primitive-admin 1.1.0-alpha.9 → 1.2.0-alpha.0

package/dist/src/lib/init-config.js

@@ -0,0 +1,186 @@
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { parseConfigToml } from "./config-toml.js";
+import { PROJECT_CONFIG_DISPLAY_NAME } from "./project-config.js";
+import { parsePlatformList } from "./resolve-platform.js";
+import { validateServerUrl } from "./server-url.js";
+export const INIT_CONFIG_FILENAME = ".primitive-init.toml";
+/**
+ * Resolves the "use an existing app" app id from the two places it can be
+ * specified: the `--use-existing-app-id` CLI flag (highest precedence) or an
+ * init-config TOML with `action = "use-existing"` + `app_id`.
+ *
+ * Before this existed, `init` only read the flag, so a `use-existing` TOML fell
+ * through to the create-app branch and interactively prompted for an app name —
+ * hanging non-interactive (`--config`) runs. (See js-bao-wss #1217.)
+ *
+ * Returns `undefined` when neither source selects an existing app (i.e. the run
+ * should create a new app).
+ */
+export function resolveUseExistingAppId(flag, initConfig) {
+    if (flag)
+        return flag;
+    if (initConfig?.action === "use-existing")
+        return initConfig.app_id;
+    return undefined;
+}
+/**
+ * Resolves whether `primitive init` skips the dependency install, from the two
+ * places it can be requested: the `--skip-install` flag (highest precedence)
+ * or `skip_install = true` in the init-config TOML.
+ *
+ * `init` used to read only the flag, so a config's `skip_install` was silently
+ * ignored and CI runs installed anyway (#2720). Precedence matches #2376's
+ * `server` fix: the flag wins. Because `--skip-install` is a boolean flag it
+ * can only ever request a skip, so an explicit `skip_install = false` in the
+ * config cannot un-skip a run that passed the flag.
+ */
+export function resolveSkipInstall(flag, initConfig) {
+    if (flag)
+        return { skipInstall: true, source: "flag" };
+    // Strict `=== true`: a non-boolean that slipped past validation must not
+    // skip the install by truthiness (`skip_install = "false"` reads as a skip).
+    if (initConfig?.skip_install === true) {
+        return { skipInstall: true, source: "config" };
+    }
+    return { skipInstall: false, source: "default" };
+}
+/**
+ * Parses a TOML string into an InitConfig object.
+ * Throws if the string contains invalid TOML.
+ */
+export function parseInitConfigToml(content) {
+    const parsed = parseConfigToml(content);
+    // The cast is safe because validateInitConfig() is always called after parsing
+    return parsed;
+}
+/**
+ * Loads and parses a .primitive-init.toml file from the given directory.
+ * Returns null if the file does not exist.
+ * Throws if the file exists but contains invalid TOML.
+ */
+export function loadInitConfig(dir) {
+    const configPath = join(dir, INIT_CONFIG_FILENAME);
+    if (!existsSync(configPath)) {
+        return null;
+    }
+    const content = readFileSync(configPath, "utf-8");
+    return parseInitConfigToml(content);
+}
+/**
+ * Validates an InitConfig object. Returns a ValidationResult with any errors.
+ */
+export function validateInitConfig(config) {
+    const errors = [];
+    // action is required
+    const ACTIONS = ["create", "use-existing", "add-client"];
+    if (!config.action) {
+        errors.push(`Missing required field: "action" (must be ${ACTIONS.map((a) => `"${a}"`).join(", ")})`);
+    }
+    else if (!ACTIONS.includes(config.action)) {
+        errors.push(`"action" must be ${ACTIONS.map((a) => `"${a}"`).join(", ")}`);
+    }
+    else {
+        // Validate action-specific required fields
+        if (config.action === "create" && !config.app_name) {
+            errors.push('"app_name" is required when action is "create"');
+        }
+        if (config.action === "use-existing" && !config.app_id) {
+            errors.push('"app_id" is required when action is "use-existing"');
+        }
+        // `add-client` takes its app — and therefore its access mode and its
+        // invitations — from the environment it adopts. Naming any of them here
+        // would describe a second app this run is not allowed to touch.
+        if (config.action === "add-client") {
+            for (const key of [
+                "app_name",
+                "app_id",
+                "access_mode",
+                "invite_emails",
+                "allowed_domains",
+            ]) {
+                const value = config[key];
+                const present = Array.isArray(value) ? value.length > 0 : value !== undefined;
+                if (present) {
+                    errors.push(`"${key}" is not allowed with action = "add-client": the app comes from the selected environment of the existing ${PROJECT_CONFIG_DISPLAY_NAME}.`);
+                }
+            }
+        }
+    }
+    // Validate access_mode if provided
+    if (config.access_mode) {
+        const validModes = ["public", "domain", "invite-only"];
+        if (!validModes.includes(config.access_mode)) {
+            errors.push('"access_mode" must be "public", "domain", or "invite-only"');
+        }
+        else if (config.access_mode === "domain" && (!config.allowed_domains || config.allowed_domains.length === 0)) {
+            errors.push('"allowed_domains" is required when access_mode is "domain"');
+        }
+    }
+    // Validate platform if provided. A string or an array of strings; only "web"
+    // and "ios" are supported (`macos` is intentionally rejected until the macOS
+    // template is ready), and each may be named once (#2890).
+    if (config.platform !== undefined) {
+        if (typeof config.platform !== "string" && !Array.isArray(config.platform)) {
+            errors.push('"platform" must be a string or an array of strings');
+        }
+        else {
+            const parsed = parsePlatformList(config.platform);
+            if (!parsed.ok)
+                errors.push(`"platform": ${parsed.error}`);
+        }
+    }
+    // `promote_schema` is consent for a move that only the add-client path can
+    // make; anywhere else it would silently do nothing.
+    if (config.promote_schema !== undefined) {
+        if (typeof config.promote_schema !== "boolean") {
+            errors.push('"promote_schema" must be a boolean (true or false)');
+        }
+        else if (config.action !== "add-client") {
+            errors.push('"promote_schema" is only valid with action = "add-client"');
+        }
+    }
+    // Validate server if provided. An unusable value must fail here rather than
+    // fall through to the current server, which is how #2376 went unnoticed.
+    if (config.server !== undefined) {
+        const serverValidation = validateServerUrl(config.server);
+        if (serverValidation !== true) {
+            errors.push(`"server" must be a valid URL (e.g., https://primitiveapi.com): ${serverValidation}`);
+        }
+    }
+    // Validate skip_install if provided. The TOML is cast to InitConfig without
+    // runtime narrowing, so a non-boolean has to be rejected here rather than
+    // reach the resolver, where anything truthy would skip the install.
+    if (config.skip_install !== undefined && typeof config.skip_install !== "boolean") {
+        errors.push('"skip_install" must be a boolean (true or false)');
+    }
+    // Validate dev_port if provided
+    if (config.dev_port !== undefined) {
+        if (typeof config.dev_port !== "number" || !Number.isInteger(config.dev_port) || config.dev_port < 1 || config.dev_port > 65535) {
+            errors.push('"dev_port" must be an integer between 1 and 65535');
+        }
+    }
+    // Validate invite_emails format if provided
+    if (config.invite_emails && Array.isArray(config.invite_emails)) {
+        for (const email of config.invite_emails) {
+            if (!email.includes("@")) {
+                errors.push(`Invalid email in invite_emails: "${email}"`);
+            }
+        }
+    }
+    // Warn about fields ignored for use-existing action
+    if (config.action === "use-existing") {
+        const ignoredFields = [];
+        if (config.access_mode)
+            ignoredFields.push("access_mode");
+        if (config.invite_emails && config.invite_emails.length > 0)
+            ignoredFields.push("invite_emails");
+        if (config.allowed_domains && config.allowed_domains.length > 0)
+            ignoredFields.push("allowed_domains");
+        if (ignoredFields.length > 0) {
+            errors.push(`The following fields are ignored when action is "use-existing": ${ignoredFields.join(", ")}. Remove them to avoid confusion.`);
+        }
+    }
+    return { valid: errors.length === 0, errors };
+}
+//# sourceMappingURL=init-config.js.map

package/dist/src/lib/init-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-config.js","sourceRoot":"","sources":["../../../src/lib/init-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAuD3D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAwB,EACxB,UAA6B;IAE7B,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,UAAU,EAAE,MAAM,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAyB,EACzB,UAA6B;IAE7B,IAAI,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,yEAAyE;IACzE,6EAA6E;IAC7E,IAAI,UAAU,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,+EAA+E;IAC/E,OAAO,MAA+B,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,qBAAqB;IACrB,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CACT,6CAA6C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxF,CAAC;IACJ,CAAC;SAAM,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,2CAA2C;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,gEAAgE;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACnC,KAAK,MAAM,GAAG,IAAI;gBAChB,UAAU;gBACV,QAAQ;gBACR,aAAa;gBACb,eAAe;gBACf,iBAAiB;aACT,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;gBAC9E,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CACT,IAAI,GAAG,4GAA4G,2BAA2B,GAAG,CAClJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,MAAM,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CACT,2DAA2D,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,kEAAkE,gBAAgB,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC;YAChI,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,oCAAoC,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,WAAW;YAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,mEAAmE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAC9I,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}

package/dist/src/lib/init-email-redirect-uris.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Whether init may add a sign-in callback to an app's magic-link allow-list,
+ * and what to write (#2982).
+ *
+ * A combined iOS + web app emails ONE https link — the web app's
+ * `/oauth/callback` — and the server matches that target against
+ * `emailRedirectUris` fail-closed. So init only points an environment's
+ * `webUrl` at a dev origin whose callback the app actually allows; otherwise it
+ * would flip a working code-only email into a request that 400s.
+ *
+ * A brand-new app is seeded with `http://localhost:5173/oauth/callback` at
+ * creation, and the dev-port step merges the chosen port's callback — but an
+ * app adopted with `--use-existing-app-id` on the default port has been through
+ * neither, and its allow-list is whatever it already was.
+ *
+ * The one thing this must never do is NARROW that list. An app with no
+ * `emailRedirectUris` attribute still behaves by the pre-#2891 app-wide
+ * `redirectUris`, and writing a fresh single-entry list would silently replace
+ * that fallback with our callback — breaking magic-link sign-in for whichever
+ * client was relying on it. An explicitly empty list is a deliberate "reject
+ * everything" for the same reason. Both are left alone, and init falls back to
+ * printing the manual step.
+ */
+export type EmailRedirectUriMerge = {
+    action: "already-listed";
+} | {
+    action: "merge";
+    uris: string[];
+} | {
+    action: "leave-alone";
+    reason: string;
+};
+/**
+ * Decide what to do with `existing` (the app's `emailRedirectUris` as the
+ * settings API reports it) to make `callbackUri` an allowed target.
+ */
+export declare function planEmailRedirectUriMerge(existing: unknown, callbackUri: string): EmailRedirectUriMerge;

package/dist/src/lib/init-email-redirect-uris.js

@@ -0,0 +1,46 @@
+/**
+ * Whether init may add a sign-in callback to an app's magic-link allow-list,
+ * and what to write (#2982).
+ *
+ * A combined iOS + web app emails ONE https link — the web app's
+ * `/oauth/callback` — and the server matches that target against
+ * `emailRedirectUris` fail-closed. So init only points an environment's
+ * `webUrl` at a dev origin whose callback the app actually allows; otherwise it
+ * would flip a working code-only email into a request that 400s.
+ *
+ * A brand-new app is seeded with `http://localhost:5173/oauth/callback` at
+ * creation, and the dev-port step merges the chosen port's callback — but an
+ * app adopted with `--use-existing-app-id` on the default port has been through
+ * neither, and its allow-list is whatever it already was.
+ *
+ * The one thing this must never do is NARROW that list. An app with no
+ * `emailRedirectUris` attribute still behaves by the pre-#2891 app-wide
+ * `redirectUris`, and writing a fresh single-entry list would silently replace
+ * that fallback with our callback — breaking magic-link sign-in for whichever
+ * client was relying on it. An explicitly empty list is a deliberate "reject
+ * everything" for the same reason. Both are left alone, and init falls back to
+ * printing the manual step.
+ */
+/**
+ * Decide what to do with `existing` (the app's `emailRedirectUris` as the
+ * settings API reports it) to make `callbackUri` an allowed target.
+ */
+export function planEmailRedirectUriMerge(existing, callbackUri) {
+    if (!Array.isArray(existing)) {
+        return {
+            action: "leave-alone",
+            reason: "this app has no emailRedirectUris list of its own, and writing one would replace the allow-list it behaves by today",
+        };
+    }
+    const uris = existing.filter((value) => typeof value === "string");
+    if (uris.length === 0) {
+        return {
+            action: "leave-alone",
+            reason: "this app's emailRedirectUris list is empty, which is a deliberate 'reject every link target'",
+        };
+    }
+    if (uris.includes(callbackUri))
+        return { action: "already-listed" };
+    return { action: "merge", uris: [...uris, callbackUri] };
+}
+//# sourceMappingURL=init-email-redirect-uris.js.map

package/dist/src/lib/init-email-redirect-uris.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-email-redirect-uris.js","sourceRoot":"","sources":["../../../src/lib/init-email-redirect-uris.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,qHAAqH;SACxH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,8FAA8F;SACjG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;AAC3D,CAAC"}

package/dist/src/lib/init-ios-links.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The `CFBundleURLName` the library and the template agree on. Changing it
+ * breaks the manager's scheme resolution, so it is pinned by a test that reads
+ * both files.
+ */
+export declare const PRIMITIVE_AUTH_URL_TYPE_NAME = "PrimitiveAuth";
+/** The library's fallback scheme — reserved, never a derived result. */
+export declare const FALLBACK_CALLBACK_SCHEME = "primitiveapp";
+/**
+ * The custom URL scheme for one scaffolded client: a readable prefix from the
+ * app name, then the full lowercased app ID.
+ *
+ * Deterministic and injective over server-generated app IDs — two apps never
+ * share a scheme, whatever they are called.
+ */
+export declare function deriveCallbackScheme(appName: string, appId: string, clientDirName?: string): string;
+/** The redirect target the emailed sign-in link uses, for one scheme. */
+export declare function iosMagicLinkRedirectUri(scheme: string): string;
+export interface StampResult {
+    /** `not-found` when the plist predates the `PrimitiveAuth` URL type. */
+    outcome: "stamped" | "already" | "not-found";
+}
+/**
+ * Replaces the scheme registered under the `PrimitiveAuth` URL type in a
+ * scaffolded client's `Info-Partial.plist`.
+ *
+ * A targeted text substitution, not a plist rewrite: the file's comments are
+ * the checklist a developer reads when their emailed link does nothing, and a
+ * serializer would drop them.
+ */
+export declare function stampCallbackScheme(clientDir: string, scheme: string): StampResult;
+/**
+ * How to point an environment at the app's web origin — in the shape that
+ * actually works (#2982).
+ *
+ * `primitive env add` CREATES an environment: it requires `--api-url` and
+ * `--app-id` (#3152), and refuses a name the config already has. Every
+ * environment anyone reads this about already exists (init wrote `dev`; `prod`
+ * was added when the app was deployed), so the instruction for those has to be
+ * the file, which is also what the docs describe as the way to edit one. The
+ * flag is worth naming only where a new environment is being created — and
+ * there it is shown with the flags the command will refuse to run without.
+ *
+ * `origin` is the placeholder or real origin to show.
+ */
+export declare function setWebUrlInstruction(origin: string, indent?: string): string[];
+/**
+ * What init prints about email sign-in on the iOS path: it already works, and
+ * this is the one opt-in that adds the link.
+ *
+ * The allow-list step is phrased as a MERGE into the existing array — `app.toml`
+ * is the whole app-settings truth on push (#2880), so a replacement array would
+ * silently drop the web callback the app was seeded with.
+ *
+ * `registered` is false when the scheme could not be stamped (an older template
+ * with no `PrimitiveAuth` URL type). The allow-list entry and the flag are the
+ * same either way, but the closing line must not claim a registration that is
+ * not there: a developer who did only the two steps would be left with a dead
+ * tap and nothing naming the missing piece.
+ */
+export declare function linkOptInGuidance(scheme: string, options?: {
+    registered?: boolean;
+}): string[];
+/**
+ * What init prints for an app with BOTH clients: the emailed sign-in link is
+ * already the web app's https callback, and this is what it takes to make that
+ * link open the iOS app in production (#2982).
+ *
+ * Everything here is a post-deploy step by necessity — the production web
+ * domain does not exist at init time, and the deploy script never learns the
+ * URL it deployed to. The order is load-bearing: the `applinks:` entitlement
+ * is the ONLY thing that makes Apple fetch the association document, and
+ * Apple's CDN caches what it gets, so it goes last — after the deployed
+ * document has been verified.
+ *
+ * `webOrigin` is the dev origin the run seeded — set only when the run also
+ * confirmed that origin's `/oauth/callback` is on the app's allow-list, since
+ * that is what makes the seeded link work.
+ *
+ * `unverifiedDevCallback` is the opposite case: a combined app whose allow-list
+ * this run could not vouch for (an adopted app, or no credentials to ask with).
+ * Nothing was seeded — the app keeps its working code-only email — and the two
+ * steps that turn the link on are printed instead. Neither is set for an
+ * adopting run, which does not own the project config at all.
+ */
+export declare function universalLinkGuidance(options?: {
+    webOrigin?: string;
+    unverifiedDevCallback?: string;
+}): string[];
+/** What init says when the template predates the `PrimitiveAuth` URL type. */
+export declare function missingUrlTypeGuidance(scheme: string): string[];

package/dist/src/lib/init-ios-links.js

@@ -0,0 +1,219 @@
+/**
+ * The iOS app's own URL scheme, and the documented opt-in that turns the
+ * sign-in email's LINK on (#2969).
+ *
+ * The Swift template registers one custom URL scheme, under the
+ * `PrimitiveAuth` URL-type name that `PrimitiveAuthManager` reads its callback
+ * scheme from. Shipped, that scheme is `primitiveapp` — which every app
+ * scaffolded from the template would otherwise share, making iOS link routing
+ * between two of them on one device ambiguous. So init stamps an app-unique
+ * scheme in its place.
+ *
+ * The suffix is the WHOLE app ID, not a tail or a hash of it: app IDs are
+ * 26-character ULIDs, and any fixed-width squeeze of them is many-to-one — two
+ * distinct apps could still be handed the same scheme, which is the failure
+ * this stamping exists to prevent.
+ *
+ * Init writes no app settings here. Email sign-in works out of the box because
+ * the manager sends NO redirect target by default, so the email carries the
+ * code alone and the allow-list is not consulted at all. Sending the link is
+ * the developer's opt-in — one allow-list entry plus one flag — and init only
+ * prints what those are.
+ */
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+/**
+ * The `CFBundleURLName` the library and the template agree on. Changing it
+ * breaks the manager's scheme resolution, so it is pinned by a test that reads
+ * both files.
+ */
+export const PRIMITIVE_AUTH_URL_TYPE_NAME = "PrimitiveAuth";
+/** The library's fallback scheme — reserved, never a derived result. */
+export const FALLBACK_CALLBACK_SCHEME = "primitiveapp";
+/** How much of the app name survives into the readable prefix. */
+const PREFIX_MAX_LENGTH = 20;
+/** The app-name placeholder init carries when it never asked for one. */
+const APP_NAME_PLACEHOLDER = "(existing app)";
+/**
+ * A URL-scheme-safe, letter-first fragment of `value`, or `""` when nothing
+ * usable survives (an empty name, an emoji-only one, digits alone).
+ */
+function schemeFragment(value, maxLength) {
+    const sanitized = (value ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
+    // RFC 3986 schemes start with a letter, and the prefix is what leads.
+    const letterFirst = sanitized.replace(/^[0-9]+/, "");
+    return letterFirst.slice(0, maxLength);
+}
+/**
+ * The custom URL scheme for one scaffolded client: a readable prefix from the
+ * app name, then the full lowercased app ID.
+ *
+ * Deterministic and injective over server-generated app IDs — two apps never
+ * share a scheme, whatever they are called.
+ */
+export function deriveCallbackScheme(appName, appId, clientDirName) {
+    const named = appName === APP_NAME_PLACEHOLDER ? "" : appName;
+    const prefix = schemeFragment(named, PREFIX_MAX_LENGTH) ||
+        schemeFragment(clientDirName, PREFIX_MAX_LENGTH) ||
+        "app";
+    // No truncation: the whole ID is what makes the scheme unique.
+    const suffix = (appId ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
+    const scheme = suffix ? `${prefix}-${suffix}` : prefix;
+    // Only reachable with no app ID at all, but the reserved scheme is exactly
+    // what a derived one must never collide with.
+    return scheme === FALLBACK_CALLBACK_SCHEME ? `${scheme}-app` : scheme;
+}
+/** The redirect target the emailed sign-in link uses, for one scheme. */
+export function iosMagicLinkRedirectUri(scheme) {
+    return `${scheme}://auth/magic-link`;
+}
+/**
+ * Replaces the scheme registered under the `PrimitiveAuth` URL type in a
+ * scaffolded client's `Info-Partial.plist`.
+ *
+ * A targeted text substitution, not a plist rewrite: the file's comments are
+ * the checklist a developer reads when their emailed link does nothing, and a
+ * serializer would drop them.
+ */
+export function stampCallbackScheme(clientDir, scheme) {
+    const plistPath = join(clientDir, "Info-Partial.plist");
+    if (!existsSync(plistPath))
+        return { outcome: "not-found" };
+    let text;
+    try {
+        text = readFileSync(plistPath, "utf-8");
+    }
+    catch {
+        return { outcome: "not-found" };
+    }
+    const marker = `<string>${PRIMITIVE_AUTH_URL_TYPE_NAME}</string>`;
+    const markerIndex = text.indexOf(marker);
+    if (markerIndex === -1)
+        return { outcome: "not-found" };
+    // Stay inside the URL-type dict the marker names: an app may register other
+    // schemes (a Google reversed client ID, say) and those are not ours to move.
+    const dictStart = text.lastIndexOf("<dict>", markerIndex);
+    const dictEnd = text.indexOf("</dict>", markerIndex);
+    if (dictStart === -1 || dictEnd === -1)
+        return { outcome: "not-found" };
+    const block = text.slice(dictStart, dictEnd);
+    if (!block.includes("<key>CFBundleURLName</key>"))
+        return { outcome: "not-found" };
+    const schemesPattern = /(<key>CFBundleURLSchemes<\/key>\s*<array>\s*<string>)([^<]*)(<\/string>)/;
+    const match = schemesPattern.exec(block);
+    if (!match)
+        return { outcome: "not-found" };
+    if (match[2] === scheme)
+        return { outcome: "already" };
+    const rewritten = block.replace(schemesPattern, `$1${scheme}$3`);
+    writeFileSync(plistPath, text.slice(0, dictStart) + rewritten + text.slice(dictEnd));
+    return { outcome: "stamped" };
+}
+/**
+ * How to point an environment at the app's web origin — in the shape that
+ * actually works (#2982).
+ *
+ * `primitive env add` CREATES an environment: it requires `--api-url` and
+ * `--app-id` (#3152), and refuses a name the config already has. Every
+ * environment anyone reads this about already exists (init wrote `dev`; `prod`
+ * was added when the app was deployed), so the instruction for those has to be
+ * the file, which is also what the docs describe as the way to edit one. The
+ * flag is worth naming only where a new environment is being created — and
+ * there it is shown with the flags the command will refuse to run without.
+ *
+ * `origin` is the placeholder or real origin to show.
+ */
+export function setWebUrlInstruction(origin, indent = "  ") {
+    return [
+        `${indent}add "webUrl": "${origin}" to that environment in primitive/config.json`,
+        `${indent}(\`primitive env add <name> --api-url … --app-id … --web-url <origin>\` does this only for an`,
+        `${indent}environment it CREATES — it cannot edit one that already exists).`,
+    ];
+}
+/**
+ * What init prints about email sign-in on the iOS path: it already works, and
+ * this is the one opt-in that adds the link.
+ *
+ * The allow-list step is phrased as a MERGE into the existing array — `app.toml`
+ * is the whole app-settings truth on push (#2880), so a replacement array would
+ * silently drop the web callback the app was seeded with.
+ *
+ * `registered` is false when the scheme could not be stamped (an older template
+ * with no `PrimitiveAuth` URL type). The allow-list entry and the flag are the
+ * same either way, but the closing line must not claim a registration that is
+ * not there: a developer who did only the two steps would be left with a dead
+ * tap and nothing naming the missing piece.
+ */
+export function linkOptInGuidance(scheme, options = {}) {
+    const registered = options.registered !== false;
+    const redirectUri = iosMagicLinkRedirectUri(scheme);
+    return [
+        "Email sign-in works now: the email carries a 6-digit code and needs no app settings.",
+        "When this app gets a web client, prefer the https link: set the environment's `webUrl` —",
+        ...setWebUrlInstruction("https://<your-web-domain>"),
+        "  The email then carries that origin's /oauth/callback instead — one link that opens this",
+        "  app where it is installed and signs in through the browser anywhere else.",
+        `Until then, to ALSO send a sign-in link that opens this app, add "${redirectUri}" to the existing`,
+        "  [auth].emailRedirectUris array in config/app.toml (merge it in — run",
+        "  `primitive config pull --only app` first if that file is not there yet), then run",
+        "  `primitive config push --only app` and set `authManager.sendsEmailSignInLink = true`.",
+        registered
+            ? "The scheme registration and the link routing are already in this client."
+            : `The scheme "${scheme}" is NOT registered in this client yet — register it first (see`
+                + ` the ${PRIMITIVE_AUTH_URL_TYPE_NAME} warning above), or the link stays a dead tap.`,
+        "  Full checklist: `primitive guides get authentication --language swift`, or the",
+        "  authentication.md docs page — 'Make the emailed sign-in link open your app'.",
+    ];
+}
+/**
+ * What init prints for an app with BOTH clients: the emailed sign-in link is
+ * already the web app's https callback, and this is what it takes to make that
+ * link open the iOS app in production (#2982).
+ *
+ * Everything here is a post-deploy step by necessity — the production web
+ * domain does not exist at init time, and the deploy script never learns the
+ * URL it deployed to. The order is load-bearing: the `applinks:` entitlement
+ * is the ONLY thing that makes Apple fetch the association document, and
+ * Apple's CDN caches what it gets, so it goes last — after the deployed
+ * document has been verified.
+ *
+ * `webOrigin` is the dev origin the run seeded — set only when the run also
+ * confirmed that origin's `/oauth/callback` is on the app's allow-list, since
+ * that is what makes the seeded link work.
+ *
+ * `unverifiedDevCallback` is the opposite case: a combined app whose allow-list
+ * this run could not vouch for (an adopted app, or no credentials to ask with).
+ * Nothing was seeded — the app keeps its working code-only email — and the two
+ * steps that turn the link on are printed instead. Neither is set for an
+ * adopting run, which does not own the project config at all.
+ */
+export function universalLinkGuidance(options = {}) {
+    const lines = [
+        "This app has both an iOS and a web client, so its sign-in email carries ONE https link:",
+        "  the web app's /oauth/callback. Tapped where the iOS app is installed it opens the app;",
+        "  anywhere else it is an ordinary web sign-in. The 6-digit code still works everywhere.",
+    ];
+    if (options.webOrigin) {
+        lines.push(`In dev that link is ${options.webOrigin}/oauth/callback — seeded as the environment's`, "  `webUrl`, and allow-listed on the app. Nothing to do.");
+    }
+    else if (options.unverifiedDevCallback) {
+        const origin = options.unverifiedDevCallback.replace(/\/oauth\/callback$/, "");
+        lines.push("The link is NOT on yet in dev: this app already existed, and its sign-in link allow-list", `  does not (or could not be checked to) carry ${options.unverifiedDevCallback}. Nothing was`, "  changed — the email stays code-only, which works. To turn the link on:", `  1. Merge "${options.unverifiedDevCallback}" into the existing [auth].emailRedirectUris`, "     array in config/app.toml (run `primitive config pull --only app` first if that file is", "     not there yet), then `primitive config push --only app`.", `  2. Then ${setWebUrlInstruction(origin, "")[0]}`, "     — the same edit the production steps below describe.");
+    }
+    else {
+        lines.push("Set `webUrl` on this app's environment to turn it on (this run did not write the", "  project config):", ...setWebUrlInstruction("https://<your-web-domain>"), "  Allow-list that origin's /oauth/callback in [auth].emailRedirectUris too.");
+    }
+    lines.push("For production, once the web app is deployed:", "  1. Set that environment's `webUrl` to the deployed origin —", ...setWebUrlInstruction("https://<your-web-domain>", "     "), "  2. Merge \"https://<your-web-domain>/oauth/callback\" into the existing", "     [auth].emailRedirectUris array in config/app.toml (run `primitive config pull --only app`", "     first if that file is not there yet), then `primitive config push --only app`.", "  3. Add `\"iosAppId\": \"ABCDE12345.com.example.app\"` beside that same environment's `webUrl`", "     — the iOS client's Application Identifier Prefix (10 characters, usually your Team ID;", "     verify it against the signed app's application-identifier entitlement) and its bundle id", "     for THAT environment. `pnpm cf-deploy` generates the apple-app-site-association document", "     from it per deploy, so each environment serves its own app id and none serves another's.", "  4. Deploy, then verify: `curl -i https://<your-web-domain>/.well-known/apple-app-site-association`", "     must return 200, application/json and the JSON body — HTML means the SPA fallback answered.", "  5. Only then enable the `applinks:<your-web-domain>` entitlement in the iOS client's", "     project.yml (it needs a real DEVELOPMENT_TEAM) and reinstall the app.", "  Full checklist: the web client's public/.well-known/README.md, or the authentication", "  docs page — 'Make the emailed sign-in link open your app'.");
+    return lines;
+}
+/** What init says when the template predates the `PrimitiveAuth` URL type. */
+export function missingUrlTypeGuidance(scheme) {
+    return [
+        `This template's Info-Partial.plist registers no ${PRIMITIVE_AUTH_URL_TYPE_NAME} URL type, so the`,
+        `  scheme "${scheme}" was not stamped and an emailed sign-in link cannot open this app.`,
+        `  Add a CFBundleURLTypes entry named ${PRIMITIVE_AUTH_URL_TYPE_NAME} with that scheme, then follow`,
+        "  the authentication.md docs page — 'Make the emailed sign-in link open your app'",
+        "  (or `primitive guides get authentication --language swift`).",
+    ];
+}
+//# sourceMappingURL=init-ios-links.js.map

package/dist/src/lib/init-ios-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-ios-links.js","sourceRoot":"","sources":["../../../src/lib/init-ios-links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CAAC;AAE5D,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAyB,EAAE,SAAiB;IAClE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,KAAa,EACb,aAAsB;IAEtB,MAAM,KAAK,GAAG,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,MAAM,GACV,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC;QACxC,cAAc,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAChD,KAAK,CAAC;IACR,+DAA+D;IAC/D,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,2EAA2E;IAC3E,8CAA8C;IAC9C,OAAO,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACvC,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAE5D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,4BAA4B,WAAW,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAExD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAEnF,MAAM,cAAc,GAClB,0EAA0E,CAAC;IAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAEvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC;IACjE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAM,GAAG,IAAI;IAChE,OAAO;QACL,GAAG,MAAM,kBAAkB,MAAM,gDAAgD;QACjF,GAAG,MAAM,+FAA+F;QACxG,GAAG,MAAM,mEAAmE;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,sFAAsF;QACtF,0FAA0F;QAC1F,GAAG,oBAAoB,CAAC,2BAA2B,CAAC;QACpD,2FAA2F;QAC3F,6EAA6E;QAC7E,qEAAqE,WAAW,mBAAmB;QACnG,wEAAwE;QACxE,qFAAqF;QACrF,yFAAyF;QACzF,UAAU;YACR,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,eAAe,MAAM,iEAAiE;kBACpF,QAAQ,4BAA4B,gDAAgD;QAC1F,kFAAkF;QAClF,gFAAgF;KACjF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkE,EAAE;IAEpE,MAAM,KAAK,GAAG;QACZ,yFAAyF;QACzF,0FAA0F;QAC1F,yFAAyF;KAC1F,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,uBAAuB,OAAO,CAAC,SAAS,+CAA+C,EACvF,yDAAyD,CAC1D,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CACR,0FAA0F,EAC1F,iDAAiD,OAAO,CAAC,qBAAqB,eAAe,EAC7F,0EAA0E,EAC1E,eAAe,OAAO,CAAC,qBAAqB,8CAA8C,EAC1F,6FAA6F,EAC7F,+DAA+D,EAC/D,aAAa,oBAAoB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,2DAA2D,CAC5D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,kFAAkF,EAClF,oBAAoB,EACpB,GAAG,oBAAoB,CAAC,2BAA2B,CAAC,EACpD,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,+CAA+C,EAC/C,+DAA+D,EAC/D,GAAG,oBAAoB,CAAC,2BAA2B,EAAE,OAAO,CAAC,EAC7D,2EAA2E,EAC3E,gGAAgG,EAChG,qFAAqF,EACrF,iGAAiG,EACjG,6FAA6F,EAC7F,+FAA+F,EAC/F,+FAA+F,EAC/F,+FAA+F,EAC/F,sGAAsG,EACtG,kGAAkG,EAClG,wFAAwF,EACxF,4EAA4E,EAC5E,wFAAwF,EACxF,8DAA8D,CAC/D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO;QACL,mDAAmD,4BAA4B,mBAAmB;QAClG,aAAa,MAAM,qEAAqE;QACxF,wCAAwC,4BAA4B,gCAAgC;QACpG,mFAAmF;QACnF,gEAAgE;KACjE,CAAC;AACJ,CAAC"}