@assemora/auth 0.1.0

package/dist/commands.d.ts

@@ -0,0 +1,232 @@
+declare module '@assemora/core' {
+    interface AssemoraEventPayloads {
+        'auth.signed-in': {
+            readonly userId: string;
+        };
+        'auth.signed-out': {
+            readonly userId: string | undefined;
+        };
+        'auth.user-created': {
+            readonly userId: string;
+        };
+    }
+}
+/**
+ * The two commands a route has to front (SPEC.md §85).
+ *
+ * `publicAuthPolicy` authorizes them for everybody, because the caller of a login is
+ * nobody yet. That removes the floor every other command stands on — the bus
+ * authorizes first, and authorization denies by default — so the checks that make
+ * them safe live in the routes written for them: the session leaves as an `httpOnly`
+ * cookie rather than as readable JSON, a CSRF token is minted beside it, logging out
+ * clears both, and the forensic fields come off the request.
+ *
+ * A generated `POST /commands/auth.login` or an MCP tool would be the same handler
+ * with none of that in front of it — and, since agent permissions never gate a
+ * publicly authorized command, an agent token would be a password oracle. Saying it
+ * here is what keeps both generators away, instead of a list of names each of them
+ * would have to maintain.
+ */
+export declare const SignIn: import("@assemora/core").CommandDefinition<{
+    email: import("@assemora/schema").StringSchema;
+    password: import("@assemora/schema").StringSchema;
+}, {
+    readonly expiresAt: Date;
+    readonly token: string;
+    readonly userId: string;
+}>;
+export declare const SignOut: import("@assemora/core").CommandDefinition<{
+    token: import("@assemora/schema").StringSchema;
+}, {
+    readonly ended: boolean;
+}>;
+export declare const CreateUser: import("@assemora/core").CommandDefinition<{
+    email: import("@assemora/schema").StringSchema;
+    name: import("@assemora/schema").StringSchema;
+    password: import("@assemora/schema").StringSchema;
+    roles: import("@assemora/schema").OptionalSchema<string[]>;
+}, {
+    readonly id: string;
+}>;
+export declare const GrantRole: import("@assemora/core").CommandDefinition<{
+    userId: import("@assemora/schema").StringSchema;
+    role: import("@assemora/schema").StringSchema;
+}, {
+    readonly role: string;
+    readonly userId: string;
+}>;
+export declare const CreateApiToken: import("@assemora/core").CommandDefinition<{
+    name: import("@assemora/schema").StringSchema;
+    permissions: import("@assemora/schema").ArraySchema<import("@assemora/schema").StringSchema>;
+    userId: import("@assemora/schema").OptionalSchema<string>;
+    expiresAt: import("@assemora/schema").OptionalSchema<Date>;
+}, {
+    readonly id: string;
+    readonly token: string;
+}>;
+export declare const CreateAgent: import("@assemora/core").CommandDefinition<{
+    name: import("@assemora/schema").StringSchema;
+    description: import("@assemora/schema").OptionalSchema<string>;
+    permissions: import("@assemora/schema").ArraySchema<import("@assemora/schema").StringSchema>;
+}, {
+    readonly agentId: string;
+    readonly token: string;
+    readonly tokenId: string;
+}>;
+export declare const UpdateUser: import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+    expectedVersion: import("@assemora/schema").OptionalSchema<number>;
+    name: import("@assemora/schema").OptionalSchema<string>;
+    email: import("@assemora/schema").OptionalSchema<string>;
+    active: import("@assemora/schema").OptionalSchema<boolean>;
+}, {
+    readonly id: string;
+    readonly version: number;
+}>;
+export declare const SetPassword: import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+    password: import("@assemora/schema").StringSchema;
+}, {
+    readonly id: string;
+}>;
+export declare const RevokeRole: import("@assemora/core").CommandDefinition<{
+    userId: import("@assemora/schema").StringSchema;
+    role: import("@assemora/schema").StringSchema;
+}, {
+    readonly role: string;
+    readonly userId: string;
+}>;
+export declare const CreateRole: import("@assemora/core").CommandDefinition<{
+    name: import("@assemora/schema").StringSchema;
+    label: import("@assemora/schema").StringSchema;
+    permissions: import("@assemora/schema").ArraySchema<import("@assemora/schema").StringSchema>;
+}, {
+    readonly id: string;
+    readonly name: string;
+}>;
+export declare const UpdateRole: import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+    expectedVersion: import("@assemora/schema").OptionalSchema<number>;
+    label: import("@assemora/schema").OptionalSchema<string>;
+    permissions: import("@assemora/schema").OptionalSchema<string[]>;
+}, {
+    readonly id: string;
+    readonly version: number;
+}>;
+export declare const DeleteRole: import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+}, {
+    readonly id: string;
+}>;
+export declare const RevokeApiToken: import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+}, {
+    readonly id: string;
+}>;
+export declare const UpdateAgent: import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+    description: import("@assemora/schema").OptionalSchema<string>;
+    permissions: import("@assemora/schema").OptionalSchema<string[]>;
+    enabled: import("@assemora/schema").OptionalSchema<boolean>;
+}, {
+    readonly enabled: boolean;
+    readonly id: string;
+}>;
+/**
+ * Signing in and signing out are open to anyone; everything else in `auth` needs the
+ * matching permission, which is what having no policy for it means.
+ */
+export declare const publicAuthPolicy: import("./policies.js").Policy<Record<string, unknown>>;
+export declare const authCommands: readonly [import("@assemora/core").CommandDefinition<{
+    email: import("@assemora/schema").StringSchema;
+    password: import("@assemora/schema").StringSchema;
+}, {
+    readonly expiresAt: Date;
+    readonly token: string;
+    readonly userId: string;
+}>, import("@assemora/core").CommandDefinition<{
+    token: import("@assemora/schema").StringSchema;
+}, {
+    readonly ended: boolean;
+}>, import("@assemora/core").CommandDefinition<{
+    email: import("@assemora/schema").StringSchema;
+    name: import("@assemora/schema").StringSchema;
+    password: import("@assemora/schema").StringSchema;
+    roles: import("@assemora/schema").OptionalSchema<string[]>;
+}, {
+    readonly id: string;
+}>, import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+    expectedVersion: import("@assemora/schema").OptionalSchema<number>;
+    name: import("@assemora/schema").OptionalSchema<string>;
+    email: import("@assemora/schema").OptionalSchema<string>;
+    active: import("@assemora/schema").OptionalSchema<boolean>;
+}, {
+    readonly id: string;
+    readonly version: number;
+}>, import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+    password: import("@assemora/schema").StringSchema;
+}, {
+    readonly id: string;
+}>, import("@assemora/core").CommandDefinition<{
+    userId: import("@assemora/schema").StringSchema;
+    role: import("@assemora/schema").StringSchema;
+}, {
+    readonly role: string;
+    readonly userId: string;
+}>, import("@assemora/core").CommandDefinition<{
+    userId: import("@assemora/schema").StringSchema;
+    role: import("@assemora/schema").StringSchema;
+}, {
+    readonly role: string;
+    readonly userId: string;
+}>, import("@assemora/core").CommandDefinition<{
+    name: import("@assemora/schema").StringSchema;
+    label: import("@assemora/schema").StringSchema;
+    permissions: import("@assemora/schema").ArraySchema<import("@assemora/schema").StringSchema>;
+}, {
+    readonly id: string;
+    readonly name: string;
+}>, import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+    expectedVersion: import("@assemora/schema").OptionalSchema<number>;
+    label: import("@assemora/schema").OptionalSchema<string>;
+    permissions: import("@assemora/schema").OptionalSchema<string[]>;
+}, {
+    readonly id: string;
+    readonly version: number;
+}>, import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+}, {
+    readonly id: string;
+}>, import("@assemora/core").CommandDefinition<{
+    name: import("@assemora/schema").StringSchema;
+    permissions: import("@assemora/schema").ArraySchema<import("@assemora/schema").StringSchema>;
+    userId: import("@assemora/schema").OptionalSchema<string>;
+    expiresAt: import("@assemora/schema").OptionalSchema<Date>;
+}, {
+    readonly id: string;
+    readonly token: string;
+}>, import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+}, {
+    readonly id: string;
+}>, import("@assemora/core").CommandDefinition<{
+    name: import("@assemora/schema").StringSchema;
+    description: import("@assemora/schema").OptionalSchema<string>;
+    permissions: import("@assemora/schema").ArraySchema<import("@assemora/schema").StringSchema>;
+}, {
+    readonly agentId: string;
+    readonly token: string;
+    readonly tokenId: string;
+}>, import("@assemora/core").CommandDefinition<{
+    id: import("@assemora/schema").StringSchema;
+    description: import("@assemora/schema").OptionalSchema<string>;
+    permissions: import("@assemora/schema").OptionalSchema<string[]>;
+    enabled: import("@assemora/schema").OptionalSchema<boolean>;
+}, {
+    readonly enabled: boolean;
+    readonly id: string;
+}>];
+//# sourceMappingURL=commands.d.ts.map

package/dist/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AA+BA,OAAO,QAAQ,gBAAgB,CAAC;IAC9B,UAAU,qBAAqB;QAC7B,gBAAgB,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;QAC7C,iBAAiB,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;SAAE,CAAA;QAC1D,mBAAmB,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD;CACF;AAwDD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,MAAM;;;;;;;EA0BjB,CAAA;AAEF,eAAO,MAAM,OAAO;;;;EAWlB,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;;EAuCrB,CAAA;AAEF,eAAO,MAAM,SAAS;;;;;;EAiBpB,CAAA;AAEF,eAAO,MAAM,cAAc;;;;;;;;EAmBzB,CAAA;AAEF,eAAO,MAAM,WAAW;;;;;;;;EAatB,CAAA;AAuBF,eAAO,MAAM,UAAU;;;;;;;;;EAgCrB,CAAA;AAEF,eAAO,MAAM,WAAW;;;;;EAiBtB,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;EAmBrB,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;;EA0BrB,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;;;EA6BrB,CAAA;AAEF,eAAO,MAAM,UAAU;;;;EAkBrB,CAAA;AAEF,eAAO,MAAM,cAAc;;;;EAczB,CAAA;AAEF,eAAO,MAAM,WAAW;;;;;;;;EA8BtB,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,yDAG3B,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAef,CAAA"}

package/dist/commands.js

@@ -0,0 +1,390 @@
+/**
+ * Authentication commands (SPEC.md §14, §49).
+ *
+ * Signing in changes state — a session is created — so it travels the Command Bus
+ * like every other mutation, and is audited like every other mutation.
+ */
+import { AssemoraError, ConflictError, command, ForbiddenError, NotFoundError, } from '@assemora/core';
+import { array, boolean, email as emailSchema, number, string, timestamp, uuid, } from '@assemora/schema';
+import { hashPassword, verifyPassword } from './credentials.js';
+import { Agent, ApiToken, Permission, Role, RolePermission, User, UserRole } from './models.js';
+import { holds, permissionsOf } from './permissions.js';
+import { policy } from './policies.js';
+import { endSession, startSession } from './sessions.js';
+import { createAgent, createApiToken } from './tokens.js';
+/**
+ * A hash to verify against when the email is unknown.
+ *
+ * Without it, a missing user answers faster than a wrong password, and the timing
+ * says which emails are registered (SPEC.md §85).
+ */
+const DECOY = await hashPassword('a password nobody has');
+const INVALID = new AssemoraError('INVALID_CREDENTIALS', 'The email or password is wrong', {
+    status: 401,
+});
+/**
+ * Refuses to hand out more than the giver has (SPEC.md §50, §72).
+ *
+ * A role, an API token and an agent all carry permissions, and any of the three would
+ * otherwise be a way to mint a credential stronger than the actor minting it — an
+ * escalation that leaves an ordinary-looking audit trail.
+ */
+const grantable = async (permissions, context) => {
+    const held = await permissionsOf(context.actor);
+    const beyond = permissions.filter((permission) => !holds(held, permission));
+    if (beyond.length > 0) {
+        throw new ForbiddenError(`You cannot grant what you do not hold: ${[...new Set(beyond)].sort().join(', ')}`);
+    }
+};
+/**
+ * Links permission names to a role, recording any that had not been seen before.
+ *
+ * A permission name is a command name (ADR-0015), so the set of legal ones is
+ * whatever the application declares — there is no fixed list to validate against, and
+ * inventing one would make a role uneditable the moment a package added a command.
+ */
+const attach = async (roleId, names) => {
+    for (const name of names) {
+        const permission = (await Permission.where('name', name).first()) ??
+            (await Permission.create({ name, description: null }));
+        const existing = await RolePermission.where('roleId', roleId)
+            .where('permissionId', permission.id)
+            .first();
+        if (existing === null)
+            await RolePermission.create({ roleId, permissionId: permission.id });
+    }
+};
+/**
+ * The two commands a route has to front (SPEC.md §85).
+ *
+ * `publicAuthPolicy` authorizes them for everybody, because the caller of a login is
+ * nobody yet. That removes the floor every other command stands on — the bus
+ * authorizes first, and authorization denies by default — so the checks that make
+ * them safe live in the routes written for them: the session leaves as an `httpOnly`
+ * cookie rather than as readable JSON, a CSRF token is minted beside it, logging out
+ * clears both, and the forensic fields come off the request.
+ *
+ * A generated `POST /commands/auth.login` or an MCP tool would be the same handler
+ * with none of that in front of it — and, since agent permissions never gate a
+ * publicly authorized command, an agent token would be a password oracle. Saying it
+ * here is what keeps both generators away, instead of a list of names each of them
+ * would have to maintain.
+ */
+export const SignIn = command('auth.login', {
+    description: 'Exchanges an email and a password for a session',
+    reachableFrom: 'its own route',
+    input: { email: emailSchema(), password: string() },
+    output: { token: string(), expiresAt: timestamp(), userId: uuid() },
+    handle: async ({ email, password }, context) => {
+        const user = await User.where('email', email.toLowerCase()).first();
+        const correct = await verifyPassword(user?.passwordHash ?? DECOY, password);
+        // The same answer either way: whether the email exists is not something an
+        // unauthenticated caller gets to learn.
+        if (user === null || !correct || !user.active)
+            throw INVALID;
+        // Off the context, never out of the input: a caller that names its own user agent
+        // is writing the forensic record of its own sign-in. There is no `ipAddress` for
+        // the same reason there is none on the context — nothing here knows the client's
+        // address without a trusted-proxy policy the HTTP server does not yet offer, and
+        // a column holding a claim is worse than a column holding nothing.
+        const session = await startSession(user.id, {
+            ...(context.userAgent === undefined ? {} : { userAgent: context.userAgent }),
+        });
+        context.emit('auth.signed-in', { userId: user.id });
+        return { token: session.token, expiresAt: session.expiresAt, userId: user.id };
+    },
+});
+export const SignOut = command('auth.logout', {
+    description: 'Ends a session',
+    reachableFrom: 'its own route',
+    input: { token: string() },
+    output: { ended: boolean() },
+    handle: async ({ token }, context) => {
+        await endSession(token);
+        context.emit('auth.signed-out', { userId: context.actor?.id });
+        return { ended: true };
+    },
+});
+export const CreateUser = command('auth.users.create', {
+    description: 'Creates a user',
+    input: {
+        email: emailSchema(),
+        name: string(),
+        password: string().min(12),
+        roles: array(string()).optional(),
+    },
+    output: { id: uuid() },
+    handle: async ({ email, name, password, roles }, context) => {
+        const user = await User.create({
+            email: email.toLowerCase(),
+            name,
+            passwordHash: await hashPassword(password),
+            active: true,
+        });
+        for (const roleName of roles ?? []) {
+            const role = await Role.where('name', roleName).first();
+            if (role === null) {
+                throw new AssemoraError('UNKNOWN_ROLE', `There is no role named "${roleName}"`, {
+                    status: 422,
+                });
+            }
+            await UserRole.create({ userId: user.id, roleId: role.id });
+        }
+        context.revise({
+            entityType: 'assemora_users',
+            entityId: user.id,
+            before: null,
+            after: user.toJSON(),
+        });
+        context.emit('auth.user-created', { userId: user.id });
+        return { id: user.id };
+    },
+});
+export const GrantRole = command('auth.roles.grant', {
+    description: 'Gives a user a role',
+    input: { userId: uuid(), role: string() },
+    output: { userId: uuid(), role: string() },
+    handle: async ({ userId, role }) => {
+        const found = await Role.where('name', role).first();
+        if (found === null) {
+            throw new AssemoraError('UNKNOWN_ROLE', `There is no role named "${role}"`, { status: 422 });
+        }
+        const existing = await UserRole.where('userId', userId).where('roleId', found.id).first();
+        if (existing === null)
+            await UserRole.create({ userId, roleId: found.id });
+        return { userId, role };
+    },
+});
+export const CreateApiToken = command('auth.tokens.create', {
+    description: 'Issues an API token. The token is returned once and never again',
+    input: {
+        name: string(),
+        permissions: array(string()),
+        userId: uuid().optional(),
+        expiresAt: timestamp().optional(),
+    },
+    output: { token: string(), id: uuid() },
+    handle: async (input, context) => {
+        await grantable(input.permissions, context);
+        return createApiToken({
+            name: input.name,
+            permissions: input.permissions,
+            ...(input.userId === undefined ? {} : { userId: input.userId }),
+            ...(input.expiresAt === undefined ? {} : { expiresAt: input.expiresAt }),
+        });
+    },
+});
+export const CreateAgent = command('auth.agents.create', {
+    description: 'Creates an agent identity and its first token (SPEC.md §72)',
+    input: { name: string(), description: string().optional(), permissions: array(string()) },
+    output: { agentId: uuid(), token: string(), tokenId: uuid() },
+    handle: async (input, context) => {
+        await grantable(input.permissions, context);
+        return createAgent({
+            name: input.name,
+            permissions: input.permissions,
+            ...(input.description === undefined ? {} : { description: input.description }),
+        });
+    },
+});
+/** Reads the row and refuses to go on if someone else has written since (SPEC.md §66). */
+const versioned = async (load, what, id, expectedVersion) => {
+    const found = await load();
+    if (found === null)
+        throw new NotFoundError(what, id);
+    if (expectedVersion !== undefined && found.version !== expectedVersion) {
+        throw new ConflictError(`This ${what} has changed since it was read`, {
+            expectedVersion,
+            currentVersion: found.version,
+        });
+    }
+    return found;
+};
+export const UpdateUser = command('auth.users.update', {
+    description: 'Changes a user name, email or whether they may sign in',
+    input: {
+        id: uuid(),
+        expectedVersion: number().integer().optional(),
+        name: string().min(1).optional(),
+        email: emailSchema().optional(),
+        active: boolean().optional(),
+    },
+    output: { id: uuid(), version: number().integer() },
+    handle: async ({ id, expectedVersion, name, email, active }, context) => {
+        const user = await versioned(() => User.find(id), 'user', id, expectedVersion);
+        const before = user.toJSON();
+        await context.authorize('auth.users', 'update', before);
+        await user.update({
+            ...(name === undefined ? {} : { name }),
+            ...(email === undefined ? {} : { email: email.toLowerCase() }),
+            ...(active === undefined ? {} : { active }),
+            version: user.version + 1,
+        });
+        context.revise({
+            entityType: 'assemora_users',
+            entityId: id,
+            before,
+            after: user.toJSON(),
+        });
+        return { id, version: user.version };
+    },
+});
+export const SetPassword = command('auth.users.password', {
+    description: 'Sets a user password. The old one is never read back to check it',
+    input: { id: uuid(), password: string().min(12) },
+    output: { id: uuid() },
+    handle: async ({ id, password }, context) => {
+        const user = await User.find(id);
+        if (user === null)
+            throw new NotFoundError('user', id);
+        await context.authorize('auth.users', 'update', user.toJSON());
+        await user.update({ passwordHash: await hashPassword(password), version: user.version + 1 });
+        // Deliberately no revision: a revision stores before and after, and neither
+        // belongs in a table anybody can read (SPEC.md §85).
+        return { id };
+    },
+});
+export const RevokeRole = command('auth.roles.revoke', {
+    description: 'Takes a role away from a user',
+    input: { userId: uuid(), role: string() },
+    output: { userId: uuid(), role: string() },
+    handle: async ({ userId, role }, context) => {
+        const found = await Role.where('name', role).first();
+        if (found === null) {
+            throw new AssemoraError('UNKNOWN_ROLE', `There is no role named "${role}"`, { status: 422 });
+        }
+        await context.authorize('auth.roles', 'revoke', { userId, role });
+        const link = await UserRole.where('userId', userId).where('roleId', found.id).first();
+        if (link !== null)
+            await link.delete();
+        return { userId, role };
+    },
+});
+export const CreateRole = command('auth.roles.create', {
+    description: 'Creates a role and the permissions it carries',
+    input: { name: string().min(1), label: string().min(1), permissions: array(string()) },
+    output: { id: uuid(), name: string() },
+    handle: async ({ name, label, permissions }, context) => {
+        await grantable(permissions, context);
+        if ((await Role.where('name', name).first()) !== null) {
+            throw new AssemoraError('ROLE_EXISTS', `There is already a role named "${name}"`, {
+                status: 409,
+            });
+        }
+        const role = await Role.create({ name, label, version: 1 });
+        await attach(role.id, permissions);
+        context.revise({
+            entityType: 'assemora_roles',
+            entityId: role.id,
+            before: null,
+            after: role.toJSON(),
+        });
+        return { id: role.id, name: role.name };
+    },
+});
+export const UpdateRole = command('auth.roles.update', {
+    description: 'Renames a role or replaces the permissions it carries',
+    input: {
+        id: uuid(),
+        expectedVersion: number().integer().optional(),
+        label: string().min(1).optional(),
+        permissions: array(string()).optional(),
+    },
+    output: { id: uuid(), version: number().integer() },
+    handle: async ({ id, expectedVersion, label, permissions }, context) => {
+        const role = await versioned(() => Role.find(id), 'role', id, expectedVersion);
+        const before = role.toJSON();
+        await context.authorize('auth.roles', 'update', before);
+        if (permissions !== undefined)
+            await grantable(permissions, context);
+        await role.update({ ...(label === undefined ? {} : { label }), version: role.version + 1 });
+        if (permissions !== undefined) {
+            for (const link of await RolePermission.where('roleId', id))
+                await link.delete();
+            await attach(id, permissions);
+        }
+        context.revise({ entityType: 'assemora_roles', entityId: id, before, after: role.toJSON() });
+        return { id, version: role.version };
+    },
+});
+export const DeleteRole = command('auth.roles.delete', {
+    description: 'Deletes a role, and takes it from everyone who held it',
+    input: { id: uuid() },
+    output: { id: uuid() },
+    handle: async ({ id }, context) => {
+        const role = await Role.find(id);
+        if (role === null)
+            throw new NotFoundError('role', id);
+        await context.authorize('auth.roles', 'delete', role.toJSON());
+        for (const link of await RolePermission.where('roleId', id))
+            await link.delete();
+        for (const link of await UserRole.where('roleId', id))
+            await link.delete();
+        await role.delete();
+        return { id };
+    },
+});
+export const RevokeApiToken = command('auth.tokens.revoke', {
+    description: 'Stops an API token working, at once and for good',
+    input: { id: uuid() },
+    output: { id: uuid() },
+    handle: async ({ id }, context) => {
+        const token = await ApiToken.find(id);
+        if (token === null)
+            throw new NotFoundError('token', id);
+        await context.authorize('auth.tokens', 'revoke', { id: token.id, name: token.name });
+        await token.delete();
+        return { id };
+    },
+});
+export const UpdateAgent = command('auth.agents.update', {
+    description: 'Changes what an agent may do, or turns it off (SPEC.md §72)',
+    input: {
+        id: uuid(),
+        description: string().optional(),
+        permissions: array(string()).optional(),
+        enabled: boolean().optional(),
+    },
+    output: { id: uuid(), enabled: boolean() },
+    handle: async ({ id, description, permissions, enabled }, context) => {
+        if (permissions !== undefined)
+            await grantable(permissions, context);
+        const agent = await Agent.find(id);
+        if (agent === null)
+            throw new NotFoundError('agent', id);
+        const before = agent.toJSON();
+        await context.authorize('auth.agents', 'update', before);
+        await agent.update({
+            ...(description === undefined ? {} : { description }),
+            ...(permissions === undefined ? {} : { permissions }),
+            ...(enabled === undefined ? {} : { enabled }),
+        });
+        context.revise({ entityType: 'assemora_agents', entityId: id, before, after: agent.toJSON() });
+        return { id, enabled: agent.enabled };
+    },
+});
+/**
+ * Signing in and signing out are open to anyone; everything else in `auth` needs the
+ * matching permission, which is what having no policy for it means.
+ */
+export const publicAuthPolicy = policy('auth', {
+    login: () => true,
+    logout: () => true,
+});
+export const authCommands = [
+    SignIn,
+    SignOut,
+    CreateUser,
+    UpdateUser,
+    SetPassword,
+    GrantRole,
+    RevokeRole,
+    CreateRole,
+    UpdateRole,
+    DeleteRole,
+    CreateApiToken,
+    RevokeApiToken,
+    CreateAgent,
+    UpdateAgent,
+];
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,aAAa,EAEb,aAAa,EACb,OAAO,EACP,cAAc,EACd,aAAa,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,KAAK,EACL,OAAO,EACP,KAAK,IAAI,WAAW,EACpB,MAAM,EACN,MAAM,EACN,SAAS,EACT,IAAI,GACL,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAUzD;;;;;GAKG;AACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEzD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,qBAAqB,EAAE,gCAAgC,EAAE;IACzF,MAAM,EAAE,GAAG;CACZ,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,KAAK,EACrB,WAA8B,EAC9B,OAAuB,EACR,EAAE;IACjB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;IAE3E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CACtB,0CAA0C,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAE,KAAwB,EAAiB,EAAE;IAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GACd,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9C,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAExD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC1D,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;aACpC,KAAK,EAAE,CAAA;QAEV,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7F,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE;IAC1C,WAAW,EAAE,iDAAiD;IAC9D,aAAa,EAAE,eAAe;IAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,YAAY,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAA;QAE3E,2EAA2E;QAC3E,wCAAwC;QACxC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,OAAO,CAAA;QAE5D,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,iFAAiF;QACjF,mEAAmE;QACnE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE;YAC1C,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SAC7E,CAAC,CAAA;QAEF,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAEnD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;IAChF,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE;IAC5C,WAAW,EAAE,gBAAgB;IAC7B,aAAa,EAAE,eAAe;IAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IAC1B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;QACvB,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAE9D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,EAAE;IACrD,WAAW,EAAE,gBAAgB;IAC7B,KAAK,EAAE;QACL,KAAK,EAAE,WAAW,EAAE;QACpB,IAAI,EAAE,MAAM,EAAE;QACd,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAClC;IACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,IAAI;YACJ,YAAY,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC;YAC1C,MAAM,EAAE,IAAI;SACb,CAAC,CAAA;QAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAA;YAEvD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2BAA2B,QAAQ,GAAG,EAAE;oBAC9E,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,OAAO,CAAC,MAAM,CAAC;YACb,UAAU,EAAE,gBAAgB;YAC5B,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;SACrB,CAAC,CAAA;QACF,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAEtD,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;IACxB,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB,EAAE;IACnD,WAAW,EAAE,qBAAqB;IAClC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;IACzC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;IAC1C,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;QAEpD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2BAA2B,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9F,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;QAEzF,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAE1E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,oBAAoB,EAAE;IAC1D,WAAW,EAAE,iEAAiE;IAC9E,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,EAAE;QACd,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE;QACzB,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE;KAClC;IACD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;IACvC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAE3C,OAAO,cAAc,CAAC;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACzE,CAAC,CAAA;IACJ,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,EAAE;IACvD,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;IACzF,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAE3C,OAAO,WAAW,CAAC;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;SAC/E,CAAC,CAAA;IACJ,CAAC;CACF,CAAC,CAAA;AAEF,0FAA0F;AAC1F,MAAM,SAAS,GAAG,KAAK,EACrB,IAA6B,EAC7B,IAAY,EACZ,EAAU,EACV,eAAmC,EACvB,EAAE;IACd,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAA;IAE1B,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAErD,IAAI,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACvE,MAAM,IAAI,aAAa,CAAC,QAAQ,IAAI,gCAAgC,EAAE;YACpE,eAAe;YACf,cAAc,EAAE,KAAK,CAAC,OAAO;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,EAAE;IACrD,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE;QACL,EAAE,EAAE,IAAI,EAAE;QACV,eAAe,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9C,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChC,KAAK,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE;QAC/B,MAAM,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC7B;IACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;IACnD,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE;QACtE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QAE5B,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QAEvD,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC;SAC1B,CAAC,CAAA;QAEF,OAAO,CAAC,MAAM,CAAC;YACb,UAAU,EAAE,gBAAgB;YAC5B,QAAQ,EAAE,EAAE;YACZ,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;SACrB,CAAC,CAAA;QAEF,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IACtC,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,qBAAqB,EAAE;IACxD,WAAW,EAAE,kEAAkE;IAC/E,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;IACjD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAEhC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAEtD,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAE9D,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,CAAA;QAE5F,4EAA4E;QAC5E,qDAAqD;QACrD,OAAO,EAAE,EAAE,EAAE,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,EAAE;IACrD,WAAW,EAAE,+BAA+B;IAC5C,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;IACzC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;IAC1C,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;QAEpD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2BAA2B,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9F,CAAC;QAED,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAEjE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;QAErF,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QAEtC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,EAAE;IACrD,WAAW,EAAE,+CAA+C;IAC5D,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;IACtF,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;IACtC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE;QACtD,MAAM,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAErC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,kCAAkC,IAAI,GAAG,EAAE;gBAChF,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;QAE3D,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAElC,OAAO,CAAC,MAAM,CAAC;YACb,UAAU,EAAE,gBAAgB;YAC5B,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;SACrB,CAAC,CAAA;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IACzC,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,EAAE;IACrD,WAAW,EAAE,uDAAuD;IACpE,KAAK,EAAE;QACL,EAAE,EAAE,IAAI,EAAE;QACV,eAAe,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9C,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxC;IACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;IACnD,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE;QACrE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QAE5B,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QAEvD,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAEpE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,CAAA;QAE3F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;YAEhF,MAAM,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAC/B,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAE5F,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IACtC,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,EAAE;IACrD,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAEhC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAEtD,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAE9D,KAAK,MAAM,IAAI,IAAI,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QAChF,KAAK,MAAM,IAAI,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QAE1E,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QAEnB,OAAO,EAAE,EAAE,EAAE,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,oBAAoB,EAAE;IAC1D,WAAW,EAAE,kDAAkD;IAC/D,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAErC,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAExD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QACpF,MAAM,KAAK,CAAC,MAAM,EAAE,CAAA;QAEpB,OAAO,EAAE,EAAE,EAAE,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,EAAE;IACvD,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE;QACL,EAAE,EAAE,IAAI,EAAE;QACV,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvC,OAAO,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC9B;IACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC1C,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE;QACnE,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAEpE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAElC,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAA;QAE7B,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QAExD,MAAM,KAAK,CAAC,MAAM,CAAC;YACjB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC,CAAA;QAEF,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAE9F,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IACvC,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE;IAC7C,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI;CACnB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM;IACN,OAAO;IACP,UAAU;IACV,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;CACH,CAAA"}