@antasphere/chassis-server 1.0.0

package/dist/api/projects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/api/projects.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAoC,MAAM,8BAA8B,CAAC;AACpG,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,IAAI,IAAI,SAAS,EACjB,gBAAgB,EAChB,cAAc,EAGf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,MAAM,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAuB/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC9E,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAE7D,+GAA+G;AAC/G,SAAS,qBAAqB,CAAC,CAAU,EAAE,UAAkB;IAC3D,KAAK,IAAI,GAAG,GAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,YAAY,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACnG,MAAM,IAAI,GAAG,GAA+C,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0GAA0G;AAC1G,MAAM,eAAe,GAAG,6CAA6C,CAAC;AAetE,MAAM,MAAM,GAAG,CAAC,CAA2C,EAAE,EAAE,CAAC,CAAC;IAC/D,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;IAC/C,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,WAAW,EAAE,CAAC,CAAC,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAOrB,EAAE,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,QAAiB;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CASnB,EAAE,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAe;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;CACrC,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,GAAG,CAAQ,qFAAqF,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC;AAEhK,uGAAuG;AACvG,MAAM,gBAAgB,GAAG,CAAC,SAAoB,EAAE,EAAE,CAAC,CAAC;IAClD,EAAE,EAAE,QAAQ,CAAC,EAAE;IACf,IAAI,EAAE,QAAQ,CAAC,IAAI;IACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;IACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;IAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;IAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;IAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;IAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;IAC7B,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,WAAW,CAAC;IACrD,uDAAuD;IACvD,WAAW,EAAE,GAAG,CAAQ,qFAAqF,WAAW;0FAChC,WAAW,GAAG;CACvG,CAAC,CAAC;AAEH,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,6DAA6D;AAC7D,MAAM,eAAe,GAAG;IACtB,EAAE,EAAE,cAAc,CAAC,EAAE;IACrB,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,SAAS,CAAC;IACtD,MAAM,EAAE,gBAAgB,CAAC,MAAM;IAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;IACtB,IAAI,EAAE,SAAS,CAAC,IAAI;IACpB,IAAI,EAAE,cAAc,CAAC,IAAI;IACzB,OAAO,EAAE,cAAc,CAAC,OAAO;IAC/B,SAAS,EAAE,cAAc,CAAC,SAAS;CACpC,CAAC;AAEF,8FAA8F;AAC9F,MAAM,aAAa,GAAG;IACpB,EAAE,EAAE,YAAY,CAAC,EAAE;IACnB,aAAa,EAAE,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC;IACpD,MAAM,EAAE,cAAc,CAAC,EAAE;IACzB,IAAI,EAAE,cAAc,CAAC,IAAI;IACzB,IAAI,EAAE,cAAc,CAAC,IAAI;IACzB,YAAY,EAAE,kBAAkB;IAChC,SAAS,EAAE,cAAc,CAAC,SAAS;IACnC,IAAI,EAAE,YAAY,CAAC,IAAI;IACvB,OAAO,EAAE,YAAY,CAAC,OAAO;IAC7B,SAAS,EAAE,YAAY,CAAC,SAAS;CAClC,CAAC;AAmBF,MAAM,UAAU,qBAAqB,CAAC,GAAgB,EAAE,IAAsB;IAC5E,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6CAA6C;IAC7C,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,sFAAsF;IACtF,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,SAAoB,EACpB,EAAU;QAEV,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI;aACrB,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;aACnC,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAChF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,YAAY,CACzB,CAAU,EACV,EAAU,EACV,GAAgB,EAChB,OAAoC,EAAE;QAEtC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,EAAE,kBAAkB,GAAG,sBAAsB,CAAC,EAAE,GAAG,CAAC;aACrG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvD,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,EAAE,oDAAoD,CAAC,CAAC;IAErG;;;;;OAKG;IACH,KAAK,UAAU,SAAS,CACtB,SAAoB,EACpB,EAAU,EACV,KAAiC;QAEjC,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;iBAC3C,IAAI,CAAC,QAAQ,CAAC;iBACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;iBAChF,GAAG,CAAC,OAAO,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACjD,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;aACnC,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QAC/C,kEAAkE;QAClE,mEAAmE;QACnE,qBAAqB,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACpF,GAAG,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EACpE,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EACtE,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,YAAY,CAAC;oBACX,KAAK,EAAE,QAAQ;oBACf,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,QAAQ;oBACR,SAAS,EAAE,SAAS,CAAC,WAAW;iBACjC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;aACA,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aACpD,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpB,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,4DAA4D;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAChD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;iBACnC,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACvD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;gBACD,2DAA2D;gBAC3D,iEAAiE;iBAChE,GAAG,CAAC,OAAO,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC;gBACN,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;gBACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAC7B,SAAS,EAAE,SAAS,CAAC,MAAM;aAC5B,CAAC;iBACD,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;gBACrC,SAAS,EAAE,OAAQ,CAAC,EAAE;gBACtB,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,SAAS,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,OAAQ,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,QAAiB,CAAC;QACtD,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,QAAQ,CAAC;aAChB,GAAG,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CACvG;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAE,CAAC;QACxD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;SACzC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,mDAAmD;IACnD,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,QAAiB,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,QAAQ,CAAC;aAChB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACtD,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CACvG;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAE,CAAC;QACxD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,QAAiB,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,QAAQ,CAAC;aAChB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAChD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EACnB,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EAC/C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC/B,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,6BAA6B,CAAC,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAE,CAAC;QACxD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,KAAa,EAAE,EAAE,CAClD,KAAK;YACH,CAAC,CAAC,GAAG,CAAA,QAAQ,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC,SAAS,kBAAkB,KAAK,CAAC,EAAE,SAAS;YAC5G,CAAC,CAAC,GAAG,CAAA,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;;;;+BAOR,EAAE,IAAI,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC;;;;;;;;;+BAStC,EAAE,IAAI,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC;;cAEvD,KAAK,GAAG,CAAC;KAClB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAmC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/B,GAAG,CAAC,IAAI,KAAK,QAAQ;YACnB,CAAC,CAAC,YAAY,CAAC;gBACX,MAAM,EAAE,GAAG,CAAC,OAAQ;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAM;gBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,QAAQ;gBACrB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;aACpC,CAAC;YACJ,CAAC,CAAC,UAAU,CAAC;gBACT,MAAM,EAAE,GAAG,CAAC,OAAQ;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAK;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;gBACpC,SAAS,EAAE,GAAG,CAAC,WAAW;gBAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,QAAQ;gBACrB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;aACpC,CAAC,CACP,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,OAAO;YACP,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;SACnG,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiB,EAAE,MAAc;QAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI;aACrB,MAAM,CAAC,eAAe,CAAC;aACvB,IAAI,CAAC,cAAc,CAAC;aACpB,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;aAC7E,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC/D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACxF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAED,qEAAqE;IACrE,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,SAAiB,EAAE,MAAc;QAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI;aACrB,MAAM,CAAC,aAAa,CAAC;aACrB,IAAI,CAAC,YAAY,CAAC;aAClB,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;aACrE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;aAChF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,OAAO,CAAC,CAAU,EAAE,EAAU,EAAE,MAAc,EAAE,IAAiB;QAC9E,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC;YACN,MAAM,EAAE,cAAc,CAAC,EAAE;YACzB,IAAI,EAAE,cAAc,CAAC,IAAI;YACzB,IAAI,EAAE,cAAc,CAAC,IAAI;YACzB,YAAY,EAAE,kBAAkB;YAChC,SAAS,EAAE,cAAc,CAAC,SAAS;SACpC,CAAC;aACD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAChG,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1F,IAAI,QAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAC/C,EAAE;iBACC,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;iBAC/E,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC9E,SAAS,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CACpD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,qBAAqB,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,EAAE,GAAG,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,8CAA8C,CAAC,EAAE,GAAG,CAAC,CAAC;QACpG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACzG,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,QAAiB,CAAC;QACtD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAU,CAAC;QAE9F,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;SACpC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC/D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACvD,IAAI,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAA,SAAS,SAAS,CAAC,KAAK,OAAO,IAAI,CAAC,KAAM,CAAC,WAAW,EAAE,EAAE,CAClE,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,2CAA2C;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CACD,cAAc,EACd,oFAAoF,CACrF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3D,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBACpF,OAAO,aAAsB,CAAC;YAChC,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,oDAAoD;YACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;iBACxB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;iBACjC,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;iBACpF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,QAAQ;gBAAE,OAAO,EAAE,CAAC;YACxB,OAAO,EAAE;iBACN,MAAM,CAAC,cAAc,CAAC;iBACtB,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;iBAC1F,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;iBACpF,SAAS,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QACnG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,oBAAoB;YAC5B,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SAC3D,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,QAAiB,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,EAAE,GAAG,CAAC,CAAC;QACvG,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAChF,CAAC;QACF,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,qBAAqB;YAC7B,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;SAChE,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,yCAAyC;IACzC,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,MAAM,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,QAAiB,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,EAAE,GAAG,CAAC,CAAC;QACvG,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAClE,CAAC;QACF,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,uBAAuB;YAC/B,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE;SAC5D,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,0BAA0B;IAC1B,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,QAAiB,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,0CAA0C,CAAC,EAAE,GAAG,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;QACF,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,mBAAmB;YAC3B,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,QAAiB,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,0CAA0C,CAAC,EAAE,GAAG,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAC9D,CAAC;QACF,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,qBAAqB;YAC7B,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/scope-routes.d.ts

@@ -0,0 +1,12 @@
+import type { defineChassisRoutes } from '@antasphere/chassis-contract/routes';
+/**
+ * The generic routes that carry something of the TOOL: its scope vocabulary
+ * (`/me`, the API-key family, the two CLI key mints) or its own words in the
+ * OpenAPI text (the export route, the file delete route). The tool
+ * instantiates them once (`defineChassisRoutes(contract, identity, copy)`) and
+ * hands the SAME objects to the routers below, so the OpenAPI document is
+ * built from one definition.
+ * The chassis reads a scope as a plain string.
+ */
+export type ScopeRoutes = ReturnType<typeof defineChassisRoutes<string>>;
+//# sourceMappingURL=scope-routes.d.ts.map

package/dist/api/scope-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-routes.d.ts","sourceRoot":"","sources":["../../src/api/scope-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/api/scope-routes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scope-routes.js.map

package/dist/api/scope-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-routes.js","sourceRoot":"","sources":["../../src/api/scope-routes.ts"],"names":[],"mappings":""}

package/dist/api/sso-connect.d.ts

@@ -0,0 +1,70 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type { ScopeRoutes } from './scope-routes.js';
+import { type Db } from '@antasphere/chassis-db';
+import type { Auth } from '../identity/better-auth.js';
+import { type HubSsoService } from '../identity/hub-sso.js';
+import type { HubGrantService } from '../identity/hub-grant.js';
+import type { ApiKeyService } from '../apikeys/service.js';
+import type { AuditService } from '../audit/service.js';
+import type { Logger } from '../logger.js';
+/**
+ * CLI cross-tool connect (cloud edition ONLY — internal/federation.md P5):
+ *
+ *   POST /sso/cli-connect → verify a hub-minted 120 s exchange JWT (the H3
+ *   counterpart), JIT-provision exactly like an SSO login, store the H3
+ *   offline grant, reconcile fail-closed, mint a USER-scoped API key
+ *
+ * PUBLIC path (the hub JWT IS the credential — the invitation-lookup /
+ * cli-auth tier-2 pattern), rate-limited on the login wall (api/index.ts),
+ * and registered by api/index.ts ONLY when the instance boots EDITION=cloud
+ * — an oss boot never mounts this module, so the path answers the JSON 404
+ * terminator there (zero hub surface, matching every other cloud seam).
+ *
+ * Because the endpoint is public, verification discipline is the whole
+ * game (a replayable exchange token mints N keys):
+ *
+ *  - the token passes `HubSsoService.verifyConnectToken` — hub-JWKS
+ *    signature, iss pinned to the hub, aud pinned to OUR resource URL,
+ *    RS256 only, expiry, `purpose: 'sso-connect'` required, `jti` required;
+ *    its TRANSITIONAL org claims are never read (org truth = reconcile);
+ *  - the `jti` is consumed ONE-TIME-USE via an INSERT into the Postgres
+ *    `sso_connect_jtis` ledger — the primary-key conflict IS the replay
+ *    signal, multi-replica safe by construction (finding G8). Claim-first
+ *    discipline: the jti is burned BEFORE provisioning, so two concurrent
+ *    presentations of one token can never both reach the mint (a
+ *    transient provisioning failure costs the caller one fresh hub
+ *    exchange — cheap, and the safe side of the race);
+ *  - every verification failure (signature, iss, aud, purpose, expiry,
+ *    replay) answers ONE uniform 401 — no oracle for probing tokens.
+ *
+ * On success the user is provisioned through the SAME HubSsoService path as
+ * a browser SSO login (JIT user via the internal adapter — the user.created
+ * hook and collaborator sweep fire — plus D9 trusted link, D10 email sync),
+ * the request's `hubRefreshToken` (the raw H3 offline grant) is stored
+ * encrypted on the account row (`acquireFromConnect` — the same row a
+ * browser login writes), and the SAME fail-closed reconcile as a browser
+ * login projects the user's orgs as-the-user. Only a definitive 'ok' pass
+ * mints: the key is an ordinary USER-scoped API key (workspaceId null —
+ * the org is a per-request parameter, like every credential), scopes
+ * the tool's read + write — NEVER its export scope (the
+ * CLI_KEY_SCOPES grant, same as /cli/auth/complete), named "Antasphere CLI
+ * <date>", audited, returned once. A connect that can prove NO usable grant
+ * (none carried, none stored, or the carried one is dead) refuses with
+ * explicit steering instead of minting a born-dead key.
+ */
+export interface SsoConnectRouteDeps {
+    db: Db;
+    auth: Auth;
+    hubSso: HubSsoService;
+    /** The per-user hub grant store — the H3 `hubRefreshToken` lands here. */
+    grant: HubGrantService;
+    apiKeys: ApiKeyService;
+    audit: AuditService;
+    logger: Logger;
+    /** The CLI key's fixed grant — the same list /cli/auth/complete mints with. */
+    cliKeyScopes: readonly string[];
+    /** The tool's instantiation of the scope-carrying connect route. */
+    routes: Pick<ScopeRoutes, 'ssoCliConnectRoute'>;
+}
+export declare function registerSsoConnectRoutes(api: OpenAPIHono, deps: SsoConnectRouteDeps): void;
+//# sourceMappingURL=sso-connect.d.ts.map

package/dist/api/sso-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connect.d.ts","sourceRoot":"","sources":["../../src/api/sso-connect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAA6D,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5G,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACxG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,EAAE,CAAC;IACP,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,oEAAoE;IACpE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;CACjD;AAOD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAsK1F"}

package/dist/api/sso-connect.js

@@ -0,0 +1,164 @@
+import { and, eq, lt, sql } from 'drizzle-orm';
+import { apiKeys as apiKeysTable, ssoConnectJtis, workspaceMembers } from '@antasphere/chassis-db';
+import { HubSsoLoginError } from '../identity/hub-sso.js';
+const err = (code, message) => ({ error: { code, message } });
+const GRANT_MISSING_MESSAGE = 'This exchange carried no usable hub grant for this instance — run `antasphere login` again with a ' +
+    'current CLI (the hub issues a grant with every exchange), or sign in to this instance once in a browser ' +
+    'with Antasphere.';
+export function registerSsoConnectRoutes(api, deps) {
+    const { db, auth, hubSso, grant, apiKeys, audit, logger, cliKeyScopes } = deps;
+    const { ssoCliConnectRoute } = deps.routes;
+    api.openapi(ssoCliConnectRoute, async (c) => {
+        const body = c.req.valid('json');
+        // 1. Verify hard. One uniform 401 for every rejection reason.
+        let assertion;
+        try {
+            assertion = await hubSso.verifyConnectToken(body.token);
+        }
+        catch (cause) {
+            logger.warn({ err: cause }, 'sso cli-connect: exchange token rejected');
+            return c.json(err('invalid_token', 'The exchange token is invalid, expired, or already used'), 401);
+        }
+        // 2. Burn the jti (one-time-use, G8). Insert-first: the claim precedes
+        // any effect, so a replay — even a concurrent one — mints nothing. The
+        // sweep keeps the ledger tiny; best-effort, never correctness-bearing
+        // (expired rows only shadow jtis of already-expired tokens).
+        void db
+            .delete(ssoConnectJtis)
+            .where(lt(ssoConnectJtis.expiresAt, sql `now() - interval '1 minute'`))
+            .catch(() => { });
+        const claimed = await db
+            .insert(ssoConnectJtis)
+            .values({ jti: assertion.jti, expiresAt: assertion.expiresAt })
+            .onConflictDoNothing()
+            .returning({ jti: ssoConnectJtis.jti });
+        if (claimed.length === 0) {
+            logger.warn({ jti: assertion.jti }, 'sso cli-connect: replayed jti rejected');
+            return c.json(err('invalid_token', 'The exchange token is invalid, expired, or already used'), 401);
+        }
+        // 3. JIT-provision through the SSO path (identical rows; no projection
+        // here — the reconcile below IS the projection).
+        let provisioned;
+        try {
+            provisioned = await hubSso.provisionConnect(auth, assertion);
+        }
+        catch (cause) {
+            if (cause instanceof HubSsoLoginError) {
+                logger.warn({ err: cause, code: cause.code }, 'sso cli-connect: provisioning refused');
+                return c.json(err(cause.code, 'Could not provision this account on the instance'), 403);
+            }
+            logger.error({ err: cause }, 'sso cli-connect: provisioning failed');
+            return c.json(err('internal', 'Connect failed — try again'), 500);
+        }
+        const { user } = provisioned;
+        // 4. The grant channel: store the H3 offline grant the request carried
+        // (newest mint wins — the replaced family idles to expiry at the hub).
+        // Without one, an already-stored grant (an earlier browser login or
+        // connect) carries the day; with NEITHER, refuse with steering — a key
+        // whose every org read would answer hub_grant_expired must not exist.
+        if (body.hubRefreshToken) {
+            try {
+                await grant.acquireFromConnect(user.id, body.hubRefreshToken);
+            }
+            catch (cause) {
+                logger.error({ err: cause }, 'sso cli-connect: storing the hub grant failed');
+                return c.json(err('internal', 'Connect failed — try again'), 500);
+            }
+        }
+        else if (!(await grant.hasStoredGrant(user.id))) {
+            logger.warn({ userId: user.id }, 'sso cli-connect: no grant carried and none stored — refusing');
+            return c.json(err('hub_grant_missing', GRANT_MISSING_MESSAGE), 403);
+        }
+        // 5. The fail-closed projection pass — the browser login's assertLogin
+        // step 3, on the connect path: one forced reconcile AS THE USER with
+        // the grant stored above. This is also what validates the presented
+        // hubRefreshToken end-to-end (redeemed at the hub under OUR client
+        // credentials); anything but a definitive 'ok' mints nothing.
+        let outcome;
+        try {
+            outcome = await hubSso.reconcileConnect(user.id);
+        }
+        catch (cause) {
+            logger.error({ err: cause }, 'sso cli-connect: reconcile pass threw');
+            return c.json(err('internal', 'Connect failed — try again'), 500);
+        }
+        if (outcome === 'grant_dead' || outcome === 'no_link') {
+            // The carried/stored grant is definitively unusable (revoked,
+            // expired, reuse-torn-down, or — no_link, unreachable after step 3 —
+            // the link itself vanished). Same steering as carrying none.
+            logger.warn({ userId: user.id, outcome }, 'sso cli-connect: grant unusable — refusing the mint');
+            return c.json(err('hub_grant_missing', GRANT_MISSING_MESSAGE), 403);
+        }
+        if (outcome !== 'ok') {
+            // Transient (hub unreachable / 5xx): nothing destroyed; the caller
+            // re-exchanges. Never mint on a pass that proved nothing.
+            logger.warn({ userId: user.id, outcome }, 'sso cli-connect: reconcile inconclusive — try again');
+            return c.json(err('internal', 'Connect failed — try again'), 500);
+        }
+        // 5b. The reconciled truth must leave the key USABLE: a user-scoped key
+        // resolves through the holder's active memberships, so zero of them
+        // (e.g. the hub answered only unknown-role entries — D11 derives roles,
+        // never maps them) would mint a born-dead key. Refuse instead; the
+        // hub-side H3 gate makes this unreachable in the healthy contract.
+        const hasActive = await db
+            .select({ id: workspaceMembers.id })
+            .from(workspaceMembers)
+            .where(and(eq(workspaceMembers.userId, user.id), eq(workspaceMembers.isActive, true)))
+            .limit(1);
+        if (hasActive.length === 0) {
+            logger.warn({ userId: user.id }, 'sso cli-connect: reconcile left no usable membership — refusing');
+            return c.json(err('no_membership', 'Your Antasphere account has no organization usable on this instance'), 403);
+        }
+        // 6. Mint the ordinary local key — USER-scoped (no workspace pin): the
+        // org is a per-request parameter authorized against the caller's live
+        // memberships, exactly like every other credential.
+        const name = `Antasphere CLI ${new Date().toISOString().slice(0, 10)}`;
+        const minted = await apiKeys.mint({
+            workspaceId: null,
+            createdBy: user.id,
+            name,
+            scopes: [...cliKeyScopes],
+            expiresAt: null
+        });
+        const [row] = await db.select().from(apiKeysTable).where(eq(apiKeysTable.id, minted.id)).limit(1);
+        if (!row) {
+            return c.json(err('internal', 'Key mint failed — try again'), 500);
+        }
+        // Principal-less public route: the audit middleware cannot attribute it —
+        // write the row directly, exactly like /cli/auth/complete does. The key
+        // is a USER credential, so the row is INSTANCE-attributed (ADR 014).
+        await audit.write({
+            workspaceId: null,
+            principal: { userId: user.id, via: 'session' },
+            action: 'apikey.create',
+            resourceType: 'api_key',
+            resourceId: minted.id,
+            requestId: c.get('requestId'),
+            metadata: {
+                name,
+                scopes: [...cliKeyScopes],
+                via: 'sso_cli_connect',
+                hubSub: assertion.sub,
+                grantChannel: body.hubRefreshToken ? 'h3_exchange' : 'stored'
+            }
+        });
+        return c.json({
+            key: minted.key,
+            apiKey: {
+                id: row.id,
+                name: row.name,
+                keyId: row.keyId,
+                scopes: row.scopes,
+                workspaceId: row.workspaceId,
+                createdBy: row.createdBy,
+                createdAt: row.createdAt.toISOString(),
+                lastUsedAt: row.lastUsedAt?.toISOString() ?? null,
+                revokedAt: row.revokedAt?.toISOString() ?? null,
+                expiresAt: row.expiresAt?.toISOString() ?? null
+            },
+            user,
+            workspaceId: null
+        }, 201);
+    });
+}
+//# sourceMappingURL=sso-connect.js.map

package/dist/api/sso-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connect.js","sourceRoot":"","sources":["../../src/api/sso-connect.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAW,MAAM,wBAAwB,CAAC;AAE5G,OAAO,EAAE,gBAAgB,EAAgD,MAAM,wBAAwB,CAAC;AAMxG,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AA+D9E,MAAM,qBAAqB,GACzB,oGAAoG;IACpG,0GAA0G;IAC1G,kBAAkB,CAAC;AAErB,MAAM,UAAU,wBAAwB,CAAC,GAAgB,EAAE,IAAyB;IAClF,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC/E,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;IAE3C,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,8DAA8D;QAC9D,IAAI,SAA8B,CAAC;QACnC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,0CAA0C,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,yDAAyD,CAAC,EAAE,GAAG,CAAC,CAAC;QACtG,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,KAAK,EAAE;aACJ,MAAM,CAAC,cAAc,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAA,6BAA6B,CAAC,CAAC;aACrE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;aAC9D,mBAAmB,EAAE;aACrB,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,wCAAwC,CAAC,CAAC;YAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,yDAAyD,CAAC,EAAE,GAAG,CAAC,CAAC;QACtG,CAAC;QAED,uEAAuE;QACvE,iDAAiD;QACjD,IAAI,WAAmE,CAAC;QACxE,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,uCAAuC,CAAC,CAAC;gBACvF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,kDAAkD,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,sCAAsC,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;QAE7B,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,+CAA+C,CAAC,CAAC;gBAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,8DAA8D,CAAC,CAAC;YACjG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,IAAI,OAA+D,CAAC;QACpE,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACtD,8DAA8D;YAC9D,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,qDAAqD,CAAC,CAAC;YACjG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,mEAAmE;YACnE,0DAA0D;YAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,qDAAqD,CAAC,CAAC;YACjG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,SAAS,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;aACnC,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aACrF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,iEAAiE,CAAC,CAAC;YACpG,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,eAAe,EAAE,qEAAqE,CAAC,EAC3F,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,IAAI,GAAG,kBAAkB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,IAAI;YACJ,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,KAAK,CAAC,KAAK,CAAC;YAChB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;YAC9C,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YAC7B,QAAQ,EAAE;gBACR,IAAI;gBACJ,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC;gBACzB,GAAG,EAAE,iBAAiB;gBACtB,MAAM,EAAE,SAAS,CAAC,GAAG;gBACrB,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;aAC9D;SACF,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CACX;YACE,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE;gBACN,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAkB;gBAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;gBACtC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;gBACjD,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;gBAC/C,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;aAChD;YACD,IAAI;YACJ,WAAW,EAAE,IAAI;SAClB,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/sso-logout.d.ts

@@ -0,0 +1,41 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type { Auth } from '../identity/better-auth.js';
+import { type HubLogoutService } from '../identity/hub-logout.js';
+import type { Logger } from '../logger.js';
+/**
+ * POST /sso/logout — the single-logout server leg (SL-2, cloud edition
+ * ONLY; api/index.ts registers this module iff the instance boots
+ * EDITION=cloud, so oss answers the JSON 404 terminator: zero hub surface).
+ *
+ * Reachability, fail-closed on every side:
+ *  - MACHINES NEVER GET HERE: the path is deliberately UNLISTED in the
+ *    fail-closed scope allowlist (middleware/scopes.ts), so authContext
+ *    403s every API key and OAuth bearer before this handler runs. Never
+ *    list it — a credential must not be able to end its user's sessions.
+ *  - SESSIONS resolve ROUTE-LOCALLY via auth.api.getSession (the /me
+ *    zero-state pattern): a live session whose user holds no active
+ *    membership — the cloud operator pre-break-glass, a hub user whose
+ *    last org was removed — resolves to a null principal upstream but must
+ *    still be able to log out.
+ *  - ANONYMOUS callers 401.
+ *
+ * Handler order (the plan's pinned sequence): resolve session → build the
+ * hub end-session URL (ANY failure → null, never an error) → revoke the
+ * local session server-side, forwarding better-auth's cookie-clearing
+ * Set-Cookie → clear the shared hint cookie → respond {url}. The local
+ * revoke + hint clear run even when url is null — a hub outage degrades the
+ * logout to local-only, it never blocks it.
+ */
+export interface SsoLogoutRouteDeps {
+    auth: Auth;
+    logout: HubLogoutService;
+    /** The shared hint cookie's clearing attributes (cross-repo contract). */
+    hint: {
+        name: string;
+        domain: string;
+        secure: boolean;
+    };
+    logger: Logger;
+}
+export declare function registerSsoLogoutRoutes(api: OpenAPIHono, deps: SsoLogoutRouteDeps): void;
+//# sourceMappingURL=sso-logout.d.ts.map

package/dist/api/sso-logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-logout.d.ts","sourceRoot":"","sources":["../../src/api/sso-logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,gBAAgB,CAAC;IACzB,0EAA0E;IAC1E,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAkCxF"}

package/dist/api/sso-logout.js

@@ -0,0 +1,34 @@
+import { ssoLogoutRoute } from '@antasphere/chassis-contract/routes';
+import { hintCookieClearHeader } from '../identity/hub-logout.js';
+const err = (code, message) => ({ error: { code, message } });
+export function registerSsoLogoutRoutes(api, deps) {
+    const { auth, logout, hint, logger } = deps;
+    api.openapi(ssoLogoutRoute, async (c) => {
+        const session = await auth.api.getSession({ headers: c.req.raw.headers });
+        if (!session?.user) {
+            return c.json(err('unauthenticated', 'Authentication required'), 401);
+        }
+        // 1. Build the hub leg FIRST (it reads the account row the revoke does
+        // not touch; null on any failure — the steps below never depend on it).
+        const url = await logout.endSessionUrl(session.user.id);
+        // 2. Revoke the local session server-side. better-auth's /sign-out
+        // deletes the session row and emits the cookie-clearing Set-Cookie —
+        // forward it so the browser drops the cookie in the same response.
+        // Its handler already swallows a failed row delete (cookie still
+        // cleared), so this throws only on wiring-level failures.
+        const signedOut = await auth.api.signOut({
+            headers: c.req.raw.headers,
+            returnHeaders: true
+        });
+        for (const value of signedOut.headers.getSetCookie()) {
+            c.header('set-cookie', value, { append: true });
+        }
+        // 3. Clear the shared hint cookie (Domain-scoped to the parent, exactly
+        // as the hub set it) — logout anywhere must stop every tool's silent
+        // auto-connect until the next hub login re-asserts it.
+        c.header('set-cookie', hintCookieClearHeader(hint), { append: true });
+        logger.info({ userId: session.user.id, hubLeg: url !== null }, 'sso logout: local session revoked');
+        return c.json({ url }, 200);
+    });
+}
+//# sourceMappingURL=sso-logout.js.map

package/dist/api/sso-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-logout.js","sourceRoot":"","sources":["../../src/api/sso-logout.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,2BAA2B,CAAC;AAGzF,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAmC9E,MAAM,UAAU,uBAAuB,CAAC,GAAgB,EAAE,IAAwB;IAChF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE5C,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAExD,mEAAmE;QACnE,qEAAqE;QACrE,mEAAmE;QACnE,iEAAiE;QACjE,0DAA0D;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YACvC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO;YAC1B,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YACrD,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,wEAAwE;QACxE,qEAAqE;QACrE,uDAAuD;QACvD,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/teams.d.ts

@@ -0,0 +1,43 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import { type Db } from '@antasphere/chassis-db';
+/**
+ * The team routes (PRDCT-2813): the same routes on both editions, only the
+ * source of a team differs. On the self-hosted edition, and in a cloud-LOCAL
+ * workspace, owners and admins make and shape teams here (`hub_team_id` NULL,
+ * the tool's own). In a hub-origin workspace the teams are the hub's
+ * projection (`hub_team_id` set, written by the reconciler alone): read here,
+ * managed on the account site. Two locks keep a write off a projected team:
+ * the members' `hub_managed` gate refuses every write of a hub-origin
+ * workspace (cloud), and every write's WHERE carries `hub_team_id IS NULL`, a
+ * projected team met by a write answering the same `hub_managed` refusal.
+ *
+ * A team holds the workspace's MEMBERSHIPS (the seat references
+ * `workspace_members` with ON DELETE CASCADE), so it can never hold an
+ * outsider and a person leaves every team with their membership. Nothing is
+ * invited, claimed or minted here.
+ *
+ * Reads (list, one team, its members) are every non-guest member's; writes are
+ * an owner's or an admin's, checked INSIDE each handler, never by a
+ * path-pattern `requireRole`: `GET /teams/{id}/members` lives under the same
+ * prefix and must stay open to every member (LESSONS, the `/thing/:id` trap).
+ * A team of another workspace reads as absent: 404, never 403.
+ */
+export interface TeamRouteDeps {
+    db: Db;
+    /**
+     * Cloud edition only: when set, every write on a hub-origin workspace
+     * answers 403 `hub_managed` with this pointer (the members' gate).
+     * undefined on oss.
+     */
+    hubManaged?: {
+        manageUrl: string;
+    } | undefined;
+}
+/**
+ * The slug a name yields when none is given: lowercased, accents folded,
+ * every run of other characters one dash, no dash at either end, at most 60
+ * characters. Null when nothing of the name survives (a name of symbols).
+ */
+export declare function slugFromName(name: string): string | null;
+export declare function registerTeamRoutes(api: OpenAPIHono, deps: TeamRouteDeps): void;
+//# sourceMappingURL=teams.d.ts.map

package/dist/api/teams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.d.ts","sourceRoot":"","sources":["../../src/api/teams.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAarD,OAAO,EAKL,KAAK,EAAE,EACR,MAAM,wBAAwB,CAAC;AAMhC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAChD;AAcD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUxD;AA6FD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CA6Y9E"}