@antasphere/chassis-server 1.0.0

package/dist/identity/hub-user-client.d.ts

@@ -0,0 +1,222 @@
+import { type WorkspaceRole } from '@antasphere/chassis-db';
+import type { Logger } from '../logger.js';
+import type { HubGrantService } from './hub-grant.js';
+/**
+ * The as-the-user hub reader (internal/federation.md, live user-scoped
+ * federation): every org/membership read between logins is `GET
+ * <hub>/api/v1/orgs` presented with the USER's OWN grant token
+ * (identity/hub-grant.ts) — the hub only ever returns what that user may
+ * see, so a cross-tenant read is structurally impossible on this path.
+ * There is deliberately NO target-user parameter anywhere.
+ *
+ * Failure posture mirrors the retired H4 client: only a definitive 200
+ * list may drive reconciliation; network/timeout/5xx/malformed answers are
+ * one loud, fail-open 'inconclusive'. A 401/403 gets exactly ONE
+ * forced-refresh retry (the presented token may be stale or wrong-audience
+ * from a pre-flip row) — a second refusal is inconclusive, never a grant
+ * kill (only the token endpoint's `invalid_grant` kills a grant, inside
+ * HubGrantService).
+ */
+/** The hub API resource identifier (RFC 8707 `aud`) — `<hub issuer>/mcp`. */
+export declare function hubApiResource(issuerUrl: string): string;
+/**
+ * One validated entry of the caller-scoped org list. Forward-compatible by
+ * construction: an absent `status` reads as 'active', an absent `isDefault`
+ * as false, an unknown `role` as null (keep-alive only — an unknown role
+ * must never read as absence).
+ */
+export interface HubOrg {
+    /** The hub org id (uuid) — what `workspaces.centralAccountId` projects. */
+    id: string;
+    /** Org display name; null when absent/blank. */
+    name: string | null;
+    role: WorkspaceRole | null;
+    status: 'active' | 'suspended';
+    /** The caller's hub-level default org (at most one entry carries it). */
+    isDefault: boolean;
+    /**
+     * The CALLER's own teams in this org (never the org's whole roster: the
+     * hub answers as the person). An absent or malformed field reads as none
+     * (a hub that predates teams); an entry without a uuid id is dropped.
+     */
+    teams: HubTeam[];
+}
+/** One of the caller's teams in an org, as `GET /orgs` carries it. */
+export interface HubTeam {
+    /** The hub's team id — what `workspace_teams.hub_team_id` projects. */
+    id: string;
+    slug: string;
+    name: string;
+}
+/**
+ * One of the caller's organizations that does NOT open this tool to them
+ * (the org restricts the tool to teams the caller is not in). The hub leaves
+ * such an org out of `orgs`; `denied` names it so the refusal page can say
+ * which organization to ask. A hint for the person, never an access input.
+ */
+export interface HubDeniedOrg {
+    id: string;
+    /** Org display name; the projection's placeholder when absent/blank. */
+    name: string;
+}
+export type HubOrgsResult = {
+    kind: 'ok';
+    orgs: HubOrg[];
+    denied: HubDeniedOrg[];
+} | {
+    kind: 'no_link';
+} | {
+    kind: 'grant_dead';
+} | {
+    kind: 'inconclusive';
+};
+/**
+ * The organization's WHOLE team list as one member reads it (`GET
+ * <hub>/api/v1/teams`, PRDCT-2813), every team of the org whether or not the
+ * reader sits in it. `complete` is false when the drain stopped at its page
+ * cap with more pages left: the list is then a prefix, good for upserting,
+ * never for deleting what it does not name.
+ */
+export type HubOrgTeamsResult = {
+    kind: 'ok';
+    teams: HubTeam[];
+    complete: boolean;
+} | {
+    kind: 'inconclusive';
+} | {
+    kind: 'no_link';
+} | {
+    kind: 'grant_dead';
+};
+/**
+ * The answer of one as-the-user org creation (PRDCT-2443):
+ *  - 'created': the hub answered 201 with a well-formed org;
+ *  - 'limit_reached': the hub's own per-user organization cap refused it;
+ *  - 'reauth_required': the hub answered 403 `insufficient_scope` — THIS
+ *    grant does not carry `orgs:create` (it predates the scope, or a CLI
+ *    connect replaced it). Not a dead grant and not a policy refusal: a
+ *    fresh browser sign-in mints a grant that has it;
+ *  - 'invalid': the hub refused the NAME (its validation, not ours);
+ *  - 'refused': any other definitive refusal (the hub does not let this
+ *    grant create organizations) — `code` is the hub's, for the log only;
+ *  - 'no_link' / 'grant_dead': the grant verdicts, verbatim from
+ *    HubGrantService;
+ *  - 'inconclusive': network/timeout/5xx/malformed. The organization MAY
+ *    exist at the hub (it commits before it answers); the caller never
+ *    retries by itself, and the next reconcile pass projects it if so.
+ */
+export type HubCreateOrgResult = {
+    kind: 'created';
+    org: {
+        id: string;
+        name: string | null;
+        role: WorkspaceRole | null;
+    };
+} | {
+    kind: 'limit_reached';
+} | {
+    kind: 'reauth_required';
+} | {
+    kind: 'invalid';
+} | {
+    kind: 'refused';
+    status: number;
+    code: string | null;
+} | {
+    kind: 'no_link';
+} | {
+    kind: 'grant_dead';
+} | {
+    kind: 'inconclusive';
+};
+/** The one-function boundary the workspace-creation route depends on (its test seam). */
+export type HubOrgCreator = (localUserId: string, name: string) => Promise<HubCreateOrgResult>;
+/**
+ * THE ONE PLACE that knows the shape of the hub's `POST /api/v1/orgs` answer
+ * (hub contract `orgCreatedSchema`: 201 `{ org: { id, name, role, … } }`;
+ * refusals in the common `{ error: { code } }` envelope). Pure, so the
+ * shape is adjustable — and testable — without touching the transport.
+ */
+export declare function classifyHubOrgCreateAnswer(status: number, body: unknown): HubCreateOrgResult;
+/**
+ * An org entry's `teams` (forward-compatible: absent or not an array reads
+ * as none). An entry without a uuid id is dropped (UUID_RE); a missing slug
+ * or name reads as the empty string rather than dropping a seat the hub
+ * asserted.
+ */
+export declare function parseTeams(raw: unknown, logger: Logger): HubTeam[];
+/**
+ * The body's top-level `denied` (absent or malformed reads as none; an entry
+ * without a uuid id is dropped, UUID_RE). A missing or blank name reads as
+ * the projection's placeholder, so every reader gets a name to show.
+ */
+export declare function parseDenied(raw: unknown, logger: Logger): HubDeniedOrg[];
+/** The SSO callback's access token, handed through by the login path. */
+export interface LoginAccessToken {
+    accessToken: string;
+    expiresAt: Date | null;
+}
+export interface HubUserClientOptions {
+    grant: HubGrantService;
+    /** The hub origin (HUB_ISSUER_URL) — /api/v1/orgs lives under it. */
+    issuerUrl: string;
+    logger: Logger;
+    /** Per-fetch timeout — tight, because reconcile passes are awaited in the identity path. */
+    timeoutMs: number;
+    /**
+     * POST /orgs fetch timeout. A creation is a deliberate human act awaited
+     * once, not an identity-path read: it gets the token-endpoint budget
+     * rather than the tight reconcile one. Defaults to `timeoutMs`.
+     */
+    createTimeoutMs?: number | undefined;
+    /** Test seam. */
+    fetchImpl?: typeof fetch;
+}
+export declare class HubUserClient {
+    private readonly opts;
+    private readonly base;
+    private readonly fetchImpl;
+    /** An older hub without `GET /teams` is said once per client, never on every pass. */
+    private warnedNoTeamsRoute;
+    constructor(opts: HubUserClientOptions);
+    /**
+     * The user's own org list, as the hub sees it RIGHT NOW. `login` carries
+     * the SSO callback's access token (already hub-audienced — the code
+     * exchange sends the same `resource`): the login path needs no refresh,
+     * and the token is primed into the grant cache for the requests that
+     * follow.
+     */
+    orgs(localUserId: string, login?: LoginAccessToken): Promise<HubOrgsResult>;
+    /**
+     * The organization's whole team list, read AS THE USER (PRDCT-2813): `GET
+     * <hub>/api/v1/teams` with the person's own grant token and the hub org in
+     * `X-Workspace-Id`, which the hub answers for any member of that org. Same
+     * posture as `orgs()`: one forced refresh and one retry on a 401/403 (once
+     * for the whole drain), `inconclusive` on any doubt (network, non-2xx,
+     * unparseable or malformed page). The pages are drained through
+     * `nextCursor`, at most ORG_TEAMS_MAX_PAGES of them; a list cut there is
+     * returned with `complete: false`.
+     */
+    orgTeams(localUserId: string, hubOrgId: string): Promise<HubOrgTeamsResult>;
+    /**
+     * Create an organization at the hub AS THE USER (PRDCT-2443): `POST
+     * <hub>/api/v1/orgs` `{ name }` presented with the user's OWN grant token,
+     * obtained through the SAME HubGrantService path `orgs()` uses (cache →
+     * single-flighted refresh; the PRDCT-1370 presentation record and probe
+     * live inside it). No service key, no target-user parameter: the hub makes
+     * the BEARER the owner, so the only organization this can ever create is
+     * the caller's own.
+     *
+     * Retry posture, deliberately narrower than the read's: ONLY a 401 earns
+     * the one forced-refresh retry (the hub refused the token before doing
+     * anything, so nothing was created). A 403 is a definitive policy answer
+     * (the cap, or a hub that does not open creation to grants) and a
+     * network/timeout/5xx answer is NEVER retried — the hub commits before it
+     * answers, so a blind second POST could create a second organization.
+     */
+    createOrg(localUserId: string, name: string): Promise<HubCreateOrgResult>;
+    private post;
+    private getTeamsPage;
+    private get;
+}
+//# sourceMappingURL=hub-user-client.d.ts.map

package/dist/identity/hub-user-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-user-client.d.ts","sourceRoot":"","sources":["../../src/identity/hub-user-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAe,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGnE;;;;;;;;;;;;;;;GAeG;AAEH,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC/B,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAO3B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAAA;KAAE,CAAA;CAAE,GACzF;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7B,yFAAyF;AACzF,MAAM,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAK/F;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAmC5F;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,CAmBlE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CAexE;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,eAAe,CAAC;IACvB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,iBAAiB;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,aAAa;IAMZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,sFAAsF;IACtF,OAAO,CAAC,kBAAkB,CAAS;gBAEN,IAAI,EAAE,oBAAoB;IAKvD;;;;;;OAMG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC;IAuFjF;;;;;;;;;OASG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA+EjF;;;;;;;;;;;;;;;OAeG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAmCjE,IAAI;YAsBJ,YAAY;YAsBZ,GAAG;CAYlB"}

package/dist/identity/hub-user-client.js

@@ -0,0 +1,406 @@
+import { workspaceRoles } from '@antasphere/chassis-db';
+import { placeholderWorkspaceName } from './hub-projection.js';
+/**
+ * The as-the-user hub reader (internal/federation.md, live user-scoped
+ * federation): every org/membership read between logins is `GET
+ * <hub>/api/v1/orgs` presented with the USER's OWN grant token
+ * (identity/hub-grant.ts) — the hub only ever returns what that user may
+ * see, so a cross-tenant read is structurally impossible on this path.
+ * There is deliberately NO target-user parameter anywhere.
+ *
+ * Failure posture mirrors the retired H4 client: only a definitive 200
+ * list may drive reconciliation; network/timeout/5xx/malformed answers are
+ * one loud, fail-open 'inconclusive'. A 401/403 gets exactly ONE
+ * forced-refresh retry (the presented token may be stale or wrong-audience
+ * from a pre-flip row) — a second refusal is inconclusive, never a grant
+ * kill (only the token endpoint's `invalid_grant` kills a grant, inside
+ * HubGrantService).
+ */
+/** The hub API resource identifier (RFC 8707 `aud`) — `<hub issuer>/mcp`. */
+export function hubApiResource(issuerUrl) {
+    return issuerUrl.replace(/\/+$/, '') + '/mcp';
+}
+/** The page size of the team-list drain (the hub's own maximum). */
+const ORG_TEAMS_PAGE_LIMIT = 100;
+/** At most this many pages per read (1,000 teams), then the drain stops. */
+const ORG_TEAMS_MAX_PAGES = 10;
+/** The hub's cap refusal codes — today's (`org_limit_reached`) and the `*_cap_reached` spelling. */
+const HUB_ORG_LIMIT_CODES = new Set(['org_limit_reached', 'org_cap_reached']);
+/**
+ * THE ONE PLACE that knows the shape of the hub's `POST /api/v1/orgs` answer
+ * (hub contract `orgCreatedSchema`: 201 `{ org: { id, name, role, … } }`;
+ * refusals in the common `{ error: { code } }` envelope). Pure, so the
+ * shape is adjustable — and testable — without touching the transport.
+ */
+export function classifyHubOrgCreateAnswer(status, body) {
+    const code = typeof body?.error?.code === 'string'
+        ? body.error.code
+        : null;
+    if (status === 201 || status === 200) {
+        const raw = (body?.org ?? null);
+        // A 2xx without a valid org id is unusable AND ambiguous (something was
+        // probably created): inconclusive, never a guess at the id.
+        if (!raw || typeof raw.id !== 'string' || !UUID_RE.test(raw.id))
+            return { kind: 'inconclusive' };
+        return {
+            kind: 'created',
+            org: {
+                id: raw.id,
+                name: typeof raw.name === 'string' && raw.name.trim() ? raw.name : null,
+                role: typeof raw.role === 'string' && workspaceRoles.includes(raw.role)
+                    ? raw.role
+                    : null
+            }
+        };
+    }
+    if ((status === 403 || status === 409) && code !== null && HUB_ORG_LIMIT_CODES.has(code)) {
+        return { kind: 'limit_reached' };
+    }
+    // Exactly the hub's scope refusal — never any other 403 (a registry
+    // refusal, `forbidden`, stays 'refused': signing in again would not help).
+    if (status === 403 && code === 'insufficient_scope')
+        return { kind: 'reauth_required' };
+    if (status === 400 || status === 422)
+        return { kind: 'invalid' };
+    if (status >= 400 && status < 500)
+        return { kind: 'refused', status, code };
+    return { kind: 'inconclusive' };
+}
+/**
+ * Strict UUID shape, the one id rule of every list this file parses (orgs,
+ * teams, denied orgs). The hub's org and team ids are uuids, and they are
+ * written to Postgres (`workspaces.central_account_id`,
+ * `workspace_teams.hub_team_id`) or shown to the person: an entry of any
+ * other shape is not a hub id, so it is dropped with a log line and never
+ * stored.
+ */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * An org entry's `teams` (forward-compatible: absent or not an array reads
+ * as none). An entry without a uuid id is dropped (UUID_RE); a missing slug
+ * or name reads as the empty string rather than dropping a seat the hub
+ * asserted.
+ */
+export function parseTeams(raw, logger) {
+    if (!Array.isArray(raw))
+        return [];
+    const teams = [];
+    const seen = new Set();
+    for (const item of raw) {
+        const team = (item ?? {});
+        if (typeof team.id !== 'string' || !UUID_RE.test(team.id)) {
+            logger.warn('hub /orgs carried a team without a valid id — entry dropped');
+            continue;
+        }
+        if (seen.has(team.id))
+            continue;
+        seen.add(team.id);
+        teams.push({
+            id: team.id,
+            slug: typeof team.slug === 'string' ? team.slug : '',
+            name: typeof team.name === 'string' ? team.name : ''
+        });
+    }
+    return teams;
+}
+/**
+ * The body's top-level `denied` (absent or malformed reads as none; an entry
+ * without a uuid id is dropped, UUID_RE). A missing or blank name reads as
+ * the projection's placeholder, so every reader gets a name to show.
+ */
+export function parseDenied(raw, logger) {
+    if (!Array.isArray(raw))
+        return [];
+    const denied = [];
+    for (const item of raw) {
+        const org = (item ?? {});
+        if (typeof org.id !== 'string' || !UUID_RE.test(org.id)) {
+            logger.warn('hub /orgs carried a denied org without a valid id — entry dropped');
+            continue;
+        }
+        denied.push({
+            id: org.id,
+            name: typeof org.name === 'string' && org.name.trim() ? org.name : placeholderWorkspaceName(org.id)
+        });
+    }
+    return denied;
+}
+export class HubUserClient {
+    opts;
+    base;
+    fetchImpl;
+    /** An older hub without `GET /teams` is said once per client, never on every pass. */
+    warnedNoTeamsRoute = false;
+    constructor(opts) {
+        this.opts = opts;
+        this.base = opts.issuerUrl.replace(/\/+$/, '');
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    /**
+     * The user's own org list, as the hub sees it RIGHT NOW. `login` carries
+     * the SSO callback's access token (already hub-audienced — the code
+     * exchange sends the same `resource`): the login path needs no refresh,
+     * and the token is primed into the grant cache for the requests that
+     * follow.
+     */
+    async orgs(localUserId, login) {
+        let token;
+        if (login) {
+            this.opts.grant.prime(localUserId, login.accessToken, login.expiresAt);
+            token = login.accessToken;
+        }
+        else {
+            const access = await this.opts.grant.accessToken(localUserId);
+            if (access.kind !== 'ok')
+                return { kind: access.kind };
+            token = access.accessToken;
+        }
+        let res = await this.get(token);
+        if (res.kind === 'error')
+            return { kind: 'inconclusive' };
+        if (res.response.status === 401 || res.response.status === 403) {
+            // The hub refused the token (expired mid-window, or a pre-flip row's
+            // wrong-audience stored token): ONE forced refresh, ONE retry. The
+            // refresh itself classifies the grant (invalid_grant → dead).
+            this.opts.grant.invalidateAccess(localUserId);
+            const refreshed = await this.opts.grant.refresh(localUserId);
+            if (refreshed.kind !== 'ok')
+                return { kind: refreshed.kind };
+            res = await this.get(refreshed.accessToken);
+            if (res.kind === 'error')
+                return { kind: 'inconclusive' };
+            if (res.response.status === 401 || res.response.status === 403) {
+                this.opts.logger.error({ status: res.response.status }, 'hub /orgs refused a FRESHLY refreshed token — the hub is rejecting this tool’s grants; failing open');
+                return { kind: 'inconclusive' };
+            }
+        }
+        const { response } = res;
+        if (!response.ok) {
+            this.opts.logger.warn({ status: response.status }, 'hub /orgs answered non-2xx — failing open');
+            return { kind: 'inconclusive' };
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            this.opts.logger.warn('hub /orgs body unparseable — failing open');
+            return { kind: 'inconclusive' };
+        }
+        const rawList = body?.orgs;
+        if (!Array.isArray(rawList)) {
+            this.opts.logger.warn('hub /orgs body malformed — failing open');
+            return { kind: 'inconclusive' };
+        }
+        const orgs = [];
+        for (const raw of rawList) {
+            const entry = (raw ?? {});
+            if (typeof entry.id !== 'string' || !UUID_RE.test(entry.id)) {
+                // One bad entry never poisons the list — but its org can neither be
+                // projected NOR protected by the keep-set, so say so loudly.
+                this.opts.logger.error('hub /orgs carried an entry without a valid id — entry dropped');
+                continue;
+            }
+            const role = typeof entry.role === 'string' && workspaceRoles.includes(entry.role)
+                ? entry.role
+                : null;
+            if (role === null) {
+                this.opts.logger.warn({ hubOrgId: entry.id }, 'hub /orgs carried an unknown role — keeping the membership alive, skipping its sync');
+            }
+            orgs.push({
+                id: entry.id,
+                name: typeof entry.name === 'string' && entry.name.trim() ? entry.name : null,
+                role,
+                // Unknown/absent status reads as 'active' (forward-compat: status
+                // only ever narrows access; enforcement reads the synced column).
+                status: entry.status === 'suspended' ? 'suspended' : 'active',
+                isDefault: entry.isDefault === true,
+                teams: parseTeams(entry.teams, this.opts.logger)
+            });
+        }
+        return { kind: 'ok', orgs, denied: parseDenied(body.denied, this.opts.logger) };
+    }
+    /**
+     * The organization's whole team list, read AS THE USER (PRDCT-2813): `GET
+     * <hub>/api/v1/teams` with the person's own grant token and the hub org in
+     * `X-Workspace-Id`, which the hub answers for any member of that org. Same
+     * posture as `orgs()`: one forced refresh and one retry on a 401/403 (once
+     * for the whole drain), `inconclusive` on any doubt (network, non-2xx,
+     * unparseable or malformed page). The pages are drained through
+     * `nextCursor`, at most ORG_TEAMS_MAX_PAGES of them; a list cut there is
+     * returned with `complete: false`.
+     */
+    async orgTeams(localUserId, hubOrgId) {
+        const access = await this.opts.grant.accessToken(localUserId);
+        if (access.kind !== 'ok')
+            return { kind: access.kind };
+        let token = access.accessToken;
+        let retried = false;
+        const teams = [];
+        const seen = new Set();
+        let cursor = null;
+        for (let page = 0; page < ORG_TEAMS_MAX_PAGES; page++) {
+            let res = await this.getTeamsPage(token, hubOrgId, cursor);
+            if (res.kind === 'error')
+                return { kind: 'inconclusive' };
+            if ((res.response.status === 401 || res.response.status === 403) && !retried) {
+                retried = true;
+                this.opts.grant.invalidateAccess(localUserId);
+                const refreshed = await this.opts.grant.refresh(localUserId);
+                if (refreshed.kind !== 'ok')
+                    return { kind: refreshed.kind };
+                token = refreshed.accessToken;
+                res = await this.getTeamsPage(token, hubOrgId, cursor);
+                if (res.kind === 'error')
+                    return { kind: 'inconclusive' };
+            }
+            const { response } = res;
+            if (response.status === 404) {
+                if (!this.warnedNoTeamsRoute) {
+                    this.warnedNoTeamsRoute = true;
+                    this.opts.logger.warn('hub /teams answered 404 — a hub without the team list; only the members’ own teams are projected');
+                }
+                return { kind: 'inconclusive' };
+            }
+            if (!response.ok) {
+                this.opts.logger.warn({ status: response.status, hubOrgId }, 'hub /teams answered non-2xx — failing open');
+                return { kind: 'inconclusive' };
+            }
+            let body;
+            try {
+                body = await response.json();
+            }
+            catch {
+                this.opts.logger.warn({ hubOrgId }, 'hub /teams body unparseable — failing open');
+                return { kind: 'inconclusive' };
+            }
+            const raw = body ?? {};
+            if (!Array.isArray(raw.teams)) {
+                this.opts.logger.warn({ hubOrgId }, 'hub /teams body malformed — failing open');
+                return { kind: 'inconclusive' };
+            }
+            const pageTeams = parseTeams(raw.teams, this.opts.logger);
+            // The hub pages on the id of the last row alone, and its teams are
+            // hard-deleted: a cursor whose team went between two page reads answers
+            // an EMPTY page with no cursor, which reads exactly like the end of the
+            // list. It is not: what was never read must not be deleted here
+            // (verifier round 1, F1). A page reached THROUGH a cursor that carries
+            // nothing is a cut list, upserted and deleted from nothing.
+            if (page > 0 && pageTeams.length === 0) {
+                this.opts.logger.warn({ hubOrgId, teams: teams.length }, 'hub /teams answered an empty page behind a cursor (the cursor’s team went) — upserting what was read, deleting nothing');
+                return { kind: 'ok', teams, complete: false };
+            }
+            for (const team of pageTeams) {
+                if (seen.has(team.id))
+                    continue;
+                seen.add(team.id);
+                teams.push(team);
+            }
+            cursor = typeof raw.nextCursor === 'string' && raw.nextCursor !== '' ? raw.nextCursor : null;
+            if (cursor === null)
+                return { kind: 'ok', teams, complete: true };
+        }
+        this.opts.logger.warn({ hubOrgId, teams: teams.length }, 'hub /teams has more pages than one read drains — upserting what was read, deleting nothing');
+        return { kind: 'ok', teams, complete: false };
+    }
+    /**
+     * Create an organization at the hub AS THE USER (PRDCT-2443): `POST
+     * <hub>/api/v1/orgs` `{ name }` presented with the user's OWN grant token,
+     * obtained through the SAME HubGrantService path `orgs()` uses (cache →
+     * single-flighted refresh; the PRDCT-1370 presentation record and probe
+     * live inside it). No service key, no target-user parameter: the hub makes
+     * the BEARER the owner, so the only organization this can ever create is
+     * the caller's own.
+     *
+     * Retry posture, deliberately narrower than the read's: ONLY a 401 earns
+     * the one forced-refresh retry (the hub refused the token before doing
+     * anything, so nothing was created). A 403 is a definitive policy answer
+     * (the cap, or a hub that does not open creation to grants) and a
+     * network/timeout/5xx answer is NEVER retried — the hub commits before it
+     * answers, so a blind second POST could create a second organization.
+     */
+    async createOrg(localUserId, name) {
+        const access = await this.opts.grant.accessToken(localUserId);
+        if (access.kind !== 'ok')
+            return { kind: access.kind };
+        let res = await this.post(access.accessToken, name);
+        if (res.kind === 'error')
+            return { kind: 'inconclusive' };
+        if (res.response.status === 401) {
+            this.opts.grant.invalidateAccess(localUserId);
+            const refreshed = await this.opts.grant.refresh(localUserId);
+            if (refreshed.kind !== 'ok')
+                return { kind: refreshed.kind };
+            res = await this.post(refreshed.accessToken, name);
+            if (res.kind === 'error')
+                return { kind: 'inconclusive' };
+            if (res.response.status === 401) {
+                this.opts.logger.error('hub POST /orgs refused a FRESHLY refreshed token — the hub is rejecting this tool’s grants');
+                return { kind: 'refused', status: 401, code: null };
+            }
+        }
+        let body = null;
+        try {
+            body = await res.response.json();
+        }
+        catch {
+            body = null;
+        }
+        const result = classifyHubOrgCreateAnswer(res.response.status, body);
+        if (result.kind === 'inconclusive' || result.kind === 'refused') {
+            this.opts.logger.warn({ status: res.response.status, code: result.kind === 'refused' ? result.code : undefined }, 'hub POST /orgs did not create the organization');
+        }
+        return result;
+    }
+    async post(token, name) {
+        try {
+            const response = await this.fetchImpl(`${this.base}/api/v1/orgs`, {
+                method: 'POST',
+                headers: {
+                    authorization: `Bearer ${token}`,
+                    accept: 'application/json',
+                    'content-type': 'application/json'
+                },
+                body: JSON.stringify({ name }),
+                signal: AbortSignal.timeout(this.opts.createTimeoutMs ?? this.opts.timeoutMs)
+            });
+            return { kind: 'ok', response };
+        }
+        catch (err) {
+            this.opts.logger.warn({ err }, 'hub POST /orgs fetch failed — the organization may or may not exist');
+            return { kind: 'error' };
+        }
+    }
+    async getTeamsPage(token, hubOrgId, cursor) {
+        const query = `limit=${ORG_TEAMS_PAGE_LIMIT}${cursor === null ? '' : `&cursor=${encodeURIComponent(cursor)}`}`;
+        try {
+            const response = await this.fetchImpl(`${this.base}/api/v1/teams?${query}`, {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                    accept: 'application/json',
+                    'x-workspace-id': hubOrgId
+                },
+                signal: AbortSignal.timeout(this.opts.timeoutMs)
+            });
+            return { kind: 'ok', response };
+        }
+        catch (err) {
+            this.opts.logger.warn({ err, hubOrgId }, 'hub /teams fetch failed — failing open');
+            return { kind: 'error' };
+        }
+    }
+    async get(token) {
+        try {
+            const response = await this.fetchImpl(`${this.base}/api/v1/orgs`, {
+                headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+                signal: AbortSignal.timeout(this.opts.timeoutMs)
+            });
+            return { kind: 'ok', response };
+        }
+        catch (err) {
+            this.opts.logger.warn({ err }, 'hub /orgs fetch failed — failing open');
+            return { kind: 'error' };
+        }
+    }
+}
+//# sourceMappingURL=hub-user-client.js.map

package/dist/identity/hub-user-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-user-client.js","sourceRoot":"","sources":["../../src/identity/hub-user-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,MAAM,wBAAwB,CAAC;AAG5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D;;;;;;;;;;;;;;;GAeG;AAEH,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;AAChD,CAAC;AAgED,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAgC/B,oGAAoG;AACpG,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc,EAAE,IAAa;IACtE,MAAM,IAAI,GACR,OAAQ,IAA8C,EAAE,KAAK,EAAE,IAAI,KAAK,QAAQ;QAC9E,CAAC,CAAE,IAAoC,CAAC,KAAK,CAAC,IAAI;QAClD,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,CAAE,IAAiC,EAAE,GAAG,IAAI,IAAI,CAIpD,CAAC;QACT,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACjG,OAAO;YACL,IAAI,EAAE,SAAS;YACf,GAAG,EAAE;gBACH,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBACvE,IAAI,EACF,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtF,CAAC,CAAE,GAAG,CAAC,IAAsB;oBAC7B,CAAC,CAAC,IAAI;aACX;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACnC,CAAC;IACD,oEAAoE;IACpE,2EAA2E;IAC3E,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,oBAAoB;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACxF,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjE,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,MAAc;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAqD,CAAC;QAC9E,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YACpD,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;SACrD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,MAAc;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAqC,CAAC;QAC7D,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;SACpG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAyBD,MAAM,OAAO,aAAa;IAMK;IALZ,IAAI,CAAS;IACb,SAAS,CAAe;IACzC,sFAAsF;IAC9E,kBAAkB,GAAG,KAAK,CAAC;IAEnC,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;QACrD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,KAAwB;QACtD,IAAI,KAAa,CAAC;QAClB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACvE,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YACvD,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,CAAC;QAED,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/D,qEAAqE;YACrE,mEAAmE;YACnE,8DAA8D;YAC9D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAgB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;YAC7D,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAC/B,qGAAqG,CACtG,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAClC,CAAC;QACH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAC;YAChG,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,OAAO,GAAI,IAAkC,EAAE,IAAI,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACjE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAOvB,CAAC;YACF,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5D,oEAAoE;gBACpE,6DAA6D;gBAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBACxF,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC1F,CAAC,CAAE,KAAK,CAAC,IAAsB;gBAC/B,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,EACtB,qFAAqF,CACtF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBAC7E,IAAI;gBACJ,kEAAkE;gBAClE,kEAAkE;gBAClE,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;gBAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI;gBACnC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAE,IAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5G,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,QAAgB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,MAAM,GAAkB,IAAI,CAAC;QAEjC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,mBAAmB,EAAE,IAAI,EAAE,EAAE,CAAC;YACtD,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7E,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBAC9C,MAAM,SAAS,GAAgB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC7D,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC;gBAC9B,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACvD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;oBAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAC5D,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;YACzB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;oBAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,kGAAkG,CACnG,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAClC,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,EACrC,4CAA4C,CAC7C,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAClC,CAAC;YACD,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,4CAA4C,CAAC,CAAC;gBAClF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAClC,CAAC;YACD,MAAM,GAAG,GAAI,IAAyD,IAAI,EAAE,CAAC;YAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,0CAA0C,CAAC,CAAC;gBAChF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAClC,CAAC;YACD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1D,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,gEAAgE;YAChE,uEAAuE;YACvE,4DAA4D;YAC5D,IAAI,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EACjC,wHAAwH,CACzH,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAChD,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YACD,MAAM,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7F,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EACjC,4FAA4F,CAC7F,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,IAAY;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAEvD,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAgB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;YAC7D,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,4FAA4F,CAC7F,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;QACD,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAC1F,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,KAAa,EACb,IAAY;QAEZ,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,cAAc,EAAE;gBAChE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;gBAC9B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;aAC9E,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,qEAAqE,CAAC,CAAC;YACtG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,KAAa,EACb,QAAgB,EAChB,MAAqB;QAErB,MAAM,KAAK,GAAG,SAAS,oBAAoB,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC/G,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,iBAAiB,KAAK,EAAE,EAAE;gBAC1E,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,MAAM,EAAE,kBAAkB;oBAC1B,gBAAgB,EAAE,QAAQ;iBAC3B;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;aACjD,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,wCAAwC,CAAC,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,cAAc,EAAE;gBAChE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACzE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;aACjD,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACxE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;CACF"}