@bevel-software/platform-core-backend 0.1.0 → 0.2.0

package/dist/core/create-core-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-core-server.d.ts","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AAOzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAChD,+EAA+E;IAC/E,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,mFAAmF;IACnF,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACpD;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,SAAS,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACtD,2EAA2E;IAC3E,MAAM,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;CACpD;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,YAAY,EAClB,GAAG,GAAE,gBAAqB,EAC1B,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,UAAU,CAAC,CAqPrB"}
+{"version":3,"file":"create-core-server.d.ts","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AAQzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAChD,+EAA+E;IAC/E,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,mFAAmF;IACnF,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACpD;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,SAAS,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACtD,2EAA2E;IAC3E,MAAM,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;CACpD;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,YAAY,EAClB,GAAG,GAAE,gBAAqB,EAC1B,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,UAAU,CAAC,CAkQrB"}

package/dist/core/create-core-server.js

@@ -18,9 +18,20 @@ import { RECOVERY_BOT_EMAIL } from '../modules/workflow/recovery-bot.js';
 import { registerSkillsTools, createSkillsRoutes } from '../modules/skills/index.js';
 import { createSecretsVaultRoutes, createSecretsVaultPublicRoutes, } from '../modules/secrets-vault/index.js';
 import { createAdminAccessRoutes } from '../modules/admin/admin-access.routes.js';
+import { createAccountRoutes } from '../modules/auth/account.routes.js';
 import { GIT_SHA } from '../version.js';
 export async function createCoreServer(core, ext = {}, opts = {}) {
     const app = express();
+    // Honor forwarded client addresses ONLY when the deployment declares its
+    // proxy topology (TRUST_PROXY = hop count or CIDR list — see CoreConfig).
+    // Without it, `req.ip` is the socket peer: safe when directly exposed, but
+    // behind a proxy every client would share the proxy's address (pooling the
+    // per-IP login rate limit). A number is the hop count; anything else is
+    // passed through as Express's address/CIDR list form.
+    if (core.config.trustProxy) {
+        const raw = core.config.trustProxy;
+        app.set('trust proxy', /^\d+$/.test(raw) ? Number(raw) : raw);
+    }
     // `credentials: true` so EventSource (`withCredentials: true`) can carry
     // the `bevel_token` cookie set at login — the only auth path the
     // EventSource API supports. `origin: true` reflects the request origin
@@ -168,6 +179,8 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     // Admin-status resolver (CORE — see the note in admin-access.routes.ts;
     // the full admin router is an enterprise `ext.authed` extension).
     app.use('/api', core.authMiddleware, createAdminAccessRoutes(core.adminAccess));
+    // Account management (list/create password accounts) — admin-gated inside.
+    app.use('/api', core.authMiddleware, createAccountRoutes(core.authService, core.adminAccess));
     app.use('/api', core.authMiddleware, createToolManualsBrowserRoutes(core.toolManualService));
     app.use('/api', core.authMiddleware, createSecretsVaultRoutes(secretsVaultRoutesDeps));
     // The authed tail of the MCP OAuth flow: /connect calls these to describe

package/dist/core/create-core-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-core-server.js","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErF,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA2DxC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAkB,EAClB,MAAwB,EAAE,EAC1B,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,yEAAyE;IACzE,qDAAqD;IACrD,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC;QACH,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;KAC/E,CAAC,CACH,CAAC;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2BAA2B;IAC3B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,gEAAgE;IAChE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,gBAAgB,CACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACjC,CACF,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAC7B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,UAAU,CAChB,CAAC,CAAC;IAEH,qEAAqE;IACrE,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;QACpB,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAChD,iBAAiB,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACpE,eAAe,EAAE,CAAC,KAAK,CAAC;QACxB,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC,CAAC;IAEJ,sEAAsE;IACtE,6DAA6D;IAC7D,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEzB,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,sBAAsB,GAAG;QAC7B,YAAY,EAAE,IAAI,CAAC,mBAAmB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAClC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAC9C,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;KACjD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,mBAAmB,GAAG;QAC1B,OAAO,EAAE,IAAI,CAAC,sBAAsB;QACpC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;QACzC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAChC,gBAAgB,EAAE,kBAAkB;QACpC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK;KAClC,CAAC;IACF,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3L,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/E,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE;QACvF,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gFAAgF;QAChF,+EAA+E;QAC/E,cAAc,EAAE,IAAI,CAAC,mBAAmB;KACzC,CAAC,CAAC;IACH,+DAA+D;IAC/D,GAAG,CAAC,KAAK,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,EAAE;QACf,mBAAmB;QACnB,IAAI;KACL,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,8EAA8E;IAC9E,8EAA8E;IAC9E,wCAAwC;IACxC,WAAW,CAAC,GAAG,CAAC,4BAA4B,CAC1C,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE7B,qEAAqE;IACrE,wEAAwE;IACxE,sCAAsC;IACtC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3B,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,qBAAqB,CACxD,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,IAAI,CAAC,aAAa,CACnB,CAAC,CAAC;IACH,wEAAwE;IACxE,uEAAuE;IACvE,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,oBAAoB,CACvD,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,QAAQ,CACd,CAAC,CAAC;IACH,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CACnD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,CACrD,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5E,wEAAwE;IACxE,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,8BAA8B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7F,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACvF,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC;QAC5D,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;KACnC,CAAC,CAAC,CAAC;IAEJ,gCAAgC;IAChC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAExB,iDAAiD;IACjD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,uEAAuE;YACvE,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"create-core-server.js","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErF,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA2DxC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAkB,EAClB,MAAwB,EAAE,EAC1B,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,sDAAsD;IACtD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,yEAAyE;IACzE,qDAAqD;IACrD,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC;QACH,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;KAC/E,CAAC,CACH,CAAC;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2BAA2B;IAC3B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,gEAAgE;IAChE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,gBAAgB,CACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACjC,CACF,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAC7B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,UAAU,CAChB,CAAC,CAAC;IAEH,qEAAqE;IACrE,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;QACpB,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAChD,iBAAiB,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACpE,eAAe,EAAE,CAAC,KAAK,CAAC;QACxB,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC,CAAC;IAEJ,sEAAsE;IACtE,6DAA6D;IAC7D,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEzB,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,sBAAsB,GAAG;QAC7B,YAAY,EAAE,IAAI,CAAC,mBAAmB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAClC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAC9C,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;KACjD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,mBAAmB,GAAG;QAC1B,OAAO,EAAE,IAAI,CAAC,sBAAsB;QACpC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;QACzC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAChC,gBAAgB,EAAE,kBAAkB;QACpC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK;KAClC,CAAC;IACF,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3L,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/E,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE;QACvF,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gFAAgF;QAChF,+EAA+E;QAC/E,cAAc,EAAE,IAAI,CAAC,mBAAmB;KACzC,CAAC,CAAC;IACH,+DAA+D;IAC/D,GAAG,CAAC,KAAK,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,EAAE;QACf,mBAAmB;QACnB,IAAI;KACL,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,8EAA8E;IAC9E,8EAA8E;IAC9E,wCAAwC;IACxC,WAAW,CAAC,GAAG,CAAC,4BAA4B,CAC1C,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE7B,qEAAqE;IACrE,wEAAwE;IACxE,sCAAsC;IACtC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3B,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,qBAAqB,CACxD,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,IAAI,CAAC,aAAa,CACnB,CAAC,CAAC;IACH,wEAAwE;IACxE,uEAAuE;IACvE,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,oBAAoB,CACvD,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,QAAQ,CACd,CAAC,CAAC;IACH,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CACnD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,CACrD,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5E,wEAAwE;IACxE,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9F,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,8BAA8B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7F,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACvF,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC;QAC5D,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;KACnC,CAAC,CAAC,CAAC;IAEJ,gCAAgC;IAChC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAExB,iDAAiD;IACjD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,uEAAuE;YACvE,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/create-core-services.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-core-services.d.ts","sourceRoot":"","sources":["../../src/core/create-core-services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAS,KAAK,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAGzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,qBAAqB,EAGtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAGrF,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gEAAgE,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EACL,oBAAoB,EAErB,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AACtF,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAEjG,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAElF,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAEnF,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,EAAE,EAAE,QAAQ,CAAC;IACb,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,UAAU,EAAE,UAAU,CAAC;IACvB,aAAa,EAAE,oBAAoB,CAAC;IACpC,aAAa,EAAE,oBAAoB,CAAC;IACpC,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,kBAAkB,EAAE,yBAAyB,CAAC;IAC9C,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;IACxD,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,UAAU,EAAE,UAAU,CAAC;IACvB,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,WAAW,EAAE,WAAW,CAAC;IACzB,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,WAAW,EAAE,QAAQ,CAAC;IACtB,WAAW,EAAE,kBAAkB,CAAC;IAChC,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,UAAU,EAAE,UAAU,CAAC;IACvB,iBAAiB,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IAC9D,gBAAgB,EAAE,kBAAkB,CAAC;IACrC,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC;IAChE,oBAAoB,EAAE,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC;IACpE,kBAAkB,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC;IAEhE,sEAAsE;IACtE,WAAW,EAAE,YAAY,CAAC;IAC1B,iEAAiE;IACjE,UAAU,EAAE,cAAc,CAAC;IAC3B,4EAA4E;IAC5E,aAAa,EAAE,kBAAkB,EAAE,CAAC;CACrC;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,UAAU,EAClB,KAAK,GAAE,SAAc,GACpB,OAAO,CAAC,YAAY,CAAC,CA4XvB"}
+{"version":3,"file":"create-core-services.d.ts","sourceRoot":"","sources":["../../src/core/create-core-services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAS,KAAK,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAGzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAEnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,qBAAqB,EAGtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAGrF,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gEAAgE,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EACL,oBAAoB,EAErB,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AACzF,OAAO,EACL,oBAAoB,EAErB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAEjG,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAElF,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAEnF,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,EAAE,EAAE,QAAQ,CAAC;IACb,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,UAAU,EAAE,UAAU,CAAC;IACvB,aAAa,EAAE,oBAAoB,CAAC;IACpC,aAAa,EAAE,oBAAoB,CAAC;IACpC,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,kBAAkB,EAAE,yBAAyB,CAAC;IAC9C,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;IACxD,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,UAAU,EAAE,UAAU,CAAC;IACvB,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,WAAW,EAAE,WAAW,CAAC;IACzB,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,WAAW,EAAE,QAAQ,CAAC;IACtB,WAAW,EAAE,kBAAkB,CAAC;IAChC,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,UAAU,EAAE,UAAU,CAAC;IACvB,iBAAiB,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IAC9D,gBAAgB,EAAE,kBAAkB,CAAC;IACrC,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC;IAChE,oBAAoB,EAAE,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC;IACpE,kBAAkB,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC;IAEhE,sEAAsE;IACtE,WAAW,EAAE,YAAY,CAAC;IAC1B,iEAAiE;IACjE,UAAU,EAAE,cAAc,CAAC;IAC3B,4EAA4E;IAC5E,aAAa,EAAE,kBAAkB,EAAE,CAAC;CACrC;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,UAAU,EAClB,KAAK,GAAE,SAAc,GACpB,OAAO,CAAC,YAAY,CAAC,CAiavB"}

package/dist/core/create-core-services.js

@@ -9,6 +9,7 @@ import { SpillStore } from '../modules/workspace/spill-store.js';
 import { UuidSessionSink } from '../modules/workspace/session-sink.js';
 import { AuthService } from '../modules/auth/auth.service.js';
 import { AccountErasureService } from '../modules/auth/account-erasure.service.js';
+import { OidcAuthProvider } from '../modules/auth/oidc-auth-provider.js';
 import { createAuthMiddleware } from '../modules/auth/auth.middleware.js';
 import { AccessControlService } from '../modules/access/access-control.service.js';
 import { CreatorAccessService } from '../modules/access/creator-access.js';
@@ -32,7 +33,7 @@ import { PendingCommitsWorker, consoleSystemNoticeSink, } from '../modules/workf
 import { ensureRecoveryBotUser } from '../modules/workflow/recovery-bot.js';
 import { AdminAccessService } from '../modules/admin/admin-access.service.js';
 import { ExternalApiKeyService } from '../modules/tool-auth/external-api-key.service.js';
-import { InternalTokenService } from '../modules/tool-auth/internal-token.service.js';
+import { InternalTokenService, deriveInternalTokenSecret, } from '../modules/tool-auth/internal-token.service.js';
 import { createToolAuthMiddleware, createManualAuthMiddleware, } from '../modules/tool-auth/tool-auth.middleware.js';
 import { unmeteredLlmUsage } from '../modules/tool-auth/llm-usage-meter.js';
 import { McpSessionStore } from '../modules/mcp/mcp-session-store.js';
@@ -167,7 +168,10 @@ export async function createCoreServices(config, ports = {}) {
     });
     // Admin = `Admin` role in roles.yaml, resolved through the access model on the
     // default branch (no env allow-list).
-    const adminAccess = new AdminAccessService(accessControl, workspaceService, DEFAULT_BRANCH);
+    const adminAccess = new AdminAccessService(accessControl, workspaceService, DEFAULT_BRANCH, 
+    // The env bootstrap admin administers accounts/roles even before the KB's
+    // roles.yaml lists it (see AdminAccessService).
+    config.adminEmail ? [config.adminEmail] : []);
     // Secrets Vault: the per-user store of credentials (static API keys + OAuth
     // tokens) that back UTCP tool variables (`${FOO_API_KEY}`). Encrypted at rest
     // with the connector-config key; read only by the `bevel-secrets` variable
@@ -193,8 +197,17 @@ export async function createCoreServices(config, ports = {}) {
     toolManualService.setMcpAuthDiscovery(mcpOAuthDiscovery);
     // Least-privilege internal tokens: minted per (workspace, user, scope) by the
     // agents' code-mode clients and by the MCP proxy, verified by the tool-auth
-    // middleware below — the same instance must back both sides.
-    const internalTokenService = new InternalTokenService({ prefix: config.internalTokenPrefix });
+    // middleware below. The signing key is STABLE across processes sharing the
+    // deployment env (INTERNAL_TOKEN_SECRET, else derived from JWT_SECRET) so a
+    // sibling process — the enterprise routine CLI, a second replica — mints
+    // tokens this server verifies. Only a deployment with NO jwtSecret at all
+    // falls back to the per-boot random key (single-process smoke setups).
+    const internalTokenSecret = config.internalTokenSecret ||
+        (config.jwtSecret ? deriveInternalTokenSecret(config.jwtSecret) : undefined);
+    const internalTokenService = new InternalTokenService({
+        prefix: config.internalTokenPrefix,
+        secret: internalTokenSecret,
+    });
     // GDPR erasure path: admin-driven user deletion. The core service erases the
     // rows it owns; each module contributes its slice as a participant.
     const accountErasureService = new AccountErasureService(db, ports.erasureParticipants ?? []);
@@ -305,6 +318,23 @@ export async function createCoreServices(config, ports = {}) {
         },
     });
     pendingCommitsWorker.start();
+    // SSO providers. The array REFERENCE is shared with the caller's port — an
+    // overlay pushes its own plugins into it after construction (they mount when
+    // the server is built, later). Core contributes the generic OIDC provider
+    // when the env configures one.
+    const authProviders = ports.authProviders ?? [];
+    if (config.oidcIssuerUrl && config.oidcClientId && config.oidcClientSecret) {
+        authProviders.push(new OidcAuthProvider({
+            issuerUrl: config.oidcIssuerUrl,
+            clientId: config.oidcClientId,
+            clientSecret: config.oidcClientSecret,
+            scopes: config.oidcScopes,
+            label: config.oidcProviderLabel,
+            publicBackendUrl: config.publicBackendUrl,
+            publicFrontendUrl: config.publicFrontendUrl,
+            cookieSecure: config.publicBackendUrl.startsWith('https'),
+        }));
+    }
     return {
         config,
         db,
@@ -346,7 +376,7 @@ export async function createCoreServices(config, ports = {}) {
         // (or, for the array, pushes into) these after construction.
         sessionSink: ports.sessionSink ?? new UuidSessionSink(),
         usageMeter: ports.usageMeter ?? unmeteredLlmUsage,
-        authProviders: ports.authProviders ?? [],
+        authProviders,
     };
 }
 //# sourceMappingURL=create-core-services.js.map

package/dist/core/create-core-services.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-core-services.js","sourceRoot":"","sources":["../../src/core/create-core-services.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAE5G,OAAO,EAAE,KAAK,EAAiB,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAqB,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,kCAAkC,GACnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gEAAgE,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AACtF,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,yCAAyC,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAClF,OAAO,EAAE,oCAAoC,EAAE,MAAM,iDAAiD,CAAC;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAkB,MAAM,iBAAiB,CAAC;AA0DpE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,QAAmB,EAAE;IAErB,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,wEAAwE;IACxE,wEAAwE;IACxE,4EAA4E;IAC5E,6CAA6C;IAC7C,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,uEAAuE;IACvE,MAAM,iBAAiB,CAAC,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,CACnB,CAAC;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,4CAA4C;IAC5C,MAAM,aAAa,GAAG,IAAI,aAAa,CACrC,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,aAAa,EACpB,CAAC,GAAG,kBAAkB,CAAC,EACvB,cAAc,EACd,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,WAAW,CACnB,CAAC;IACF,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACnF,yEAAyE;IACzE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAElG,6EAA6E;IAC7E,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,wEAAwE;IACxE,kFAAkF;IAClF,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC3D,8EAA8E;IAC9E,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACzF,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACnG,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEzD,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,gBAAgB,EAChB,aAAa,EACb,MAAM,CAAC,SAAS,EAChB,cAAc,EACd,aAAa,CACd,CAAC;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,gBAAgB,CAAC,0BAA0B,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAC/C,EAAE,EACF,gBAAgB,EAChB,aAAa,EACb,UAAU,CACX,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,WAAW,CACjC,gBAAgB,EAChB,cAAc,EACd,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,SAAS,CACjB,CAAC;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,oEAAoE;IACpE,mEAAmE;IACnE,gBAAgB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CACrD,EAAE,EACF,aAAa,EACb,gBAAgB,EAChB,UAAU,CACX,CAAC;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,kBAAkB,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAE5D,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IAChD,kEAAkE;IAClE,uEAAuE;IACvE,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,kEAAkE;IAClE,UAAU,CAAC,sBAAsB,CAAC,CAAC,WAAW,EAAE,EAAE,CAChD,qBAAqB,CAAC,kBAAkB,CAAC,WAAW,CAAC,CACtD,CAAC;IACF,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,0EAA0E;IAC1E,yEAAyE;IACzE,8EAA8E;IAC9E,2CAA2C;IAC3C,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,EAAE,EACF,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,MAAM,CAAC,SAAS,EAChB,QAAQ,EACR,kBAAkB;IAClB,wEAAwE;IACxE,yEAAyE;IACzE,6BAA6B;IAC7B,aAAa,CACd,CAAC;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,gEAAgE;IAChE,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,4DAA4D;IAC5D,kBAAkB,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QACtD,IAAI,MAAM,KAAK,cAAc;YAAE,OAAO;QACtC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,GAAG,CAAC,CAAC;YAAE,iBAAiB,CAAC,UAAU,EAAE,CAAC;QACzG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,GAAG,CAAC,CAAC;YAAE,YAAY,CAAC,UAAU,EAAE,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,sCAAsC;IACtC,MAAM,WAAW,GAAG,IAAI,kBAAkB,CAAC,aAAa,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAE5F,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,IAAI,qBAAqB,CACnD,EAAE,EACF,MAAM,CAAC,aAAa,EACpB,SAAS;IACT,+EAA+E;IAC/E,2EAA2E;IAC3E,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,GAAG,CAAC,CAChD,CAAC;IACF,8EAA8E;IAC9E,gFAAgF;IAChF,kCAAkC,CAAC,mBAAmB,CAAC,CAAC;IAExD,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,iBAAiB,GAAG,IAAI,wBAAwB,CAAC;QACrD,YAAY,EAAE,mBAAmB;QACjC,WAAW,EAAE,GAAG,MAAM,CAAC,gBAAgB,6BAA6B;KACrE,CAAC,CAAC;IACH,iBAAiB,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAEzD,8EAA8E;IAC9E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAE9F,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAE7F,0EAA0E;IAC1E,gEAAgE;IAChE,wEAAwE;IACxE,6EAA6E;IAC7E,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACzF,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,eAAe,EACf;QACE,2EAA2E;QAC3E,4EAA4E;QAC5E,mCAAmC;QACnC,eAAe,EAAE,oBAAoB,MAAM,CAAC,IAAI,EAAE;QAClD,wEAAwE;QACxE,UAAU,EAAE,gBAAgB;QAC5B,0EAA0E;QAC1E,wEAAwE;QACxE,UAAU;QACV,sEAAsE;QACtE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,eAAe;IACf,mBAAmB,EACnB,iBAAiB;IACjB,uEAAuE;IACvE,4DAA4D;IAC5D,oBAAoB;IACpB,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CACzD,CAAC;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,kBAAkB,CAAC;QAC9C,EAAE;QACF,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;QAC3E,WAAW,EAAE,MAAM,CAAC,SAAS;QAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,mBAAmB;KACxC,CAAC,CAAC;IACH,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpE,MAAM,sBAAsB,GAAG,oCAAoC,CAAC,cAAc,CAAC,CAAC;IACpF,MAAM,iBAAiB,GAAG,uBAAuB,CAC/C,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,CACvB,CAAC;IAEF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IACxC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;QACnD,WAAW;QACX,gBAAgB;QAChB,eAAe;QACf,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa;KACd,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IACjG,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAElH,qEAAqE;IACrE,iEAAiE;IACjE,qEAAqE;IACrE,iCAAiC;IACjC,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAEpD,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,+DAA+D;IAC/D,EAAE;IACF,gEAAgE;IAChE,sEAAsE;IACtE,kEAAkE;IAClE,gEAAgE;IAChE,4CAA4C;IAC5C,MAAM,qBAAqB,CAAC,gBAAgB,CAC1C,gBAAgB,CAAC,eAAe,EAAE,EAClC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CACrD,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC;QACpD,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE;YACR,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACpD,eAAe,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;SACpE;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,6DAA6D;QAC7D,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,iBAAiB;QACvD,QAAQ,EAAE,KAAK,CAAC,YAAY,IAAI,uBAAuB;QACvD,UAAU,EAAE;YACV,eAAe,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,eAAe,EAAE;SAC1D;QACD,WAAW,EAAE;YACX,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB;KACF,CAAC,CAAC;IACH,oBAAoB,CAAC,KAAK,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM;QACN,EAAE;QACF,gBAAgB;QAChB,aAAa;QACb,UAAU;QACV,aAAa;QACb,aAAa;QACb,sBAAsB;QACtB,kBAAkB;QAClB,YAAY;QACZ,iBAAiB;QACjB,WAAW;QACX,cAAc;QACd,qBAAqB;QACrB,UAAU;QACV,kBAAkB;QAClB,WAAW;QACX,qBAAqB;QACrB,eAAe;QACf,eAAe;QACf,QAAQ;QACR,kBAAkB;QAClB,qBAAqB;QACrB,oBAAoB;QACpB,WAAW;QACX,WAAW;QACX,mBAAmB;QACnB,qBAAqB;QACrB,oBAAoB;QACpB,UAAU;QACV,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,kBAAkB;QAClB,oBAAoB;QACpB,kBAAkB;QAClB,uEAAuE;QACvE,6DAA6D;QAC7D,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,eAAe,EAAE;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,iBAAiB;QACjD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;KACzC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"create-core-services.js","sourceRoot":"","sources":["../../src/core/create-core-services.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAE5G,OAAO,EAAE,KAAK,EAAiB,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAqB,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,kCAAkC,GACnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gEAAgE,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AACzF,OAAO,EACL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,yCAAyC,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAClF,OAAO,EAAE,oCAAoC,EAAE,MAAM,iDAAiD,CAAC;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAkB,MAAM,iBAAiB,CAAC;AA0DpE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,QAAmB,EAAE;IAErB,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,wEAAwE;IACxE,wEAAwE;IACxE,4EAA4E;IAC5E,6CAA6C;IAC7C,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,uEAAuE;IACvE,MAAM,iBAAiB,CAAC,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,CACnB,CAAC;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,4CAA4C;IAC5C,MAAM,aAAa,GAAG,IAAI,aAAa,CACrC,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,aAAa,EACpB,CAAC,GAAG,kBAAkB,CAAC,EACvB,cAAc,EACd,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,WAAW,CACnB,CAAC;IACF,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACnF,yEAAyE;IACzE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAElG,6EAA6E;IAC7E,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,wEAAwE;IACxE,kFAAkF;IAClF,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC3D,8EAA8E;IAC9E,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACzF,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACnG,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEzD,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,gBAAgB,EAChB,aAAa,EACb,MAAM,CAAC,SAAS,EAChB,cAAc,EACd,aAAa,CACd,CAAC;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,gBAAgB,CAAC,0BAA0B,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAC/C,EAAE,EACF,gBAAgB,EAChB,aAAa,EACb,UAAU,CACX,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,WAAW,CACjC,gBAAgB,EAChB,cAAc,EACd,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,SAAS,CACjB,CAAC;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,oEAAoE;IACpE,mEAAmE;IACnE,gBAAgB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CACrD,EAAE,EACF,aAAa,EACb,gBAAgB,EAChB,UAAU,CACX,CAAC;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,kBAAkB,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAE5D,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IAChD,kEAAkE;IAClE,uEAAuE;IACvE,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,kEAAkE;IAClE,UAAU,CAAC,sBAAsB,CAAC,CAAC,WAAW,EAAE,EAAE,CAChD,qBAAqB,CAAC,kBAAkB,CAAC,WAAW,CAAC,CACtD,CAAC;IACF,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,0EAA0E;IAC1E,yEAAyE;IACzE,8EAA8E;IAC9E,2CAA2C;IAC3C,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,EAAE,EACF,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,MAAM,CAAC,SAAS,EAChB,QAAQ,EACR,kBAAkB;IAClB,wEAAwE;IACxE,yEAAyE;IACzE,6BAA6B;IAC7B,aAAa,CACd,CAAC;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,gEAAgE;IAChE,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,4DAA4D;IAC5D,kBAAkB,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QACtD,IAAI,MAAM,KAAK,cAAc;YAAE,OAAO;QACtC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,GAAG,CAAC,CAAC;YAAE,iBAAiB,CAAC,UAAU,EAAE,CAAC;QACzG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,GAAG,CAAC,CAAC;YAAE,YAAY,CAAC,UAAU,EAAE,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,sCAAsC;IACtC,MAAM,WAAW,GAAG,IAAI,kBAAkB,CACxC,aAAa,EACb,gBAAgB,EAChB,cAAc;IACd,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC;IAEF,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,IAAI,qBAAqB,CACnD,EAAE,EACF,MAAM,CAAC,aAAa,EACpB,SAAS;IACT,+EAA+E;IAC/E,2EAA2E;IAC3E,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,GAAG,CAAC,CAChD,CAAC;IACF,8EAA8E;IAC9E,gFAAgF;IAChF,kCAAkC,CAAC,mBAAmB,CAAC,CAAC;IAExD,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,iBAAiB,GAAG,IAAI,wBAAwB,CAAC;QACrD,YAAY,EAAE,mBAAmB;QACjC,WAAW,EAAE,GAAG,MAAM,CAAC,gBAAgB,6BAA6B;KACrE,CAAC,CAAC;IACH,iBAAiB,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAEzD,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,mBAAmB,GACvB,MAAM,CAAC,mBAAmB;QAC1B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC;QACpD,MAAM,EAAE,MAAM,CAAC,mBAAmB;QAClC,MAAM,EAAE,mBAAmB;KAC5B,CAAC,CAAC;IAEH,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAE7F,0EAA0E;IAC1E,gEAAgE;IAChE,wEAAwE;IACxE,6EAA6E;IAC7E,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACzF,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,eAAe,EACf;QACE,2EAA2E;QAC3E,4EAA4E;QAC5E,mCAAmC;QACnC,eAAe,EAAE,oBAAoB,MAAM,CAAC,IAAI,EAAE;QAClD,wEAAwE;QACxE,UAAU,EAAE,gBAAgB;QAC5B,0EAA0E;QAC1E,wEAAwE;QACxE,UAAU;QACV,sEAAsE;QACtE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,eAAe;IACf,mBAAmB,EACnB,iBAAiB;IACjB,uEAAuE;IACvE,4DAA4D;IAC5D,oBAAoB;IACpB,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CACzD,CAAC;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,kBAAkB,CAAC;QAC9C,EAAE;QACF,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;QAC3E,WAAW,EAAE,MAAM,CAAC,SAAS;QAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,mBAAmB;KACxC,CAAC,CAAC;IACH,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpE,MAAM,sBAAsB,GAAG,oCAAoC,CAAC,cAAc,CAAC,CAAC;IACpF,MAAM,iBAAiB,GAAG,uBAAuB,CAC/C,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,CACvB,CAAC;IAEF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IACxC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;QACnD,WAAW;QACX,gBAAgB;QAChB,eAAe;QACf,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa;KACd,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IACjG,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAElH,qEAAqE;IACrE,iEAAiE;IACjE,qEAAqE;IACrE,iCAAiC;IACjC,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAEpD,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,+DAA+D;IAC/D,EAAE;IACF,gEAAgE;IAChE,sEAAsE;IACtE,kEAAkE;IAClE,gEAAgE;IAChE,4CAA4C;IAC5C,MAAM,qBAAqB,CAAC,gBAAgB,CAC1C,gBAAgB,CAAC,eAAe,EAAE,EAClC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CACrD,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC;QACpD,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE;YACR,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACpD,eAAe,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;SACpE;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,6DAA6D;QAC7D,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,iBAAiB;QACvD,QAAQ,EAAE,KAAK,CAAC,YAAY,IAAI,uBAAuB;QACvD,UAAU,EAAE;YACV,eAAe,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,eAAe,EAAE;SAC1D;QACD,WAAW,EAAE;YACX,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB;KACF,CAAC,CAAC;IACH,oBAAoB,CAAC,KAAK,EAAE,CAAC;IAE7B,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC3E,aAAa,CAAC,IAAI,CAChB,IAAI,gBAAgB,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,QAAQ,EAAE,MAAM,CAAC,YAAY;YAC7B,YAAY,EAAE,MAAM,CAAC,gBAAgB;YACrC,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,KAAK,EAAE,MAAM,CAAC,iBAAiB;YAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC;SAC1D,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM;QACN,EAAE;QACF,gBAAgB;QAChB,aAAa;QACb,UAAU;QACV,aAAa;QACb,aAAa;QACb,sBAAsB;QACtB,kBAAkB;QAClB,YAAY;QACZ,iBAAiB;QACjB,WAAW;QACX,cAAc;QACd,qBAAqB;QACrB,UAAU;QACV,kBAAkB;QAClB,WAAW;QACX,qBAAqB;QACrB,eAAe;QACf,eAAe;QACf,QAAQ;QACR,kBAAkB;QAClB,qBAAqB;QACrB,oBAAoB;QACpB,WAAW;QACX,WAAW;QACX,mBAAmB;QACnB,qBAAqB;QACrB,oBAAoB;QACpB,UAAU;QACV,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,kBAAkB;QAClB,oBAAoB;QACpB,kBAAkB;QAClB,uEAAuE;QACvE,6DAA6D;QAC7D,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,eAAe,EAAE;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,iBAAiB;QACjD,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/core-config.d.ts

@@ -35,7 +35,32 @@ export declare class CoreConfig {
      */
     readonly spillRoot: string;
     readonly jwtSecret: string;
-    readonly testPassword: string;
+    /**
+     * Bootstrap admin credential, checked directly against the environment at
+     * login time (never stored). Lets a fresh deployment sign in before any
+     * account exists; that admin (or any user with the Admin role in
+     * `roles.yaml`) then creates per-user accounts from Roles & Members.
+     * Remove EITHER variable and the credential stops working immediately —
+     * accounts created in the database are unaffected. The email is also
+     * always recognized as an admin (see AdminAccessService), so a fresh KB
+     * whose `roles.yaml` doesn't list it yet is still administrable.
+     */
+    readonly adminEmail: string;
+    readonly adminPassword: string;
+    /**
+     * Generic OIDC single sign-on (any spec-compliant provider: Entra, Okta,
+     * Auth0, Keycloak, Google, …). Enabled when issuer URL + client id + client
+     * secret are ALL set; the issuer's `/.well-known/openid-configuration` is
+     * discovered at first use. The redirect URI to register with the provider is
+     * `<PUBLIC_BACKEND_URL>/api/auth/oidc/callback`.
+     */
+    readonly oidcIssuerUrl: string;
+    readonly oidcClientId: string;
+    readonly oidcClientSecret: string;
+    /** Space-separated scopes requested (default `openid profile email`). */
+    readonly oidcScopes: string;
+    /** Login-button label (default "Single sign-on"). */
+    readonly oidcProviderLabel: string;
     /** Clone/push URL for the KB repo. Any https git host (GitHub, GitLab, Bitbucket, Azure DevOps, self-hosted). */
     readonly kbRepoUrl: string;
     /** Directory name the KB lives under inside each user's workspace dir. */
@@ -98,6 +123,25 @@ export declare class CoreConfig {
      * saved (a clear error surfaces only when a secret is actually written/read).
      */
     readonly secretsEncKey: string;
+    /**
+     * Optional dedicated HMAC key for internal (loopback) tokens. Unset
+     * (default) → the composition root derives a domain-separated key from
+     * `JWT_SECRET`, so every process sharing the deployment env (the server,
+     * a routine CLI, a second replica) mints tokens the server verifies. Set
+     * `INTERNAL_TOKEN_SECRET` to rotate the internal tool surface's credential
+     * independently of user sessions.
+     */
+    readonly internalTokenSecret: string;
+    /**
+     * Express `trust proxy` setting, from `TRUST_PROXY`: the number of reverse
+     * proxy hops in front of this backend (e.g. `1`), or an address/CIDR list
+     * (`loopback`, `10.0.0.0/8`). Unset (default) → forwarded headers are
+     * IGNORED and `req.ip` is the socket peer — correct for direct exposure,
+     * but behind a proxy it makes every client share the proxy's IP (so the
+     * per-IP login rate limit would pool all users). Set it to the actual hop
+     * count — never a blanket trust — so clients can't spoof X-Forwarded-For.
+     */
+    readonly trustProxy: string;
     /**
      * Public base URL of THIS backend, used to build OAuth redirect URIs.
      * Must match a redirect URI registered with the OAuth provider(s).

package/dist/core-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-config.d.ts","sourceRoot":"","sources":["../src/core-config.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iHAAiH;IACjH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;;IA8FnC,mEAAmE;IACnE,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,mEAAmE;IACnE,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,uEAAuE;IACvE,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,2DAA2D;IAC3D,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,OAAO,CAAC,kBAAkB;CA4B3B"}
+{"version":3,"file":"core-config.d.ts","sourceRoot":"","sources":["../src/core-config.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,iHAAiH;IACjH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;;IAiHnC,mEAAmE;IACnE,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,mEAAmE;IACnE,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,uEAAuE;IACvE,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,2DAA2D;IAC3D,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,OAAO,CAAC,kBAAkB;CA4B3B"}

package/dist/core-config.js

@@ -41,7 +41,32 @@ export class CoreConfig {
      */
     spillRoot;
     jwtSecret;
-    testPassword;
+    /**
+     * Bootstrap admin credential, checked directly against the environment at
+     * login time (never stored). Lets a fresh deployment sign in before any
+     * account exists; that admin (or any user with the Admin role in
+     * `roles.yaml`) then creates per-user accounts from Roles & Members.
+     * Remove EITHER variable and the credential stops working immediately —
+     * accounts created in the database are unaffected. The email is also
+     * always recognized as an admin (see AdminAccessService), so a fresh KB
+     * whose `roles.yaml` doesn't list it yet is still administrable.
+     */
+    adminEmail;
+    adminPassword;
+    /**
+     * Generic OIDC single sign-on (any spec-compliant provider: Entra, Okta,
+     * Auth0, Keycloak, Google, …). Enabled when issuer URL + client id + client
+     * secret are ALL set; the issuer's `/.well-known/openid-configuration` is
+     * discovered at first use. The redirect URI to register with the provider is
+     * `<PUBLIC_BACKEND_URL>/api/auth/oidc/callback`.
+     */
+    oidcIssuerUrl;
+    oidcClientId;
+    oidcClientSecret;
+    /** Space-separated scopes requested (default `openid profile email`). */
+    oidcScopes;
+    /** Login-button label (default "Single sign-on"). */
+    oidcProviderLabel;
     /** Clone/push URL for the KB repo. Any https git host (GitHub, GitLab, Bitbucket, Azure DevOps, self-hosted). */
     kbRepoUrl;
     /** Directory name the KB lives under inside each user's workspace dir. */
@@ -104,6 +129,25 @@ export class CoreConfig {
      * saved (a clear error surfaces only when a secret is actually written/read).
      */
     secretsEncKey;
+    /**
+     * Optional dedicated HMAC key for internal (loopback) tokens. Unset
+     * (default) → the composition root derives a domain-separated key from
+     * `JWT_SECRET`, so every process sharing the deployment env (the server,
+     * a routine CLI, a second replica) mints tokens the server verifies. Set
+     * `INTERNAL_TOKEN_SECRET` to rotate the internal tool surface's credential
+     * independently of user sessions.
+     */
+    internalTokenSecret;
+    /**
+     * Express `trust proxy` setting, from `TRUST_PROXY`: the number of reverse
+     * proxy hops in front of this backend (e.g. `1`), or an address/CIDR list
+     * (`loopback`, `10.0.0.0/8`). Unset (default) → forwarded headers are
+     * IGNORED and `req.ip` is the socket peer — correct for direct exposure,
+     * but behind a proxy it makes every client share the proxy's IP (so the
+     * per-IP login rate limit would pool all users). Set it to the actual hop
+     * count — never a blanket trust — so clients can't spoof X-Forwarded-For.
+     */
+    trustProxy;
     /**
      * Public base URL of THIS backend, used to build OAuth redirect URIs.
      * Must match a redirect URI registered with the OAuth provider(s).
@@ -123,7 +167,25 @@ export class CoreConfig {
         this.backupsRoot = process.env.BACKUPS_ROOT || path.resolve(this.workspacesRoot, '..', 'backups');
         this.spillRoot = process.env.SPILL_ROOT || path.resolve(this.workspacesRoot, '..', 'tool-chain-spills');
         this.jwtSecret = process.env.JWT_SECRET || '';
-        this.testPassword = process.env.TEST_PASSWORD || '';
+        this.adminEmail = (process.env.ADMIN_EMAIL || '').trim().toLowerCase();
+        this.adminPassword = process.env.ADMIN_PASSWORD || '';
+        if (this.adminEmail && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(this.adminEmail)) {
+            throw new Error(`ADMIN_EMAIL is not a valid email: "${this.adminEmail}"`);
+        }
+        this.oidcIssuerUrl = (process.env.OIDC_ISSUER_URL || '').trim().replace(/\/+$/, '');
+        this.oidcClientId = (process.env.OIDC_CLIENT_ID || '').trim();
+        this.oidcClientSecret = (process.env.OIDC_CLIENT_SECRET || '').trim();
+        this.oidcScopes = (process.env.OIDC_SCOPES || 'openid profile email').trim();
+        this.oidcProviderLabel = (process.env.OIDC_PROVIDER_LABEL || 'Single sign-on').trim();
+        if (this.oidcIssuerUrl) {
+            // Parse-validate so a typo'd issuer fails at boot, not at first login.
+            try {
+                new URL(this.oidcIssuerUrl);
+            }
+            catch {
+                throw new Error(`OIDC_ISSUER_URL is not a valid URL: "${this.oidcIssuerUrl}"`);
+            }
+        }
         // No default: the KB repo is deployment-specific, and a wrong fallback
         // would surface much later as a confusing clone failure. Fail at boot.
         this.kbRepoUrl = (process.env.KB_REPO_URL || '').trim();
@@ -165,6 +227,8 @@ export class CoreConfig {
             process.env.CONNECTOR_CONFIG_ENC_KEY ||
             process.env.SHAREPOINT_TOKEN_ENC_KEY ||
             '').trim();
+        this.internalTokenSecret = (process.env.INTERNAL_TOKEN_SECRET || '').trim();
+        this.trustProxy = (process.env.TRUST_PROXY || '').trim();
         this.publicBackendUrl = (process.env.PUBLIC_BACKEND_URL || `http://localhost:${this.port}`)
             .trim()
             .replace(/\/+$/, '');

package/dist/core-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-config.js","sourceRoot":"","sources":["../src/core-config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,OAAO,CAAS;IACzB;;;;;;;OAOG;IACM,QAAQ,CAAS;IACjB,cAAc,CAAS;IAChC;;;;;;OAMG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,YAAY,CAAS;IAC9B,iHAAiH;IACxG,SAAS,CAAS;IAC3B,0EAA0E;IACjE,SAAS,CAAS;IAC3B;;;;;;;OAOG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,aAAa,CAAS;IAC/B;;;;;OAKG;IACM,eAAe,CAAW;IACnC;;;;;;;;;OASG;IACM,oBAAoB,CAAU;IACvC;;;;;OAKG;IACM,oBAAoB,CAAU;IACvC;;;;;;OAMG;IACM,mBAAmB,CAAW;IACvC;;;;;;;OAOG;IACM,aAAa,CAAS;IAC/B;;;OAGG;IACM,gBAAgB,CAAS;IAClC,4EAA4E;IACnE,iBAAiB,CAAS;IAEnC;QACE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,+CAA+C,CAAC;QAC/F,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,kEAAkE,IAAI,CAAC,QAAQ,GAAG,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/F,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;QACpD,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,gBAAgB,CAAC;QAC7D,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,8EAA8E;QAC9E,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3F,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,CAAC,WAAW,GAAG,CAC7F,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC3E,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACzD,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAClF,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAC1E,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;aACjE,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,CACnB,OAAO,CAAC,GAAG,CAAC,eAAe;YAC3B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;aACxF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;aAClF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;YAC1B,CAAC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7C,CAAC,qBAAqB,EAAE,IAAI,CAAC,iBAAiB,CAAC;SACvC,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,GAAG,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,IAAI,oBAAoB;QACtB,OAAO,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;IAC7B,CAAC;IAED,mEAAmE;IACnE,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAED,uEAAuE;IACvE,IAAI,iBAAiB;QACnB,OAAO,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;IAChC,CAAC;IAED,2DAA2D;IAC3D,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAEO,kBAAkB;QACxB,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,8EAA8E;QAC9E,4BAA4B;QAC5B,IACE,CAAC,IAAI,CAAC,SAAS;YACf,IAAI,CAAC,SAAS,KAAK,GAAG;YACtB,IAAI,CAAC,SAAS,KAAK,IAAI;YACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"core-config.js","sourceRoot":"","sources":["../src/core-config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,OAAO,CAAS;IACzB;;;;;;;OAOG;IACM,QAAQ,CAAS;IACjB,cAAc,CAAS;IAChC;;;;;;OAMG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,SAAS,CAAS;IAClB,SAAS,CAAS;IAC3B;;;;;;;;;OASG;IACM,UAAU,CAAS;IACnB,aAAa,CAAS;IAC/B;;;;;;OAMG;IACM,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,gBAAgB,CAAS;IAClC,yEAAyE;IAChE,UAAU,CAAS;IAC5B,qDAAqD;IAC5C,iBAAiB,CAAS;IACnC,iHAAiH;IACxG,SAAS,CAAS;IAC3B,0EAA0E;IACjE,SAAS,CAAS;IAC3B;;;;;;;OAOG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,aAAa,CAAS;IAC/B;;;;;OAKG;IACM,eAAe,CAAW;IACnC;;;;;;;;;OASG;IACM,oBAAoB,CAAU;IACvC;;;;;OAKG;IACM,oBAAoB,CAAU;IACvC;;;;;;OAMG;IACM,mBAAmB,CAAW;IACvC;;;;;;;OAOG;IACM,aAAa,CAAS;IAC/B;;;;;;;OAOG;IACM,mBAAmB,CAAS;IACrC;;;;;;;;OAQG;IACM,UAAU,CAAS;IAC5B;;;OAGG;IACM,gBAAgB,CAAS;IAClC,4EAA4E;IACnE,iBAAiB,CAAS;IAEnC;QACE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,+CAA+C,CAAC;QAC/F,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,kEAAkE,IAAI,CAAC,QAAQ,GAAG,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/F,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACtD,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,uEAAuE;YACvE,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,gBAAgB,CAAC;QAC7D,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,8EAA8E;QAC9E,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3F,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,CAAC,WAAW,GAAG,CAC7F,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC3E,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACzD,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAClF,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAC1E,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;aACjE,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,CACnB,OAAO,CAAC,GAAG,CAAC,eAAe;YAC3B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;aACxF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;aAClF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;YAC1B,CAAC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7C,CAAC,qBAAqB,EAAE,IAAI,CAAC,iBAAiB,CAAC;SACvC,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,GAAG,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,IAAI,oBAAoB;QACtB,OAAO,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;IAC7B,CAAC;IAED,mEAAmE;IACnE,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAED,uEAAuE;IACvE,IAAI,iBAAiB;QACnB,OAAO,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;IAChC,CAAC;IAED,2DAA2D;IAC3D,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAEO,kBAAkB;QACxB,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,8EAA8E;QAC9E,4BAA4B;QAC5B,IACE,CAAC,IAAI,CAAC,SAAS;YACf,IAAI,CAAC,SAAS,KAAK,GAAG;YACtB,IAAI,CAAC,SAAS,KAAK,IAAI;YACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}

package/dist/modules/admin/admin-access.service.d.ts

@@ -16,9 +16,25 @@ export declare class AdminAccessService implements IAdminAccessService {
     private readonly workspaceService;
     /** Branch whose `roles.yaml` defines admins (the authoritative default branch). */
     private readonly branch;
+    /**
+     * Emails treated as admin WITHOUT consulting `roles.yaml` — the env
+     * bootstrap admin (`ADMIN_EMAIL`). A fresh deployment's KB may not list
+     * that email yet, and the bootstrap credential must be able to administer
+     * accounts/roles regardless; membership here tracks the env var, so
+     * removing the var removes the privilege.
+     */
+    private readonly alwaysAdminEmails;
     constructor(accessControl: IAccessControl, workspaceService: WorkspaceService, 
     /** Branch whose `roles.yaml` defines admins (the authoritative default branch). */
-    branch: string);
+    branch: string, 
+    /**
+     * Emails treated as admin WITHOUT consulting `roles.yaml` — the env
+     * bootstrap admin (`ADMIN_EMAIL`). A fresh deployment's KB may not list
+     * that email yet, and the bootstrap credential must be able to administer
+     * accounts/roles regardless; membership here tracks the env var, so
+     * removing the var removes the privilege.
+     */
+    alwaysAdminEmails?: string[]);
     isAdmin(email: string | undefined): Promise<boolean>;
 }
 //# sourceMappingURL=admin-access.service.d.ts.map

package/dist/modules/admin/admin-access.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-access.service.d.ts","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,KAAK,gBAAgB,EAAwB,MAAM,mCAAmC,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAE1D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB;IACnD,mFAAmF;IAClE,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;CAe3D"}
+{"version":3,"file":"admin-access.service.d.ts","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,KAAK,gBAAgB,EAAwB,MAAM,mCAAmC,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAE1D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAXjB,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB;IACnD,mFAAmF;IAClE,MAAM,EAAE,MAAM;IAC/B;;;;;;OAMG;IACc,iBAAiB,GAAE,MAAM,EAAO;IAG7C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;CAiB3D"}

package/dist/modules/admin/admin-access.service.js

@@ -13,16 +13,29 @@ export class AdminAccessService {
     accessControl;
     workspaceService;
     branch;
+    alwaysAdminEmails;
     constructor(accessControl, workspaceService, 
     /** Branch whose `roles.yaml` defines admins (the authoritative default branch). */
-    branch) {
+    branch, 
+    /**
+     * Emails treated as admin WITHOUT consulting `roles.yaml` — the env
+     * bootstrap admin (`ADMIN_EMAIL`). A fresh deployment's KB may not list
+     * that email yet, and the bootstrap credential must be able to administer
+     * accounts/roles regardless; membership here tracks the env var, so
+     * removing the var removes the privilege.
+     */
+    alwaysAdminEmails = []) {
         this.accessControl = accessControl;
         this.workspaceService = workspaceService;
         this.branch = branch;
+        this.alwaysAdminEmails = alwaysAdminEmails;
     }
     async isAdmin(email) {
         if (!email)
             return false;
+        const normalized = email.trim().toLowerCase();
+        if (this.alwaysAdminEmails.includes(normalized))
+            return true;
         try {
             // Ensure the authoritative clone is on disk, then resolve Admin-role
             // membership via the access model. Any failure (missing/invalid

package/dist/modules/admin/admin-access.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-access.service.js","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGhG;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAEV;IACA;IAEA;IAJnB,YACmB,aAA6B,EAC7B,gBAAkC;IACnD,mFAAmF;IAClE,MAAc;QAHd,kBAAa,GAAb,aAAa,CAAgB;QAC7B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAElC,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,qEAAqE;YACrE,gEAAgE;YAChE,uEAAuE;YACvE,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9D,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,2CAA2C;YAC3C,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACrG,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"admin-access.service.js","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGhG;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAEV;IACA;IAEA;IAQA;IAZnB,YACmB,aAA6B,EAC7B,gBAAkC;IACnD,mFAAmF;IAClE,MAAc;IAC/B;;;;;;OAMG;IACc,oBAA8B,EAAE;QAXhC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAElC,WAAM,GAAN,MAAM,CAAQ;QAQd,sBAAiB,GAAjB,iBAAiB,CAAe;IAChD,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC;YACH,qEAAqE;YACrE,gEAAgE;YAChE,uEAAuE;YACvE,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9D,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,2CAA2C;YAC3C,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACrG,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/modules/auth/account.routes.d.ts

@@ -0,0 +1,17 @@
+import express from 'express';
+import type { AuthService } from './auth.service.js';
+import type { IAdminAccessService } from '../admin/admin.interface.js';
+import './auth.middleware.js';
+/**
+ * Admin account management (Roles & Members → Accounts): list accounts and
+ * create/reset password accounts. Gated per request by
+ * {@link IAdminAccessService} — the Admin role in `roles.yaml`, plus the env
+ * bootstrap admin (always-admin, see AdminAccessService).
+ *
+ * Deliberately namespaced `/admin/accounts` (not `/admin/users`): the
+ * enterprise overlay mounts its own richer user administration (listing with
+ * activity, GDPR erasure) at `/admin/users`, and the two must not shadow each
+ * other across mount phases.
+ */
+export declare function createAccountRoutes(authService: AuthService, adminAccess: IAdminAccessService): express.Router;
+//# sourceMappingURL=account.routes.d.ts.map

package/dist/modules/auth/account.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,mBAAmB,GAC/B,OAAO,CAAC,MAAM,CAuChB"}

package/dist/modules/auth/account.routes.js

@@ -0,0 +1,47 @@
+import express from 'express';
+import './auth.middleware.js'; // Express Request augmentation
+/**
+ * Admin account management (Roles & Members → Accounts): list accounts and
+ * create/reset password accounts. Gated per request by
+ * {@link IAdminAccessService} — the Admin role in `roles.yaml`, plus the env
+ * bootstrap admin (always-admin, see AdminAccessService).
+ *
+ * Deliberately namespaced `/admin/accounts` (not `/admin/users`): the
+ * enterprise overlay mounts its own richer user administration (listing with
+ * activity, GDPR erasure) at `/admin/users`, and the two must not shadow each
+ * other across mount phases.
+ */
+export function createAccountRoutes(authService, adminAccess) {
+    const router = express.Router();
+    const requireAdmin = async (req, res, next) => {
+        if (!(await adminAccess.isAdmin(req.userEmail))) {
+            res.status(403).json({ error: 'Admins only' });
+            return;
+        }
+        next();
+    };
+    // GET /api/admin/accounts — id, email, name, whether a password is set.
+    router.get('/admin/accounts', requireAdmin, async (_req, res) => {
+        res.json({ accounts: await authService.listAccounts() });
+    });
+    // POST /api/admin/accounts { email, name?, password } — create an account
+    // (or reset the password of an existing one; upsert-by-email is deliberate,
+    // see AuthService.createAccount).
+    router.post('/admin/accounts', requireAdmin, async (req, res) => {
+        const { email, name, password } = req.body;
+        if (!email || !password) {
+            res.status(400).json({ error: 'email and password are required' });
+            return;
+        }
+        try {
+            const user = await authService.createAccount(email, name, password);
+            res.status(201).json(user);
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : 'Unknown error';
+            res.status(400).json({ error: msg });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=account.routes.js.map

package/dist/modules/auth/account.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAwB,EACxB,WAAgC;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAIrC,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/auth/auth.routes.d.ts

@@ -8,16 +8,22 @@ import type { AuthService } from './auth.service.js';
  */
 export declare const AUTH_COOKIE_MAX_AGE_S: number;
 /**
- * A pluggable SSO login method. Core ships password login only; the
- * composition root passes provider plugins (e.g. Microsoft OIDC, owned by the
- * sharepoint module) which mount their own routes under `/auth/<key>/…` and
- * are advertised to the login screen under `key` by the capability probe.
- * A plugin is only passed in when its machinery is configured AND the
- * instance hasn't switched it off — presence means enabled.
+ * A pluggable SSO login method. Core ships password login and (when
+ * configured) the generic OIDC provider; overlays may pass additional plugins
+ * (e.g. the enterprise "Sign in with Microsoft", owned by its sharepoint
+ * module). A plugin mounts its own routes under `/auth/<key>/…` and is
+ * advertised to the login screen by the capability probe, which renders one
+ * button per provider from `label` + `startPath`. A plugin is only present
+ * when its machinery is configured AND the instance hasn't switched it off —
+ * presence means enabled.
  */
 export interface AuthProviderPlugin {
-    /** Probe key + route namespace (e.g. 'microsoft' → /auth/microsoft/…). */
+    /** Probe key + route namespace (e.g. 'oidc' → /auth/oidc/…). */
     readonly key: string;
+    /** Login-button label (e.g. "Sign in with Microsoft"). */
+    readonly label: string;
+    /** Browser navigation target that starts the flow (e.g. '/api/auth/oidc/login'). */
+    readonly startPath: string;
     /** Mount the provider's routes (login redirect, callback) on the auth router. */
     mountRoutes(router: express.Router, authService: AuthService): void;
 }