@antasphere/chassis-server 1.0.0

package/dist/api/workspaces.js

@@ -0,0 +1,462 @@
+import { and, eq, ne, sql } from 'drizzle-orm';
+import { ACTIVE_WORKSPACE_HEADER } from '@antasphere/chassis-contract';
+import { defaultWorkspaceSetRoute, workspaceCreateRoute, workspaceUpdateRoute } from '@antasphere/chassis-contract/routes';
+import { apiKeys, workspaceMembers, workspaces } from '@antasphere/chassis-db';
+import { projectOrgMembership } from '../identity/hub-projection.js';
+import { requireAuth, requireRole } from '../middleware/auth-context.js';
+const err = (code, message) => ({ error: { code, message } });
+/**
+ * POST /workspaces — a signed-in person creates ANOTHER workspace from inside
+ * the product (PRDCT-2444 self-hosted, PRDCT-2443 cloud). ADR 014 kept this
+ * door shut in the template ("workspace creation is a product decision");
+ * this module is that decision, taken.
+ *
+ * One route, two editions:
+ *  - oss: `WorkspaceService.create` (the setup path) under a per-user
+ *    advisory lock + the operator's `MAX_WORKSPACES_PER_USER` cap — the
+ *    hub's `POST /orgs` model, mirrored.
+ *  - cloud: the organization is created AT THE HUB as the caller (their own
+ *    stored grant, ADR 019 — no service key, no target-user parameter), then
+ *    the caller's reconcile is forced so the local projection and the
+ *    `origin='hub'` owner membership exist before the answer. The answer
+ *    carries the LOCAL workspace id.
+ *
+ * SESSIONS ONLY, twice: the path is deliberately UNLISTED in the fail-closed
+ * machine scope allowlist (middleware/scopes.ts — never list it), and the
+ * handler re-checks `via === 'session'` itself. /mcp carries no tool for it.
+ *
+ * A WORKSPACE NEVER LEARNS WHAT ITS MEMBERS DO ELSEWHERE: the route is
+ * exempt from the generic audit middleware (which would attribute the event
+ * to the workspace the person happened to be in) and writes its one genesis
+ * row, `workspace.create`, into the NEW workspace's own trail — the setup
+ * pattern. The idempotency claim is the only trace left in the caller's
+ * current scope, and it is a sealed replay cache, never a readable surface.
+ */
+/**
+ * Per-user creation lock, two-int advisory form `(classid, hashtext(userId))`.
+ * 7432006 is free in this repository (7432001 migrations, 7432002/3 the
+ * last-owner guards, 7432004 the grant refresh + pg-boss, 7432005 a tool's
+ * uploads) and is, on purpose, the same number the hub uses for the same
+ * job in ITS database.
+ */
+const WORKSPACE_CREATE_LOCK_NAMESPACE = 7432006;
+/**
+ * THE ONE eligibility rule, shared by the route (inside its locked
+ * transaction) and by `/me.canCreateWorkspace` — so the flag can never
+ * promise what the route refuses. Order = the order the refusals are
+ * reported in.
+ *
+ *  - sessions only;
+ *  - the operator's dial at 0 closes the door on both editions;
+ *  - a GUEST-ONLY user (every active membership is `origin='guest'`) is an
+ *    outsider invited to single resources (D2): refused like every other
+ *    workspace-level act. One non-guest active membership anywhere lifts it
+ *    — it is a fact about the PERSON, not about the workspace they are in;
+ *  - oss: fewer ACTIVE OWNER memberships than the cap (setup's counts);
+ *  - cloud: the tool not restricted (TOOL_RESTRICTED), then a live hub link.
+ *    The count is the hub's own cap, asked there.
+ */
+export async function workspaceCreationRefusal(conn, policy, caller) {
+    if (caller.via !== 'session')
+        return 'session_required';
+    if (policy.maxPerUser === 0)
+        return 'workspace_creation_disabled';
+    const rows = await conn
+        .select({ origin: workspaceMembers.origin, role: workspaceMembers.role })
+        .from(workspaceMembers)
+        .where(and(eq(workspaceMembers.userId, caller.userId), eq(workspaceMembers.isActive, true)));
+    if (rows.length > 0 && rows.every((r) => r.origin === 'guest'))
+        return 'guest_forbidden';
+    if (policy.hasHubLink) {
+        if (policy.restricted)
+            return 'restricted_tool';
+        return (await policy.hasHubLink(caller.userId)) ? null : 'hub_link_required';
+    }
+    const owned = rows.filter((r) => r.role === 'owner').length;
+    return owned >= policy.maxPerUser ? 'workspace_limit_reached' : null;
+}
+/**
+ * Every refusal but `guest_forbidden`, whose sentence is the tool's
+ * (`WorkspaceRouteDeps.guestForbiddenMessage`), and `restricted_tool`, whose
+ * sentence names the tool (`restrictedToolMessage`).
+ */
+const CHASSIS_REFUSAL_MESSAGES = {
+    session_required: 'Creating a workspace requires a browser session',
+    workspace_creation_disabled: 'Workspace creation is closed on this instance',
+    workspace_limit_reached: 'This account already owns the maximum number of workspaces',
+    hub_link_required: 'Sign in with Antasphere to create an organization'
+};
+/**
+ * The restricted tool's refusal (PRDCT-2947), tool-neutral through the
+ * identity: who opens an organization to the tool, and whom to ask.
+ */
+export const restrictedToolMessage = (displayName) => `Organizations that open ${displayName} are granted by Antasphere; ask Antasphere to open it for yours`;
+const personKey = (userId) => `u:${userId}`;
+async function bucketExhausted(limiter, key) {
+    // A backend read error fails open, like every other read of a limiter here.
+    const state = await limiter.get(key).catch(() => null);
+    return Boolean(state && state.remainingPoints <= 0 && state.msBeforeNext > 0);
+}
+/**
+ * Read-only: would the wall refuse this person at this address right now?
+ * `/me.canCreateWorkspace` asks it so the flag stays honest about the wall.
+ */
+export async function workspaceCreateWallClosed(wall, address, userId) {
+    return ((await bucketExhausted(wall.person, personKey(userId))) || (await bucketExhausted(wall.address, address)));
+}
+/** Spend one attempt. False = walled (429). */
+async function spendCreationAttempt(wall, address, userId) {
+    // A walled ADDRESS refuses without charging the person for it.
+    if (await bucketExhausted(wall.address, address))
+        return false;
+    try {
+        await wall.person.consume(personKey(userId));
+    }
+    catch {
+        return false; // the person's own budget is spent: the address bucket is NOT touched
+    }
+    try {
+        await wall.address.consume(address);
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+/** Control-flow marker: a refusal decided inside the locked transaction. */
+class CreationRefused extends Error {
+    refusal;
+    constructor(refusal) {
+        super(refusal);
+        this.refusal = refusal;
+    }
+}
+export function workspaceCreationPolicy(deps) {
+    return { maxPerUser: deps.maxPerUser, restricted: deps.restricted, hasHubLink: deps.cloud?.hasHubLink };
+}
+export function registerWorkspaceRoutes(api, deps) {
+    const { db, auth, audit, registry, logger, cloud } = deps;
+    const policy = workspaceCreationPolicy(deps);
+    const REFUSAL_MESSAGES = {
+        ...CHASSIS_REFUSAL_MESSAGES,
+        guest_forbidden: deps.guestForbiddenMessage,
+        restricted_tool: restrictedToolMessage(deps.displayName)
+    };
+    api.openapi(workspaceCreateRoute, async (c) => {
+        const principal = c.get('principal');
+        // Defense in depth: the scope allowlist already 403s every machine
+        // principal (POST /workspaces is unlisted, fail-closed); this explicit
+        // check stays so a future allowlist edit cannot silently hand workspace
+        // creation to an API key or an OAuth bearer.
+        if (principal && principal.via !== 'session') {
+            return c.json(err('session_required', REFUSAL_MESSAGES.session_required), 403);
+        }
+        // The caller. A resolved principal is a session by now. WITHOUT one, the
+        // cloud edition still serves the ZERO-MEMBERSHIP session (the /me zero
+        // state: a hub user whose last organization was removed creates their
+        // next one here) — resolved route-locally, the /me pattern, and ONLY
+        // for the selector-less request. On oss no principal means no active
+        // membership of this instance: not someone who may create here.
+        let userId;
+        if (principal) {
+            userId = principal.userId;
+        }
+        else {
+            // A request that NAMED a workspace and failed its membership check keeps
+            // the fail-closed 401 (no oracle about that workspace) — /me's rule.
+            if (c.req.header(ACTIVE_WORKSPACE_HEADER)?.trim()) {
+                return c.json(err('unauthenticated', 'Authentication required'), 401);
+            }
+            const session = cloud ? await auth.api.getSession({ headers: c.req.raw.headers }) : null;
+            if (!session?.user)
+                return c.json(err('unauthenticated', 'Authentication required'), 401);
+            userId = session.user.id;
+        }
+        const actor = { userId, via: 'session' };
+        // The rate wall, now that the caller is a known person (see
+        // WorkspaceCreateWall): nothing above this line spends a point.
+        if (!(await spendCreationAttempt(deps.wall, deps.clientIp(c), userId))) {
+            return c.json(err('rate_limited', 'Too many requests, slow down'), 429);
+        }
+        const body = c.req.valid('json');
+        const name = body.name.trim();
+        if (!name)
+            return c.json(err('validation_error', 'The workspace needs a name'), 400);
+        // The look the person picked in the dialog: written on the row the
+        // moment it exists (oss) or once it is projected (cloud), so the
+        // workspace opens with it on every member's screen, not just this browser's.
+        const look = {
+            theme: body.look?.theme ?? null,
+            pattern: body.look?.pattern ?? null,
+            field: body.look?.field ?? null,
+            grain: body.look?.grain ?? null
+        };
+        let workspaceId;
+        let workspaceName = name;
+        if (!cloud) {
+            // ── oss: local creation under the per-user lock ─────────────────────
+            try {
+                workspaceId = await db.transaction(async (tx) => {
+                    // Serializes THIS user's creations: two concurrent requests can
+                    // never both count "one under the cap". Transaction-scoped — it
+                    // cannot leak.
+                    await tx.execute(sql `SELECT pg_advisory_xact_lock(${WORKSPACE_CREATE_LOCK_NAMESPACE}, hashtext(${userId}))`);
+                    const refusal = await workspaceCreationRefusal(tx, policy, actor);
+                    if (refusal)
+                        throw new CreationRefused(refusal);
+                    // The registry's WorkspaceService (ADR 014), joined to this
+                    // transaction exactly as setup does: workspace + ACTIVE OWNER
+                    // membership (origin defaults to 'local') or nothing.
+                    const created = await registry.workspaces.create(name, userId, tx);
+                    await tx
+                        .update(workspaces)
+                        .set({
+                        lookTheme: look.theme,
+                        lookPattern: look.pattern,
+                        lookField: look.field,
+                        lookGrain: look.grain
+                    })
+                        .where(eq(workspaces.id, created.workspaceId));
+                    return created.workspaceId;
+                });
+            }
+            catch (cause) {
+                if (cause instanceof CreationRefused) {
+                    return c.json(err(cause.refusal, REFUSAL_MESSAGES[cause.refusal]), 403);
+                }
+                throw cause;
+            }
+        }
+        else {
+            // ── cloud: create at the hub as the caller, then project ────────────
+            const refusal = await workspaceCreationRefusal(db, policy, actor);
+            if (refusal)
+                return c.json(err(refusal, REFUSAL_MESSAGES[refusal]), 403);
+            const created = await cloud.createOrg(userId, name);
+            switch (created.kind) {
+                case 'created':
+                    break;
+                case 'limit_reached':
+                    return c.json(err('workspace_limit_reached', 'This account already owns the maximum number of organizations'), 403);
+                case 'invalid':
+                    return c.json(err('validation_error', 'Antasphere refused this organization name'), 400);
+                case 'no_link':
+                    return c.json(err('hub_link_required', REFUSAL_MESSAGES.hub_link_required), 403);
+                case 'grant_dead':
+                    // The existing live-gate verdict, verbatim: a browser SSO re-login heals it.
+                    return c.json(err('hub_grant_expired', 'Your Antasphere grant on this instance has expired — sign in with Antasphere again to renew it'), 401);
+                case 'reauth_required':
+                    // The grant is alive but predates `orgs:create` (or a CLI connect
+                    // replaced it). Same status and same cure as hub_grant_expired — a
+                    // browser sign-in — under its own code, so it is never mistaken
+                    // for a refusal that signing in again would not lift.
+                    return c.json(err('hub_reauth_required', 'Sign in again to create a workspace, then retry'), 401);
+                case 'refused':
+                    return c.json(err('hub_refused', 'Antasphere did not accept the creation of this organization'), 403);
+                case 'inconclusive':
+                    // The existing live-gate verdict's code. Never retried here: the
+                    // hub commits before it answers, so the organization may exist —
+                    // if it does, the caller's next reconcile pass projects it.
+                    return c.json(err('hub_unavailable', 'Antasphere could not be reached — the organization was not confirmed'), 403);
+            }
+            // The reconcile IS the projection (the login path's rule): force the
+            // caller's pass so the workspace row and the origin='hub' membership
+            // are written by the same code every other hub org goes through.
+            const pass = await cloud.forceReconcile(userId);
+            const find = () => db
+                .select({ id: workspaces.id, name: workspaces.name })
+                .from(workspaces)
+                .innerJoin(workspaceMembers, and(eq(workspaceMembers.workspaceId, workspaces.id), eq(workspaceMembers.userId, userId), eq(workspaceMembers.isActive, true)))
+                .where(eq(workspaces.centralAccountId, created.org.id))
+                .limit(1);
+            let [local] = await find();
+            if (!local && created.org.role !== null) {
+                // The pass right after the 201 was inconclusive (a hub blip). The
+                // 201 itself is hub truth read AS THE USER about THIS org — the same
+                // standing as one entry of their GET /orgs list — so project that
+                // one entry through the same primitive rather than answer an error
+                // for an organization that exists (a retry would create a second).
+                // Never from a token, never for anyone but the caller.
+                logger.warn({ userId, pass }, 'workspace create: forced reconcile did not project the new org — projecting from the hub 201');
+                await projectOrgMembership(db, {
+                    localUserId: userId,
+                    hubWorkspaceId: created.org.id,
+                    hubWorkspaceName: created.org.name,
+                    role: created.org.role
+                });
+                [local] = await find();
+            }
+            if (!local) {
+                logger.error({ userId, pass }, 'workspace create: hub org created but no local projection');
+                return c.json(err('hub_unavailable', 'The organization was created at Antasphere and will appear shortly'), 403);
+            }
+            workspaceId = local.id;
+            workspaceName = local.name;
+            // The look is a LOCAL fact of the projection (the hub reconcile writes
+            // the name and the status, never the look's columns).
+            await db
+                .update(workspaces)
+                .set({
+                lookTheme: look.theme,
+                lookPattern: look.pattern,
+                lookField: look.field,
+                lookGrain: look.grain
+            })
+                .where(eq(workspaces.id, workspaceId));
+        }
+        // Genesis row in the NEW workspace's own trail — and nowhere else.
+        await audit.write({
+            workspaceId,
+            principal: actor,
+            action: 'workspace.create',
+            resourceType: 'workspace',
+            resourceId: workspaceId,
+            requestId: c.get('requestId'),
+            ip: deps.clientIp(c),
+            metadata: { name: workspaceName }
+        });
+        registry.events.emit('workspace.created', { workspaceId, ownerUserId: userId });
+        return c.json({ workspace: { id: workspaceId, name: workspaceName, look } }, 201);
+    });
+    // ── PATCH /workspace: the active workspace's own settings ───────────────
+    // Owners and admins, from a browser session (unlisted in the machine scope
+    // allowlist like the create; re-checked here). The route names no id: the
+    // request's one workspace is the one edited (ADR 014). A guest never
+    // holds admin, so requireRole covers D2 too.
+    // PUT /me/default-workspace (PRDCT-2815): the person chooses the workspace
+    // a request naming none resolves to. `workspace_members.is_default` and
+    // the selection rule (identity/resolve-membership.ts) are shared by both
+    // editions; only the WRITER differs. On cloud the hub reconcile is the
+    // writer (it clears and sets the flag from the person's account at every
+    // pass, so a local write would be undone within minutes): the route
+    // refuses with the account site to set it on, whatever the workspace. On
+    // self-hosted this route is the writer.
+    //
+    // A setting of the PERSON: it reads `principal.userId` and never the
+    // request's workspace, is open to the person's keys and tokens under the
+    // write scope (the CLI sets it), and is refused to a key pinned to one
+    // workspace, which reaches that workspace alone and must not change where
+    // the person's other credentials land. It writes NO audit row: a
+    // workspace never learns what its members do elsewhere, and the row would
+    // land in the trail of the workspace the request happened to be in. The
+    // path is exempt from the generic audit middleware (audit/service.ts),
+    // and the change is on the server log.
+    api.use('/me/default-workspace', requireAuth());
+    api.openapi(defaultWorkspaceSetRoute, async (c) => {
+        const principal = c.get('principal');
+        if (cloud) {
+            return c.json({
+                error: {
+                    code: 'hub_managed',
+                    message: 'Your default workspace is a setting of your Antasphere account — choose it there',
+                    details: { manageUrl: cloud.manageUrl }
+                }
+            }, 403);
+        }
+        if (principal.apiKeyId) {
+            const [key] = await db
+                .select({ pin: apiKeys.workspaceId })
+                .from(apiKeys)
+                .where(eq(apiKeys.id, principal.apiKeyId))
+                .limit(1);
+            if (!key || key.pin !== null) {
+                return c.json(err('key_pinned', 'This key is pinned to one workspace and cannot change your default workspace'), 403);
+            }
+        }
+        const { workspaceId } = c.req.valid('json');
+        if (workspaceId !== null) {
+            // An ACTIVE membership of the caller, or nothing: a workspace that
+            // does not exist and one the caller does not belong to answer alike.
+            const [membership] = await db
+                .select({ id: workspaceMembers.id })
+                .from(workspaceMembers)
+                .where(and(eq(workspaceMembers.userId, principal.userId), eq(workspaceMembers.workspaceId, workspaceId), eq(workspaceMembers.isActive, true)))
+                .limit(1);
+            if (!membership)
+                return c.json(err('not_found', 'Workspace not found'), 404);
+        }
+        // Clear-then-set in ONE transaction: the partial unique index (user_id
+        // WHERE is_default) forbids two trues even transiently (the reconcile's
+        // own order). The set re-states the active membership, so a membership
+        // switched off between the check and the write is never made the default.
+        const chosen = await db.transaction(async (tx) => {
+            await tx
+                .update(workspaceMembers)
+                .set({ isDefault: false })
+                .where(and(eq(workspaceMembers.userId, principal.userId), eq(workspaceMembers.isDefault, true), ...(workspaceId !== null ? [ne(workspaceMembers.workspaceId, workspaceId)] : [])));
+            if (workspaceId === null)
+                return null;
+            const set = await tx
+                .update(workspaceMembers)
+                .set({ isDefault: true })
+                .where(and(eq(workspaceMembers.userId, principal.userId), eq(workspaceMembers.workspaceId, workspaceId), eq(workspaceMembers.isActive, true)))
+                .returning({ workspaceId: workspaceMembers.workspaceId });
+            return set[0]?.workspaceId ?? null;
+        });
+        if (workspaceId !== null && chosen === null) {
+            return c.json(err('not_found', 'Workspace not found'), 404);
+        }
+        logger.info({ userId: principal.userId, via: principal.via, defaultWorkspaceId: chosen }, 'default workspace changed by the person');
+        return c.json({ defaultWorkspaceId: chosen }, 200);
+    });
+    api.use('/workspace', requireRole('admin'));
+    api.openapi(workspaceUpdateRoute, async (c) => {
+        const principal = c.get('principal');
+        if (!principal)
+            return c.json(err('unauthenticated', 'Authentication required'), 401);
+        if (principal.via !== 'session') {
+            return c.json(err('session_required', 'Changing a workspace requires a browser session'), 403);
+        }
+        const body = c.req.valid('json');
+        const patch = {};
+        if (body.name !== undefined) {
+            const name = body.name.trim();
+            if (!name)
+                return c.json(err('validation_error', 'The workspace needs a name'), 400);
+            // P7: a hub-origin workspace's name is the hub's — renamed there, and
+            // the next reconcile pass would overwrite a local rename anyway.
+            if (principal.accountRef) {
+                return c.json({
+                    error: {
+                        code: 'hub_managed',
+                        message: 'This workspace is an Antasphere organization — rename it at Antasphere',
+                        details: { manageUrl: cloud?.manageUrl ?? null }
+                    }
+                }, 403);
+            }
+            patch.name = name;
+        }
+        if (body.look?.theme !== undefined)
+            patch.lookTheme = body.look.theme;
+        if (body.look?.pattern !== undefined)
+            patch.lookPattern = body.look.pattern;
+        if (body.look?.field !== undefined)
+            patch.lookField = body.look.field;
+        if (body.look?.grain !== undefined)
+            patch.lookGrain = body.look.grain;
+        const [row] = await db
+            .update(workspaces)
+            .set(patch)
+            .where(eq(workspaces.id, principal.workspaceId))
+            .returning({
+            id: workspaces.id,
+            name: workspaces.name,
+            lookTheme: workspaces.lookTheme,
+            lookPattern: workspaces.lookPattern,
+            lookField: workspaces.lookField,
+            lookGrain: workspaces.lookGrain
+        });
+        // The principal's workspace exists by construction (a live join built
+        // it); a missing row here is a race with a deletion, refused like a gate.
+        if (!row)
+            return c.json(err('forbidden', 'Workspace not found'), 403);
+        return c.json({
+            workspace: {
+                id: row.id,
+                name: row.name,
+                look: { theme: row.lookTheme, pattern: row.lookPattern, field: row.lookField, grain: row.lookGrain }
+            }
+        }, 200);
+    });
+}
+//# sourceMappingURL=workspaces.js.map

package/dist/api/workspaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces.js","sourceRoot":"","sources":["../../src/api/workspaces.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAwB,MAAM,wBAAwB,CAAC;AAGrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAQzE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;GAMG;AACH,MAAM,+BAA+B,GAAG,OAAO,CAAC;AA6BhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,MAA+B,EAC/B,MAAgE;IAEhE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC;IACxD,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,IAAI;SACpB,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC;SACxE,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACzF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO,iBAAiB,CAAC;QAChD,OAAO,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAG1B;IACF,gBAAgB,EAAE,iDAAiD;IACnE,2BAA2B,EAAE,+CAA+C;IAC5E,uBAAuB,EAAE,4DAA4D;IACrF,iBAAiB,EAAE,mDAAmD;CACvE,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,WAAmB,EAAU,EAAE,CACnE,2BAA2B,WAAW,iEAAiE,CAAC;AA4B1G,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;AAEpD,KAAK,UAAU,eAAe,CAAC,OAA4B,EAAE,GAAW;IACtE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAyB,EACzB,OAAe,EACf,MAAc;IAEd,OAAO,CACL,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAC1G,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,KAAK,UAAU,oBAAoB,CACjC,IAAyB,EACzB,OAAe,EACf,MAAc;IAEd,+DAA+D;IAC/D,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,sEAAsE;IACtF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,eAAgB,SAAQ,KAAK;IACZ;IAArB,YAAqB,OAAiC;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,YAAO,GAAP,OAAO,CAA0B;IAEtD,CAAC;CACF;AA+BD,MAAM,UAAU,uBAAuB,CACrC,IAAqE;IAErE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAgB,EAAE,IAAwB;IAChF,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC1D,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAA6C;QACjE,GAAG,wBAAwB;QAC3B,eAAe,EAAE,IAAI,CAAC,qBAAqB;QAC3C,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC;KACzD,CAAC;IAEF,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,6CAA6C;QAC7C,IAAI,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,gEAAgE;QAChE,IAAI,MAAc,CAAC;QACnB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;gBAClD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzF,IAAI,CAAC,OAAO,EAAE,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1F,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAkB,EAAE,CAAC;QAElD,4DAA4D;QAC5D,gEAAgE;QAChE,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,8BAA8B,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;QACrF,mEAAmE;QACnE,iEAAiE;QACjE,6EAA6E;QAC7E,MAAM,IAAI,GAAkB;YAC1B,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI;YAC/B,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI;YACnC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI;YAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI;SAChC,CAAC;QAEF,IAAI,WAAmB,CAAC;QACxB,IAAI,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,uEAAuE;YACvE,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBAC9C,gEAAgE;oBAChE,gEAAgE;oBAChE,eAAe;oBACf,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,gCAAgC,+BAA+B,cAAc,MAAM,IAAI,CAC3F,CAAC;oBACF,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;oBAClE,IAAI,OAAO;wBAAE,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;oBAChD,4DAA4D;oBAC5D,8DAA8D;oBAC9D,sDAAsD;oBACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;oBACnE,MAAM,EAAE;yBACL,MAAM,CAAC,UAAU,CAAC;yBAClB,GAAG,CAAC;wBACH,SAAS,EAAE,IAAI,CAAC,KAAK;wBACrB,WAAW,EAAE,IAAI,CAAC,OAAO;wBACzB,SAAS,EAAE,IAAI,CAAC,KAAK;wBACrB,SAAS,EAAE,IAAI,CAAC,KAAK;qBACtB,CAAC;yBACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;oBACjD,OAAO,OAAO,CAAC,WAAW,CAAC;gBAC7B,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAClE,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAEzE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrB,KAAK,SAAS;oBACZ,MAAM;gBACR,KAAK,eAAe;oBAClB,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,yBAAyB,EAAE,+DAA+D,CAAC,EAC/F,GAAG,CACJ,CAAC;gBACJ,KAAK,SAAS;oBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC3F,KAAK,SAAS;oBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnF,KAAK,YAAY;oBACf,6EAA6E;oBAC7E,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CACD,mBAAmB,EACnB,gGAAgG,CACjG,EACD,GAAG,CACJ,CAAC;gBACJ,KAAK,iBAAiB;oBACpB,kEAAkE;oBAClE,mEAAmE;oBACnE,gEAAgE;oBAChE,sDAAsD;oBACtD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpG,KAAK,SAAS;oBACZ,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,aAAa,EAAE,6DAA6D,CAAC,EACjF,GAAG,CACJ,CAAC;gBACJ,KAAK,cAAc;oBACjB,iEAAiE;oBACjE,iEAAiE;oBACjE,4DAA4D;oBAC5D,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,iBAAiB,EAAE,sEAAsE,CAAC,EAC9F,GAAG,CACJ,CAAC;YACN,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;iBACpD,IAAI,CAAC,UAAU,CAAC;iBAChB,SAAS,CACR,gBAAgB,EAChB,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,EAC/C,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;iBACA,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;iBACtD,KAAK,CAAC,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxC,kEAAkE;gBAClE,qEAAqE;gBACrE,kEAAkE;gBAClE,mEAAmE;gBACnE,mEAAmE;gBACnE,uDAAuD;gBACvD,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,IAAI,EAAE,EAChB,8FAA8F,CAC/F,CAAC;gBACF,MAAM,oBAAoB,CAAC,EAAE,EAAE;oBAC7B,WAAW,EAAE,MAAM;oBACnB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;oBAC9B,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;oBAClC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,2DAA2D,CAAC,CAAC;gBAC5F,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,iBAAiB,EAAE,oEAAoE,CAAC,EAC5F,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,WAAW,GAAG,KAAK,CAAC,EAAE,CAAC;YACvB,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC;YAC3B,uEAAuE;YACvE,sDAAsD;YACtD,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC;gBACH,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,SAAS,EAAE,IAAI,CAAC,KAAK;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAC3C,CAAC;QAED,mEAAmE;QACnE,MAAM,KAAK,CAAC,KAAK,CAAC;YAChB,WAAW;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YAC7B,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpB,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;SAClC,CAAC,CAAC;QACH,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,6CAA6C;IAC7C,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,yEAAyE;IACzE,wCAAwC;IACxC,EAAE;IACF,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,iEAAiE;IACjE,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,uCAAuC;IACvC,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,kFAAkF;oBAC3F,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;iBACxC;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;iBACpC,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;iBACzC,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,YAAY,EAAE,8EAA8E,CAAC,EACjG,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE5C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;iBACnC,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC/C,MAAM,EAAE;iBACL,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;iBACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,EACpC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACjF,CACF,CAAC;YACJ,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;iBACA,SAAS,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,WAAW,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAC5E,yCAAyC,CAC1C,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,iDAAiD,CAAC,EAAE,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,KAAK,GAMN,EAAE,CAAC;QACR,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;YACrF,sEAAsE;YACtE,iEAAiE;YACjE,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;gBACzB,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,wEAAwE;wBACjF,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE;qBACjD;iBACF,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QACtE,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5E,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QACtE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAEtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,KAAK,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;aAC/C,SAAS,CAAC;YACT,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;QACL,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC,IAAI,CACX;YACE,SAAS,EAAE;gBACT,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE;aACrG;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/apikeys/index.d.ts

@@ -0,0 +1,3 @@
+export { type PepperRegistry, buildPepperRegistry, parseApiKeyPeppers } from './peppers.js';
+export { ApiKeyService } from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/apikeys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/apikeys/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/apikeys/index.js

@@ -0,0 +1,3 @@
+export { buildPepperRegistry, parseApiKeyPeppers } from './peppers.js';
+export { ApiKeyService } from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/apikeys/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/apikeys/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/apikeys/peppers.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Versioned API-key peppers — the seam that lets API keys survive an
+ * AUTH_SECRET rotation (ADR 008).
+ *
+ * Version 1 is ALWAYS the pepper that hashed keys before versioning existed:
+ * the resolved auth secret, used verbatim as `sha256(secret + pepper)`. With
+ * no `API_KEY_PEPPERS` set the registry is exactly `{ 1: authSecret }` and
+ * new keys mint at version 1 — byte-identical to the pre-versioning
+ * behaviour, nothing to migrate.
+ *
+ * `API_KEY_PEPPERS` supplies additional versions as `<version>:<secret>`
+ * entries joined by `;` (e.g. `1:<old secret>;2:<new pepper>`). Entries
+ * override the defaults, so pinning `1:<value>` freezes version 1
+ * independently of the live AUTH_SECRET — the first step of the rotation
+ * runbook in internal/security-runbooks.md. LOUD RULE: whenever version 1 is pinned, its
+ * value MUST be the historical AUTH_SECRET-derived pepper (the secret that
+ * was live when the version-1 keys were minted), or every existing key stops
+ * resolving. New keys always mint under the HIGHEST version in the registry.
+ *
+ * Resolution looks up the pepper by the key row's stored `pepper_version`
+ * and FAILS CLOSED on a version the registry does not contain — same 401 as
+ * a revoked key, never a fallback to another pepper.
+ */
+/** `pepper_version` is a Postgres smallint. */
+export declare const MAX_PEPPER_VERSION = 32767;
+export interface PepperRegistry {
+    /** The version new keys are minted under — the highest defined. */
+    readonly current: number;
+    /** True when API_KEY_PEPPERS explicitly pins version 1 (rotation-safe). */
+    readonly v1Pinned: boolean;
+    /** The pepper for a stored version, or undefined — the caller MUST fail closed. */
+    get(version: number): string | undefined;
+    /**
+     * Every registered version, ascending. For credentials that carry no
+     * version indicator (share-token secrets, whose sha256 IS the DB lookup
+     * key), resolution computes the candidate hash under EACH version — the
+     * registry has one entry per rotation, so this stays O(rotations).
+     */
+    readonly versions: readonly number[];
+}
+/**
+ * Parse the `API_KEY_PEPPERS` value into a version→secret map. Throws a
+ * readable Error on any malformed entry — surfaced by the env schema, so a
+ * bad value refuses boot instead of silently mis-hashing keys.
+ */
+export declare function parseApiKeyPeppers(raw: string): Map<number, string>;
+/**
+ * Build the registry from the resolved auth secret plus the optional
+ * `API_KEY_PEPPERS` value (already format-validated by the env schema; this
+ * re-parses so direct callers get the same guarantees).
+ */
+export declare function buildPepperRegistry(authSecret: string, apiKeyPeppers?: string): PepperRegistry;
+//# sourceMappingURL=peppers.d.ts.map

package/dist/apikeys/peppers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"peppers.d.ts","sourceRoot":"","sources":["../../src/apikeys/peppers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAKxC,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,mFAAmF;IACnF,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsCnE;AAQD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAe9F"}