@boopkit/cap-users 0.6.0 → 0.7.0

package/capability.json

@@ -25,6 +25,7 @@
     "src/middleware/auth.ts",
     "src/controllers/auth.ts",
     "src/routes/auth.ts",
+    "src/scripts/migrate-credentials.ts",
     "views/signup.hbs",
     "views/login.hbs",
     "views/partials/auth-nav.hbs",
@@ -34,6 +35,12 @@
   "skills": [
     "boop-users-user-data-modeling"
   ],
+  "scripts": {
+    "credentials:migrate": {
+      "cmd": "tsx src/scripts/migrate-credentials.ts",
+      "description": "Rehash cleartext credentials in property tables (report only; pass -- --run to apply). ONE-WAY — back up first."
+    }
+  },
   "hooks": [
     {
       "phase": "imports",
@@ -107,6 +114,18 @@
         "type": "prisma-generate",
         "label": "Generate Prisma client",
         "hint": "npm run db:generate"
+      },
+      {
+        "type": "probe",
+        "label": "No cleartext authorization tokens",
+        "query": "SELECT 1 FROM user_properties WHERE property = 'authorization' AND info_schema <> 'authorization-hashed-01' LIMIT 1",
+        "hint": "Some authorization grants predate credential hashing and may hold a raw session token or API key. Run the credential-hashing migration (see reference/user-auth.ref.md)."
+      },
+      {
+        "type": "probe",
+        "label": "No cleartext invitation tokens",
+        "query": "SELECT 1 FROM account_properties WHERE property = 'team_invitations' AND info_schema <> 'team-invitations-hashed-01' LIMIT 1",
+        "hint": "Some team invitations predate credential hashing and may hold a raw, redeemable token. Run the credential-hashing migration (see reference/user-auth.ref.md)."
       }
     ]
   },

package/dist/auth-service.d.ts

@@ -104,6 +104,14 @@ export declare function generateToken(partition?: string): string;
  * so a fast hash is sufficient (no need for bcrypt).
  */
 export declare function hashToken(token: string): string;
+/**
+ * True when `value` is already a SHA-256 hex digest, so hashing it again would
+ * double-hash. Session tokens (dashed base36, ~29 chars) and API keys (43
+ * base64url chars) never match this shape, so it distinguishes a raw credential
+ * from its stored hash by value shape alone. This is the idempotency test the
+ * migration tool and the auth service share.
+ */
+export declare function isHashedToken(value: string): boolean;
 /**
  * Create an auth business service orchestrating signup, login, and
  * session management on top of user data services.

package/dist/auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAEV,kBAAkB,EAClB,YAAY,EAEZ,SAAS,EACT,IAAI,EACJ,kBAAkB,EAGlB,YAAY,EAEb,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAItE,uDAAuD;AACvD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK3C;AAED,6EAA6E;AAC7E,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,GAAE,MAAoC;CAI1D;AAID,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAE1B,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAGzC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1F,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1F,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChH,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvI,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAGtD,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAG3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC7E,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAChG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7E,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAG/F,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGhD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAGxF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAGjF,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAGvD,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACnD;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,SAAO,GAAG,MAAM,CAItD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AA2DD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,WAAW,CAwpBb"}
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAEV,kBAAkB,EAClB,YAAY,EAEZ,SAAS,EACT,IAAI,EACJ,kBAAkB,EAGlB,YAAY,EAEb,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAItE,uDAAuD;AACvD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK3C;AAED,6EAA6E;AAC7E,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,GAAE,MAAoC;CAI1D;AAID,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAE1B,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAGzC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1F,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1F,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChH,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvI,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAGtD,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAG3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC7E,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAChG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7E,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAG/F,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGhD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAGxF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAGjF,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAGvD,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACnD;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,SAAO,GAAG,MAAM,CAItD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAKD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AA4FD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,WAAW,CAkqBb"}

package/dist/auth-service.js

@@ -6,11 +6,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthError = exports.AuthValidationError = void 0;
 exports.generateToken = generateToken;
 exports.hashToken = hashToken;
+exports.isHashedToken = isHashedToken;
 exports.createAuthService = createAuthService;
 const node_crypto_1 = require("node:crypto");
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
 const logger_1 = require("@boopkit/logger");
 const cap_services_1 = require("@boopkit/cap-services");
+const info_schema_tags_js_1 = require("./info-schema-tags.js");
 const logger = (0, logger_1.createLogger)('users', 'auth');
 // ---------- Errors ----------
 /** Thrown when signup/login input validation fails. */
@@ -48,6 +50,47 @@ function generateToken(partition = '01') {
 function hashToken(token) {
     return (0, node_crypto_1.createHash)('sha256').update(token).digest('hex');
 }
+/** A SHA-256 hex digest: 64 lowercase hex chars — what hashToken() produces. */
+const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
+/**
+ * True when `value` is already a SHA-256 hex digest, so hashing it again would
+ * double-hash. Session tokens (dashed base36, ~29 chars) and API keys (43
+ * base64url chars) never match this shape, so it distinguishes a raw credential
+ * from its stored hash by value shape alone. This is the idempotency test the
+ * migration tool and the auth service share.
+ */
+function isHashedToken(value) {
+    return SHA256_HEX_RE.test(value);
+}
+/** Hash an identity key for storage unless it is already hashed (idempotent). */
+function hashIdentityKey(key) {
+    return isHashedToken(key) ? key : hashToken(key);
+}
+// Authorization grants are keyed by a hashed identity_key (see setAuthorization).
+// Rows written before credential hashing stored the raw token instead, and boop
+// cannot know whether a downstream has run the migration — so the read path
+// tolerates BOTH forms permanently. The raw branch logs once per process to
+// nudge an operator toward the migration; it goes quiet on its own once the data
+// is migrated. Removing the fallback would be a time bomb, so there is no
+// release that drops it.
+let warnedRawGrant = false;
+/**
+ * Does a stored grant's identity_key correspond to the raw `rawKey` a caller
+ * presented? Matches the hashed form (new writes and migrated rows) and the raw
+ * form (pre-hash rows). The raw branch warns once per process.
+ */
+function grantMatchesIdentityKey(storedKey, rawKey) {
+    if (storedKey === hashToken(rawKey))
+        return true;
+    if (storedKey === rawKey && !isHashedToken(storedKey)) {
+        if (!warnedRawGrant) {
+            warnedRawGrant = true;
+            logger.warn('authorization grant matched a raw (pre-hash) identity_key; run the credential-hashing migration to rehash it');
+        }
+        return true;
+    }
+    return false;
+}
 // ---------- Trust tier helpers ----------
 const TRUST_ORDER = ['recognized', 'authenticated', 'verified'];
 function trustLevel(tier) {
@@ -176,10 +219,32 @@ function createAuthService(deps, options) {
             });
         });
     }
+    // Ensure every grant's identity_key is stored hashed. Idempotent: an
+    // already-hashed key is left untouched, so this opportunistically migrates any
+    // raw grant a payload still carries whenever the property is rewritten.
+    function normalizeGrantKeys(grants) {
+        return grants.map((g) => {
+            const hashed = hashIdentityKey(g.identity_key);
+            return hashed === g.identity_key ? g : { ...g, identity_key: hashed };
+        });
+    }
+    // Single write path for the authorization property: it hashes any raw grant
+    // keys and stamps the migrated info_schema tag, so every row this service
+    // writes is fully hashed AND truthfully tagged for the `boop status` probe.
+    function putAuthorization(userId, grants, expectedRevision) {
+        return userPropertyService.put(userId, 'authorization', normalizeGrantKeys(grants), {
+            expectedRevision,
+            infoSchema: info_schema_tags_js_1.AUTHORIZATION_HASHED_INFO_SCHEMA,
+        });
+    }
     async function setAuthorization(userId, identityKey, strategy, trust, expiresIn) {
         const duration = expiresIn ?? defaultSessionDuration;
         const grant = {
-            identity_key: identityKey,
+            // Store the hash, not the raw token. identity_key is only ever compared for
+            // equality (never replayed), so a one-way hash preserves behaviour while
+            // keeping a live bearer credential out of the readable 'authorization'
+            // property. The read path hashes the caller's raw key before comparing.
+            identity_key: hashIdentityKey(identityKey),
             strategy,
             trust,
             granted_at: Date.now(),
@@ -190,16 +255,14 @@ function createAuthService(deps, options) {
         return withRetry(async () => {
             const existing = await userPropertyService.get(userId, 'authorization');
             const grants = existing ? [...existing.info] : [];
-            const idx = grants.findIndex((g) => g.identity_key === identityKey);
+            const idx = grants.findIndex((g) => grantMatchesIdentityKey(g.identity_key, identityKey));
             if (idx >= 0) {
                 grants[idx] = grant;
             }
             else {
                 grants.push(grant);
             }
-            return userPropertyService.put(userId, 'authorization', grants, {
-                expectedRevision: existing?.revision,
-            });
+            return putAuthorization(userId, grants, existing?.revision);
         });
     }
     async function generateSessionToken(userId) {
@@ -279,7 +342,7 @@ function createAuthService(deps, options) {
         const record = await userPropertyService.get(userId, 'authorization');
         if (!record)
             return null;
-        return record.info.find((g) => g.identity_key === identityKey) ?? null;
+        return record.info.find((g) => grantMatchesIdentityKey(g.identity_key, identityKey)) ?? null;
     }
     async function getTrustTier(userId, identityKey) {
         const grant = await getAuthorizationStatus(userId, identityKey);
@@ -317,12 +380,10 @@ function createAuthService(deps, options) {
             if (!record)
                 return;
             const grants = [...record.info];
-            const idx = grants.findIndex((g) => g.identity_key === sessionToken);
+            const idx = grants.findIndex((g) => grantMatchesIdentityKey(g.identity_key, sessionToken));
             if (idx >= 0) {
                 grants[idx] = { ...grants[idx], trust: 'recognized', granted_at: Date.now() };
-                await userPropertyService.put(userId, 'authorization', grants, {
-                    expectedRevision: record.revision,
-                });
+                await putAuthorization(userId, grants, record.revision);
             }
         });
         logger.info('logout', { userId });
@@ -336,9 +397,7 @@ function createAuthService(deps, options) {
             const grants = record.info.map((g) => g.strategy === 'session'
                 ? { ...g, trust: 'recognized', granted_at: Date.now() }
                 : g);
-            await userPropertyService.put(userId, 'authorization', grants, {
-                expectedRevision: record.revision,
-            });
+            await putAuthorization(userId, grants, record.revision);
         });
         logger.info('logout all sessions', { userId });
     }
@@ -354,11 +413,9 @@ function createAuthService(deps, options) {
             const record = await userPropertyService.get(userId, 'authorization');
             if (!record)
                 return;
-            const grants = record.info.filter((g) => g.identity_key !== sessionToken);
+            const grants = record.info.filter((g) => !grantMatchesIdentityKey(g.identity_key, sessionToken));
             if (grants.length !== record.info.length) {
-                await userPropertyService.put(userId, 'authorization', grants, {
-                    expectedRevision: record.revision,
-                });
+                await putAuthorization(userId, grants, record.revision);
             }
         });
         logger.info('forget device', { userId });
@@ -376,9 +433,7 @@ function createAuthService(deps, options) {
             if (!record)
                 return;
             const grants = record.info.filter((g) => g.strategy !== 'session');
-            await userPropertyService.put(userId, 'authorization', grants, {
-                expectedRevision: record.revision,
-            });
+            await putAuthorization(userId, grants, record.revision);
         });
         logger.info('forget all devices', { userId });
     }
@@ -396,12 +451,13 @@ function createAuthService(deps, options) {
                 return setAuthorization(userId, identityKey, 'session', tier);
             }
             const grants = [...record.info];
-            const idx = grants.findIndex((g) => g.identity_key === identityKey);
+            const idx = grants.findIndex((g) => grantMatchesIdentityKey(g.identity_key, identityKey));
             if (idx >= 0) {
                 grants[idx] = { ...grants[idx], trust: tier, granted_at: Date.now() };
             }
             else {
-                // No grant for this identity_key — create one
+                // No grant for this identity_key — create one. putAuthorization hashes
+                // the key before storage.
                 grants.push({
                     identity_key: identityKey,
                     strategy: 'session',
@@ -411,9 +467,7 @@ function createAuthService(deps, options) {
                     granted_duration: defaultSessionDuration,
                 });
             }
-            return userPropertyService.put(userId, 'authorization', grants, {
-                expectedRevision: record.revision,
-            });
+            return putAuthorization(userId, grants, record.revision);
         });
     }
     // ---- API key lifecycle ----
@@ -453,20 +507,17 @@ function createAuthService(deps, options) {
      * identity lookup; it is keyed per key (see `addApiKeyCredential`), so a user
      * may hold several keys at once and each authenticates on its own.
      *
-     * The authorization grant below is deliberately still keyed on the RAW key.
-     * `identity_key` is the argument callers pass to `isAuthorized` and
-     * `getTrustTier`, and session grants store their token raw too — so hashing
-     * the api-key half alone would leave one field with two meanings and break
-     * that contract for API keys only. The `authorization` property is its own
-     * plaintext-at-rest bug, wider than this one because it covers every logged-in
-     * session, and it is tracked as boop-owbv to be fixed in one consistent move
-     * with a migration that rehashes rather than logs everybody out.
+     * The authorization grant below is keyed on `hashToken(apiKey)` — the same
+     * value the identity row and the credential entry store. `setAuthorization`
+     * hashes its `identityKey` argument, and session grants are hashed the same
+     * way, so `identity_key` has one meaning across both strategies (boop-j8xc.2).
+     * The raw key never reaches the readable `authorization` property.
      *
-     * COUPLING: the request pipeline now leans on this raw-key grant. resolveBearer
-     * (auth-middleware.ts) records the presented raw key as req.sessionToken so the
-     * gate's isAuthorized(user.id, req.sessionToken, …) call finds this grant. If
-     * boop-owbv hashes identity_key here, resolveBearer MUST hash the presented key
-     * to match, or every API key silently fails authorization. Update both together.
+     * COUPLING: the request pipeline leans on this grant. resolveBearer
+     * (auth-middleware.ts) records the presented raw key as req.sessionToken, and
+     * the gate calls isAuthorized(user.id, req.sessionToken, …). That keeps working
+     * because isAuthorized hashes its identityKey argument before comparing, so the
+     * raw presented key matches this hashed grant. Do not hash at the call site.
      */
     async function createApiKey(userId) {
         const apiKey = (0, node_crypto_1.randomBytes)(32).toString('base64url');
@@ -474,7 +525,7 @@ function createAuthService(deps, options) {
         await addApiKeyCredential(userId, hashedKey, apiKey);
         await addAuthenticationMethod(userId, 'api-key');
         await identityService.create(userId, 'api-key', hashedKey);
-        await setAuthorization(userId, apiKey, 'api-key', 'authenticated', 0); // see note above: boop-owbv
+        await setAuthorization(userId, apiKey, 'api-key', 'authenticated', 0); // grant keyed on hashToken(apiKey), see note above
         logger.info('api key created', { userId });
         return { apiKey };
     }
@@ -539,11 +590,9 @@ function createAuthService(deps, options) {
             const record = await userPropertyService.get(userId, 'authorization');
             if (!record)
                 return;
-            const grants = record.info.filter((g) => g.identity_key !== apiKey);
+            const grants = record.info.filter((g) => !grantMatchesIdentityKey(g.identity_key, apiKey));
             if (grants.length !== record.info.length) {
-                await userPropertyService.put(userId, 'authorization', grants, {
-                    expectedRevision: record.revision,
-                });
+                await putAuthorization(userId, grants, record.revision);
             }
         });
         logger.info('api key revoked', { userId });
@@ -623,9 +672,7 @@ function createAuthService(deps, options) {
             const grants = authRecord.info.map((g) => g.strategy === 'session' && trustLevel(g.trust) < trustLevel('verified')
                 ? { ...g, trust: 'verified' }
                 : g);
-            return userPropertyService.put(userId, 'authorization', grants, {
-                expectedRevision: authRecord.revision,
-            });
+            return putAuthorization(userId, grants, authRecord.revision);
         });
         // 6. Resolve user email for the result
         const user = await userService.findById(userId);

package/dist/auth-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":";;;;;;AA4JA,sCAIC;AAMD,8BAEC;AA+DD,8CA2pBC;AAl4BD,6CAAsD;AACtD,wDAA8B;AAC9B,4CAA+C;AAC/C,wDAAyD;AAEzD,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAmB7C,+BAA+B;AAE/B,uDAAuD;AACvD,MAAa,mBAAoB,SAAQ,KAAK;IAG5C,YAAY,KAAa,EAAE,OAAe;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AARD,kDAQC;AAED,6EAA6E;AAC7E,MAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,UAAkB,2BAA2B;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AALD,8BAKC;AA0GD,yCAAyC;AAEzC;;;;GAIG;AACH,SAAgB,aAAa,CAAC,SAAS,GAAG,IAAI;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,2CAA2C;AAE3C,MAAM,WAAW,GAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AAE7E,SAAS,UAAU,CAAC,IAAe;IACjC,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,2CAA2C;AAE3C,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAC9C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACvD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,EACV,6BAA6B,mBAAmB,aAAa,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB,EAAE,YAAoB;IAC1E,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,qCAAqC;AAErC,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAI,EAAoB;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,+BAAgB,IAAI,OAAO,GAAG,WAAW;gBAAE,SAAS;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,IAAqB,EACrB,OAA4B;IAE5B,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IACnE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;IAC7C,MAAM,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,IAAI,MAAM,CAAC,CAAC,SAAS;IAEnF,uBAAuB;IAEvB,SAAS,mBAAmB,CAAC,KAAkB;QAC7C,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjC,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3E,CAAC;IAED,6BAA6B;IAE7B,KAAK,UAAU,UAAU,CAAC,KAAgD;QACxE,MAAM,IAAI,GAAiB;YACzB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,GAAW;QACvE,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,WAAoB;QAC5D,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAc;QAC5E,MAAM,IAAI,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,MAAM,OAAO,GAAsB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;gBAC7D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,QAAgB,EAChB,UAAiC;QAEjC,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7F,MAAM,OAAO,GAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAyB;gBAClC,QAAQ;gBACR,QAAQ,EAAE,IAAI;gBACd,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC3F,GAAG,CAAC,UAAU,EAAE,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;gBACxF,GAAG,CAAC,UAAU,EAAE,uBAAuB,KAAK,SAAS,IAAI,EAAE,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,EAAE,CAAC;gBACzH,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;aAC5F,CAAC;YACF,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE;gBAChE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,2BAA2B,CAAC,MAAc,EAAE,QAAgB;QACzE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7F,MAAM,OAAO,GAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACtD,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE;gBAChE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,WAAmB,EACnB,QAAgB,EAChB,KAAgB,EAChB,SAAkB;QAElB,MAAM,QAAQ,GAAG,SAAS,IAAI,sBAAsB,CAAC;QACrD,MAAM,KAAK,GAAuB;YAChC,YAAY,EAAE,WAAW;YACzB,QAAQ;YACR,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,+DAA+D;YAC/D,UAAU,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI;YAC7D,gBAAgB,EAAE,QAAQ;SAC3B,CAAC;QACF,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAyB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;YACpE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC9D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,MAAc;QAChD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB;IAElB,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB;QAClE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAErC,sEAAsE;QACtE,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAE3C,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC9C,QAAQ,CAAC,MAAM,EACf,aAAa,EACb,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,KAAK,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,kFAAkF;IAClF,mFAAmF;IACnF,uFAAuF;IACvF,gEAAgE;IAChE,KAAK,UAAU,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAE,mBAA4B;QAChF,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACvE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+BAA+B;IAE/B,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,qCAAqC;IACrC,2EAA2E;IAC3E,2DAA2D;IAC3D,qFAAqF;IACrF,gEAAgE;IAChE,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,mBAA4B;QACvE,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,aAAa,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACnF,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3C,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,0BAA0B;IAE1B,KAAK,UAAU,wBAAwB,CAAC,MAAc;QACpD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,WAAmB;QACvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,IAAI,IAAI,CAAC;IACzE,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB;QAC7D,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,+EAA+E;QAC/E,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,YAAY,CAAC;QAC3E,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,QAAgB;QAC9D,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC3D,OAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB,EAAE,gBAA2B,eAAe;QACzG,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,yFAAyF;QACzF,mFAAmF;QACnF,uEAAuE;QACvE,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,CAAC,CAAC,YAAyB;YAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAChB,OAAO,UAAU,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,yCAAyC;IAEzC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,YAAoB;QACxD,gFAAgF;QAChF,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;YACrE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,YAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC3F,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;oBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,MAAc;QACrC,0EAA0E;QAC1E,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnC,CAAC,CAAC,QAAQ,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpE,CAAC,CAAC,CAAC,CACN,CAAC;YACF,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,YAAoB;QAC9D,4CAA4C;QAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;YAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;oBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;QAC5C,iCAAiC;QACjC,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC5E,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YACnE,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,6BAA6B;IAE7B,yEAAyE;IACzE,kEAAkE;IAClE,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAe;QAC1E,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,6EAA6E;gBAC7E,sEAAsE;gBACtE,8DAA8D;gBAC9D,OAAO,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;YACpE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,8CAA8C;gBAC9C,MAAM,CAAC,IAAI,CAAC;oBACV,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;oBACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI;oBACtD,gBAAgB,EAAE,sBAAsB;iBACzC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC9D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8BAA8B;IAE9B;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,WAAmB,EAAE,MAAc;QACpF,MAAM,IAAI,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,MAAM,OAAO,GAAsB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/E,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;gBAC7D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,UAAU,YAAY,CAAC,MAAc;QACxC,MAAM,MAAM,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,4BAA4B;QACnG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;QAC5C,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAErC,2DAA2D;QAC3D,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAE3C,0EAA0E;QAC1E,uEAAuE;QACvE,mDAAmD;QACnD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC9C,QAAQ,CAAC,MAAM,EACf,aAAa,EACb,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAChE,CAAC;QACF,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAExC,MAAM,KAAK,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAElC,sBAAsB;QACtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,MAAc;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChF,wEAAwE;QACxE,wEAAwE;QACxE,wBAAwB;QACxB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,MAAM,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEvD,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,qCAAqC;QACrC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC1C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CACnE,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1C,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;oBAC5D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;oBAC7D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,aAAqB;QAC/D,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,MAAM,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,+BAA+B;IAE/B,MAAM,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,KAAK,CAAC,CAAC,cAAc;IAEnF,KAAK,UAAU,2BAA2B,CAAC,MAAc;QACvD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnF,qDAAqD;QACrD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAExE,yCAAyC;QACzC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;YACF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE;gBACvE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,KAAa;QACxC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAErC,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAE/B,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC1C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE1E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE9E,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1D,gCAAgC;YAChC,MAAM,eAAe,CAAC,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,CAAC;QAED,sEAAsE;QACtE,MAAM,eAAe,CAAC,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QACjE,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC3C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YAC5E,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBAClF,gBAAgB,EAAE,OAAO,CAAC,QAAQ;aACnC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAc,MAAM,EAAE,SAAS,CAAC,CAAC;YACpF,IAAI,CAAC,aAAa;gBAAE,OAAO;YAC3B,MAAM,OAAO,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE;gBACzD,gBAAgB,EAAE,aAAa,CAAC,QAAQ;aACzC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YAC7F,IAAI,CAAC,UAAU;gBAAE,OAAO;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC;gBACtE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,UAAuB,EAAE;gBAC1C,CAAC,CAAC,CAAC,CACN,CAAC;YACF,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBAC9D,gBAAgB,EAAE,UAAU,CAAC,QAAQ;aACtC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAEtC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,wBAAwB;IAExB,KAAK,UAAU,MAAM,CAAC,KAAkB;QACtC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;SACjD,CAAC,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACpD,MAAM,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,cAAc,EAAE,mBAAmB;QACnC,UAAU;QACV,cAAc;QACd,UAAU;QACV,cAAc;QACd,uBAAuB;QACvB,2BAA2B;QAC3B,gBAAgB;QAChB,oBAAoB;QACpB,mBAAmB,EAAE,qBAAqB;QAC1C,KAAK;QACL,aAAa;QACb,wBAAwB;QACxB,sBAAsB;QACtB,YAAY;QACZ,gBAAgB;QAChB,YAAY;QACZ,MAAM;QACN,SAAS;QACT,YAAY;QACZ,gBAAgB;QAChB,QAAQ;QACR,YAAY;QACZ,cAAc,EAAE,gBAAgB;QAChC,YAAY;QACZ,YAAY;QACZ,yBAAyB,EAAE,2BAA2B;QACtD,WAAW,EAAE,aAAa;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":";;;;;;AA6JA,sCAIC;AAMD,8BAEC;AAYD,sCAEC;AAgGD,8CAqqBC;AA57BD,6CAAsD;AACtD,wDAA8B;AAC9B,4CAA+C;AAC/C,wDAAyD;AACzD,+DAAyE;AAEzE,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAmB7C,+BAA+B;AAE/B,uDAAuD;AACvD,MAAa,mBAAoB,SAAQ,KAAK;IAG5C,YAAY,KAAa,EAAE,OAAe;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AARD,kDAQC;AAED,6EAA6E;AAC7E,MAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,UAAkB,2BAA2B;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AALD,8BAKC;AA0GD,yCAAyC;AAEzC;;;;GAIG;AACH,SAAgB,aAAa,CAAC,SAAS,GAAG,IAAI;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,gFAAgF;AAChF,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,iFAAiF;AACjF,0EAA0E;AAC1E,yBAAyB;AACzB,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,SAAiB,EAAE,MAAc;IAChE,IAAI,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,SAAS,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,IAAI,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,8GAA8G,CAC/G,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2CAA2C;AAE3C,MAAM,WAAW,GAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AAE7E,SAAS,UAAU,CAAC,IAAe;IACjC,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,2CAA2C;AAE3C,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAC9C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACvD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,EACV,6BAA6B,mBAAmB,aAAa,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB,EAAE,YAAoB;IAC1E,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,qCAAqC;AAErC,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAI,EAAoB;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,+BAAgB,IAAI,OAAO,GAAG,WAAW;gBAAE,SAAS;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,IAAqB,EACrB,OAA4B;IAE5B,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IACnE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;IAC7C,MAAM,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,IAAI,MAAM,CAAC,CAAC,SAAS;IAEnF,uBAAuB;IAEvB,SAAS,mBAAmB,CAAC,KAAkB;QAC7C,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjC,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3E,CAAC;IAED,6BAA6B;IAE7B,KAAK,UAAU,UAAU,CAAC,KAAgD;QACxE,MAAM,IAAI,GAAiB;YACzB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,GAAW;QACvE,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,WAAoB;QAC5D,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAc;QAC5E,MAAM,IAAI,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,MAAM,OAAO,GAAsB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;gBAC7D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,QAAgB,EAChB,UAAiC;QAEjC,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7F,MAAM,OAAO,GAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAyB;gBAClC,QAAQ;gBACR,QAAQ,EAAE,IAAI;gBACd,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC3F,GAAG,CAAC,UAAU,EAAE,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;gBACxF,GAAG,CAAC,UAAU,EAAE,uBAAuB,KAAK,SAAS,IAAI,EAAE,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,EAAE,CAAC;gBACzH,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;aAC5F,CAAC;YACF,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE;gBAChE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,2BAA2B,CAAC,MAAc,EAAE,QAAgB;QACzE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7F,MAAM,OAAO,GAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACtD,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE;gBAChE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,+EAA+E;IAC/E,wEAAwE;IACxE,SAAS,kBAAkB,CAAC,MAA4B;QACtD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC/C,OAAO,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,SAAS,gBAAgB,CACvB,MAAc,EACd,MAA4B,EAC5B,gBAAyB;QAEzB,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE;YAClF,gBAAgB;YAChB,UAAU,EAAE,sDAAgC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,WAAmB,EACnB,QAAgB,EAChB,KAAgB,EAChB,SAAkB;QAElB,MAAM,QAAQ,GAAG,SAAS,IAAI,sBAAsB,CAAC;QACrD,MAAM,KAAK,GAAuB;YAChC,4EAA4E;YAC5E,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,YAAY,EAAE,eAAe,CAAC,WAAW,CAAC;YAC1C,QAAQ;YACR,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,+DAA+D;YAC/D,UAAU,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI;YAC7D,gBAAgB,EAAE,QAAQ;SAC3B,CAAC;QACF,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAyB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1F,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,OAAO,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,MAAc;QAChD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB;IAElB,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB;QAClE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAErC,sEAAsE;QACtE,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAE3C,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC9C,QAAQ,CAAC,MAAM,EACf,aAAa,EACb,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,KAAK,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,kFAAkF;IAClF,mFAAmF;IACnF,uFAAuF;IACvF,gEAAgE;IAChE,KAAK,UAAU,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAE,mBAA4B;QAChF,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACvE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+BAA+B;IAE/B,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,qCAAqC;IACrC,2EAA2E;IAC3E,2DAA2D;IAC3D,qFAAqF;IACrF,gEAAgE;IAChE,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,mBAA4B;QACvE,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,aAAa,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACnF,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3C,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,0BAA0B;IAE1B,KAAK,UAAU,wBAAwB,CAAC,MAAc;QACpD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAqB,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,WAAmB;QACvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/F,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB;QAC7D,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,+EAA+E;QAC/E,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,YAAY,CAAC;QAC3E,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,QAAgB;QAC9D,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC3D,OAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB,EAAE,gBAA2B,eAAe;QACzG,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,yFAAyF;QACzF,mFAAmF;QACnF,uEAAuE;QACvE,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,CAAC,CAAC,YAAyB;YAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAChB,OAAO,UAAU,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,yCAAyC;IAEzC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,YAAoB;QACxD,gFAAgF;QAChF,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;YAC3F,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,YAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC3F,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,MAAc;QACrC,0EAA0E;QAC1E,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnC,CAAC,CAAC,QAAQ,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpE,CAAC,CAAC,CAAC,CACN,CAAC;YACF,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,YAAoB;QAC9D,4CAA4C;QAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;YACjG,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;QAC5C,iCAAiC;QACjC,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC5E,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YACnE,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,6BAA6B;IAE7B,yEAAyE;IACzE,kEAAkE;IAClE,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAe;QAC1E,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,6EAA6E;gBAC7E,sEAAsE;gBACtE,8DAA8D;gBAC9D,OAAO,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1F,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,uEAAuE;gBACvE,0BAA0B;gBAC1B,MAAM,CAAC,IAAI,CAAC;oBACV,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;oBACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI;oBACtD,gBAAgB,EAAE,sBAAsB;iBACzC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8BAA8B;IAE9B;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,WAAmB,EAAE,MAAc;QACpF,MAAM,IAAI,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,MAAM,OAAO,GAAsB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/E,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;gBAC7D,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,UAAU,YAAY,CAAC,MAAc;QACxC,MAAM,MAAM,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,mDAAmD;QAC1H,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;QAC5C,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAErC,2DAA2D;QAC3D,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAE3C,0EAA0E;QAC1E,uEAAuE;QACvE,mDAAmD;QACnD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC9C,QAAQ,CAAC,MAAM,EACf,aAAa,EACb,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAChE,CAAC;QACF,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAExC,MAAM,KAAK,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAElC,sBAAsB;QACtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,MAAc;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChF,wEAAwE;QACxE,wEAAwE;QACxE,wBAAwB;QACxB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,MAAM,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEvD,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,qCAAqC;QACrC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC1C,MAAM,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAChD,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CACnE,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1C,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE;oBAC5D,gBAAgB,EAAE,MAAM,CAAC,QAAQ;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3F,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,aAAqB;QAC/D,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,MAAM,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,+BAA+B;IAE/B,MAAM,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,KAAK,CAAC,CAAC,cAAc;IAEnF,KAAK,UAAU,2BAA2B,CAAC,MAAc;QACvD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnF,qDAAqD;QACrD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAExE,yCAAyC;QACzC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC5C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;YACF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE;gBACvE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,KAAa;QACxC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAErC,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAE/B,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC1C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE1E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAE9E,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1D,gCAAgC;YAChC,MAAM,eAAe,CAAC,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,CAAC;QAED,sEAAsE;QACtE,MAAM,eAAe,CAAC,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QACjE,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAC3C,MAAM,EAAE,oBAAoB,CAC7B,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YAC5E,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBAClF,gBAAgB,EAAE,OAAO,CAAC,QAAQ;aACnC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAc,MAAM,EAAE,SAAS,CAAC,CAAC;YACpF,IAAI,CAAC,aAAa;gBAAE,OAAO;YAC3B,MAAM,OAAO,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE;gBACzD,gBAAgB,EAAE,aAAa,CAAC,QAAQ;aACzC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAoB,MAAM,EAAE,eAAe,CAAC,CAAC;YAC7F,IAAI,CAAC,UAAU;gBAAE,OAAO;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC;gBACtE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,UAAuB,EAAE;gBAC1C,CAAC,CAAC,CAAC,CACN,CAAC;YACF,OAAO,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAEtC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,wBAAwB;IAExB,KAAK,UAAU,MAAM,CAAC,KAAkB;QACtC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;SACjD,CAAC,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACpD,MAAM,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,cAAc,EAAE,mBAAmB;QACnC,UAAU;QACV,cAAc;QACd,UAAU;QACV,cAAc;QACd,uBAAuB;QACvB,2BAA2B;QAC3B,gBAAgB;QAChB,oBAAoB;QACpB,mBAAmB,EAAE,qBAAqB;QAC1C,KAAK;QACL,aAAa;QACb,wBAAwB;QACxB,sBAAsB;QACtB,YAAY;QACZ,gBAAgB;QAChB,YAAY;QACZ,MAAM;QACN,SAAS;QACT,YAAY;QACZ,gBAAgB;QAChB,QAAQ;QACR,YAAY;QACZ,cAAc,EAAE,gBAAgB;QAChC,YAAY;QACZ,YAAY;QACZ,yBAAyB,EAAE,2BAA2B;QACtD,WAAW,EAAE,aAAa;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/credential-migration.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The minimal shape of a Prisma property-table delegate the migration needs:
+ * enumerate the rows for a property and update one by id. Both `db.userProperties`
+ * and `db.accountProperties` satisfy it.
+ */
+export interface MigrationDelegate {
+    findMany(args: {
+        where: Record<string, unknown>;
+    }): Promise<Record<string, unknown>[]>;
+    update(args: {
+        where: {
+            id: number;
+        };
+        data: Record<string, unknown>;
+    }): Promise<unknown>;
+}
+/** Result of rehashing one payload: the new payload and whether anything changed. */
+export interface RehashResult {
+    info: unknown;
+    changed: boolean;
+}
+/** Describes one property store the migration knows how to rehash. */
+export interface CredentialStore {
+    /** Human-readable name for the report, e.g. "authorization grants". */
+    label: string;
+    /** The `property` column value whose payload holds raw credentials. */
+    property: string;
+    /** The info_schema tag stamped on a row once it is migrated. */
+    infoSchema: string;
+    /** Rehash a row's payload idempotently. `changed` is true only if a raw value was hashed. */
+    rehash(info: unknown): RehashResult;
+}
+/** Counts from running (or previewing) a store's migration. */
+export interface MigrationReport {
+    property: string;
+    label: string;
+    /** Total rows found for this property. */
+    scanned: number;
+    /** Rows that hold a raw value or lack the migrated tag — i.e. rows that need a write. */
+    needsMigration: number;
+    /** Rows actually written. 0 in report mode; equals needsMigration after a successful run. */
+    migrated: number;
+    /** Whether writes were applied (`run: true`) or this was a read-only report. */
+    run: boolean;
+}
+/**
+ * Rehash the identity keys of an `authorization` payload. Each grant's
+ * `identity_key` is a bearer token compared only for equality, so a raw value is
+ * replaced with `hashToken(value)`; an already-hashed value is left untouched
+ * (idempotent). A non-array payload is returned unchanged.
+ */
+export declare function rehashAuthorizationGrants(info: unknown): RehashResult;
+/** The `authorization` user-property store (boop-j8xc.2). */
+export declare const authorizationStore: CredentialStore;
+/**
+ * Rehash the tokens of a `team_invitations` payload. Each invitation's `token`
+ * is a bearer credential compared only for equality, so a raw value is replaced
+ * with `hashToken(value)`; an already-hashed value is left untouched
+ * (idempotent). A payload without an `invitations` array is returned unchanged.
+ */
+export declare function rehashTeamInvitations(info: unknown): RehashResult;
+/** The `team_invitations` account-property store (boop-j8xc.3). */
+export declare const teamInvitationsStore: CredentialStore;
+/**
+ * Migrate one credential store. Reports by default; writes only when
+ * `opts.run` is true — mirroring `boop loop` and `tools/publish-caps.sh`.
+ *
+ * A row needs migration when its payload still holds a raw value OR its
+ * info_schema lacks the migrated tag (so a payload that is already hashed but
+ * untagged is still stamped, keeping the `boop status` probe truthful). The
+ * write stamps the tag and bumps the revision.
+ */
+export declare function migrateCredentialStore(model: MigrationDelegate, store: CredentialStore, opts?: {
+    run?: boolean;
+}): Promise<MigrationReport>;
+//# sourceMappingURL=credential-migration.d.ts.map

package/dist/credential-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-migration.d.ts","sourceRoot":"","sources":["../src/credential-migration.ts"],"names":[],"mappings":"AAmCA;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1F;AAED,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAAC;CACrC;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,cAAc,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAarE;AAED,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,EAAE,eAKhC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAYjE;AAED,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,EAAE,eAKlC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,eAAe,EACtB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,eAAe,CAAC,CA4B1B"}

package/dist/credential-migration.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.teamInvitationsStore = exports.authorizationStore = void 0;
+exports.rehashAuthorizationGrants = rehashAuthorizationGrants;
+exports.rehashTeamInvitations = rehashTeamInvitations;
+exports.migrateCredentialStore = migrateCredentialStore;
+/**
+ * Credential-hashing migration (boop-j8xc epic).
+ *
+ * A handful of property payloads once stored a raw, redeemable bearer credential
+ * beside its correctly-hashed twin (see boop-owbv). The fixed services now store
+ * the hash and read tolerantly, but existing rows keep the raw value until they
+ * are rewritten. Because the raw value is still present, those rows can be
+ * REHASHED IN PLACE rather than invalidated — so a deployment migrates without
+ * logging every user out or voiding every pending invitation.
+ *
+ * This module is the reusable core of the migration. It is deliberately generic:
+ * each credential store (the `authorization` user-property here, the
+ * `team_invitations` account-property in boop-j8xc.3) is described by a
+ * {@link CredentialStore} and rehashed by the SAME runner — there is no second
+ * tool. A thin CLI (scaffold/src/scripts/migrate-credentials.ts) wires a project's
+ * Prisma client to this core.
+ *
+ * ONE-WAY, NO ROLLBACK. Hashing is irreversible; there is no way back to the raw
+ * values once they are overwritten. Take a database backup before running with
+ * `run: true`. Re-running is safe: idempotency is decided by value shape (a
+ * SHA-256 digest is left untouched, {@link isHashedToken}), so nothing is ever
+ * double-hashed.
+ *
+ * SCOPE BOUNDARY. Provider access/refresh tokens in the `authentication`
+ * property are replayed to Google/Microsoft and must NEVER be hashed. No store
+ * here touches them.
+ */
+const auth_service_js_1 = require("./auth-service.js");
+const info_schema_tags_js_1 = require("./info-schema-tags.js");
+/**
+ * Rehash the identity keys of an `authorization` payload. Each grant's
+ * `identity_key` is a bearer token compared only for equality, so a raw value is
+ * replaced with `hashToken(value)`; an already-hashed value is left untouched
+ * (idempotent). A non-array payload is returned unchanged.
+ */
+function rehashAuthorizationGrants(info) {
+    if (!Array.isArray(info))
+        return { info, changed: false };
+    let changed = false;
+    const grants = info.map((grant) => {
+        if (grant && typeof grant === 'object' && typeof grant.identity_key === 'string') {
+            if (!(0, auth_service_js_1.isHashedToken)(grant.identity_key)) {
+                changed = true;
+                return { ...grant, identity_key: (0, auth_service_js_1.hashToken)(grant.identity_key) };
+            }
+        }
+        return grant;
+    });
+    return { info: grants, changed };
+}
+/** The `authorization` user-property store (boop-j8xc.2). */
+exports.authorizationStore = {
+    label: 'authorization grants',
+    property: 'authorization',
+    infoSchema: info_schema_tags_js_1.AUTHORIZATION_HASHED_INFO_SCHEMA,
+    rehash: rehashAuthorizationGrants,
+};
+/**
+ * Rehash the tokens of a `team_invitations` payload. Each invitation's `token`
+ * is a bearer credential compared only for equality, so a raw value is replaced
+ * with `hashToken(value)`; an already-hashed value is left untouched
+ * (idempotent). A payload without an `invitations` array is returned unchanged.
+ */
+function rehashTeamInvitations(info) {
+    const invitations = info?.invitations;
+    if (!Array.isArray(invitations))
+        return { info, changed: false };
+    let changed = false;
+    const rehashed = invitations.map((inv) => {
+        if (inv && typeof inv === 'object' && typeof inv.token === 'string' && !(0, auth_service_js_1.isHashedToken)(inv.token)) {
+            changed = true;
+            return { ...inv, token: (0, auth_service_js_1.hashToken)(inv.token) };
+        }
+        return inv;
+    });
+    return { info: { ...info, invitations: rehashed }, changed };
+}
+/** The `team_invitations` account-property store (boop-j8xc.3). */
+exports.teamInvitationsStore = {
+    label: 'team invitations',
+    property: 'team_invitations',
+    infoSchema: info_schema_tags_js_1.TEAM_INVITATIONS_HASHED_INFO_SCHEMA,
+    rehash: rehashTeamInvitations,
+};
+/**
+ * Migrate one credential store. Reports by default; writes only when
+ * `opts.run` is true — mirroring `boop loop` and `tools/publish-caps.sh`.
+ *
+ * A row needs migration when its payload still holds a raw value OR its
+ * info_schema lacks the migrated tag (so a payload that is already hashed but
+ * untagged is still stamped, keeping the `boop status` probe truthful). The
+ * write stamps the tag and bumps the revision.
+ */
+async function migrateCredentialStore(model, store, opts = {}) {
+    const run = opts.run ?? false;
+    const rows = await model.findMany({ where: { property: store.property } });
+    let needsMigration = 0;
+    let migrated = 0;
+    for (const row of rows) {
+        const { info, changed } = store.rehash(row.info);
+        const currentTag = row.infoSchema ?? '';
+        const needsWrite = changed || currentTag !== store.infoSchema;
+        if (!needsWrite)
+            continue;
+        needsMigration += 1;
+        if (run) {
+            await model.update({
+                where: { id: row.id },
+                data: {
+                    info: info,
+                    infoSchema: store.infoSchema,
+                    revision: (row.revision ?? 1) + 1,
+                },
+            });
+            migrated += 1;
+        }
+    }
+    return { property: store.property, label: store.label, scanned: rows.length, needsMigration, migrated, run };
+}
+//# sourceMappingURL=credential-migration.js.map

package/dist/credential-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-migration.js","sourceRoot":"","sources":["../src/credential-migration.ts"],"names":[],"mappings":";;;AAmFA,8DAaC;AAgBD,sDAYC;AAmBD,wDAgCC;AA/KD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,uDAA6D;AAC7D,+DAG+B;AA8C/B;;;;;GAKG;AACH,SAAgB,yBAAyB,CAAC,IAAa;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAI,IAA6B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACjF,IAAI,CAAC,IAAA,+BAAa,EAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvC,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAA,2BAAS,EAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,6DAA6D;AAChD,QAAA,kBAAkB,GAAoB;IACjD,KAAK,EAAE,sBAAsB;IAC7B,QAAQ,EAAE,eAAe;IACzB,UAAU,EAAE,sDAAgC;IAC5C,MAAM,EAAE,yBAAyB;CAClC,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,IAAa;IACjD,MAAM,WAAW,GAAI,IAA2C,EAAE,WAAW,CAAC;IAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAmB,EAAE,EAAE;QACvD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAA,+BAAa,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjG,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,IAAA,2BAAS,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,EAAE,GAAI,IAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC;AAC3E,CAAC;AAED,mEAAmE;AACtD,QAAA,oBAAoB,GAAoB;IACnD,KAAK,EAAE,kBAAkB;IACzB,QAAQ,EAAE,kBAAkB;IAC5B,UAAU,EAAE,yDAAmC;IAC/C,MAAM,EAAE,qBAAqB;CAC9B,CAAC;AAEF;;;;;;;;GAQG;AACI,KAAK,UAAU,sBAAsB,CAC1C,KAAwB,EACxB,KAAsB,EACtB,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAE3E,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAI,GAAG,CAAC,UAAqB,IAAI,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,IAAI,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;QAC9D,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,cAAc,IAAI,CAAC,CAAC;QACpB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAY,EAAE;gBAC/B,IAAI,EAAE;oBACJ,IAAI,EAAE,IAA+B;oBACrC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,CAAE,GAAG,CAAC,QAAmB,IAAI,CAAC,CAAC,GAAG,CAAC;iBAC9C;aACF,CAAC,CAAC;YACH,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC/G,CAAC"}

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export { createIdentityService } from './identity-service.js';
 export type { IdentityService, IdentityServiceOptions, IdentityQueryOptions } from './identity-service.js';
 export { createUserPropertyService } from './user-property-service.js';
 export type { UserPropertyService, UserPropertyServiceOptions } from './user-property-service.js';
-export { createAuthService, AuthValidationError, AuthError, generateToken, hashToken } from './auth-service.js';
+export { createAuthService, AuthValidationError, AuthError, generateToken, hashToken, isHashedToken } from './auth-service.js';
 export type { AuthService, AuthServiceDeps, AuthServiceOptions, AddAuthMethodOptions, SignupInput, SignupResult, LoginResult, VerifyEmailResult, } from './auth-service.js';
 export { createAuthMiddleware } from './auth-middleware.js';
 export type { AuthMiddleware, AuthMiddlewareDeps, AuthMiddlewareOptions, AuthLocals, } from './auth-middleware.js';
@@ -24,4 +24,7 @@ export { createAccountManagementService, AccountManagementError } from './accoun
 export type { AccountManagementService, AccountManagementServiceDeps, AccountManagementServiceOptions, ProvisionAccountInput, ProvisionAccountResult, TeamMember, } from './account-management-service.js';
 export { createTeamInvitationService, TeamInvitationError, DEFAULT_INVITATION_TTL_MS, MAX_PENDING_INVITATIONS, MAX_RESENDS, } from './team-invitation-service.js';
 export type { TeamInvitation, TeamInvitationsPropertyInfo, TeamInvitationService, TeamInvitationServiceDeps, TeamInvitationServiceOptions, AccountUserRole, } from './team-invitation-service.js';
+export { AUTHORIZATION_HASHED_INFO_SCHEMA, TEAM_INVITATIONS_HASHED_INFO_SCHEMA, } from './info-schema-tags.js';
+export { migrateCredentialStore, rehashAuthorizationGrants, authorizationStore, rehashTeamInvitations, teamInvitationsStore, } from './credential-migration.js';
+export type { MigrationDelegate, CredentialStore, RehashResult, MigrationReport, } from './credential-migration.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,IAAI,EACJ,YAAY,EACZ,WAAW,EACX,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE3G,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAElG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAChH,YAAY,EACV,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,YAAY,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE3G,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzG,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,+BAA+B,EAC/B,qBAAqB,EACrB,sBAAsB,EACtB,UAAU,GACX,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,GACZ,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,IAAI,EACJ,YAAY,EACZ,WAAW,EACX,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE3G,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAElG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/H,YAAY,EACV,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,YAAY,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE3G,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzG,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,+BAA+B,EAC/B,qBAAqB,EACrB,sBAAsB,EACtB,UAAU,GACX,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,GACZ,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,eAAe,GAChB,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@
  * composing on top of @boopkit/cap-services primitives.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_RESENDS = exports.MAX_PENDING_INVITATIONS = exports.DEFAULT_INVITATION_TTL_MS = exports.TeamInvitationError = exports.createTeamInvitationService = exports.AccountManagementError = exports.createAccountManagementService = exports.createAccountPropertyService = exports.createAccountService = exports.createAuthMiddleware = exports.hashToken = exports.generateToken = exports.AuthError = exports.AuthValidationError = exports.createAuthService = exports.createUserPropertyService = exports.createIdentityService = exports.createUserService = exports.DuplicateAccountUserError = exports.DuplicateIdentityError = void 0;
+exports.teamInvitationsStore = exports.rehashTeamInvitations = exports.authorizationStore = exports.rehashAuthorizationGrants = exports.migrateCredentialStore = exports.TEAM_INVITATIONS_HASHED_INFO_SCHEMA = exports.AUTHORIZATION_HASHED_INFO_SCHEMA = exports.MAX_RESENDS = exports.MAX_PENDING_INVITATIONS = exports.DEFAULT_INVITATION_TTL_MS = exports.TeamInvitationError = exports.createTeamInvitationService = exports.AccountManagementError = exports.createAccountManagementService = exports.createAccountPropertyService = exports.createAccountService = exports.createAuthMiddleware = exports.isHashedToken = exports.hashToken = exports.generateToken = exports.AuthError = exports.AuthValidationError = exports.createAuthService = exports.createUserPropertyService = exports.createIdentityService = exports.createUserService = exports.DuplicateAccountUserError = exports.DuplicateIdentityError = void 0;
 var types_js_1 = require("./types.js");
 Object.defineProperty(exports, "DuplicateIdentityError", { enumerable: true, get: function () { return types_js_1.DuplicateIdentityError; } });
 Object.defineProperty(exports, "DuplicateAccountUserError", { enumerable: true, get: function () { return types_js_1.DuplicateAccountUserError; } });
@@ -22,6 +22,7 @@ Object.defineProperty(exports, "AuthValidationError", { enumerable: true, get: f
 Object.defineProperty(exports, "AuthError", { enumerable: true, get: function () { return auth_service_js_1.AuthError; } });
 Object.defineProperty(exports, "generateToken", { enumerable: true, get: function () { return auth_service_js_1.generateToken; } });
 Object.defineProperty(exports, "hashToken", { enumerable: true, get: function () { return auth_service_js_1.hashToken; } });
+Object.defineProperty(exports, "isHashedToken", { enumerable: true, get: function () { return auth_service_js_1.isHashedToken; } });
 var auth_middleware_js_1 = require("./auth-middleware.js");
 Object.defineProperty(exports, "createAuthMiddleware", { enumerable: true, get: function () { return auth_middleware_js_1.createAuthMiddleware; } });
 var account_service_js_1 = require("./account-service.js");
@@ -37,4 +38,13 @@ Object.defineProperty(exports, "TeamInvitationError", { enumerable: true, get: f
 Object.defineProperty(exports, "DEFAULT_INVITATION_TTL_MS", { enumerable: true, get: function () { return team_invitation_service_js_1.DEFAULT_INVITATION_TTL_MS; } });
 Object.defineProperty(exports, "MAX_PENDING_INVITATIONS", { enumerable: true, get: function () { return team_invitation_service_js_1.MAX_PENDING_INVITATIONS; } });
 Object.defineProperty(exports, "MAX_RESENDS", { enumerable: true, get: function () { return team_invitation_service_js_1.MAX_RESENDS; } });
+var info_schema_tags_js_1 = require("./info-schema-tags.js");
+Object.defineProperty(exports, "AUTHORIZATION_HASHED_INFO_SCHEMA", { enumerable: true, get: function () { return info_schema_tags_js_1.AUTHORIZATION_HASHED_INFO_SCHEMA; } });
+Object.defineProperty(exports, "TEAM_INVITATIONS_HASHED_INFO_SCHEMA", { enumerable: true, get: function () { return info_schema_tags_js_1.TEAM_INVITATIONS_HASHED_INFO_SCHEMA; } });
+var credential_migration_js_1 = require("./credential-migration.js");
+Object.defineProperty(exports, "migrateCredentialStore", { enumerable: true, get: function () { return credential_migration_js_1.migrateCredentialStore; } });
+Object.defineProperty(exports, "rehashAuthorizationGrants", { enumerable: true, get: function () { return credential_migration_js_1.rehashAuthorizationGrants; } });
+Object.defineProperty(exports, "authorizationStore", { enumerable: true, get: function () { return credential_migration_js_1.authorizationStore; } });
+Object.defineProperty(exports, "rehashTeamInvitations", { enumerable: true, get: function () { return credential_migration_js_1.rehashTeamInvitations; } });
+Object.defineProperty(exports, "teamInvitationsStore", { enumerable: true, get: function () { return credential_migration_js_1.teamInvitationsStore; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,uCAA+E;AAAtE,kHAAA,sBAAsB,OAAA;AAAE,qHAAA,yBAAyB,OAAA;AAmB1D,qDAAsD;AAA7C,oHAAA,iBAAiB,OAAA;AAG1B,6DAA8D;AAArD,4HAAA,qBAAqB,OAAA;AAG9B,uEAAuE;AAA9D,qIAAA,yBAAyB,OAAA;AAGlC,qDAAgH;AAAvG,oHAAA,iBAAiB,OAAA;AAAE,sHAAA,mBAAmB,OAAA;AAAE,4GAAA,SAAS,OAAA;AAAE,gHAAA,aAAa,OAAA;AAAE,4GAAA,SAAS,OAAA;AAYpF,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAQ7B,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAG7B,6EAA6E;AAApE,2IAAA,4BAA4B,OAAA;AAGrC,iFAAyG;AAAhG,+IAAA,8BAA8B,OAAA;AAAE,uIAAA,sBAAsB,OAAA;AAU/D,2EAMsC;AALpC,yIAAA,2BAA2B,OAAA;AAC3B,iIAAA,mBAAmB,OAAA;AACnB,uIAAA,yBAAyB,OAAA;AACzB,qIAAA,uBAAuB,OAAA;AACvB,yHAAA,WAAW,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,uCAA+E;AAAtE,kHAAA,sBAAsB,OAAA;AAAE,qHAAA,yBAAyB,OAAA;AAmB1D,qDAAsD;AAA7C,oHAAA,iBAAiB,OAAA;AAG1B,6DAA8D;AAArD,4HAAA,qBAAqB,OAAA;AAG9B,uEAAuE;AAA9D,qIAAA,yBAAyB,OAAA;AAGlC,qDAA+H;AAAtH,oHAAA,iBAAiB,OAAA;AAAE,sHAAA,mBAAmB,OAAA;AAAE,4GAAA,SAAS,OAAA;AAAE,gHAAA,aAAa,OAAA;AAAE,4GAAA,SAAS,OAAA;AAAE,gHAAA,aAAa,OAAA;AAYnG,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAQ7B,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAG7B,6EAA6E;AAApE,2IAAA,4BAA4B,OAAA;AAGrC,iFAAyG;AAAhG,+IAAA,8BAA8B,OAAA;AAAE,uIAAA,sBAAsB,OAAA;AAU/D,2EAMsC;AALpC,yIAAA,2BAA2B,OAAA;AAC3B,iIAAA,mBAAmB,OAAA;AACnB,uIAAA,yBAAyB,OAAA;AACzB,qIAAA,uBAAuB,OAAA;AACvB,yHAAA,WAAW,OAAA;AAWb,6DAG+B;AAF7B,uIAAA,gCAAgC,OAAA;AAChC,0IAAA,mCAAmC,OAAA;AAGrC,qEAMmC;AALjC,iIAAA,sBAAsB,OAAA;AACtB,oIAAA,yBAAyB,OAAA;AACzB,6HAAA,kBAAkB,OAAA;AAClB,gIAAA,qBAAqB,OAAA;AACrB,+HAAA,oBAAoB,OAAA"}

package/dist/info-schema-tags.d.ts

@@ -0,0 +1,21 @@
+/**
+ * info_schema tags that mark a property payload as written by the
+ * credential-hashing library (boop-j8xc epic).
+ *
+ * Both property tables carry an `info_schema` column that versions the payload
+ * shape. For most properties it stays `''`. The two properties that once stored
+ * a raw, redeemable credential get a distinct tag the moment their values are
+ * hashed — stamped by the fixed library on every new write and by the migration
+ * tool on every row it rewrites (boop-j8xc.2 and boop-j8xc.3).
+ *
+ * The `boop status` data probe uses these tags as a fast, exact migration
+ * signal: a row missing the tag predates the fix and may hold a cleartext
+ * credential, so the probe needs no JSON parsing — one column comparison with
+ * an early exit. Keep each literal in sync with the matching probe query in
+ * `capability.json`.
+ */
+/** Stamped on the `authorization` user-property once its grants store hashed identity keys. */
+export declare const AUTHORIZATION_HASHED_INFO_SCHEMA = "authorization-hashed-01";
+/** Stamped on the `team_invitations` account-property once its tokens are stored hashed. */
+export declare const TEAM_INVITATIONS_HASHED_INFO_SCHEMA = "team-invitations-hashed-01";
+//# sourceMappingURL=info-schema-tags.d.ts.map

package/dist/info-schema-tags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"info-schema-tags.d.ts","sourceRoot":"","sources":["../src/info-schema-tags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,+FAA+F;AAC/F,eAAO,MAAM,gCAAgC,4BAA4B,CAAC;AAE1E,4FAA4F;AAC5F,eAAO,MAAM,mCAAmC,+BAA+B,CAAC"}

package/dist/info-schema-tags.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * info_schema tags that mark a property payload as written by the
+ * credential-hashing library (boop-j8xc epic).
+ *
+ * Both property tables carry an `info_schema` column that versions the payload
+ * shape. For most properties it stays `''`. The two properties that once stored
+ * a raw, redeemable credential get a distinct tag the moment their values are
+ * hashed — stamped by the fixed library on every new write and by the migration
+ * tool on every row it rewrites (boop-j8xc.2 and boop-j8xc.3).
+ *
+ * The `boop status` data probe uses these tags as a fast, exact migration
+ * signal: a row missing the tag predates the fix and may hold a cleartext
+ * credential, so the probe needs no JSON parsing — one column comparison with
+ * an early exit. Keep each literal in sync with the matching probe query in
+ * `capability.json`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEAM_INVITATIONS_HASHED_INFO_SCHEMA = exports.AUTHORIZATION_HASHED_INFO_SCHEMA = void 0;
+/** Stamped on the `authorization` user-property once its grants store hashed identity keys. */
+exports.AUTHORIZATION_HASHED_INFO_SCHEMA = 'authorization-hashed-01';
+/** Stamped on the `team_invitations` account-property once its tokens are stored hashed. */
+exports.TEAM_INVITATIONS_HASHED_INFO_SCHEMA = 'team-invitations-hashed-01';
+//# sourceMappingURL=info-schema-tags.js.map

package/dist/info-schema-tags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"info-schema-tags.js","sourceRoot":"","sources":["../src/info-schema-tags.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,+FAA+F;AAClF,QAAA,gCAAgC,GAAG,yBAAyB,CAAC;AAE1E,4FAA4F;AAC/E,QAAA,mCAAmC,GAAG,4BAA4B,CAAC"}

package/dist/team-invitation-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"team-invitation-service.d.ts","sourceRoot":"","sources":["../src/team-invitation-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAK7D,eAAO,MAAM,yBAAyB,QAA0B,CAAC;AACjE,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,YAAY,QAA2B,CAAC;AASrD,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IACzD,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B;AAID,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAID,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7D,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpE,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF;;;;OAIG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CAC/E;AAID,MAAM,WAAW,yBAAyB;IACxC,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,cAAc,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;IAChD,eAAe,EAAE,eAAe,CAAC;CAClC;AAID,MAAM,WAAW,4BAA4B;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,yBAAyB,EAC/B,OAAO,CAAC,EAAE,4BAA4B,GACrC,qBAAqB,CAmQvB"}
+{"version":3,"file":"team-invitation-service.d.ts","sourceRoot":"","sources":["../src/team-invitation-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,eAAO,MAAM,yBAAyB,QAA0B,CAAC;AACjE,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,YAAY,QAA2B,CAAC;AAsCrD,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IACzD,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B;AAID,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAID,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7D,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpE,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF;;;;OAIG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CAC/E;AAID,MAAM,WAAW,yBAAyB;IACxC,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,cAAc,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;IAChD,eAAe,EAAE,eAAe,CAAC;CAClC;AAID,MAAM,WAAW,4BAA4B;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,yBAAyB,EAC/B,OAAO,CAAC,EAAE,4BAA4B,GACrC,qBAAqB,CA0QvB"}

package/dist/team-invitation-service.js

@@ -3,7 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TeamInvitationError = exports.PRUNE_AGE_MS = exports.PRUNE_THRESHOLD = exports.MAX_RESENDS = exports.MAX_PENDING_INVITATIONS = exports.DEFAULT_INVITATION_TTL_MS = void 0;
 exports.createTeamInvitationService = createTeamInvitationService;
 const auth_service_js_1 = require("./auth-service.js");
+const info_schema_tags_js_1 = require("./info-schema-tags.js");
 const cap_services_1 = require("@boopkit/cap-services");
+const logger_1 = require("@boopkit/logger");
+const logger = (0, logger_1.createLogger)('users', 'invitations');
 // ---------- Constants ----------
 exports.DEFAULT_INVITATION_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
 exports.MAX_PENDING_INVITATIONS = 20;
@@ -11,9 +14,35 @@ exports.MAX_RESENDS = 3;
 exports.PRUNE_THRESHOLD = 100;
 exports.PRUNE_AGE_MS = 90 * 24 * 60 * 60 * 1000; // 90 days
 const PROPERTY = 'team_invitations';
-const SCHEMA = 'team-invitations-01';
 const MAX_CONCURRENCY_RETRIES = 3;
 const TERMINAL_STATUSES = new Set(['accepted', 'cancelled', 'expired']);
+// An invitation token is a bearer credential: presenting it joins the account at
+// the role the invitation grants. The stored `token` is therefore hashed, exactly
+// as session cookies and API keys are — the raw value is emailed to the invitee
+// once and never persisted. The read path hashes the presented token before
+// comparing. Rows written before this fix stored the RAW token, and boop cannot
+// know whether a downstream has run the migration, so the read tolerates BOTH
+// forms permanently. The raw branch logs once per process to nudge an operator
+// toward the migration; it goes quiet on its own once the data is hashed.
+let warnedRawInvitation = false;
+/**
+ * Does a stored invitation `storedToken` correspond to the raw `rawToken` a
+ * caller presented? Matches the hashed form (new writes and migrated rows) and
+ * the raw form (pre-hash rows). The raw branch warns once per process. Mirrors
+ * `grantMatchesIdentityKey` in auth-service, for the same reason.
+ */
+function invitationMatchesToken(storedToken, rawToken) {
+    if (storedToken === (0, auth_service_js_1.hashToken)(rawToken))
+        return true;
+    if (storedToken === rawToken && !(0, auth_service_js_1.isHashedToken)(storedToken)) {
+        if (!warnedRawInvitation) {
+            warnedRawInvitation = true;
+            logger.warn('invitation matched a raw (pre-hash) token; run the credential-hashing migration to rehash it');
+        }
+        return true;
+    }
+    return false;
+}
 // ---------- Errors ----------
 class TeamInvitationError extends Error {
     constructor(message) {
@@ -57,7 +86,7 @@ function createTeamInvitationService(deps, options) {
     }
     async function saveInvitations(accountId, invitations, expectedRevision) {
         pruneTerminalInvitations(invitations);
-        await accountPropertyService.put(accountId, PROPERTY, { invitations }, { infoSchema: SCHEMA, expectedRevision });
+        await accountPropertyService.put(accountId, PROPERTY, { invitations }, { infoSchema: info_schema_tags_js_1.TEAM_INVITATIONS_HASHED_INFO_SCHEMA, expectedRevision });
     }
     /**
      * Retry a read-modify-write operation on StaleEntityError (optimistic concurrency conflict).
@@ -129,9 +158,11 @@ function createTeamInvitationService(deps, options) {
                 throw new TeamInvitationError(`Maximum of ${maxPending} pending invitations reached`);
             }
             const now = new Date();
+            // The raw token is emailed to the invitee; only its hash is persisted.
+            const rawToken = (0, auth_service_js_1.generateToken)();
             const invitation = {
                 id: (0, auth_service_js_1.generateToken)(),
-                token: (0, auth_service_js_1.generateToken)(),
+                token: (0, auth_service_js_1.hashToken)(rawToken),
                 email: normalizedEmail,
                 role,
                 status: 'pending',
@@ -143,7 +174,8 @@ function createTeamInvitationService(deps, options) {
             };
             snapshot.invitations.push(invitation);
             await saveInvitations(accountId, snapshot.invitations, snapshot.revision);
-            return invitation;
+            // Hand the caller the RAW token to email; the stored record keeps only the hash.
+            return { ...invitation, token: rawToken };
         });
     }
     async function cancelInvitation(accountId, invitationId) {
@@ -171,11 +203,13 @@ function createTeamInvitationService(deps, options) {
             if (inv.resendCount >= maxResends) {
                 throw new TeamInvitationError(`Maximum of ${maxResends} resends reached for this invitation`);
             }
-            inv.token = (0, auth_service_js_1.generateToken)();
+            // Mint a fresh raw token, persist only its hash, and email the raw value.
+            const rawToken = (0, auth_service_js_1.generateToken)();
+            inv.token = (0, auth_service_js_1.hashToken)(rawToken);
             inv.expiresAt = new Date(Date.now() + invitationTtl).toISOString();
             inv.resendCount += 1;
             await saveInvitations(accountId, snapshot.invitations, snapshot.revision);
-            return inv;
+            return { ...inv, token: rawToken };
         });
     }
     /**
@@ -188,7 +222,7 @@ function createTeamInvitationService(deps, options) {
             const snapshot = await loadInvitations(accountId);
             applyLazyExpiry(snapshot.invitations);
             const now = new Date().toISOString();
-            const inv = snapshot.invitations.find((i) => i.token === token && i.status === 'pending');
+            const inv = snapshot.invitations.find((i) => i.status === 'pending' && invitationMatchesToken(i.token, token));
             if (!inv) {
                 throw new TeamInvitationError('Invalid or expired invitation token');
             }
@@ -206,7 +240,7 @@ function createTeamInvitationService(deps, options) {
     }
     async function findByToken(accountId, token) {
         const all = await getInvitations(accountId);
-        return all.find((i) => i.token === token && i.status === 'pending') ?? null;
+        return all.find((i) => i.status === 'pending' && invitationMatchesToken(i.token, token)) ?? null;
     }
     /**
      * Resolve emails for account members by looking up identities in the 'email' domain.

package/dist/team-invitation-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"team-invitation-service.js","sourceRoot":"","sources":["../src/team-invitation-service.ts"],"names":[],"mappings":";;;AA8FA,kEAsQC;AApWD,uDAAkD;AAKlD,wDAAyD;AAEzD,kCAAkC;AAErB,QAAA,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAC9D,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAC7B,QAAA,WAAW,GAAG,CAAC,CAAC;AAChB,QAAA,eAAe,GAAG,GAAG,CAAC;AACtB,QAAA,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAEhE,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAyB7F,+BAA+B;AAE/B,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AA0CD,gCAAgC;AAEhC,SAAgB,2BAA2B,CACzC,IAA+B,EAC/B,OAAsC;IAEtC,MAAM,EAAE,sBAAsB,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IACzE,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,iCAAyB,CAAC;IAC1E,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,+BAAuB,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,mBAAW,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,uBAAe,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,oBAAY,CAAC;IAOvD,KAAK,UAAU,eAAe,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAC7C,SAAS,EACT,QAAQ,CACT,CAAC;QACF,OAAO;YACL,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE;YAC5C,QAAQ,EAAE,MAAM,EAAE,QAAQ;SAC3B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,SAAS,wBAAwB,CAAC,WAA6B;QAC7D,IAAI,WAAW,CAAC,MAAM,IAAI,cAAc;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBAChE,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,WAA6B,EAC7B,gBAAoC;QAEpC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,sBAAsB,CAAC,GAAG,CAC9B,SAAS,EACT,QAAQ,EACR,EAAE,WAAW,EAAE,EACf,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,SAAS,CAAI,EAAoB;QAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,uBAAuB,EAAE,OAAO,EAAE,EAAE,CAAC;YACpE,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,EAAE,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,+BAAgB,IAAI,OAAO,GAAG,uBAAuB,EAAE,CAAC;oBACzE,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,wCAAwC;QACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,gFAAgF;IAChF,SAAS,eAAe,CAAC,WAA6B;QACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,SAAiB;QAC7C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,+BAAgB,CAAC;oBAAE,MAAM,GAAG,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,qBAAqB,CAAC,SAAiB;QACpD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,KAAa,EACb,IAAqB,EACrB,SAA2C;QAE3C,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAEnD,oFAAoF;QACpF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,eAAe,sCAAsC,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAE/E,0BAA0B;YAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,eAAe,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,eAAe,EAAE,CAAC,CAAC;YAC9F,CAAC;YAED,oBAAoB;YACpB,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mBAAmB,CAAC,cAAc,UAAU,8BAA8B,CAAC,CAAC;YACxF,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,UAAU,GAAmB;gBACjC,EAAE,EAAE,IAAA,+BAAa,GAAE;gBACnB,KAAK,EAAE,IAAA,+BAAa,GAAE;gBACtB,KAAK,EAAE,eAAe;gBACtB,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,eAAe,EAAE,SAAS,CAAC,MAAM;gBACjC,aAAa,EAAE,SAAS,CAAC,IAAI;gBAC7B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE;gBAChE,WAAW,EAAE,CAAC;aACf,CAAC;YAEF,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,YAAoB;QACrE,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,cAAc,YAAY,YAAY,CAAC,CAAC;YAEhF,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;YACzB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,YAAoB;QACrE,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,cAAc,YAAY,YAAY,CAAC,CAAC;YAEhF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,GAAG,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,mBAAmB,CAAC,cAAc,UAAU,sCAAsC,CAAC,CAAC;YAChG,CAAC;YAED,GAAG,CAAC,KAAK,GAAG,IAAA,+BAAa,GAAE,CAAC;YAC5B,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC;YACrB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,KAAa,EACb,eAAuB;QAEvB,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAE1F,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;gBACvB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC1E,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;YAC1D,CAAC;YAED,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;YACxB,GAAG,CAAC,gBAAgB,GAAG,eAAe,CAAC;YACvC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,KAAa;QACzD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,iBAAiB,CAC9B,KAAgC;QAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACjE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,cAAc;QACd,qBAAqB;QACrB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,WAAW;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"team-invitation-service.js","sourceRoot":"","sources":["../src/team-invitation-service.ts"],"names":[],"mappings":";;;AA+HA,kEA6QC;AA5YD,uDAA4E;AAC5E,+DAA4E;AAK5E,wDAAyD;AACzD,4CAA+C;AAE/C,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEpD,kCAAkC;AAErB,QAAA,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAC9D,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAC7B,QAAA,WAAW,GAAG,CAAC,CAAC;AAChB,QAAA,eAAe,GAAG,GAAG,CAAC;AACtB,QAAA,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAEhE,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7F,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,WAAmB,EAAE,QAAgB;IACnE,IAAI,WAAW,KAAK,IAAA,2BAAS,EAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAA,+BAAa,EAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,mBAAmB,GAAG,IAAI,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAyBD,+BAA+B;AAE/B,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AA0CD,gCAAgC;AAEhC,SAAgB,2BAA2B,CACzC,IAA+B,EAC/B,OAAsC;IAEtC,MAAM,EAAE,sBAAsB,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IACzE,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,iCAAyB,CAAC;IAC1E,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,+BAAuB,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,mBAAW,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,uBAAe,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,oBAAY,CAAC;IAOvD,KAAK,UAAU,eAAe,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAC7C,SAAS,EACT,QAAQ,CACT,CAAC;QACF,OAAO;YACL,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE;YAC5C,QAAQ,EAAE,MAAM,EAAE,QAAQ;SAC3B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,SAAS,wBAAwB,CAAC,WAA6B;QAC7D,IAAI,WAAW,CAAC,MAAM,IAAI,cAAc;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBAChE,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,WAA6B,EAC7B,gBAAoC;QAEpC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,sBAAsB,CAAC,GAAG,CAC9B,SAAS,EACT,QAAQ,EACR,EAAE,WAAW,EAAE,EACf,EAAE,UAAU,EAAE,yDAAmC,EAAE,gBAAgB,EAAE,CACtE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,SAAS,CAAI,EAAoB;QAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,uBAAuB,EAAE,OAAO,EAAE,EAAE,CAAC;YACpE,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,EAAE,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,+BAAgB,IAAI,OAAO,GAAG,uBAAuB,EAAE,CAAC;oBACzE,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,wCAAwC;QACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,gFAAgF;IAChF,SAAS,eAAe,CAAC,WAA6B;QACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,SAAiB;QAC7C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,+BAAgB,CAAC;oBAAE,MAAM,GAAG,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,qBAAqB,CAAC,SAAiB;QACpD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,KAAa,EACb,IAAqB,EACrB,SAA2C;QAE3C,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAEnD,oFAAoF;QACpF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,eAAe,sCAAsC,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAE/E,0BAA0B;YAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,eAAe,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,eAAe,EAAE,CAAC,CAAC;YAC9F,CAAC;YAED,oBAAoB;YACpB,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mBAAmB,CAAC,cAAc,UAAU,8BAA8B,CAAC,CAAC;YACxF,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,uEAAuE;YACvE,MAAM,QAAQ,GAAG,IAAA,+BAAa,GAAE,CAAC;YACjC,MAAM,UAAU,GAAmB;gBACjC,EAAE,EAAE,IAAA,+BAAa,GAAE;gBACnB,KAAK,EAAE,IAAA,2BAAS,EAAC,QAAQ,CAAC;gBAC1B,KAAK,EAAE,eAAe;gBACtB,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,eAAe,EAAE,SAAS,CAAC,MAAM;gBACjC,aAAa,EAAE,SAAS,CAAC,IAAI;gBAC7B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE;gBAChE,WAAW,EAAE,CAAC;aACf,CAAC;YAEF,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,iFAAiF;YACjF,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,YAAoB;QACrE,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,cAAc,YAAY,YAAY,CAAC,CAAC;YAEhF,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;YACzB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,YAAoB;QACrE,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,cAAc,YAAY,YAAY,CAAC,CAAC;YAEhF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,GAAG,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,mBAAmB,CAAC,cAAc,UAAU,sCAAsC,CAAC,CAAC;YAChG,CAAC;YAED,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,IAAA,+BAAa,GAAE,CAAC;YACjC,GAAG,CAAC,KAAK,GAAG,IAAA,2BAAS,EAAC,QAAQ,CAAC,CAAC;YAChC,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC;YACrB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,KAAa,EACb,eAAuB;QAEvB,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CACxE,CAAC;YAEF,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;gBACvB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC1E,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;YAC1D,CAAC;YAED,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;YACxB,GAAG,CAAC,gBAAgB,GAAG,eAAe,CAAC;YACvC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,KAAa;QACzD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;IACnG,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,iBAAiB,CAC9B,KAAgC;QAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACjE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,cAAc;QACd,qBAAqB;QACrB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boopkit/cap-users",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "User accounts, authentication, and session management via Prisma",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/scaffold/reference/user-auth.ref.md

@@ -130,7 +130,7 @@ An API key is simultaneously an identity, a credential, and a bearer token. All
 | **Identity** | `domain: "api-key", key: "a3f1..."` — the SHA-256 of the key, as the cookie domain holds a session token. Lookup hashes the presented key and searches for that |
 | **Authentication** | `{ strategy: "api-key", accepted: true }` — user can use API keys |
 | **Credentials** | `{ strategy: "api-key", secret: "$2b$..." }` — bcrypt hash of the key |
-| **Authorization** | `{ identity_key: "47ZHJY-...", strategy: "api-key", trust: "authenticated", expires_at: 0 }` — standing per-key grant, still keyed on the **raw** key |
+| **Authorization** | `{ identity_key: "a3f1...", strategy: "api-key", trust: "authenticated", expires_at: 0 }` — standing per-key grant, keyed on `hashToken(key)` (the same hash the identity row holds) |
 
 **Three independent levers to control access:**
 1. **Revoke the key** — end-date the identity. Immediate.
@@ -258,9 +258,23 @@ The raw key is returned once and is not what `user_identities` holds: the row st
 To authenticate an HTTP request with one, mount `resolveBearer` — it reads `Authorization: Bearer <key>`, sets the same `req.user` the cookie path yields, and answers `401 { error: 'invalid_token' }` with a `WWW-Authenticate: Bearer` challenge when the token does not resolve.
 It never falls back to the session cookie, so revoking a key stops the request even from a browser that still holds a session.
 
-> The authorization *grant* still records the raw key as its `identity_key`, because that is the value callers pass to `isAuthorized` and `getTrustTier` and session grants store their token the same way.
-> `resolveBearer` depends on this: it records the presented raw key as `req.sessionToken` so the gate's `isAuthorized` call finds the per-key grant. Hashing the grant key and this middleware are two halves of one contract — change one and you must change the other.
-> Fixing that half consistently — grants and sessions together, with a migration that rehashes rather than logging everyone out — is tracked separately.
+> The authorization *grant* records `hashToken(key)` as its `identity_key`, never the raw key — the same treatment the identity row and credential entry get. Session grants store their token the same way. `identity_key` is only ever compared for equality, so `setAuthorization` hashes the value it is handed, and `isAuthorized` / `getTrustTier` hash the raw token a caller presents before comparing. The raw value never lands in the readable `authorization` property.
+> `resolveBearer` still records the presented **raw** key as `req.sessionToken`, and the gate calls `isAuthorized(user.id, req.sessionToken, …)`. That keeps working because `isAuthorized` hashes its argument — so the call site does **not** hash, and must not: hashing at both ends would double-hash and never match.
+
+### Migrating existing deployments
+
+A deployment that stored grants before this fix keeps a raw session token or API key in each `authorization` row. The read path tolerates the old form permanently — it matches either `identity_key === hashToken(token)` or `identity_key === token` — so **nobody is logged out by upgrading**. The first time a raw grant is matched, the service logs one warning per process nudging you to migrate; it goes quiet on its own once the data is hashed.
+
+`boop status` flags the un-migrated rows (its probe checks that every `authorization` row carries the `authorization-hashed-01` info_schema tag). To clear them, rehash in place:
+
+```bash
+npm run credentials:migrate            # REPORT ONLY — counts what would change, writes nothing
+npm run credentials:migrate -- --run   # apply the rehash
+```
+
+The same tool and command also rehash **team invitation tokens**. An invitation token is a bearer credential — presenting it joins the account at the role the invitation grants — so it is hashed at rest exactly as session cookies and API keys are: the raw token is emailed to the invitee once and only its hash is stored in the `team_invitations` account-property, and `acceptInvitation` / `findByToken` hash the presented token before comparing. The read path tolerates a pre-fix row whose stored token is still raw (matching `token === hashToken(presented)` or `token === presented`), so **no pending invitation is voided by upgrading**, and it warns once per process until the data is migrated. `boop status` has a matching probe (every `team_invitations` row must carry the `team-invitations-hashed-01` tag), and the migration run above stamps it.
+
+Because the raw values are still present, the tool rehashes them in place rather than invalidating them — every session, standing key, and pending invitation keeps working. It is **one-way and has no rollback**: once a row is rewritten the raw value is gone, so **take a database backup before `--run`**. Re-running is safe: a value that is already a SHA-256 digest is left untouched, so nothing is ever double-hashed.
 
 **Trust queries**: `getTrustTier(userId, identityKey)`, `isAuthorized(userId, identityKey, requiredTrust?)`.
 

package/scaffold/src/scripts/migrate-credentials.ts

@@ -0,0 +1,69 @@
+// @boopkit/cap-users template — Rehash cleartext credentials stored in property
+// tables (boop-j8xc credential-hashing epic).
+//
+// Some property payloads once stored a raw, redeemable bearer credential beside
+// its correctly-hashed twin: session tokens and API keys in the `authorization`
+// user-property (and, once cap-users ships it, invitation tokens in the
+// `team_invitations` account-property). The upgraded services store the hash and
+// read tolerantly, but existing rows keep the raw value until they are rewritten.
+// This script rehashes them IN PLACE, so no user is logged out and no pending
+// invitation is voided.
+//
+// Usage:
+//   npm run credentials:migrate            # REPORT ONLY — counts what would change, writes nothing
+//   npm run credentials:migrate -- --run   # apply the rehash
+//
+// ⚠️  ONE-WAY, NO ROLLBACK. Hashing is irreversible — once a row is rewritten the
+//     raw value is gone for good. TAKE A DATABASE BACKUP before running --run.
+//
+// Safe to re-run: idempotency is decided by value shape (a SHA-256 digest is left
+// untouched), so a value is never double-hashed. Provider access/refresh tokens
+// in the `authentication` property are never touched — they are replayed to
+// Google/Microsoft and must stay raw.
+
+import { migrateCredentialStore, authorizationStore, teamInvitationsStore, type CredentialStore, type MigrationDelegate } from '@boopkit/cap-users';
+import db from '../db';
+
+const run = process.argv.includes('--run');
+
+// The stores this deployment migrates — the same runner drives every one:
+//   - `authorization` user-property: raw session tokens and API keys (boop-j8xc.2)
+//   - `team_invitations` account-property: raw invitation tokens (boop-j8xc.3)
+const targets: { model: MigrationDelegate; store: CredentialStore }[] = [
+  { model: db.userProperty as unknown as MigrationDelegate, store: authorizationStore },
+  { model: db.accountProperty as unknown as MigrationDelegate, store: teamInvitationsStore },
+];
+
+async function main() {
+  if (!run) {
+    console.log('=== REPORT ONLY (no writes) — pass --run to apply ===\n');
+  } else {
+    console.log('=== APPLYING migration (--run) ===\n');
+  }
+
+  let totalPending = 0;
+  for (const { model, store } of targets) {
+    const report = await migrateCredentialStore(model, store, { run });
+    totalPending += report.needsMigration;
+    const action = run ? `rehashed ${report.migrated}` : `${report.needsMigration} would be rehashed`;
+    console.log(
+      `${store.label}: scanned ${report.scanned}, ${action} ` +
+        `(${report.scanned - report.needsMigration} already migrated)`,
+    );
+  }
+
+  if (!run && totalPending > 0) {
+    console.log(`\n${totalPending} row(s) hold a raw credential. Back up your database, then re-run with --run.`);
+  } else if (run) {
+    console.log('\nDone. All targeted rows are hashed and tagged.');
+  } else {
+    console.log('\nNothing to migrate — every targeted row is already hashed.');
+  }
+}
+
+main()
+  .catch((err) => {
+    console.error('Migration failed:', err);
+    process.exitCode = 1;
+  })
+  .finally(() => db.$disconnect());