@boopkit/cap-users 0.4.4 → 0.6.0

package/README.md

@@ -14,7 +14,7 @@ Copied into your project on install:
 - `prisma/schema/accounts.prisma` — `Account`, `AccountUser`, `AccountProperty` models
 - `src/services/users.service.ts` — wires `userService`, `identityService`, `userPropertyService`, `authService` to Prisma
 - `src/services/accounts.service.ts` — wires `accountService`, `accountPropertyService`, `accountManagementService`, `teamInvitationService`
-- `src/middleware/auth.ts` — `ensureVisitor`, `addAuthContext`, `requireAuth` middleware instances
+- `src/middleware/auth.ts` — `resolveVisitor`, `resolveBearer`, `addAuthContext`, `requireAuth`, `requireApiKey` middleware instances
 - `src/controllers/auth.ts` — signup, login, logout, forget-device controllers
 - `src/routes/auth.ts` — Express router mounting `/signup`, `/login`, `/logout`, `/logout/forget`
 - `views/signup.hbs`, `views/login.hbs`, `views/partials/auth-nav.hbs` — auth views and nav partial
@@ -27,18 +27,18 @@ Wired into `src/server.ts` at install time:
 
 ```ts
 import cookieParser from 'cookie-parser';
-import { ensureVisitor, addAuthContext, authRoutes } from './middleware/auth';
+import { resolveVisitor, addAuthContext, authRoutes } from './middleware/auth';
 import AccountService from './services/accounts.service';
 
 // ...
 
 app.use(cookieParser());   // order 14
-app.use(ensureVisitor);    // order 15 — resolve session from auth_id cookie
+app.use(resolveVisitor);   // order 15 — resolve session from auth_id cookie
 app.use(addAuthContext);   // order 16 — populate res.locals.auth for views
 app.use(authRoutes);       // order 52 — mount /signup, /login, /logout
 ```
 
-`middleware/auth.ts` imports `UserService` transitively and builds the middleware + router from it, so the wiring stays in one place. `ensureVisitor` runs on every request; if the `auth_id` cookie is missing or stale it creates an anonymous `User` with a fresh session — every visitor has an identity from their first request, whether they've signed up or not. Login upgrades the trust tier on the same underlying user.
+`middleware/auth.ts` imports `UserService` transitively and builds the middleware + router from it, so the wiring stays in one place. `resolveVisitor` runs on every request and is read-only: if the `auth_id` cookie is missing or stale, `req.user` simply stays undefined, so anonymous traffic does not mint user records. Write paths that need a persisted visitor — waitlist capture, signup, onboarding — call `getOrCreateUser(req, res)` explicitly, which mints the user and sets the cookies and is idempotent if `resolveVisitor` already resolved one. Login upgrades the trust tier on the same underlying user.
 
 ### Skills installed
 
@@ -104,20 +104,56 @@ export default router;
 
 Unauthenticated web requests are redirected to `/login?next=<original-url>`. API requests (paths under `/api/`) get a `401 { error: 'Unauthorized' }` response instead.
 
+**Authenticating an API request.** `requireAuth` gates; it does not authenticate a caller who has no cookie. For that, mount `resolveBearer` on the API router, which reads `Authorization: Bearer <api-key>` and sets the same `req.user` the cookie path yields:
+
+```ts
+// src/routes/api.ts
+import { resolveBearer, requireAuth } from '../middleware/auth';
+
+router.use(resolveBearer);                    // authenticate the token, if one is sent
+router.get('/me', requireAuth(), api.me);     // then gate as usual
+```
+
+Three outcomes, and the middle one is the point:
+
+- **No `Authorization` header, or another scheme** — passes through with `req.user` untouched, so the same router can still serve anonymous traffic. Gating remains `requireAuth`'s job.
+- **A Bearer token that does not resolve** — `401 { error: 'invalid_token' }` with a `WWW-Authenticate: Bearer` challenge, rather than silent anonymity. A caller that presented a credential and got it wrong should be told, and it does **not** fall back to the session cookie: revoking a key has to stop the request even from a browser that still holds a session.
+- **A Bearer token that resolves** — `req.user` is set (plus `req.sessionToken`, the presented key, and `req.authStrategy = 'api-key'`), and everything downstream works without knowing which door the request came in. `requireAuth` reads both `req.user` and `req.sessionToken`, so setting the token is what lets the pairing above admit a valid key rather than redirect it to `/login`.
+
+**Requiring a key, not just any login.** The route above is door-agnostic: a browser with a valid session cookie satisfies `requireAuth` there without presenting a key, because `resolveVisitor` runs app-wide and populates `req.user` before the API router. For a route that must be reached *with an API key* — so that revoking or expiring the key stops it even for a user whose browser session is still alive — gate with `requireApiKey` instead:
+
+```ts
+// src/routes/api.ts
+import { resolveBearer, requireApiKey } from '../middleware/auth';
+
+router.use(resolveBearer);
+router.get('/integrations', requireApiKey(), api.integrations); // an API key, not a cookie
+```
+
+`requireApiKey` accepts the request only when `resolveBearer` resolved it from a key (`req.authStrategy === 'api-key'`), then runs the same `isAuthorized` grant check `requireAuth` does — so an expired per-key grant is refused here even though the key still resolves.
+
+Issue keys with `authService.createApiKey(userId)`, which returns the raw key once. Only `hashToken(apiKey)` is stored in `user_identities`, the same treatment a session cookie gets, so a read of that table hands nobody a working credential. Keys issued before this change were stored raw and will not resolve after it; reissue them.
+
+There is deliberately no route, screen, or command for minting a key. Handing out a credential that acts as a user is not a generic operation — who may do it, for whom, whether it needs a second factor or an approval, and what the audit trail looks like are answers only your application has, and a default affordance would answer them for you on the sensitive side. Wire `createApiKey` behind whatever authorization you already trust, and tell the holder at the moment you show it that the key cannot be retrieved again.
+
 **2.** Read the current user in a controller:
 
 ```ts
 // src/controllers/pages.ts
 import type { Request, Response } from 'express';
-import type { User, BaseUserInfo } from '@boopkit/cap-users';
 
 export function dashboard(req: Request, res: Response): void {
-  const user = (req as Request & { user: User<BaseUserInfo> }).user;
+  // req.user is typed — no cast. cap-users ships an Express request
+  // augmentation (src/types/express.ts) that declares req.user,
+  // req.sessionToken, req.visitorToken and req.authStrategy, so every handler
+  // sees the real User shape.
+  const user = req.user;
+  if (!user) { res.redirect('/login'); return; }
   res.render('dashboard', { email: user.info.email });
 }
 ```
 
-`req.user` is set by `ensureVisitor` on every request. For views, `res.locals.auth` is populated by `addAuthContext` with `trustTier`, `userName`, `userEmail`, and `userInitial` — the `auth-nav` partial uses these to show the right sign-in / sign-out affordances.
+`req.user` is set by `resolveVisitor` on every request, so the augmentation types it as optional — narrow it, or put the route behind `requireAuth`, before you read it. The typing arrives with the scaffold file `src/types/express.ts`, which your tsconfig compiles along with the rest of `src/`; there is no import to add. For views, `res.locals.auth` is populated by `addAuthContext` with `trustTier`, `userName`, `userEmail`, and `userInitial` — the `auth-nav` partial uses these to show the right sign-in / sign-out affordances.
 
 ### Extending the user shape
 

package/capability.json

@@ -9,18 +9,19 @@
   ],
   "package": "@boopkit/cap-users",
   "dependencies": [
-    "bcryptjs",
-    "cookie-parser"
+    "bcryptjs@^3",
+    "cookie-parser@^1"
   ],
   "devDependencies": [
-    "@types/bcryptjs",
-    "@types/cookie-parser"
+    "@types/bcryptjs@^2",
+    "@types/cookie-parser@^1"
   ],
   "files": [
     "prisma/schema/users.prisma",
     "prisma/schema/accounts.prisma",
     "src/services/users.service.ts",
     "src/services/accounts.service.ts",
+    "src/types/express.ts",
     "src/middleware/auth.ts",
     "src/controllers/auth.ts",
     "src/routes/auth.ts",
@@ -92,7 +93,9 @@
     "steps": [
       "Run database migration to create user and account tables: npm run db:migrate -- --name add-${capabilityName}",
       "Generate updated Prisma client: npm run db:generate",
-      "Add {{> auth-nav}} to your main.hbs layout — inside <body> before your main content."
+      "Add {{> auth-nav}} to your main.hbs layout — inside <body> before your main content.",
+      "Authenticate API requests with a bearer token: mount resolveBearer (exported from src/middleware/auth.ts) on your API router, then gate routes with requireAuth(). It is deliberately NOT mounted for you — app-wide it would reject every request carrying a bad token.",
+      "Issuing API keys is yours to design. authService.createApiKey(userId) mints one and returns the raw key exactly once; nothing stores a recoverable copy. boop ships no UI or CLI for this on purpose — who may mint a key, for whom, and with what approval is a decision only your application can make. See reference/user-auth.ref.md before you expose it."
     ],
     "setupChecks": [
       {

package/dist/auth-middleware.d.ts

@@ -5,6 +5,8 @@
  * - `resolveVisitor` — resolves req.user/sessionToken/visitorToken from auth_id/visitor_id
  *   cookies if present. Never creates a user or sets cookies. If no cookie resolves,
  *   req.user stays undefined so anonymous traffic does not mint user records.
+ * - `resolveBearer` — the same resolution for `Authorization: Bearer`, so an API
+ *   request authenticates to the same req.user principal a browser session does.
  * - `getOrCreateUser` — helper for write paths (waitlist capture, signup, onboarding).
  *   Mints a user + visitor identity + session token and sets cookies on first call.
  *   Idempotent: if resolveVisitor already populated req, returns the existing user.
@@ -34,6 +36,14 @@ export interface AuthMiddlewareOptions {
     visitorCookieMaxAge?: number;
     /** Login path for redirects. Default: '/login' */
     loginPath?: string;
+    /**
+     * Value sent as the `WWW-Authenticate` challenge when a bearer token is
+     * refused. Default: 'Bearer'. A resource server that has to point clients at
+     * its discovery document (oauth-server does) overrides this with the fuller
+     * challenge — `Bearer resource_metadata="..."` — rather than reimplementing
+     * the middleware.
+     */
+    bearerChallenge?: string;
 }
 /** Shape of res.locals.auth populated by addAuthContext. */
 export interface AuthLocals {
@@ -45,8 +55,10 @@ export interface AuthLocals {
 /** The middleware functions returned by createAuthMiddleware. */
 export interface AuthMiddleware {
     resolveVisitor: (req: Request, res: Response, next: NextFunction) => void;
+    resolveBearer: (req: Request, res: Response, next: NextFunction) => void;
     getOrCreateUser: (req: Request, res: Response) => Promise<User<BaseUserInfo>>;
     requireAuth: (requiredTrust?: TrustTier) => (req: Request, res: Response, next: NextFunction) => void;
+    requireApiKey: (requiredTrust?: TrustTier) => (req: Request, res: Response, next: NextFunction) => void;
     addAuthContext: (req: Request, res: Response, next: NextFunction) => void;
 }
 /**

package/dist/auth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../src/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAMhE,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,WAAW,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;CACxC;AAED,wCAAwC;AACxC,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1E,eAAe,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9E,WAAW,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACtG,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3E;AASD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,kBAAkB,EACxB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,cAAc,CA0KhB"}
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../src/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAMhE,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,WAAW,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;CACxC;AAED,wCAAwC;AACxC,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1E,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACzE,eAAe,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9E,WAAW,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACtG,aAAa,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxG,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3E;AASD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,kBAAkB,EACxB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,cAAc,CAkShB"}

package/dist/auth-middleware.js

@@ -6,6 +6,8 @@
  * - `resolveVisitor` — resolves req.user/sessionToken/visitorToken from auth_id/visitor_id
  *   cookies if present. Never creates a user or sets cookies. If no cookie resolves,
  *   req.user stays undefined so anonymous traffic does not mint user records.
+ * - `resolveBearer` — the same resolution for `Authorization: Bearer`, so an API
+ *   request authenticates to the same req.user principal a browser session does.
  * - `getOrCreateUser` — helper for write paths (waitlist capture, signup, onboarding).
  *   Mints a user + visitor identity + session token and sets cookies on first call.
  *   Idempotent: if resolveVisitor already populated req, returns the existing user.
@@ -31,6 +33,7 @@ function createAuthMiddleware(deps, options) {
     const visitorCookieName = options?.visitorCookieName ?? 'visitor_id';
     const visitorCookieMaxAge = options?.visitorCookieMaxAge ?? TEN_YEARS_MS;
     const loginPath = options?.loginPath ?? '/login';
+    const bearerChallenge = options?.bearerChallenge ?? 'Bearer';
     /**
      * resolveVisitor — read-only resolver. Populates req.user, req.sessionToken, and
      * req.visitorToken from the auth_id/visitor_id cookies when present. Never creates
@@ -41,6 +44,74 @@ function createAuthMiddleware(deps, options) {
     function resolveVisitor(req, res, next) {
         resolveFromCookies(req).then(() => next()).catch(next);
     }
+    /**
+     * resolveBearer — read-only resolver for `Authorization: Bearer <token>`.
+     *
+     * Three outcomes, and the middle one is the design decision:
+     *
+     * - No `Authorization` header, or a scheme other than Bearer: pass through
+     *   with req.user untouched, so this can be mounted on a router that also
+     *   serves anonymous traffic. Gating is `requireAuth`'s job, not this one's.
+     * - A Bearer token that does not resolve: **401**, not silent anonymity. A
+     *   caller that presented a credential and got it wrong should be told; a
+     *   broken client that looks like a logged-out one is a bad afternoon.
+     * - A Bearer token that resolves: req.user is set to the same principal the
+     *   cookie path yields, so everything downstream — requireAuth, trust tiers,
+     *   res.locals.auth — works without knowing which door the request came in.
+     *   It also records two more fields the cookie path does not:
+     *     - req.sessionToken = the presented raw key. requireAuth reads BOTH
+     *       req.user and req.sessionToken and denies if either is missing, so
+     *       setting only req.user would make the published `resolveBearer` +
+     *       `requireAuth` pairing deny every bearer request. sessionToken is also
+     *       the `identityKey` requireAuth hands isAuthorized, and createApiKey
+     *       records the per-key grant under the RAW key — so the presented key is
+     *       exactly what that call is asking for, and routing it through
+     *       isAuthorized restores the per-key grant check ("expire the grant") for
+     *       free. COUPLING: this relies on createApiKey keying the grant on the
+     *       raw key (auth-service.ts, `setAuthorization(userId, apiKey, ...)`).
+     *       boop-owbv proposes hashing that field; whichever of the two lands
+     *       second MUST update the other or API-key authorization breaks silently.
+     *     - req.authStrategy = 'api-key', so a gate that must accept ONLY a key
+     *       (requireApiKey) can tell a key principal from a cookie one. req.user
+     *       alone cannot: resolveVisitor may have populated it from the cookie.
+     *
+     * It deliberately does **not** fall back to the session cookie when the token
+     * is bad. One of the donor codebases the oauth work drew on did fall back on
+     * a shared mount, and specs/oauth-server.spec.md names that as a shape not to
+     * lift: it means a request carrying a revoked key can still succeed, on the
+     * strength of a cookie the caller was not presenting as its credential.
+     *
+     * Only errors that mean "this credential is not good" become 401s; anything
+     * else (the database being unreachable, say) goes to next(err) so it is not
+     * misreported to the client as an auth failure.
+     */
+    function resolveBearer(req, res, next) {
+        const header = req.headers?.authorization;
+        if (typeof header !== 'string')
+            return next();
+        const match = /^Bearer +(.+)$/i.exec(header.trim());
+        if (!match)
+            return next();
+        const token = match[1].trim();
+        if (token === '')
+            return next();
+        authService
+            .validateApiKey(token)
+            .then((user) => {
+            const r = req;
+            r.user = user;
+            r.sessionToken = token;
+            r.authStrategy = 'api-key';
+            next();
+        })
+            .catch((err) => {
+            if (!(err instanceof auth_service_js_1.AuthError))
+                return next(err);
+            logger.warn('bearer token refused', { path: req.path });
+            res.set('WWW-Authenticate', bearerChallenge);
+            res.status(401).json({ error: 'invalid_token' });
+        });
+    }
     async function resolveFromCookies(req) {
         let user;
         let sessionToken;
@@ -126,8 +197,52 @@ function createAuthMiddleware(deps, options) {
         }
         next();
     }
+    /**
+     * requireApiKey — gate for routes that must be reached with an API key, not
+     * merely with any authenticated principal.
+     *
+     * requireAuth answers "is there an authorized principal?" — and a browser
+     * holding a session cookie is one. Because resolveVisitor is mounted app-wide
+     * (well ahead of the API router), such a browser arrives at /api/* already
+     * carrying req.user and req.sessionToken from its cookie. Gating a key-only
+     * route with requireAuth would therefore let any logged-in browser through
+     * with no key, and would let a revoked key keep working from a browser whose
+     * session is still alive — defeating the promise that a key is an independent,
+     * independently-revocable credential.
+     *
+     * The one fact that separates the two is req.authStrategy, which only
+     * resolveBearer sets. This gate requires it, then makes the SAME authorization
+     * decision requireAuth does — isAuthorized against the grant behind the
+     * presented credential — and answers with the 401 an API client expects
+     * rather than an HTML redirect.
+     */
+    function requireApiKey(requiredTrust = 'authenticated') {
+        return function requireApiKeyMiddleware(req, res, next) {
+            const user = req.user;
+            const sessionToken = req.sessionToken;
+            const authStrategy = req.authStrategy;
+            if (!user || !sessionToken || authStrategy !== 'api-key') {
+                res.set('WWW-Authenticate', bearerChallenge).status(401).json({ error: 'Unauthorized' });
+                return;
+            }
+            authService
+                .isAuthorized(user.id, sessionToken, requiredTrust)
+                .then((authorized) => {
+                if (authorized)
+                    return next();
+                res.set('WWW-Authenticate', bearerChallenge).status(401).json({ error: 'Unauthorized' });
+            })
+                .catch(next);
+        };
+    }
     function isApiRequest(req) {
-        return req.path.startsWith('/api/') || req.path.startsWith('/api');
+        // Test req.originalUrl, not req.path: inside a router mounted with
+        // app.use('/api', apiRoutes), req.path is router-relative ('/me' for
+        // GET /api/me) and would miss the '/api' prefix entirely, so an
+        // unauthenticated API caller would get an HTML redirect instead of a 401.
+        // originalUrl carries the full request path (with an optional query string).
+        const pathname = req.originalUrl.split('?')[0];
+        return pathname === '/api' || pathname.startsWith('/api/');
     }
     function denyAccess(req, res) {
         logger.warn('access denied', { method: req.method, path: req.originalUrl, userId: req.user?.id });
@@ -168,8 +283,10 @@ function createAuthMiddleware(deps, options) {
     }
     return {
         resolveVisitor,
+        resolveBearer,
         getOrCreateUser,
         requireAuth,
+        requireApiKey,
         addAuthContext,
     };
 }

package/dist/auth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../src/auth-middleware.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA8DH,oDA6KC;AAvOD,4CAA+C;AAC/C,uDAA6D;AAM7D,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAyC7C,kCAAkC;AAElC,MAAM,WAAW,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,MAAM,YAAY,GAAG,EAAE,GAAG,WAAW,CAAC;AAEtC,gCAAgC;AAEhC;;GAEG;AACH,SAAgB,oBAAoB,CAClC,IAAwB,EACxB,OAA+B;IAE/B,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,SAAS,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,WAAW,CAAC;IAC1D,MAAM,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,YAAY,CAAC;IACrE,MAAM,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,IAAI,YAAY,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,QAAQ,CAAC;IAEjD;;;;;;OAMG;IACH,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACrE,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,GAAY;QAC5C,IAAI,IAAoC,CAAC;QACzC,IAAI,YAAgC,CAAC;QACrC,IAAI,YAAgC,CAAC;QAErC,6DAA6D;QAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAA,2BAAS,EAAC,YAAY,CAAC,CAAC,CAAC;YAC7F,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACtD,IAAI,CAAC,EAAE,CAAC;oBACN,IAAI,GAAG,CAAC,CAAC;oBACT,YAAY,GAAG,YAAY,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAA,2BAAS,EAAC,eAAe,CAAC,CAAC,CAAC;YAChG,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;gBAClE,CAAC;gBACD,IAAI,IAAI,EAAE,CAAC;oBACT,YAAY,GAAG,eAAe,CAAC;gBACjC,CAAC;gBACD,wEAAwE;gBACxE,6EAA6E;gBAC7E,mEAAmE;YACrE,CAAC;QACH,CAAC;QAEA,GAAW,CAAC,IAAI,GAAG,IAAI,CAAC;QACxB,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;QACxC,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,GAAa;QACxD,IAAI,IAAI,GAAI,GAAW,CAAC,IAAsC,CAAC;QAC/D,IAAI,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QACnE,IAAI,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAEnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAkB,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,IAAA,+BAAa,GAAE,CAAC;YAC/B,MAAM,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAA,2BAAS,EAAC,YAAY,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,MAAM,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QAEA,GAAW,CAAC,IAAI,GAAG,IAAI,CAAC;QACxB,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;QACxC,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,SAAS,WAAW,CAAC,gBAA2B,eAAe;QAC7D,OAAO,SAAS,qBAAqB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;YACnF,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,aAAwB;QAChG,MAAM,IAAI,GAAI,GAAW,CAAC,IAAsC,CAAC;QACjE,MAAM,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAErE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;IAED,SAAS,YAAY,CAAC,GAAY;QAChC,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,SAAS,UAAU,CAAC,GAAY,EAAE,GAAa;QAC7C,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAG,GAAW,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3G,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACjD,GAAG,CAAC,QAAQ,CAAC,GAAG,SAAS,SAAS,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACrE,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,IAAI,GAAI,GAAW,CAAC,IAAsC,CAAC;QACjE,MAAM,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAErE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAuB,CAAC;YAC/G,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,sFAAsF;QACtF,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,MAAM,SAAS,GAAc,WAAW,IAAI,YAAY,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QACtC,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAE5D,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG;YAChB,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,KAAK;YAChB,WAAW;SACS,CAAC;IACzB,CAAC;IAED,OAAO;QACL,cAAc;QACd,eAAe;QACf,WAAW;QACX,cAAc;KACf,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../src/auth-middleware.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAwEH,oDAqSC;AAzWD,4CAA+C;AAC/C,uDAAwE;AAMxE,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAmD7C,kCAAkC;AAElC,MAAM,WAAW,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,MAAM,YAAY,GAAG,EAAE,GAAG,WAAW,CAAC;AAEtC,gCAAgC;AAEhC;;GAEG;AACH,SAAgB,oBAAoB,CAClC,IAAwB,EACxB,OAA+B;IAE/B,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,SAAS,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,WAAW,CAAC;IAC1D,MAAM,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,YAAY,CAAC;IACrE,MAAM,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,IAAI,YAAY,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,QAAQ,CAAC;IACjD,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,QAAQ,CAAC;IAE7D;;;;;;OAMG;IACH,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACrE,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,SAAS,aAAa,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;QAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAC;QAE9C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,IAAI,EAAE,CAAC;QAEhC,WAAW;aACR,cAAc,CAAC,KAAK,CAAC;aACrB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACb,MAAM,CAAC,GAAG,GAIT,CAAC;YACF,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;YACd,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC;YACvB,CAAC,CAAC,YAAY,GAAG,SAAS,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,CAAC,CAAC,GAAG,YAAY,2BAAS,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,GAAY;QAC5C,IAAI,IAAoC,CAAC;QACzC,IAAI,YAAgC,CAAC;QACrC,IAAI,YAAgC,CAAC;QAErC,6DAA6D;QAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAA,2BAAS,EAAC,YAAY,CAAC,CAAC,CAAC;YAC7F,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACtD,IAAI,CAAC,EAAE,CAAC;oBACN,IAAI,GAAG,CAAC,CAAC;oBACT,YAAY,GAAG,YAAY,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAA,2BAAS,EAAC,eAAe,CAAC,CAAC,CAAC;YAChG,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;gBAClE,CAAC;gBACD,IAAI,IAAI,EAAE,CAAC;oBACT,YAAY,GAAG,eAAe,CAAC;gBACjC,CAAC;gBACD,wEAAwE;gBACxE,6EAA6E;gBAC7E,mEAAmE;YACrE,CAAC;QACH,CAAC;QAEA,GAAW,CAAC,IAAI,GAAG,IAAI,CAAC;QACxB,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;QACxC,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,GAAa;QACxD,IAAI,IAAI,GAAI,GAAW,CAAC,IAAsC,CAAC;QAC/D,IAAI,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QACnE,IAAI,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAEnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAkB,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,IAAA,+BAAa,GAAE,CAAC;YAC/B,MAAM,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAA,2BAAS,EAAC,YAAY,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,MAAM,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QAEA,GAAW,CAAC,IAAI,GAAG,IAAI,CAAC;QACxB,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;QACxC,GAAW,CAAC,YAAY,GAAG,YAAY,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,SAAS,WAAW,CAAC,gBAA2B,eAAe;QAC7D,OAAO,SAAS,qBAAqB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;YACnF,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,aAAwB;QAChG,MAAM,IAAI,GAAI,GAAW,CAAC,IAAsC,CAAC;QACjE,MAAM,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAErE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,aAAa,CAAC,gBAA2B,eAAe;QAC/D,OAAO,SAAS,uBAAuB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;YACrF,MAAM,IAAI,GAAI,GAAW,CAAC,IAAsC,CAAC;YACjE,MAAM,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;YACrE,MAAM,YAAY,GAAI,GAAW,CAAC,YAAqC,CAAC;YAExE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBACzD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YAED,WAAW;iBACR,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC;iBAClD,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;gBACnB,IAAI,UAAU;oBAAE,OAAO,IAAI,EAAE,CAAC;gBAC9B,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3F,CAAC,CAAC;iBACD,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,YAAY,CAAC,GAAY;QAChC,mEAAmE;QACnE,qEAAqE;QACrE,gEAAgE;QAChE,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,SAAS,UAAU,CAAC,GAAY,EAAE,GAAa;QAC7C,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAG,GAAW,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3G,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACjD,GAAG,CAAC,QAAQ,CAAC,GAAG,SAAS,SAAS,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACrE,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,IAAI,GAAI,GAAW,CAAC,IAAsC,CAAC;QACjE,MAAM,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAErE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAuB,CAAC;YAC/G,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,sFAAsF;QACtF,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,MAAM,SAAS,GAAc,WAAW,IAAI,YAAY,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QACtC,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAE5D,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG;YAChB,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,KAAK;YAChB,WAAW;SACS,CAAC;IACzB,CAAC;IAED,OAAO;QACL,cAAc;QACd,aAAa;QACb,eAAe;QACf,WAAW;QACX,aAAa;QACb,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAEV,kBAAkB,EAClB,YAAY,EAEZ,SAAS,EACT,IAAI,EACJ,kBAAkB,EAGlB,YAAY,EAEb,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAItE,uDAAuD;AACvD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK3C;AAED,6EAA6E;AAC7E,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,GAAE,MAAoC;CAI1D;AAID,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAE1B,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAGzC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1F,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1F,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChH,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvI,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAGtD,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAG3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC7E,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAChG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7E,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAG/F,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGhD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAGxF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAGjF,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAGvD,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACnD;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,SAAO,GAAG,MAAM,CAItD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AA2DD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,WAAW,CAmjBb"}
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAEV,kBAAkB,EAClB,YAAY,EAEZ,SAAS,EACT,IAAI,EACJ,kBAAkB,EAGlB,YAAY,EAEb,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAItE,uDAAuD;AACvD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK3C;AAED,6EAA6E;AAC7E,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,GAAE,MAAoC;CAI1D;AAID,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAE1B,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAGzC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1F,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1F,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChH,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvI,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAGtD,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAG3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC7E,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAChG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7E,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAG/F,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGhD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAGxF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAGjF,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAGvD,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACnD;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,SAAO,GAAG,MAAM,CAItD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AA2DD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,WAAW,CAwpBb"}

package/dist/auth-service.js

@@ -417,29 +417,85 @@ function createAuthService(deps, options) {
         });
     }
     // ---- API key lifecycle ----
+    /**
+     * Store an API key's bcrypt credential, keyed to that key's identity.
+     *
+     * A user may hold several API keys at once — one per integration. The other
+     * three layers already permit that: identity rows are unique per key, the
+     * authentication policy is one shared `api-key` entry, and each key gets its
+     * own authorization grant. Credentials were the exception: `setCredentials`
+     * replaces the single per-strategy slot, so minting a second key overwrote
+     * the first's hash and `validateApiKey` — which `.find()`s by strategy —
+     * could then only ever match the newest key. This helper APPENDS instead,
+     * tagging each entry with `identity_key` (the `hashToken(key)` the identity
+     * row stores), so every key carries its own credential and each validates
+     * independently until it is individually revoked.
+     */
+    async function addApiKeyCredential(userId, identityKey, apiKey) {
+        const hash = await bcryptjs_1.default.hash(apiKey, hashRounds);
+        return withRetry(async () => {
+            const existing = await userPropertyService.get(userId, 'credentials', { allowSensitive: true });
+            const entries = existing ? [...existing.info] : [];
+            entries.push({ strategy: 'api-key', secret: hash, identity_key: identityKey });
+            return userPropertyService.put(userId, 'credentials', entries, {
+                expectedRevision: existing?.revision,
+            });
+        });
+    }
+    /**
+     * Mint an API key.
+     *
+     * The raw key is returned to the caller once and is not what the identity row
+     * holds: `user_identities` stores `hashToken(apiKey)`, the same treatment
+     * `generateSessionToken` gives a session cookie, so a read of that table
+     * hands nobody a working credential. The bcrypt entry under `credentials` is
+     * a separate, slower check that `validateApiKey` still performs on top of the
+     * identity lookup; it is keyed per key (see `addApiKeyCredential`), so a user
+     * may hold several keys at once and each authenticates on its own.
+     *
+     * The authorization grant below is deliberately still keyed on the RAW key.
+     * `identity_key` is the argument callers pass to `isAuthorized` and
+     * `getTrustTier`, and session grants store their token raw too — so hashing
+     * the api-key half alone would leave one field with two meanings and break
+     * that contract for API keys only. The `authorization` property is its own
+     * plaintext-at-rest bug, wider than this one because it covers every logged-in
+     * session, and it is tracked as boop-owbv to be fixed in one consistent move
+     * with a migration that rehashes rather than logs everybody out.
+     *
+     * COUPLING: the request pipeline now leans on this raw-key grant. resolveBearer
+     * (auth-middleware.ts) records the presented raw key as req.sessionToken so the
+     * gate's isAuthorized(user.id, req.sessionToken, …) call finds this grant. If
+     * boop-owbv hashes identity_key here, resolveBearer MUST hash the presented key
+     * to match, or every API key silently fails authorization. Update both together.
+     */
     async function createApiKey(userId) {
         const apiKey = (0, node_crypto_1.randomBytes)(32).toString('base64url');
-        await setCredentials(userId, 'api-key', apiKey);
+        const hashedKey = hashToken(apiKey);
+        await addApiKeyCredential(userId, hashedKey, apiKey);
         await addAuthenticationMethod(userId, 'api-key');
-        await identityService.create(userId, 'api-key', apiKey);
-        await setAuthorization(userId, apiKey, 'api-key', 'authenticated', 0);
+        await identityService.create(userId, 'api-key', hashedKey);
+        await setAuthorization(userId, apiKey, 'api-key', 'authenticated', 0); // see note above: boop-owbv
         logger.info('api key created', { userId });
         return { apiKey };
     }
     async function validateApiKeyFn(apiKey) {
-        // 1. Identity lookup — does this key resolve to a user?
-        const identity = await identityService.findByDomainAndKey('api-key', apiKey);
+        // 1. Identity lookup — does this key resolve to a user? Keys are stored
+        //    hashed, so look up by the hash, as the cookie path does.
+        const hashedKey = hashToken(apiKey);
+        const identity = await identityService.findByDomainAndKey('api-key', hashedKey);
         if (!identity)
             throw new AuthError();
         // 2. Policy gate — is api-key auth accepted for this user?
         const methodAccepted = await isMethodAccepted(identity.userId, 'api-key');
         if (!methodAccepted)
             throw new AuthError();
-        // 3. Credential verification — does the key match the stored hash?
+        // 3. Credential verification — does the key match the stored hash? A user
+        //    may hold several keys, so match the credential tied to THIS key's
+        //    identity, not just the first 'api-key' entry.
         const credRecord = await userPropertyService.get(identity.userId, 'credentials', { allowSensitive: true });
         if (!credRecord)
             throw new AuthError();
-        const apiKeyEntry = credRecord.info.find((e) => e.strategy === 'api-key');
+        const apiKeyEntry = credRecord.info.find((e) => e.strategy === 'api-key' && e.identity_key === hashedKey);
         if (!apiKeyEntry)
             throw new AuthError();
         const match = await bcryptjs_1.default.compare(apiKey, apiKeyEntry.secret);
@@ -452,10 +508,44 @@ function createAuthService(deps, options) {
         return user;
     }
     async function revokeApiKey(userId, apiKey) {
-        const existing = await identityService.findByDomainAndKey('api-key', apiKey);
-        if (existing && existing.userId === userId) {
-            await identityService.endDate('api-key', existing.key);
+        const hashedKey = hashToken(apiKey);
+        const existing = await identityService.findByDomainAndKey('api-key', hashedKey);
+        // Ownership gate: only the key's own user may revoke it. If it does not
+        // resolve or belongs to someone else, this is a no-op — leaving another
+        // user's key untouched.
+        if (!existing || existing.userId !== userId) {
+            return;
         }
+        // 1. End-date the identity so the key no longer resolves.
+        await identityService.endDate('api-key', existing.key);
+        // 2. Drop this key's credential entry. Without this the revoked key's bcrypt
+        //    hash would linger in `credentials` — a dead key that still looks live
+        //    to a reader of the database, the mirror of the append/replace bug this
+        //    fix closes on the minting side.
+        await withRetry(async () => {
+            const record = await userPropertyService.get(userId, 'credentials', { allowSensitive: true });
+            if (!record)
+                return;
+            const entries = record.info.filter((e) => !(e.strategy === 'api-key' && e.identity_key === hashedKey));
+            if (entries.length !== record.info.length) {
+                await userPropertyService.put(userId, 'credentials', entries, {
+                    expectedRevision: record.revision,
+                });
+            }
+        });
+        // 3. Drop this key's authorization grant (keyed on the raw key), so no
+        //    standing grant outlives the key it belonged to.
+        await withRetry(async () => {
+            const record = await userPropertyService.get(userId, 'authorization');
+            if (!record)
+                return;
+            const grants = record.info.filter((g) => g.identity_key !== apiKey);
+            if (grants.length !== record.info.length) {
+                await userPropertyService.put(userId, 'authorization', grants, {
+                    expectedRevision: record.revision,
+                });
+            }
+        });
         logger.info('api key revoked', { userId });
     }
     async function rotateApiKey(userId, currentApiKey) {

package/dist/auth-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":";;;;;;AA4JA,sCAIC;AAMD,8BAEC;AA+DD,8CAsjBC;AA7xBD,6CAAsD;AACtD,wDAA8B;AAC9B,4CAA+C;AAC/C,wDAAyD;AAEzD,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAmB7C,+BAA+B;AAE/B,uDAAuD;AACvD,MAAa,mBAAoB,SAAQ,KAAK;IAG5C,YAAY,KAAa,EAAE,OAAe;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AARD,kDAQC;AAED,6EAA6E;AAC7E,MAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,UAAkB,2BAA2B;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AALD,8BAKC;AA0GD,yCAAyC;AAEzC;;;;GAIG;AACH,SAAgB,aAAa,CAAC,SAAS,GAAG,IAAI;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,2CAA2C;AAE3C,MAAM,WAAW,GAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AAE7E,SAAS,UAAU,CAAC,IAAe;IACjC,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,2CAA2C;AAE3C,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAC9C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACvD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,EACV,6BAA6B,mBAAmB,aAAa,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB,EAAE,YAAoB;IAC1E,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,qCAAqC;AAErC,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAI,EAAoB;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,+BAAgB,IAAI,OAAO,GAAG,WAAW;gBAAE,SAAS;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,IAAqB,EACrB,OAA4B;IAE5B,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IACnE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;IAC7C,MAAM,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,IAAI,MAAM,CAAC,CAAC,SAAS;IAEnF,uBAAuB;IAEvB,SAAS,mBAAmB,CAAC,KAAkB;QAC7C,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjC,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3E,CAAC;IAED,6BAA6B;IAE7B,KAAK,UAAU,UAAU,CAAC,KAAgD;QACxE,MAAM,IAAI,GAAiB;YACzB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,GAAW;QACvE,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,WAAoB;QAC5D,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAc;QAC5E,MAAM,IAAI,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,MAAM,OAAO,GAAsB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;gBAC7D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,QAAgB,EAChB,UAAiC;QAEjC,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7F,MAAM,OAAO,GAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAyB;gBAClC,QAAQ;gBACR,QAAQ,EAAE,IAAI;gBACd,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC3F,GAAG,CAAC,UAAU,EAAE,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;gBACxF,GAAG,CAAC,UAAU,EAAE,uBAAuB,KAAK,SAAS,IAAI,EAAE,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,EAAE,CAAC;gBACzH,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;aAC5F,CAAC;YACF,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE;gBAChE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,2BAA2B,CAAC,MAAc,EAAE,QAAgB;QACzE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7F,MAAM,OAAO,GAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACtD,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE;gBAChE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,WAAmB,EACnB,QAAgB,EAChB,KAAgB,EAChB,SAAkB;QAElB,MAAM,QAAQ,GAAG,SAAS,IAAI,sBAAsB,CAAC;QACrD,MAAM,KAAK,GAAuB;YAChC,YAAY,EAAE,WAAW;YACzB,QAAQ;YACR,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,+DAA+D;YAC/D,UAAU,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI;YAC7D,gBAAgB,EAAE,QAAQ;SAC3B,CAAC;QACF,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAyB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;YACpE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC9D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,MAAc;QAChD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB;IAElB,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB;QAClE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAErC,sEAAsE;QACtE,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAE3C,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC9C,QAAQ,CAAC,MAAM,EACf,aAAa,EACb,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,KAAK,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,kFAAkF;IAClF,mFAAmF;IACnF,uFAAuF;IACvF,gEAAgE;IAChE,KAAK,UAAU,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAE,mBAA4B;QAChF,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACvE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+BAA+B;IAE/B,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,qCAAqC;IACrC,2EAA2E;IAC3E,2DAA2D;IAC3D,qFAAqF;IACrF,gEAAgE;IAChE,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,mBAA4B;QACvE,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,aAAa,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACnF,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3C,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,0BAA0B;IAE1B,KAAK,UAAU,wBAAwB,CAAC,MAAc;QACpD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,WAAmB;QACvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,IAAI,IAAI,CAAC;IACzE,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB;QAC7D,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,+EAA+E;QAC/E,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,YAAY,CAAC;QAC3E,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,QAAgB;QAC9D,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC3D,OAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB,EAAE,gBAA2B,eAAe;QACzG,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,yFAAyF;QACzF,mFAAmF;QACnF,uEAAuE;QACvE,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,CAAC,CAAC,YAAyB;YAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAChB,OAAO,UAAU,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,yCAAyC;IAEzC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,YAAoB;QACxD,gFAAgF;QAChF,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;YACrE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,YAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC3F,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;oBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,MAAc;QACrC,0EAA0E;QAC1E,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnC,CAAC,CAAC,QAAQ,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpE,CAAC,CAAC,CAAC,CACN,CAAC;YACF,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,YAAoB;QAC9D,4CAA4C;QAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;YAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;oBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;QAC5C,iCAAiC;QACjC,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC5E,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YACnE,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,6BAA6B;IAE7B,yEAAyE;IACzE,kEAAkE;IAClE,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAe;QAC1E,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,6EAA6E;gBAC7E,sEAAsE;gBACtE,8DAA8D;gBAC9D,OAAO,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;YACpE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,8CAA8C;gBAC9C,MAAM,CAAC,IAAI,CAAC;oBACV,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;oBACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI;oBACtD,gBAAgB,EAAE,sBAAsB;iBACzC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC9D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8BAA8B;IAE9B,KAAK,UAAU,YAAY,CAAC,MAAc;QACxC,MAAM,MAAM,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;QAC5C,wDAAwD;QACxD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAErC,2DAA2D;QAC3D,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAE3C,mEAAmE;QACnE,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC9C,QAAQ,CAAC,MAAM,EACf,aAAa,EACb,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAExC,MAAM,KAAK,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAElC,sBAAsB;QACtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,MAAc;QACxD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,aAAqB;QAC/D,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,MAAM,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,+BAA+B;IAE/B,MAAM,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,KAAK,CAAC,CAAC,cAAc;IAEnF,KAAK,UAAU,2BAA2B,CAAC,MAAc;QACvD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnF,qDAAqD;QACrD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAExE,yCAAyC;QACzC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;YACF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE;gBACvE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,KAAa;QACxC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAErC,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAE/B,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC1C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE1E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE9E,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1D,gCAAgC;YAChC,MAAM,eAAe,CAAC,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,CAAC;QAED,sEAAsE;QACtE,MAAM,eAAe,CAAC,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QACjE,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC3C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YAC5E,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBAClF,gBAAgB,EAAE,OAAO,CAAC,QAAQ;aACnC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAc,MAAM,EAAE,SAAS,CAAC,CAAC;YACpF,IAAI,CAAC,aAAa;gBAAE,OAAO;YAC3B,MAAM,OAAO,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE;gBACzD,gBAAgB,EAAE,aAAa,CAAC,QAAQ;aACzC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YAC7F,IAAI,CAAC,UAAU;gBAAE,OAAO;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC;gBACtE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,UAAuB,EAAE;gBAC1C,CAAC,CAAC,CAAC,CACN,CAAC;YACF,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC9D,gBAAgB,EAAE,UAAU,CAAC,QAAQ;aACtC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAEtC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,wBAAwB;IAExB,KAAK,UAAU,MAAM,CAAC,KAAkB;QACtC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;SACjD,CAAC,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACpD,MAAM,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,cAAc,EAAE,mBAAmB;QACnC,UAAU;QACV,cAAc;QACd,UAAU;QACV,cAAc;QACd,uBAAuB;QACvB,2BAA2B;QAC3B,gBAAgB;QAChB,oBAAoB;QACpB,mBAAmB,EAAE,qBAAqB;QAC1C,KAAK;QACL,aAAa;QACb,wBAAwB;QACxB,sBAAsB;QACtB,YAAY;QACZ,gBAAgB;QAChB,YAAY;QACZ,MAAM;QACN,SAAS;QACT,YAAY;QACZ,gBAAgB;QAChB,QAAQ;QACR,YAAY;QACZ,cAAc,EAAE,gBAAgB;QAChC,YAAY;QACZ,YAAY;QACZ,yBAAyB,EAAE,2BAA2B;QACtD,WAAW,EAAE,aAAa;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":";;;;;;AA4JA,sCAIC;AAMD,8BAEC;AA+DD,8CA2pBC;AAl4BD,6CAAsD;AACtD,wDAA8B;AAC9B,4CAA+C;AAC/C,wDAAyD;AAEzD,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAmB7C,+BAA+B;AAE/B,uDAAuD;AACvD,MAAa,mBAAoB,SAAQ,KAAK;IAG5C,YAAY,KAAa,EAAE,OAAe;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AARD,kDAQC;AAED,6EAA6E;AAC7E,MAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,UAAkB,2BAA2B;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AALD,8BAKC;AA0GD,yCAAyC;AAEzC;;;;GAIG;AACH,SAAgB,aAAa,CAAC,SAAS,GAAG,IAAI;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,2CAA2C;AAE3C,MAAM,WAAW,GAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AAE7E,SAAS,UAAU,CAAC,IAAe;IACjC,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,2CAA2C;AAE3C,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAC9C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACvD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,EACV,6BAA6B,mBAAmB,aAAa,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB,EAAE,YAAoB;IAC1E,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,qCAAqC;AAErC,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAI,EAAoB;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,+BAAgB,IAAI,OAAO,GAAG,WAAW;gBAAE,SAAS;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,IAAqB,EACrB,OAA4B;IAE5B,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IACnE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;IAC7C,MAAM,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,IAAI,MAAM,CAAC,CAAC,SAAS;IAEnF,uBAAuB;IAEvB,SAAS,mBAAmB,CAAC,KAAkB;QAC7C,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjC,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3E,CAAC;IAED,6BAA6B;IAE7B,KAAK,UAAU,UAAU,CAAC,KAAgD;QACxE,MAAM,IAAI,GAAiB;YACzB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,GAAW;QACvE,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,WAAoB;QAC5D,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAc;QAC5E,MAAM,IAAI,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,MAAM,OAAO,GAAsB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;gBAC7D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,QAAgB,EAChB,UAAiC;QAEjC,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7F,MAAM,OAAO,GAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAyB;gBAClC,QAAQ;gBACR,QAAQ,EAAE,IAAI;gBACd,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC3F,GAAG,CAAC,UAAU,EAAE,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;gBACxF,GAAG,CAAC,UAAU,EAAE,uBAAuB,KAAK,SAAS,IAAI,EAAE,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,EAAE,CAAC;gBACzH,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;aAC5F,CAAC;YACF,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE;gBAChE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,2BAA2B,CAAC,MAAc,EAAE,QAAgB;QACzE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7F,MAAM,OAAO,GAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACtD,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE;gBAChE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,WAAmB,EACnB,QAAgB,EAChB,KAAgB,EAChB,SAAkB;QAElB,MAAM,QAAQ,GAAG,SAAS,IAAI,sBAAsB,CAAC;QACrD,MAAM,KAAK,GAAuB;YAChC,YAAY,EAAE,WAAW;YACzB,QAAQ;YACR,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,+DAA+D;YAC/D,UAAU,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI;YAC7D,gBAAgB,EAAE,QAAQ;SAC3B,CAAC;QACF,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAyB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;YACpE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC9D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,MAAc;QAChD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB;IAElB,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB;QAClE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAErC,sEAAsE;QACtE,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAE3C,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC9C,QAAQ,CAAC,MAAM,EACf,aAAa,EACb,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,KAAK,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,kFAAkF;IAClF,mFAAmF;IACnF,uFAAuF;IACvF,gEAAgE;IAChE,KAAK,UAAU,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAE,mBAA4B;QAChF,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACvE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+BAA+B;IAE/B,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,qCAAqC;IACrC,2EAA2E;IAC3E,2DAA2D;IAC3D,qFAAqF;IACrF,gEAAgE;IAChE,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,mBAA4B;QACvE,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,aAAa,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACnF,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3C,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,0BAA0B;IAE1B,KAAK,UAAU,wBAAwB,CAAC,MAAc;QACpD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,WAAmB;QACvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,IAAI,IAAI,CAAC;IACzE,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB;QAC7D,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,+EAA+E;QAC/E,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,YAAY,CAAC;QAC3E,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,QAAgB;QAC9D,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC3D,OAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB,EAAE,gBAA2B,eAAe;QACzG,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,yFAAyF;QACzF,mFAAmF;QACnF,uEAAuE;QACvE,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,CAAC,CAAC,YAAyB;YAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAChB,OAAO,UAAU,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,yCAAyC;IAEzC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,YAAoB;QACxD,gFAAgF;QAChF,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;YACrE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,YAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC3F,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;oBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,MAAc;QACrC,0EAA0E;QAC1E,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnC,CAAC,CAAC,QAAQ,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpE,CAAC,CAAC,CAAC,CACN,CAAC;YACF,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,YAAoB;QAC9D,4CAA4C;QAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;YAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;oBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;QAC5C,iCAAiC;QACjC,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC5E,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YACnE,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,6BAA6B;IAE7B,yEAAyE;IACzE,kEAAkE;IAClE,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAe;QAC1E,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,6EAA6E;gBAC7E,sEAAsE;gBACtE,8DAA8D;gBAC9D,OAAO,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;YACpE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,8CAA8C;gBAC9C,MAAM,CAAC,IAAI,CAAC;oBACV,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;oBACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI;oBACtD,gBAAgB,EAAE,sBAAsB;iBACzC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC9D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8BAA8B;IAE9B;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,WAAmB,EAAE,MAAc;QACpF,MAAM,IAAI,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,MAAM,OAAO,GAAsB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/E,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;gBAC7D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,UAAU,YAAY,CAAC,MAAc;QACxC,MAAM,MAAM,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,4BAA4B;QACnG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;QAC5C,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAErC,2DAA2D;QAC3D,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAE3C,0EAA0E;QAC1E,uEAAuE;QACvE,mDAAmD;QACnD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC9C,QAAQ,CAAC,MAAM,EACf,aAAa,EACb,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAChE,CAAC;QACF,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAExC,MAAM,KAAK,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAElC,sBAAsB;QACtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,MAAc;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChF,wEAAwE;QACxE,wEAAwE;QACxE,wBAAwB;QACxB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,MAAM,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEvD,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,qCAAqC;QACrC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC1C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CACnE,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1C,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;oBAC5D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;oBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,aAAqB;QAC/D,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,MAAM,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,+BAA+B;IAE/B,MAAM,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,KAAK,CAAC,CAAC,cAAc;IAEnF,KAAK,UAAU,2BAA2B,CAAC,MAAc;QACvD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnF,qDAAqD;QACrD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAExE,yCAAyC;QACzC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;YACF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE;gBACvE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,KAAa;QACxC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAErC,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAE/B,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC1C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE1E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE9E,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1D,gCAAgC;YAChC,MAAM,eAAe,CAAC,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,CAAC;QAED,sEAAsE;QACtE,MAAM,eAAe,CAAC,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QACjE,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC3C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YAC5E,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBAClF,gBAAgB,EAAE,OAAO,CAAC,QAAQ;aACnC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAc,MAAM,EAAE,SAAS,CAAC,CAAC;YACpF,IAAI,CAAC,aAAa;gBAAE,OAAO;YAC3B,MAAM,OAAO,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE;gBACzD,gBAAgB,EAAE,aAAa,CAAC,QAAQ;aACzC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YAC7F,IAAI,CAAC,UAAU;gBAAE,OAAO;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC;gBACtE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,UAAuB,EAAE;gBAC1C,CAAC,CAAC,CAAC,CACN,CAAC;YACF,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC9D,gBAAgB,EAAE,UAAU,CAAC,QAAQ;aACtC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAEtC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,wBAAwB;IAExB,KAAK,UAAU,MAAM,CAAC,KAAkB;QACtC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;SACjD,CAAC,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACpD,MAAM,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,cAAc,EAAE,mBAAmB;QACnC,UAAU;QACV,cAAc;QACd,UAAU;QACV,cAAc;QACd,uBAAuB;QACvB,2BAA2B;QAC3B,gBAAgB;QAChB,oBAAoB;QACpB,mBAAmB,EAAE,qBAAqB;QAC1C,KAAK;QACL,aAAa;QACb,wBAAwB;QACxB,sBAAsB;QACtB,YAAY;QACZ,gBAAgB;QAChB,YAAY;QACZ,MAAM;QACN,SAAS;QACT,YAAY;QACZ,gBAAgB;QAChB,QAAQ;QACR,YAAY;QACZ,cAAc,EAAE,gBAAgB;QAChC,YAAY;QACZ,YAAY;QACZ,yBAAyB,EAAE,2BAA2B;QACtD,WAAW,EAAE,aAAa;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -35,6 +35,14 @@ export interface UserProfile {
 export interface CredentialEntry {
     strategy: string;
     secret: string;
+    /**
+     * The identity this secret belongs to, when a strategy can hold more than one
+     * credential per user. API keys use it: a user may hold several keys at once,
+     * so each key's bcrypt hash is tagged with `hashToken(key)` — the same value
+     * the key's identity row stores — instead of sharing the single strategy slot.
+     * Absent for single-credential strategies like `local`.
+     */
+    identity_key?: string;
 }
 /** Auth credentials — strategy-keyed array, never plaintext (property: "credentials"). */
 export type UserCredentials = CredentialEntry[];

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAIpD,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;CAC/B;AAID,uDAAuD;AACvD,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAIpE,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,+DAA+D;AAC/D,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAET,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAMxC;AAID,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CAChD;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,eAAe,EAAE,CAAC;AAEhD,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;AAExD,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,UAAU,CAAC;AAEpE,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,EAAE,CAAC;AAIrD,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;CAChC;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;CAC/C;AAED,0DAA0D;AAC1D,MAAM,MAAM,OAAO,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAE7E,kDAAkD;AAClD,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,2EAA2E;AAC3E,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM9C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAIpD,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;CAC/B;AAID,uDAAuD;AACvD,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAIpE,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,+DAA+D;AAC/D,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAET,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAMxC;AAID,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CAChD;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,eAAe,EAAE,CAAC;AAEhD,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;AAExD,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,UAAU,CAAC;AAEpE,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,EAAE,CAAC;AAIrD,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;CAChC;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;CAC/C;AAED,0DAA0D;AAC1D,MAAM,MAAM,OAAO,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAE7E,kDAAkD;AAClD,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,2EAA2E;AAC3E,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM9C"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AA6BA,+DAA+D;AAC/D,MAAa,sBAAuB,SAAQ,KAAK;IAI/C,YAAY,MAAc,EAAE,GAAW;QACrC,KAAK,CAAC,uBAAuB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF;AAVD,wDAUC;AA2ED,2EAA2E;AAC3E,MAAa,yBAA0B,SAAQ,KAAK;IAIlD,YAAY,SAAiB,EAAE,MAAc;QAC3C,KAAK,CAAC,QAAQ,MAAM,mCAAmC,SAAS,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAVD,8DAUC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AA6BA,+DAA+D;AAC/D,MAAa,sBAAuB,SAAQ,KAAK;IAI/C,YAAY,MAAc,EAAE,GAAW;QACrC,KAAK,CAAC,uBAAuB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF;AAVD,wDAUC;AAmFD,2EAA2E;AAC3E,MAAa,yBAA0B,SAAQ,KAAK;IAIlD,YAAY,SAAiB,EAAE,MAAc;QAC3C,KAAK,CAAC,QAAQ,MAAM,mCAAmC,SAAS,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAVD,8DAUC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boopkit/cap-users",
-  "version": "0.4.4",
+  "version": "0.6.0",
   "description": "User accounts, authentication, and session management via Prisma",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/scaffold/reference/user-auth.ref.md

@@ -127,19 +127,43 @@ An API key is simultaneously an identity, a credential, and a bearer token. All
 
 | Layer | What happens |
 |-------|-------------|
-| **Identity** | `domain: "api-key", key: "47ZHJY-..."` — lookup on each request |
+| **Identity** | `domain: "api-key", key: "a3f1..."` — the SHA-256 of the key, as the cookie domain holds a session token. Lookup hashes the presented key and searches for that |
 | **Authentication** | `{ strategy: "api-key", accepted: true }` — user can use API keys |
 | **Credentials** | `{ strategy: "api-key", secret: "$2b$..." }` — bcrypt hash of the key |
-| **Authorization** | `{ identity_key: "47ZHJY-...", strategy: "api-key", trust: "authenticated", expires_at: 0 }` — standing per-key grant |
+| **Authorization** | `{ identity_key: "47ZHJY-...", strategy: "api-key", trust: "authenticated", expires_at: 0 }` — standing per-key grant, still keyed on the **raw** key |
 
 **Three independent levers to control access:**
 1. **Revoke the key** — end-date the identity. Immediate.
 2. **Disable API key auth** — set `accepted: false` on the authentication entry. All API keys stop working, but keys still exist.
-3. **Expire the grant** — set `expires_at` on the per-key grant. Can be re-enabled without rotating the key.
+3. **Expire the grant** — set `expires_at` on the per-key grant. Can be re-enabled without rotating the key. Enforced at the gate, not inside `validateApiKey`: the presented key is routed through `isAuthorized`.
 
-**Validation flow:** identity lookup → `isMethodAccepted("api-key")` → bcrypt compare → check per-key grant → return user.
+**Validation flow.** `validateApiKey` resolves a key — hash the presented key → identity lookup → `isMethodAccepted("api-key")` → bcrypt compare → return user. It does not read the grant; resolving answers "whose key is this?", not "is this key still allowed?". The grant (lever 3) is checked at the gate: `requireAuth`/`requireApiKey` call `isAuthorized(user.id, presentedKey, trust)`, and `resolveBearer` records the presented key as `req.sessionToken` so that call finds the per-key grant.
 
-The plaintext key is returned exactly once at creation. Only the hash is stored.
+**Presenting a key.** `resolveBearer`, exported from `src/middleware/auth.ts`, reads `Authorization: Bearer <key>`, sets the same `req.user` a session cookie yields, and also records `req.sessionToken` (the presented key) and `req.authStrategy = 'api-key'`. The `req.sessionToken` it sets is what lets `requireAuth` — which reads both `req.user` and `req.sessionToken` — admit the key instead of redirecting it to `/login`.
+Mount it on your API router ahead of your routes and gate:
+
+```typescript
+// src/routes/api.ts
+import { resolveBearer, requireAuth, requireApiKey } from '../middleware/auth';
+
+healthCheck(router);                                 // before resolveBearer — a probe's stale key won't 401 it
+router.use(resolveBearer);                           // authenticate a token, if one is sent
+router.get('/me', requireAuth(), apiController.me);          // cookie OR key — door-agnostic
+router.get('/integrations', requireApiKey(), apiController.integrations); // an API key only
+```
+
+`requireAuth` accepts any authorized principal, so a logged-in browser satisfies `/me` without a key (`resolveVisitor` runs app-wide and populates `req.user` before this router). Use `requireApiKey` when a route must be reached *with a key* — it accepts the request only when `req.authStrategy === 'api-key'`, then runs the same `isAuthorized` grant check, so revoking or expiring the key stops the request even for a user whose browser session is still alive.
+
+`resolveBearer` is not mounted for you, because app-wide it would answer every request that carries a bad token.
+A request with no `Authorization` header passes through with `req.user` unset, so the same router still serves anonymous routes.
+A token that does not resolve gets `401 { error: 'invalid_token' }` and a `WWW-Authenticate` challenge, and does **not** fall back to the session cookie — revoking a key has to stop the request even from a browser that is still logged in.
+It refuses a malformed token on every route it covers, open ones included, which is why the health check is mounted ahead of it: a route registered before `resolveBearer` never sees the middleware, so a monitor carrying a stale or garbled `Authorization` header still gets its `200` rather than a `401`.
+
+**Issuing a key is yours to design.**
+`authService.createApiKey(userId)` mints one and returns the raw key exactly once; the identity row holds its SHA-256 and the credentials entry a bcrypt hash, so nothing can hand it back later and any surface you build has to say so at the moment it is shown.
+This capability deliberately ships no route, screen, or command for it.
+Minting a credential that acts as a user is not a generic operation: who may do it, for whom, whether it needs a second factor or an approval, how many keys a user may hold, and what the audit trail looks like are answers only your application has, and a default affordance would answer them for you — wrongly, and on the sensitive side.
+Wire it behind whatever authorization your app already trusts, and reach for the three levers below when you need to take a key back.
 
 ### OAuth (as client)
 
@@ -230,6 +254,13 @@ All services compose from `@boopkit/cap-services` primitives:
 - `logoutAll` / `forgetAllDevices` — bulk variants
 
 **API keys**: `createApiKey(userId)` / `validateApiKey(key)` / `revokeApiKey` / `rotateApiKey` — standing grants that never expire.
+The raw key is returned once and is not what `user_identities` holds: the row stores `hashToken(apiKey)`, the same treatment a session cookie gets, and lookups hash before they search.
+To authenticate an HTTP request with one, mount `resolveBearer` — it reads `Authorization: Bearer <key>`, sets the same `req.user` the cookie path yields, and answers `401 { error: 'invalid_token' }` with a `WWW-Authenticate: Bearer` challenge when the token does not resolve.
+It never falls back to the session cookie, so revoking a key stops the request even from a browser that still holds a session.
+
+> The authorization *grant* still records the raw key as its `identity_key`, because that is the value callers pass to `isAuthorized` and `getTrustTier` and session grants store their token the same way.
+> `resolveBearer` depends on this: it records the presented raw key as `req.sessionToken` so the gate's `isAuthorized` call finds the per-key grant. Hashing the grant key and this middleware are two halves of one contract — change one and you must change the other.
+> Fixing that half consistently — grants and sessions together, with a migration that rehashes rather than logging everyone out — is tracked separately.
 
 **Trust queries**: `getTrustTier(userId, identityKey)`, `isAuthorized(userId, identityKey, requiredTrust?)`.
 
@@ -266,4 +297,7 @@ The type propagates through all service operations.
 |------|---------|
 | `prisma/users.prisma` | User, UserIdentity, UserProperty table definitions |
 | `src/services/users.service.ts` | Service wiring — instantiates all user services |
+| `src/types/express.ts` | Global Express request augmentation: types `req.user`, `req.sessionToken`, `req.visitorToken`, `req.authStrategy` for every handler |
 | `@boopkit/cap-users` | Service factories (user, identity, property, auth) |
+
+**Request typing.** The four fields the auth middleware writes onto the request — `req.user` (the resolved `User`), `req.sessionToken`, `req.visitorToken`, and `req.authStrategy` — are declared once in `src/types/express.ts`, a global ambient augmentation your tsconfig compiles with the rest of `src/`. Handlers read them off `express`'s `Request` directly, with no per-file cast or hand-rolled request interface. The user shape hangs off `Express.User` rather than being typed onto `Request.user` directly, so it merges cleanly with the empty `Express.User` that `@types/passport` contributes once oauth-client is installed instead of colliding with it.

package/scaffold/src/controllers/auth.ts

@@ -1,15 +1,11 @@
-import type { Response } from 'express';
+import type { Request, Response } from 'express';
 import type { AuthService } from '@boopkit/cap-users';
 import { AuthValidationError } from '@boopkit/cap-users';
-
-/** Extended Express Request with auth fields set by resolveVisitor middleware. */
-interface AuthRequest {
-  body: Record<string, any>;
-  query: Record<string, any>;
-  cookies?: Record<string, string>;
-  user?: { id: number; [key: string]: any };
-  sessionToken?: string;
-}
+// Side-effect import: brings in the Express request augmentation that types
+// req.user / req.sessionToken / req.visitorToken / req.authStrategy. A generated
+// project also picks these up automatically via its tsconfig `include`, so this
+// line is only needed to type-check the controller in isolation.
+import '../types/express';
 
 const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1000;
 const COOKIE_NAME = 'auth_id';
@@ -97,7 +93,7 @@ export function createAuthController(deps: AuthControllerDeps) {
 
   // ---- Login ----
 
-  async function showLogin(req: AuthRequest, res: Response): Promise<void> {
+  async function showLogin(req: Request, res: Response): Promise<void> {
     // Already authenticated? Redirect away.
     if (res.locals.auth?.trustTier === 'authenticated' || res.locals.auth?.trustTier === 'verified') {
       const next = req.query.next as string | undefined;
@@ -118,7 +114,7 @@ export function createAuthController(deps: AuthControllerDeps) {
     });
   }
 
-  async function handleLogin(req: AuthRequest, res: Response): Promise<void> {
+  async function handleLogin(req: Request, res: Response): Promise<void> {
     const { email, password } = req.body;
     const next = req.body.next || req.query.next as string | undefined;
     const currentSessionToken = req.cookies?.[COOKIE_NAME] as string | undefined;
@@ -149,7 +145,7 @@ export function createAuthController(deps: AuthControllerDeps) {
 
   // ---- Signup ----
 
-  async function showSignup(req: AuthRequest, res: Response): Promise<void> {
+  async function showSignup(req: Request, res: Response): Promise<void> {
     // Already authenticated? Redirect away.
     if (res.locals.auth?.trustTier === 'authenticated' || res.locals.auth?.trustTier === 'verified') {
       const next = req.query.next as string | undefined;
@@ -166,7 +162,7 @@ export function createAuthController(deps: AuthControllerDeps) {
     });
   }
 
-  async function handleSignup(req: AuthRequest, res: Response): Promise<void> {
+  async function handleSignup(req: Request, res: Response): Promise<void> {
     const { email, password, passwordConfirmation } = req.body;
     const next = req.body.next || req.query.next as string | undefined;
 
@@ -209,14 +205,14 @@ export function createAuthController(deps: AuthControllerDeps) {
 
   // ---- Logout ----
 
-  async function handleLogout(req: AuthRequest, res: Response): Promise<void> {
+  async function handleLogout(req: Request, res: Response): Promise<void> {
     if (req.user && req.sessionToken) {
       await authService.logout(req.user.id, req.sessionToken);
     }
     res.redirect('/');
   }
 
-  async function handleForgetDevice(req: AuthRequest, res: Response): Promise<void> {
+  async function handleForgetDevice(req: Request, res: Response): Promise<void> {
     if (req.user && req.sessionToken) {
       await authService.forgetDevice(req.user.id, req.sessionToken);
     }

package/scaffold/src/middleware/auth.ts

@@ -6,15 +6,24 @@ import createAuthRouter from '../routes/auth';
 
 const { authService, identityService, userService } = UserService;
 
-const { resolveVisitor, getOrCreateUser, addAuthContext, requireAuth } = createAuthMiddleware(
-  { authService, identityService, userService },
-  {
-    cookieName: 'auth_id',
-    loginPath: '/login',
-  },
-);
+const { resolveVisitor, resolveBearer, getOrCreateUser, addAuthContext, requireAuth, requireApiKey } =
+  createAuthMiddleware(
+    { authService, identityService, userService },
+    {
+      cookieName: 'auth_id',
+      loginPath: '/login',
+    },
+  );
 
 /** Pre-built auth routes (signup, login, logout). Ready to mount with app.use(). */
 const authRoutes = createAuthRouter({ authService });
 
-export { resolveVisitor, getOrCreateUser, addAuthContext, requireAuth, authRoutes };
+export {
+  resolveVisitor,
+  resolveBearer,
+  getOrCreateUser,
+  addAuthContext,
+  requireAuth,
+  requireApiKey,
+  authRoutes,
+};

package/scaffold/src/types/express.ts

@@ -0,0 +1,77 @@
+/**
+ * Express request augmentation for the auth principal (cap-users).
+ *
+ * cap-users' middleware writes four fields onto the Express request —
+ * `req.user`, `req.sessionToken`, `req.visitorToken` and `req.authStrategy` —
+ * but the library sets them through `(req as any)` casts and declares none of
+ * them to TypeScript. Without this file every consumer has to invent its own
+ * typing: the scaffolded auth controller used to hand-roll an `AuthRequest`
+ * interface that restated `body`, `query` and `cookies` purely to stand in for
+ * `Request`, and typed `user` as `{ id: number; [key: string]: any }`, losing
+ * the real `User` shape. Declaring the fields once here types every consumer —
+ * this controller, your own route handlers, anything that reads `req.user`.
+ *
+ * This file is a global ambient augmentation. In a generated project your
+ * tsconfig's `include` already compiles everything under `src/`, so these
+ * declarations apply project-wide with no import needed; the side-effect
+ * `import './types/express'` in the auth controller is only there so the
+ * controller still type-checks when compiled outside a full project (for
+ * example inside boop's own test suite).
+ *
+ * WHY THE USER SHAPE HANGS OFF `Express.User`, NOT `Request.user` DIRECTLY.
+ * `@types/passport` — pulled in the moment you add oauth-client — augments the
+ * global `Express` namespace with an empty `interface User {}` and types
+ * `Request['user']` as that `Express.User`. If cap-users declared
+ * `Request.user` with a *different* type (say `User<BaseUserInfo>`), the two
+ * declarations would merge and collide: TypeScript reports TS2717, "subsequent
+ * property declarations must have the same type", and every auth handler stops
+ * matching `RequestHandler`. Extending `Express.User` instead means both
+ * capabilities describe `Request.user` with the *same* type (`Express.User`),
+ * so their declarations merge cleanly and passport's empty interface simply
+ * picks up the real `User` members. This is the shape that stays correct
+ * whether or not passport is present. (See boop-lrse for the failure this
+ * avoids.)
+ */
+import type { BaseUserInfo, User } from '@boopkit/cap-users';
+
+declare global {
+  namespace Express {
+    /**
+     * The authenticated principal's shape. Extending here rather than typing
+     * `Request.user` directly is what lets cap-users and `@types/passport`
+     * agree on a single `Request.user` type instead of colliding.
+     */
+    interface User extends UserPrincipal {}
+
+    interface Request {
+      /** Set by resolveVisitor (session cookie) or resolveBearer (API key). */
+      user?: User;
+      /**
+       * The identity_key for this request's credential — the session-cookie
+       * token on the browser path, the raw API key on the bearer path.
+       * requireAuth hands it to authService.isAuthorized.
+       */
+      sessionToken?: string;
+      /** Anonymous visitor tracking token, from the visitor_id cookie. */
+      visitorToken?: string;
+      /**
+       * Which door this request's principal came through, set only by the
+       * resolver that actually resolved it. Absent when req.user arrived from
+       * the session cookie via resolveVisitor. A gate that must accept only one
+       * kind of credential (requireApiKey) reads this — req.user alone cannot
+       * tell a key principal from a cookie one.
+       */
+      authStrategy?: 'api-key';
+    }
+  }
+}
+
+/**
+ * The concrete user shape, kept out of the `Express` namespace so the
+ * `interface User extends …` line above reads cleanly. It is exactly the
+ * `User<BaseUserInfo>` the services return, so `req.user` carries the real
+ * entity (`id`, `publicId`, `info`, timestamps) rather than a stand-in.
+ */
+type UserPrincipal = User<BaseUserInfo>;
+
+export {};