@actuate-media/cms-core 0.35.1 → 0.37.0

package/dist/security/center/gather.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.js","sourceRoot":"","sources":["../../../src/security/center/gather.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,0BAA0B,CAAA;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAgC,MAAM,gBAAgB,CAAA;AAoB/F,SAAS,QAAQ,CAAyB,EAAU,EAAE,KAAQ;IAC5D,OAAO,OAAO,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAA;AAC1E,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAmB;IAC7C,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,IAAI;YACP,OAAO,MAAM,CAAA;QACf,KAAK,MAAM;YACT,OAAO,SAAS,CAAA;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,MAAM,CAAA;QACf;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAW;IACzD,MAAM,CAAC,GAAG,EAAY,CAAA;IACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC;QAAE,OAAO,qBAAqB,CAAC,EAAE,CAAC,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAS,CAAC,SAAS,CAAC;YACtC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE;YAClD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAA;QACF,OAAO,qBAAqB,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,CAAC,EAAE,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAmB;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,EAAY,CAAA;IAC3B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAA;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAEtB,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEzD,MAAM,QAAQ,GAAc,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC;aACJ,IAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;aAC7E,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IAEtC,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC;aACnB,IAAK,CAAC,UAAU,CAAC;YAChB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;YAC1B,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;SAC9B,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpB,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC;aACJ,OAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;aAC7E,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC,CAAA;IAEL,MAAM,UAAU,GAAgB,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC;aACJ,MAAO,CAAC,QAAQ,CAAC;YAChB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SAC7E,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAEjD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACjD,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC;aACJ,QAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;aAChF,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC,CAAA;IAEL,gFAAgF;IAChF,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;IACjC,MAAM,YAAY,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAErF,IAAI,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,SAAS,CAAC,CAAA;IACjF,IAAI,SAAS,KAAK,MAAM,IAAI,YAAY;QAAE,SAAS,GAAG,MAAM,CAAA;IAE5D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,MAAM,IAAI,MAAM,CAAA;IACjE,kFAAkF;IAClF,IAAI,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC9C,IAAI,MAAM,KAAK,MAAM,IAAI,YAAY;QAAE,aAAa,GAAG,MAAM,CAAA;IAE7D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IAC5D,MAAM,gBAAgB,GACpB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAA;IAEhD,MAAM,OAAO,GAAkB;QAC7B,SAAS;QACT,aAAa;QACb,gBAAgB;QAChB,aAAa,EAAE,IAAI;QACnB,uBAAuB,EAAE,aAAa,KAAK,MAAM;KAClD,CAAA;IAED,gFAAgF;IAChF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC;QACtD,CAAC,CAAE,MAAO,CAAC,KAAM,CAAC,WAAwB;QAC1C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IACxC,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAsB;QACpE,MAAM;QACN,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;KACzF,CAAA;IAED,MAAM,kBAAkB,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,2CAA2C;IAE7E,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,YAAY;QACZ,QAAQ;QACR,KAAK;QACL,OAAO;QACP,OAAO;QACP,WAAW;QACX,eAAe;QACf,cAAc;QACd,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;KACnB,CAAC,CAAA;IAEF,MAAM,QAAQ,GAA2B,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC/E,MAAM,OAAO,GAA2C;QACtD,WAAW,EAAE,QAAQ;QACrB,kBAAkB,EAAE,QAAQ;QAC5B,qBAAqB,EAAE,QAAQ;QAC/B,kBAAkB,EAAE;YAClB,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,kDAAkD;SAC3D;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,qEAAqE;SAC9E;QACD,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE;QAC9F,YAAY,EAAE;YACZ,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,oEAAoE;SAC7E;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,8BAA8B;SACvC;QACD,SAAS,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;QACzD,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE;KAC1E,CAAA;IAED,OAAO;QACL,QAAQ;QACR,MAAM;QACN,KAAK;QACL,OAAO;QACP,OAAO;QACP,WAAW;QACX,eAAe;QACf,cAAc;QACd,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;QAClB,kBAAkB;QAClB,YAAY;QACZ,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;QAC5E,OAAO;KACR,CAAA;AACH,CAAC"}

package/dist/security/center/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Security Center — public barrel.
+ *
+ * Exports the PURE pieces only (types, settings parse/validate, IP validation,
+ * status computation, cross-module summaries) so the admin client can import
+ * them without pulling in server-side DB/env code. The async gatherer
+ * (`gather.ts`) is imported directly by the API handlers, not re-exported here.
+ */
+export type { ApiKeysSecuritySummary, CheckStatus, IpAllowlistStatus, MfaSettings, SecretsStatus, SecurityCenterData, SecurityCheck, SecuritySettings, SecuritySourceMetadata, SecurityStatus, SecurityStatusInput, SecurityStatusLevel, SecurityWarning, SecurityWarningCategory, SessionSettings, UsersSecuritySummary, } from './types.js';
+export { DEFAULT_SECURITY_SETTINGS, MAX_CONCURRENT_SESSION_OPTIONS, MFA_GRACE_PERIOD_OPTIONS, mfaEnableLockoutError, parseSecuritySettings, validateIpRange, validateSecuritySettings, type SecurityValidationIssue, } from './settings.js';
+export { computeSecurityStatus } from './status.js';
+export { summarizeApiKeys, summarizeUsers, type ApiKeyRow, type UserRow } from './summaries.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/center/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/center/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EACV,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,wBAAwB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/security/center/index.js

@@ -0,0 +1,4 @@
+export { DEFAULT_SECURITY_SETTINGS, MAX_CONCURRENT_SESSION_OPTIONS, MFA_GRACE_PERIOD_OPTIONS, mfaEnableLockoutError, parseSecuritySettings, validateIpRange, validateSecuritySettings, } from './settings.js';
+export { computeSecurityStatus } from './status.js';
+export { summarizeApiKeys, summarizeUsers } from './summaries.js';
+//# sourceMappingURL=index.js.map

package/dist/security/center/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/center/index.ts"],"names":[],"mappings":"AA2BA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,wBAAwB,GAEzB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAgC,MAAM,gBAAgB,CAAA"}

package/dist/security/center/settings.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Security settings parsing + validation (pure).
+ *
+ * The persisted, enforced policy lives under the `security` key of the
+ * `settings` global. Only fields the runtime actually enforces are stored
+ * here (MFA requirement + grace, concurrent-session cap) so the UI never
+ * presents a control that does nothing.
+ */
+import type { SecuritySettings } from './types.js';
+export declare const DEFAULT_SECURITY_SETTINGS: SecuritySettings;
+export declare const MFA_GRACE_PERIOD_OPTIONS: readonly [0, 1, 7, 14, 30];
+export declare const MAX_CONCURRENT_SESSION_OPTIONS: readonly [0, 3, 5, 10];
+export interface SecurityValidationIssue {
+    field: string;
+    message: string;
+    severity: 'error' | 'warning';
+}
+/** Read the `security` blob off a settings document, coercing to a safe shape. */
+export declare function parseSecuritySettings(blob: unknown): SecuritySettings;
+/** Validate an incoming settings payload. Pure — no DB / lockout checks here. */
+export declare function validateSecuritySettings(settings: SecuritySettings): SecurityValidationIssue[];
+/**
+ * Lockout-safe MFA enable check. Enabling org-wide MFA while the acting admin
+ * has no TOTP configured would lock them (and possibly everyone) out. Callers
+ * MUST run this server-side before persisting `mfa.required = true`.
+ */
+export declare function mfaEnableLockoutError(input: {
+    enabling: boolean;
+    viewerHasMfa: boolean;
+    totalAdmins: number;
+}): string | null;
+/**
+ * Validate a single allowlist entry: an IPv4/IPv6 literal or a CIDR range.
+ * Standalone (does not import the matcher's private helpers) so it can run in
+ * the client bundle for inline form validation.
+ */
+export declare function validateIpRange(entry: string): boolean;
+//# sourceMappingURL=settings.d.ts.map

package/dist/security/center/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../../src/security/center/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,eAAO,MAAM,yBAAyB,EAAE,gBAGvC,CAAA;AAED,eAAO,MAAM,wBAAwB,4BAA6B,CAAA;AAClE,eAAO,MAAM,8BAA8B,wBAAyB,CAAA;AAEpE,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAA;CAC9B;AAOD,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAiCrE;AAcD,iFAAiF;AACjF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,uBAAuB,EAAE,CAmB9F;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAA;IACjB,YAAY,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,MAAM,GAAG,IAAI,CAMhB;AAKD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAatD"}

package/dist/security/center/settings.js

@@ -0,0 +1,121 @@
+export const DEFAULT_SECURITY_SETTINGS = {
+    mfa: { required: false, gracePeriodDays: 7 },
+    session: { maxConcurrentSessions: 5 },
+};
+export const MFA_GRACE_PERIOD_OPTIONS = [0, 1, 7, 14, 30];
+export const MAX_CONCURRENT_SESSION_OPTIONS = [0, 3, 5, 10];
+function toInt(value, fallback) {
+    const n = typeof value === 'number' ? value : Number(value);
+    return Number.isFinite(n) ? Math.trunc(n) : fallback;
+}
+/** Read the `security` blob off a settings document, coercing to a safe shape. */
+export function parseSecuritySettings(blob) {
+    const root = (blob && typeof blob === 'object' ? blob : {}) ?? {};
+    const sec = (root.security && typeof root.security === 'object'
+        ? root.security
+        : {});
+    const mfa = (sec.mfa && typeof sec.mfa === 'object' ? sec.mfa : {});
+    const session = (sec.session && typeof sec.session === 'object' ? sec.session : {});
+    return {
+        mfa: {
+            required: Boolean(mfa.required),
+            gracePeriodDays: clampGrace(toInt(mfa.gracePeriodDays, DEFAULT_SECURITY_SETTINGS.mfa.gracePeriodDays)),
+            requiredAt: typeof mfa.requiredAt === 'string' ? mfa.requiredAt : undefined,
+        },
+        session: {
+            maxConcurrentSessions: clampSessions(toInt(session.maxConcurrentSessions, DEFAULT_SECURITY_SETTINGS.session.maxConcurrentSessions)),
+        },
+        updatedAt: typeof sec.updatedAt === 'string' ? sec.updatedAt : undefined,
+        updatedBy: typeof sec.updatedBy === 'string' ? sec.updatedBy : undefined,
+    };
+}
+function clampGrace(n) {
+    if (n < 0)
+        return 0;
+    if (n > 365)
+        return 365;
+    return n;
+}
+function clampSessions(n) {
+    if (n < 0)
+        return 0;
+    if (n > 100)
+        return 100;
+    return n;
+}
+/** Validate an incoming settings payload. Pure — no DB / lockout checks here. */
+export function validateSecuritySettings(settings) {
+    const issues = [];
+    const grace = settings.mfa.gracePeriodDays;
+    if (!Number.isInteger(grace) || grace < 0 || grace > 365) {
+        issues.push({
+            field: 'mfaGracePeriodDays',
+            message: 'MFA grace period must be a whole number of days between 0 and 365.',
+            severity: 'error',
+        });
+    }
+    const max = settings.session.maxConcurrentSessions;
+    if (!Number.isInteger(max) || max < 0 || max > 100) {
+        issues.push({
+            field: 'maxConcurrentSessions',
+            message: 'Maximum concurrent sessions must be a whole number between 0 (unlimited) and 100.',
+            severity: 'error',
+        });
+    }
+    return issues;
+}
+/**
+ * Lockout-safe MFA enable check. Enabling org-wide MFA while the acting admin
+ * has no TOTP configured would lock them (and possibly everyone) out. Callers
+ * MUST run this server-side before persisting `mfa.required = true`.
+ */
+export function mfaEnableLockoutError(input) {
+    if (!input.enabling)
+        return null;
+    if (!input.viewerHasMfa) {
+        return 'Set up MFA for your own account before requiring it for everyone — otherwise you would lock yourself out.';
+    }
+    return null;
+}
+const IPV4_OCTET = '(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)';
+const IPV4_RE = new RegExp(`^${IPV4_OCTET}(\\.${IPV4_OCTET}){3}$`);
+/**
+ * Validate a single allowlist entry: an IPv4/IPv6 literal or a CIDR range.
+ * Standalone (does not import the matcher's private helpers) so it can run in
+ * the client bundle for inline form validation.
+ */
+export function validateIpRange(entry) {
+    const value = entry.trim();
+    if (!value)
+        return false;
+    const [addr, maskStr, ...rest] = value.split('/');
+    if (rest.length > 0 || addr === undefined)
+        return false;
+    const isV6 = addr.includes(':');
+    if (maskStr !== undefined) {
+        if (!/^\d{1,3}$/.test(maskStr))
+            return false;
+        const mask = Number(maskStr);
+        if (isV6 ? mask > 128 : mask > 32)
+            return false;
+    }
+    return isV6 ? isValidIpv6(addr) : IPV4_RE.test(addr);
+}
+function isValidIpv6(addr) {
+    // Reject IPv4-mapped + multiple `::`; otherwise validate 1–8 hextet groups.
+    if (addr.includes('.'))
+        return false;
+    const halves = addr.split('::');
+    if (halves.length > 2)
+        return false;
+    const groups = addr
+        .replace('::', ':')
+        .split(':')
+        .filter((g) => g.length > 0);
+    if (groups.length === 0 && halves.length !== 2)
+        return false;
+    if (groups.length > 8)
+        return false;
+    return groups.every((g) => /^[0-9a-fA-F]{1,4}$/.test(g));
+}
+//# sourceMappingURL=settings.js.map

package/dist/security/center/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/security/center/settings.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;IAC5C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;CACtC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAU,CAAA;AAClE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAU,CAAA;AAQpE,SAAS,KAAK,CAAC,KAAc,EAAE,QAAgB;IAC7C,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AACtD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,IAAa;IACjD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;IAC9F,MAAM,GAAG,GAAG,CACV,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAChD,CAAC,CAAE,IAAI,CAAC,QAAoC;QAC5C,CAAC,CAAC,EAAE,CACoB,CAAA;IAC5B,MAAM,GAAG,GAAG,CACV,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,GAA+B,CAAC,CAAC,CAAC,EAAE,CACxD,CAAA;IAC5B,MAAM,OAAO,GAAG,CACd,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,OAAmC,CAAC,CAAC,CAAC,EAAE,CACpE,CAAA;IAE5B,OAAO;QACL,GAAG,EAAE;YACH,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/B,eAAe,EAAE,UAAU,CACzB,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,yBAAyB,CAAC,GAAG,CAAC,eAAe,CAAC,CAC1E;YACD,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAC5E;QACD,OAAO,EAAE;YACP,qBAAqB,EAAE,aAAa,CAClC,KAAK,CACH,OAAO,CAAC,qBAAqB,EAC7B,yBAAyB,CAAC,OAAO,CAAC,qBAAqB,CACxD,CACF;SACF;QACD,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACxE,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACzE,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IACnB,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,GAAG,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IACnB,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,GAAG,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,QAA0B;IACjE,MAAM,MAAM,GAA8B,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,oEAAoE;YAC7E,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAA;IAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,mFAAmF;YAC5F,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,2GAA2G,CAAA;IACpH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,GAAG,uCAAuC,CAAA;AAC1D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,OAAO,UAAU,OAAO,CAAC,CAAA;AAElE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE;YAAE,OAAO,KAAK,CAAA;IACjD,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,4EAA4E;IAC5E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,MAAM,MAAM,GAAG,IAAI;SAChB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC"}

package/dist/security/center/status.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Pure security-posture computation.
+ *
+ * Turns gathered signals ({@link SecurityStatusInput}) into checks, warnings,
+ * an overall level, and an advisory score. No I/O — fully unit-tested so the
+ * "is this safe for production?" verdict is deterministic and reviewable.
+ */
+import type { SecurityStatus, SecurityStatusInput } from './types.js';
+export declare function computeSecurityStatus(input: SecurityStatusInput): SecurityStatus;
+//# sourceMappingURL=status.d.ts.map

package/dist/security/center/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/security/center/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAEV,cAAc,EACd,mBAAmB,EAGpB,MAAM,YAAY,CAAA;AA2BnB,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAuNhF"}

package/dist/security/center/status.js

@@ -0,0 +1,249 @@
+const ADMIN_HREF = '/settings?tab=users';
+const API_KEYS_HREF = '/settings?tab=api-keys';
+const FAILED_LOGIN_WARN_THRESHOLD = 20;
+const LEVEL_COPY = {
+    secure: {
+        label: 'Secure',
+        description: 'Core protections are configured. Keep MFA coverage and API keys under review.',
+    },
+    needs_attention: {
+        label: 'Needs attention',
+        description: 'Some recommended controls are missing. Review the warnings below.',
+    },
+    at_risk: {
+        label: 'At risk',
+        description: 'Critical protections are missing or misconfigured. Resolve these before running in production.',
+    },
+    unknown: {
+        label: 'Unknown',
+        description: 'Security state could not be fully determined. Some services may be unavailable.',
+    },
+};
+export function computeSecurityStatus(input) {
+    const checks = [];
+    const warnings = [];
+    // ── MFA coverage ──────────────────────────────────────────────────────────
+    if (input.users.totalAdmins === 0) {
+        checks.push({ key: 'mfa', label: 'MFA coverage', status: 'unknown', value: 'No admins' });
+    }
+    else {
+        const allCovered = input.users.adminsWithoutMfa === 0;
+        const mfaStatus = allCovered ? 'pass' : input.settings.mfa.required ? 'fail' : 'warning';
+        checks.push({
+            key: 'mfa',
+            label: 'MFA coverage',
+            status: mfaStatus,
+            value: `${input.users.withMfa} of ${input.users.totalAdmins} admins`,
+            actionHref: ADMIN_HREF,
+        });
+        if (input.settings.mfa.required && input.users.adminsWithoutMfa > 0) {
+            warnings.push({
+                id: 'mfa-required-gap',
+                severity: 'critical',
+                category: 'auth',
+                title: 'Admins without MFA while MFA is required',
+                description: `${input.users.adminsWithoutMfa} admin account(s) have not set up MFA. They must enroll within the grace period.`,
+                actionLabel: 'Review users',
+                actionHref: ADMIN_HREF,
+            });
+        }
+        else if (!input.settings.mfa.required && input.isProduction) {
+            warnings.push({
+                id: 'mfa-not-required',
+                severity: 'warning',
+                category: 'auth',
+                title: 'MFA is not required in production',
+                description: 'Requiring MFA for admins significantly reduces account-takeover risk.',
+            });
+        }
+    }
+    // ── Active sessions (informational) ─────────────────────────────────────────
+    checks.push({
+        key: 'sessions',
+        label: 'Active admin sessions',
+        status: 'pass',
+        value: String(input.activeSessions),
+        actionHref: '/settings?tab=security&section=sessions',
+    });
+    // ── API keys ────────────────────────────────────────────────────────────────
+    const keyRisk = input.apiKeys.broadScope > 0
+        ? 'fail'
+        : input.apiKeys.withoutExpiration > 0 || input.apiKeys.staleUnused90d > 0
+            ? 'warning'
+            : 'pass';
+    checks.push({
+        key: 'api_keys',
+        label: 'High-risk API keys',
+        status: keyRisk === 'pass' ? 'pass' : keyRisk,
+        value: keyRisk === 'pass' ? `${input.apiKeys.active} active` : describeKeyRisk(input.apiKeys),
+        actionHref: API_KEYS_HREF,
+    });
+    if (input.apiKeys.broadScope > 0) {
+        warnings.push({
+            id: 'api-keys-broad',
+            severity: 'warning',
+            category: 'api_keys',
+            title: 'API keys with broad scopes',
+            description: `${input.apiKeys.broadScope} key(s) hold admin or full read/write scope. Scope keys to the minimum required.`,
+            actionLabel: 'Review API keys',
+            actionHref: API_KEYS_HREF,
+        });
+    }
+    if (input.apiKeys.withoutExpiration > 0) {
+        warnings.push({
+            id: 'api-keys-no-expiry',
+            severity: 'info',
+            category: 'api_keys',
+            title: 'API keys without expiration',
+            description: `${input.apiKeys.withoutExpiration} key(s) never expire. Consider setting an expiry.`,
+            actionLabel: 'Review API keys',
+            actionHref: API_KEYS_HREF,
+        });
+    }
+    // ── Failed logins (24h) ──────────────────────────────────────────────────────
+    const loginStatus = input.failedLogins24h >= FAILED_LOGIN_WARN_THRESHOLD ? 'warning' : 'pass';
+    checks.push({
+        key: 'failed_logins',
+        label: 'Failed logins (24h)',
+        status: loginStatus,
+        value: String(input.failedLogins24h),
+    });
+    if (loginStatus === 'warning') {
+        warnings.push({
+            id: 'failed-logins-spike',
+            severity: 'warning',
+            category: 'auth',
+            title: 'Elevated failed login attempts',
+            description: `${input.failedLogins24h} failed logins in the last 24h. This may indicate a brute-force attempt.`,
+        });
+    }
+    // ── CSRF ──────────────────────────────────────────────────────────────────────
+    checks.push({
+        key: 'csrf',
+        label: 'CSRF protection',
+        status: input.csrfEnabled ? 'pass' : 'fail',
+        value: input.csrfEnabled ? 'Enabled' : 'Disabled',
+    });
+    if (!input.csrfEnabled) {
+        warnings.push({
+            id: 'csrf-disabled',
+            severity: 'critical',
+            category: 'access',
+            title: 'CSRF protection disabled',
+            description: 'State-changing requests are not CSRF-protected. This exposes the admin to cross-site request forgery.',
+        });
+    }
+    // ── Rate limiting ──────────────────────────────────────────────────────────────
+    const distributed = input.secrets.rateLimitBackend === 'distributed';
+    checks.push({
+        key: 'rate_limit',
+        label: 'Rate limiting',
+        status: distributed ? 'pass' : 'warning',
+        value: distributed ? 'Distributed (Upstash)' : 'In-memory',
+    });
+    if (!distributed && input.isProduction) {
+        warnings.push({
+            id: 'rate-limit-in-memory',
+            severity: 'warning',
+            category: 'rate_limit',
+            title: 'Rate limiting is in-memory',
+            description: 'Without Upstash/Redis, rate limits are per-process and ineffective across serverless invocations. Configure UPSTASH_REDIS_REST_URL.',
+        });
+    }
+    // ── Upload validation ───────────────────────────────────────────────────────
+    checks.push({
+        key: 'uploads',
+        label: 'Upload validation',
+        status: input.uploadValidation ? 'pass' : 'warning',
+        value: input.uploadValidation ? 'MIME + magic bytes + SVG sanitization' : 'Unknown',
+    });
+    // ── Secrets / encryption ─────────────────────────────────────────────────────
+    checks.push({
+        key: 'cms_secret',
+        label: 'CMS secret',
+        status: input.secrets.cmsSecret,
+        value: secretValueLabel(input.secrets.cmsSecret),
+    });
+    if (input.secrets.cmsSecret === 'fail') {
+        warnings.push({
+            id: 'cms-secret-missing',
+            severity: 'critical',
+            category: 'secrets',
+            title: 'CMS_SECRET is missing or weak',
+            description: 'Session JWTs cannot be signed securely. Set a 32+ character CMS_SECRET.',
+        });
+    }
+    checks.push({
+        key: 'encryption_key',
+        label: 'Encryption key',
+        status: input.secrets.encryptionKey,
+        value: secretValueLabel(input.secrets.encryptionKey),
+    });
+    if (input.secrets.encryptionKey === 'fail') {
+        warnings.push({
+            id: 'encryption-key',
+            severity: input.isProduction ? 'critical' : 'warning',
+            category: 'secrets',
+            title: 'Encryption key not configured',
+            description: 'CMS_ENCRYPTION_KEY (64 hex chars) is required to encrypt secrets at rest (webhook secrets, OAuth tokens, TOTP secrets).',
+        });
+    }
+    // ── Audit logging ──────────────────────────────────────────────────────────────
+    checks.push({
+        key: 'audit',
+        label: 'Audit logging',
+        status: input.auditEnabled ? 'pass' : 'warning',
+        value: input.auditEnabled ? 'Enabled' : 'Disabled',
+        actionHref: '/settings?tab=security&section=audit',
+    });
+    // ── Roll up level + score ────────────────────────────────────────────────────
+    const hasCritical = warnings.some((w) => w.severity === 'critical');
+    const hasWarning = warnings.some((w) => w.severity === 'warning');
+    const unknown = input.secrets.cmsSecret === 'unknown';
+    let level;
+    if (unknown)
+        level = 'unknown';
+    else if (hasCritical)
+        level = 'at_risk';
+    else if (hasWarning)
+        level = 'needs_attention';
+    else
+        level = 'secure';
+    let score = 100;
+    for (const w of warnings) {
+        score -= w.severity === 'critical' ? 30 : w.severity === 'warning' ? 12 : 3;
+    }
+    score = Math.max(0, Math.min(100, score));
+    return {
+        status: level,
+        score,
+        label: LEVEL_COPY[level].label,
+        description: LEVEL_COPY[level].description,
+        checks,
+        warnings,
+        lastCheckedAt: new Date().toISOString(),
+    };
+}
+function describeKeyRisk(k) {
+    const parts = [];
+    if (k.broadScope > 0)
+        parts.push(`${k.broadScope} broad-scope`);
+    if (k.withoutExpiration > 0)
+        parts.push(`${k.withoutExpiration} no expiry`);
+    if (k.staleUnused90d > 0)
+        parts.push(`${k.staleUnused90d} stale`);
+    return parts.join(', ') || 'OK';
+}
+function secretValueLabel(status) {
+    switch (status) {
+        case 'pass':
+            return 'Configured';
+        case 'warning':
+            return 'Not configured';
+        case 'fail':
+            return 'Missing / invalid';
+        default:
+            return 'Unknown';
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/security/center/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/security/center/status.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,GAAG,qBAAqB,CAAA;AACxC,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAE9C,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAEtC,MAAM,UAAU,GAAwE;IACtF,MAAM,EAAE;QACN,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,+EAA+E;KAC7F;IACD,eAAe,EAAE;QACf,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,mEAAmE;KACjF;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,gGAAgG;KACnG;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,iFAAiF;KAC/F;CACF,CAAA;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA0B;IAC9D,MAAM,MAAM,GAAoB,EAAE,CAAA;IAClC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IAEtC,6EAA6E;IAC7E,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC3F,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;QACxF,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,KAAK;YACV,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,SAAS;YACpE,UAAU,EAAE,UAAU;SACvB,CAAC,CAAA;QACF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,0CAA0C;gBACjD,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,kFAAkF;gBAC9H,WAAW,EAAE,cAAc;gBAC3B,UAAU,EAAE,UAAU;aACvB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,mCAAmC;gBAC1C,WAAW,EAAE,uEAAuE;aACrF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QACnC,UAAU,EAAE,yCAAyC;KACtD,CAAC,CAAA;IAEF,+EAA+E;IAC/E,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC;QAC1B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC;YACvE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAA;IACd,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QAC7C,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7F,UAAU,EAAE,aAAa;KAC1B,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,kFAAkF;YAC1H,WAAW,EAAE,iBAAiB;YAC9B,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,mDAAmD;YAClG,WAAW,EAAE,iBAAiB;YAC9B,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;IAC7F,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,qBAAqB;QAC5B,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;KACrC,CAAC,CAAA;IACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,qBAAqB;YACzB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,GAAG,KAAK,CAAC,eAAe,0EAA0E;SAChH,CAAC,CAAA;IACJ,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC3C,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;KAClD,CAAC,CAAA;IACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,eAAe;YACnB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,0BAA0B;YACjC,WAAW,EACT,uGAAuG;SAC1G,CAAC,CAAA;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,KAAK,aAAa,CAAA;IACpE,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACxC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,WAAW;KAC3D,CAAC,CAAA;IACF,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EACT,qIAAqI;SACxI,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IAC/E,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACnD,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,SAAS;KACpF,CAAC,CAAA;IAEF,gFAAgF;IAChF,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAC/B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;KACjD,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,+BAA+B;YACtC,WAAW,EAAE,yEAAyE;SACvF,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QACnC,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;KACrD,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACrD,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,+BAA+B;YACtC,WAAW,EACT,yHAAyH;SAC5H,CAAC,CAAA;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/C,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAClD,UAAU,EAAE,sCAAsC;KACnD,CAAC,CAAA;IAEF,gFAAgF;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAA;IAErD,IAAI,KAA0B,CAAA;IAC9B,IAAI,OAAO;QAAE,KAAK,GAAG,SAAS,CAAA;SACzB,IAAI,WAAW;QAAE,KAAK,GAAG,SAAS,CAAA;SAClC,IAAI,UAAU;QAAE,KAAK,GAAG,iBAAiB,CAAA;;QACzC,KAAK,GAAG,QAAQ,CAAA;IAErB,IAAI,KAAK,GAAG,GAAG,CAAA;IACf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAEzC,OAAO;QACL,MAAM,EAAE,KAAK;QACb,KAAK;QACL,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK;QAC9B,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW;QAC1C,MAAM;QACN,QAAQ;QACR,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAIxB;IACC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,cAAc,CAAC,CAAA;IAC/D,IAAI,CAAC,CAAC,iBAAiB,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,YAAY,CAAC,CAAA;IAC3E,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAA;IACjE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA+B;IACvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,YAAY,CAAA;QACrB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAA;QACzB,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAA;QAC5B;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC"}

package/dist/security/center/summaries.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Pure cross-module risk summaries (users + API keys).
+ *
+ * Take already-fetched rows so they can be unit-tested without a DB. The
+ * gatherer queries the minimal columns and hands them here.
+ */
+import type { ApiKeysSecuritySummary, UsersSecuritySummary } from './types.js';
+export interface UserRow {
+    role: string;
+    isActive: boolean;
+    totpEnabled: boolean;
+}
+export declare function summarizeUsers(rows: UserRow[]): UsersSecuritySummary;
+export interface ApiKeyRow {
+    scopes: unknown;
+    expiresAt: Date | string | null;
+    lastUsedAt: Date | string | null;
+    revokedAt: Date | string | null;
+}
+export declare function summarizeApiKeys(rows: ApiKeyRow[], now?: number): ApiKeysSecuritySummary;
+//# sourceMappingURL=summaries.d.ts.map

package/dist/security/center/summaries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"summaries.d.ts","sourceRoot":"","sources":["../../../src/security/center/summaries.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE9E,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;CACrB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAwBpE;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,SAAS,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CAChC;AAgBD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,EAAE,EACjB,GAAG,GAAE,MAAmB,GACvB,sBAAsB,CAgBxB"}

package/dist/security/center/summaries.js

@@ -0,0 +1,65 @@
+export function summarizeUsers(rows) {
+    let totalAdmins = 0;
+    let withMfa = 0;
+    let adminsWithoutMfa = 0;
+    let withoutMfa = 0;
+    let inactive = 0;
+    for (const u of rows) {
+        if (!u.isActive)
+            inactive++;
+        if (!u.totpEnabled)
+            withoutMfa++;
+        const isAdmin = u.role === 'ADMIN';
+        if (isAdmin) {
+            totalAdmins++;
+            if (u.totpEnabled)
+                withMfa++;
+            else if (u.isActive)
+                adminsWithoutMfa++;
+        }
+    }
+    return {
+        totalUsers: rows.length,
+        totalAdmins,
+        withMfa,
+        withoutMfa,
+        adminsWithoutMfa,
+        inactive,
+    };
+}
+const STALE_MS = 90 * 24 * 60 * 60 * 1000;
+/** A key is "broad" if it carries the admin scope (full control). */
+function isBroadScope(scopes) {
+    if (!scopes || typeof scopes !== 'object')
+        return false;
+    return scopes.admin === true;
+}
+function toTime(v) {
+    if (!v)
+        return null;
+    const t = v instanceof Date ? v.getTime() : new Date(v).getTime();
+    return Number.isFinite(t) ? t : null;
+}
+export function summarizeApiKeys(rows, now = Date.now()) {
+    let active = 0;
+    let withoutExpiration = 0;
+    let broadScope = 0;
+    let staleUnused90d = 0;
+    for (const k of rows) {
+        if (k.revokedAt)
+            continue;
+        const exp = toTime(k.expiresAt);
+        if (exp !== null && exp <= now)
+            continue; // expired ⇒ not active
+        active++;
+        if (exp === null)
+            withoutExpiration++;
+        if (isBroadScope(k.scopes))
+            broadScope++;
+        const used = toTime(k.lastUsedAt);
+        if (used !== null && now - used > STALE_MS)
+            staleUnused90d++;
+    }
+    return { active, withoutExpiration, broadScope, staleUnused90d };
+}
+//# sourceMappingURL=summaries.js.map

package/dist/security/center/summaries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"summaries.js","sourceRoot":"","sources":["../../../src/security/center/summaries.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,cAAc,CAAC,IAAe;IAC5C,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,QAAQ,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,UAAU,EAAE,CAAA;QAChC,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,CAAA;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,WAAW,EAAE,CAAA;YACb,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,EAAE,CAAA;iBACvB,IAAI,CAAC,CAAC,QAAQ;gBAAE,gBAAgB,EAAE,CAAA;QACzC,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,WAAW;QACX,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,QAAQ;KACT,CAAA;AACH,CAAC;AASD,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEzC,qEAAqE;AACrE,SAAS,YAAY,CAAC,MAAe;IACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACvD,OAAQ,MAAkC,CAAC,KAAK,KAAK,IAAI,CAAA;AAC3D,CAAC;AAED,SAAS,MAAM,CAAC,CAAuB;IACrC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAiB,EACjB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,SAAS;YAAE,SAAQ;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG;YAAE,SAAQ,CAAC,uBAAuB;QAChE,MAAM,EAAE,CAAA;QACR,IAAI,GAAG,KAAK,IAAI;YAAE,iBAAiB,EAAE,CAAA;QACrC,IAAI,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,UAAU,EAAE,CAAA;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;QACjC,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,QAAQ;YAAE,cAAc,EAAE,CAAA;IAC9D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;AAClE,CAAC"}