAAM,CAErB;IACD,IAAI,MAAM,IAAI,MAAM,CAEnB;IACD,IAAI,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAErC;IACD,uCAAuC;IACvC,IAAI,MAAM,IAAI,SAAS,MAAM,EAAE,CAE9B;IACD,IAAI,SAAS,IAAI,IAAI,GAAG,IAAI,CAE3B;IACD,4DAA4D;IAC5D,IAAI,cAAc,IAAI,OAAO,CAE5B;IACD,IAAI,WAAW,IAAI,IAAI,CAEtB;IAED,iDAAiD;IACjD,SAAS,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO;IAIvC;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAe3E;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAIpC,+CAA+C;IACzC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;;;;;OAOG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAY7B,+DAA+D;IACzD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,MAAM;;;;;;;;YAeQ,OAAO;YAUP,WAAW;IAYzB,OAAO,CAAC,UAAU;YA2BJ,IAAI;IA8BlB,OAAO,CAAC,OAAO;CAMhB"}

package/dist/auth/connections/ConnectionStore.d.ts

@@ -0,0 +1,146 @@
+import type { DatabaseConnection } from "../../database/Connection";
+import type { Dialect } from "../../database/dialect";
+import type { Encrypter } from "../../services/encryption/Encrypter";
+import type { OAuthTokenSet } from "./OAuthConnectionProvider";
+/** One stored connection, tokens decrypted. Lives only inside the framework. */
+export interface ConnectionRecord {
+    id: string;
+    userId: string;
+    provider: string;
+    providerAccountId: string | null;
+    scopes: string[];
+    accessToken: string;
+    refreshToken: string | null;
+    tokenType: string | null;
+    expiresAt: Date | null;
+    needsReconnect: boolean;
+    /** Bumped on every token change: the compare-and-swap that serialises refreshes. */
+    revision: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Where connections are kept. `DatabaseConnectionStore` in an app, `MemoryConnectionStore` in tests. */
+export interface ConnectionStore {
+    find(userId: string, provider: string): Promise<ConnectionRecord | null>;
+    list(userId: string): Promise<ConnectionRecord[]>;
+    /** Stores a fresh grant, replacing any connection the user had to this provider. */
+    save(userId: string, provider: string, tokens: OAuthTokenSet): Promise<ConnectionRecord>;
+    /**
+     * Replaces the tokens of the connection at `revision`, or resolves `null`
+     * when it has moved on (another request refreshed it first) or is gone.
+     */
+    updateTokens(id: string, revision: number, tokens: OAuthTokenSet): Promise<ConnectionRecord | null>;
+    markNeedsReconnect(id: string): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+export declare class MemoryConnectionStore implements ConnectionStore {
+    private readonly rows;
+    find(userId: string, provider: string): Promise<{
+        id: string;
+        userId: string;
+        provider: string;
+        providerAccountId: string | null;
+        scopes: string[];
+        accessToken: string;
+        refreshToken: string | null;
+        tokenType: string | null;
+        expiresAt: Date | null;
+        needsReconnect: boolean;
+        /** Bumped on every token change: the compare-and-swap that serialises refreshes. */
+        revision: number;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    list(userId: string): Promise<{
+        id: string;
+        userId: string;
+        provider: string;
+        providerAccountId: string | null;
+        scopes: string[];
+        accessToken: string;
+        refreshToken: string | null;
+        tokenType: string | null;
+        expiresAt: Date | null;
+        needsReconnect: boolean;
+        /** Bumped on every token change: the compare-and-swap that serialises refreshes. */
+        revision: number;
+        createdAt: Date;
+        updatedAt: Date;
+    }[]>;
+    save(userId: string, provider: string, tokens: OAuthTokenSet): Promise<{
+        id: string;
+        userId: string;
+        provider: string;
+        providerAccountId: string | null;
+        scopes: string[];
+        accessToken: string;
+        refreshToken: string | null;
+        tokenType: string | null;
+        expiresAt: Date | null;
+        needsReconnect: boolean;
+        /** Bumped on every token change: the compare-and-swap that serialises refreshes. */
+        revision: number;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    updateTokens(id: string, revision: number, tokens: OAuthTokenSet): Promise<{
+        needsReconnect: boolean;
+        revision: number;
+        updatedAt: Date;
+        providerAccountId: string;
+        scopes: string[];
+        accessToken: string;
+        refreshToken: string;
+        tokenType: string;
+        expiresAt: Date;
+        id: string;
+        userId: string;
+        provider: string;
+        createdAt: Date;
+    }>;
+    markNeedsReconnect(id: string): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+export interface DatabaseConnectionStoreOptions {
+    /** Default `gemi_oauth_connections`. A plain identifier: it is spliced into every statement. */
+    table?: string;
+}
+/**
+ * Connections in a table of the app's database, tokens encrypted with the
+ * app's `Encrypter` (the keys in `app/config/encryption.ts`). Raw SQL, like
+ * the queue's and the locks' tables, for SQLite, Postgres and MySQL 8 /
+ * MariaDB: the table is not an ORM model, so no ORM read can return a token.
+ */
+export declare class DatabaseConnectionStore implements ConnectionStore {
+    private readonly encrypter;
+    readonly table: string;
+    private readonly sql;
+    private readonly dialect;
+    constructor(connection: Pick<DatabaseConnection, "sql" | "dialect">, encrypter: () => Encrypter, options?: DatabaseConnectionStoreOptions);
+    /** Creates the table if it does not exist: the DDL Prisma makes for the model in the docs. */
+    createTable(): Promise<void>;
+    find(userId: string, provider: string): Promise<ConnectionRecord>;
+    list(userId: string): Promise<ConnectionRecord[]>;
+    save(userId: string, provider: string, tokens: OAuthTokenSet): Promise<ConnectionRecord>;
+    updateTokens(id: string, revision: number, tokens: OAuthTokenSet): Promise<ConnectionRecord>;
+    markNeedsReconnect(id: string): Promise<void>;
+    delete(id: string): Promise<void>;
+    /**
+     * Re-encrypts every token still under an older key. Run by
+     * `gemi run encryption:rotate`; a token refreshed in the meantime is
+     * already current and is skipped by the revision check.
+     */
+    rotateEncryption(options?: {
+        dryRun?: boolean;
+    }): Promise<{
+        scanned: number;
+        rotated: number;
+    }>;
+    private encode;
+    private decode;
+    private get mysql();
+    private name;
+}
+/** The connections table, as Prisma generates it for the model in the docs, with `IF NOT EXISTS`. */
+export declare function createConnectionTableStatements(dialect: Dialect, table: string): string[];
+//# sourceMappingURL=ConnectionStore.d.ts.map

package/dist/auth/connections/ConnectionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectionStore.d.ts","sourceRoot":"","sources":["../../../auth/connections/ConnectionStore.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,yGAAyG;AACzG,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClD,oFAAoF;IACpF,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzF;;;OAGG;IACH,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpG,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuC;IAEtD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;YAlCvC,MAAM;gBACF,MAAM;kBACJ,MAAM;2BACG,MAAM,GAAG,IAAI;gBACxB,MAAM,EAAE;qBACH,MAAM;sBACL,MAAM,GAAG,IAAI;mBAChB,MAAM,GAAG,IAAI;mBACb,IAAI,GAAG,IAAI;wBACN,OAAO;QACvB,oFAAoF;kBAC1E,MAAM;mBACL,IAAI;mBACJ,IAAI;;IA4BT,IAAI,CAAC,MAAM,EAAE,MAAM;YAzCrB,MAAM;gBACF,MAAM;kBACJ,MAAM;2BACG,MAAM,GAAG,IAAI;gBACxB,MAAM,EAAE;qBACH,MAAM;sBACL,MAAM,GAAG,IAAI;mBAChB,MAAM,GAAG,IAAI;mBACb,IAAI,GAAG,IAAI;wBACN,OAAO;QACvB,oFAAoF;kBAC1E,MAAM;mBACL,IAAI;mBACJ,IAAI;;IAgCT,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa;YA7C9D,MAAM;gBACF,MAAM;kBACJ,MAAM;2BACG,MAAM,GAAG,IAAI;gBACxB,MAAM,EAAE;qBACH,MAAM;sBACL,MAAM,GAAG,IAAI;mBAChB,MAAM,GAAG,IAAI;mBACb,IAAI,GAAG,IAAI;wBACN,OAAO;QACvB,oFAAoF;kBAC1E,MAAM;mBACL,IAAI;mBACJ,IAAI;;IAiDT,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa;;;;;;;;;;YA9DlE,MAAM;gBACF,MAAM;kBACJ,MAAM;mBAUL,IAAI;;IA0DT,kBAAkB,CAAC,EAAE,EAAE,MAAM;IAK7B,MAAM,CAAC,EAAE,EAAE,MAAM;CAGxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAO3D,OAAO,CAAC,QAAQ,CAAC,SAAS;IAN5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;gBAGhC,UAAU,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,SAAS,CAAC,EACtC,SAAS,EAAE,MAAM,SAAS,EAC3C,OAAO,GAAE,8BAAmC;IAW9C,8FAA8F;IACxF,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAQrC,IAAI,CAAC,MAAM,EAAE,MAAM;IAQnB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa;IAsC5D,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa;IAiBhE,kBAAkB,CAAC,EAAE,EAAE,MAAM;IAK7B,MAAM,CAAC,EAAE,EAAE,MAAM;IAKvB;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBzG,OAAO,CAAC,MAAM;IAYd,OAAO,CAAC,MAAM;IAmBd,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,CAAC,IAAI;CAGb;AAkCD,qGAAqG;AACrG,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CA4CzF"}

package/dist/auth/connections/ConnectionsController.d.ts

@@ -0,0 +1,23 @@
+import { Controller } from "../../http/Controller";
+import { HttpRequest } from "../../http/HttpRequest";
+/**
+ * `GET /auth/connections/:provider` and its callback: connects the signed-in
+ * user's account at a provider, to call its API on their behalf. The same
+ * `state` + PKCE round trip as an OAuth sign-in, in a cookie of its own, and
+ * it neither signs anyone in nor out. Both routes require a signed-in user.
+ */
+export declare class ConnectionsController extends Controller {
+    connect(req?: HttpRequest<Record<string, never>, Record<string, never>>): Promise<{
+        destination: string;
+    }>;
+    callback(req?: HttpRequest<Record<string, never>, Record<string, never>>): Promise<{
+        destination: string;
+    }>;
+    /**
+     * Back to where the connect started (`?redirect=` on the connect link), or
+     * `auth.redirectPath`, with `?connection=<provider>` and, on failure,
+     * `&connection_error=<code>`.
+     */
+    protected finish(returnTo: string, provider: string, error?: string): never;
+}
+//# sourceMappingURL=ConnectionsController.d.ts.map

package/dist/auth/connections/ConnectionsController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectionsController.d.ts","sourceRoot":"","sources":["../../../auth/connections/ConnectionsController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAcrD;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;IAC7C,OAAO,CAAC,GAAG,4DAAoB,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IA2BlE,QAAQ,CAAC,GAAG,4DAAoB,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAyDzE;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK;CAS5E"}

package/dist/auth/connections/OAuthConnectionProvider.d.ts

@@ -0,0 +1,105 @@
+export interface OAuthConnectionProviderConfig {
+    /** The provider's authorization endpoint: `https://www.figma.com/oauth`. */
+    authorizeUrl: string;
+    /** The token endpoint, for the code exchange and refreshes. */
+    tokenUrl: string;
+    /**
+     * The RFC 7009 revocation endpoint. Without one, `revoke()` is refused and
+     * `disconnect()` (which forgets the tokens locally) is the way to remove a
+     * connection.
+     */
+    revokeUrl?: string;
+    clientId: string;
+    clientSecret: string;
+    /** The scopes to request. */
+    scopes: string[];
+    /** How `scopes` are joined on the authorization URL. Default `" "` (RFC 6749). */
+    scopeSeparator?: string;
+    /**
+     * How the client authenticates to the token and revocation endpoints:
+     * `"body"` sends `client_id` and `client_secret` as form fields (what most
+     * providers document), `"basic"` sends them as HTTP Basic credentials.
+     * Default `"body"`.
+     */
+    clientAuth?: "body" | "basic";
+    /** Send a PKCE challenge (S256). Default `true`; turn off only for a provider that rejects it. */
+    pkce?: boolean;
+    /**
+     * Extra query parameters for the authorization URL, such as
+     * `{ access_type: "offline", prompt: "consent" }` for Google. They cannot
+     * replace `state`, the PKCE challenge, `redirect_uri`, `client_id` or `scope`.
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * The callback URL registered with the provider. Default
+     * `${HOST_NAME}/auth/connections/<name>/callback` (the request's origin when
+     * `HOST_NAME` is unset).
+     */
+    redirectUri?: string;
+    /**
+     * Where the provider's API lives: `https://api.figma.com`. Required:
+     * `connection.fetch` takes paths relative to it and **refuses any other
+     * origin**, so the user's token only ever goes to the provider's API host,
+     * even for a URL that came from user input.
+     */
+    apiBaseUrl: string;
+    /** Refresh this many seconds before the access token expires. Default 60. */
+    refreshLeewaySeconds?: number;
+}
+/** What a token endpoint answered, normalised. */
+export interface OAuthTokenSet {
+    accessToken: string;
+    refreshToken: string | null;
+    tokenType: string | null;
+    /** Absent when the provider did not say (`expires_in` missing). */
+    expiresAt: Date | null;
+    /** The scopes granted, when the provider says; otherwise the ones requested. */
+    scopes: string[];
+    /** The provider's id for the account, when the token response carries one (Figma's `user_id`). */
+    providerAccountId: string | null;
+}
+/**
+ * A provider an app can connect a user's account to, to call its API on the
+ * user's behalf — as opposed to `OAuthProvider`, which signs the user in.
+ * Configured under `auth.connections`:
+ *
+ * ```ts
+ * connections: {
+ *   figma: new OAuthConnectionProvider({
+ *     authorizeUrl: "https://www.figma.com/oauth",
+ *     tokenUrl: "https://api.figma.com/v1/oauth/token",
+ *     clientId: process.env.FIGMA_CLIENT_ID!,
+ *     clientSecret: process.env.FIGMA_CLIENT_SECRET!,
+ *     scopes: ["file_content:read"],
+ *     apiBaseUrl: "https://api.figma.com",
+ *   }),
+ * }
+ * ```
+ */
+export declare class OAuthConnectionProvider {
+    readonly config: Required<Omit<OAuthConnectionProviderConfig, "revokeUrl" | "redirectUri">> & Pick<OAuthConnectionProviderConfig, "revokeUrl" | "redirectUri">;
+    constructor(config: OAuthConnectionProviderConfig);
+    /** The URL to send the browser to. */
+    authorizationUrl(args: {
+        state: string;
+        codeChallenge: string;
+        redirectUri: string;
+    }): string;
+    /** Exchanges an authorization code for tokens. */
+    exchangeCode(args: {
+        code: string;
+        codeVerifier: string;
+        redirectUri: string;
+    }): Promise<OAuthTokenSet>;
+    /**
+     * Spends `refreshToken` for a new access token. A provider that does not
+     * rotate refresh tokens answers without one, and the old one is kept.
+     */
+    refresh(refreshToken: string, scopes: string[]): Promise<OAuthTokenSet>;
+    /** Revokes `token` at the provider (RFC 7009). */
+    revoke(token: string, hint: "refresh_token" | "access_token"): Promise<void>;
+    private post;
+    private tokenRequest;
+}
+export declare function isLoopback(hostname: string): boolean;
+//# sourceMappingURL=OAuthConnectionProvider.d.ts.map

package/dist/auth/connections/OAuthConnectionProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectionProvider.d.ts","sourceRoot":"","sources":["../../../auth/connections/OAuthConnectionProvider.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,6BAA6B;IAC5C,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,kGAAkG;IAClG,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mEAAmE;IACnE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kGAAkG;IAClG,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,uBAAuB;IAClC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CACvB,IAAI,CAAC,6BAA6B,EAAE,WAAW,GAAG,aAAa,CAAC,CACjE,GACC,IAAI,CAAC,6BAA6B,EAAE,WAAW,GAAG,aAAa,CAAC,CAAC;gBAEvD,MAAM,EAAE,6BAA6B;IA0BjD,sCAAsC;IACtC,gBAAgB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAkB7F,kDAAkD;IAClD,YAAY,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAUvG;;;OAGG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAKvE,kDAAkD;IAC5C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBlF,OAAO,CAAC,IAAI;YAgBE,YAAY;CAwC3B;AAgBD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/auth/connections/errors.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Why an OAuth connection operation failed. Never carries a token or a token
+ * endpoint's body; `providerError` is the provider's RFC 6749 error code at
+ * most (`invalid_grant`).
+ */
+export type OAuthConnectionErrorCode = "unknown_provider" | "exchange_failed" | "refresh_failed" | "reconnect_required" | "revoke_failed" | "revoke_unsupported" | "forbidden_url";
+export declare class OAuthConnectionError extends Error {
+    readonly code: OAuthConnectionErrorCode;
+    readonly status?: number;
+    readonly providerError?: string;
+    constructor(code: OAuthConnectionErrorCode, message: string, options?: {
+        cause?: unknown;
+        status?: number;
+        providerError?: string;
+    });
+}
+/**
+ * The connection's tokens no longer work and refreshing them failed, so the
+ * user has to connect the account again (send them to
+ * `/auth/connections/<provider>`). The connection is marked, so every later
+ * call fails the same way without asking the provider again, until it is
+ * reconnected.
+ */
+export declare class OAuthReconnectRequiredError extends OAuthConnectionError {
+    readonly provider: string;
+    constructor(provider: string, options?: {
+        cause?: unknown;
+        status?: number;
+        providerError?: string;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/connections/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../auth/connections/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,kBAAkB,GAClB,iBAAiB,GACjB,gBAAgB,GAChB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,GACpB,eAAe,CAAC;AAEpB,qBAAa,oBAAqB,SAAQ,KAAK;IAK3C,QAAQ,CAAC,IAAI,EAAE,wBAAwB;IAJzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;gBAGrB,IAAI,EAAE,wBAAwB,EACvC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO;CAO7E;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,oBAAoB;IAEjE,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM,EACzB,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO;CAS7E"}

package/dist/auth/oauth/oauthState.d.ts

@@ -27,7 +27,12 @@
  *   have expired.
  */
 export declare const OAUTH_STATE_TTL_SECONDS: number;
-export declare function oauthStateCookieName(secure: boolean): string;
+/**
+ * `base` separates round trips that must not overwrite each other's cookie:
+ * a sign-in and an OAuth connection (`gemi_oauth_connection`) can be in
+ * flight in one browser at once.
+ */
+export declare function oauthStateCookieName(secure: boolean, base?: string): string;
 export interface OAuthStatePayload {
     /** The provider key the round trip was started for. */
     provider: string;
@@ -35,9 +40,17 @@ export interface OAuthStatePayload {
     codeVerifier: string;
     /** Epoch milliseconds after which the round trip is refused. */
     expiresAt: number;
+    /**
+     * Who started the round trip, for a flow that must finish as the same user
+     * (an OAuth connection is stored for the signed-in user, so a callback that
+     * arrives for someone else is refused). Absent for a sign-in.
+     */
+    subject?: string;
+    /** A same-origin path to return to after the callback. */
+    returnTo?: string;
 }
 /** A fresh `state` and PKCE pair. */
-export declare function createOAuthState(provider: string, now?: number): {
+export declare function createOAuthState(provider: string, now?: number, extra?: Pick<OAuthStatePayload, "subject" | "returnTo">): {
     state: string;
     codeVerifier: string;
     codeChallenge: string;

package/dist/auth/oauth/oauthState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthState.d.ts","sourceRoot":"","sources":["../../../auth/oauth/oauthState.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,uBAAuB,QAAU,CAAC;AAK/C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAE5D;AAED,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;CACnB;AAiBD,qCAAqC;AACrC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAa;;;;;EAYlE;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAGjE;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CAwBzF;AAyBD,iBAAiB;AACjB,wBAAgB,wBAAwB,SAEvC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAA;CAAE,CAAC;AAE/E;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,eAAe,CAgBlB"}
+{"version":3,"file":"oauthState.d.ts","sourceRoot":"","sources":["../../../auth/oauth/oauthState.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,uBAAuB,QAAU,CAAC;AAK/C;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAE,MAAoB,GAAG,MAAM,CAGxF;AAED,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAiBD,qCAAqC;AACrC,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAa,EAChB,KAAK,GAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,UAAU,CAAM;;;;;EAe5D;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAGjE;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CA0BzF;AAyBD,iBAAiB;AACjB,wBAAgB,wBAAwB,SAEvC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAA;CAAE,CAAC;AAE/E;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,eAAe,CAgBlB"}

package/dist/auth/routes.d.ts

@@ -17,6 +17,18 @@ declare class OAuthViewRouter extends ViewRouter {
         }>, Record<string, never>>;
     };
 }
+/** OAuth connections (#845): connect the signed-in user's account at a provider. */
+declare class ConnectionsViewRouter extends ViewRouter {
+    middlewares: string[];
+    routes: {
+        "/:provider": import("../http/ViewRouter").ViewRoute<Record<string, never>, Promise<{
+            destination: string;
+        }>, Record<string, never>>;
+        "/:provider/callback": import("../http/ViewRouter").ViewRoute<Record<string, never>, Promise<{
+            destination: string;
+        }>, Record<string, never>>;
+    };
+}
 export declare class AuthViewRouter extends ViewRouter {
     middlewares: string[];
     routes: {
@@ -28,6 +40,7 @@ export declare class AuthViewRouter extends ViewRouter {
             error?: undefined;
         }>, Record<string, never>>;
         "/oauth": typeof OAuthViewRouter;
+        "/connections": typeof ConnectionsViewRouter;
     };
 }
 export declare class AuthApiRouter extends ApiRouter {

package/dist/auth/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,cAAM,eAAgB,SAAQ,UAAU;IACtC,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;;MAMJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;MAMJ;CACH;AAED,qBAAa,aAAc,SAAQ,SAAS;IAC1C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;;;;;MAiBJ;CACH"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,cAAM,eAAgB,SAAQ,UAAU;IACtC,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;;MAMJ;CACH;AAED,oFAAoF;AACpF,cAAM,qBAAsB,SAAQ,UAAU;IAC5C,WAAW,WAA6B;IACxC,MAAM;;;;;;;MAGJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;MAOJ;CACH;AAED,qBAAa,aAAc,SAAQ,SAAS;IAC1C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;;;;;MAiBJ;CACH"}