@cat-factory/kernel 0.243.1 → 0.245.0

package/dist/ports/agent-tools.d.ts

@@ -1,4 +1,4 @@
-import type { McpSecretRef } from '../domain/agent-capabilities.js';
+import type { McpOAuthConfig, McpSecretRef } from '../domain/agent-capabilities.js';
 /**
  * WHAT a credential is being resolved for. A discriminated subject rather than a bare id,
  * because two different registries mint these ids and nothing stops them colliding: a
@@ -56,4 +56,66 @@ export interface ToolSecretResolver {
         keys: McpSecretRef[];
     }): Promise<Record<string, string>>;
 }
+/**
+ * What an {@link McpOAuthTokenSource} answered for one dispatch. A DISCRIMINATED result rather
+ * than a nullable token, because the three outcomes need three different things said: a working
+ * header, "nobody has authorised this board", and "we hold a grant and it did not produce a
+ * token". Collapsing the last two into a bare absence is the "absent and zero must never render
+ * the same" rule applied to a credential — the first is a person pressing Connect and the second
+ * is an outage or a revocation.
+ */
+export type McpOAuthTokenResult = 
+/** A live access token, already folded into the header its declaration named. */
+{
+    status: 'ok';
+    header: string;
+    value: string;
+}
+/**
+ * `authorization_code` only: this workspace holds no grant for this server. Not an error and
+ * not transient — the remedy is the grant flow, and the dispatch states it to the agent as
+ * `oauth_not_connected`.
+ */
+ | {
+    status: 'not_connected';
+}
+/**
+ * A grant (or a client-credentials client) is on file and no access token came out of it: the
+ * refresh token was revoked or expired, the authorization server refused or was unreachable, the
+ * client secret did not resolve, or discovery failed. `error` is operator-facing prose, already
+ * scrubbed at the emit site.
+ */
+ | {
+    status: 'token_failed';
+    error: string;
+};
+/**
+ * Mints the access token a remote (`http`) tool server's OAuth declaration asks for, per dispatch.
+ *
+ * A PORT rather than a direct call for the same reason {@link ToolSecretResolver} is one: the
+ * grant lives in a sealed per-workspace store that only a facade can build (it needs the
+ * deployment's `ENCRYPTION_KEY`), while the code that decides what a dispatch carries is
+ * runtime-neutral. A facade that wired no store passes nothing, and every OAuth server is then
+ * reported to the agent as unavailable rather than dispatched with no `Authorization` header,
+ * which would surface as the server 401ing mid-run.
+ *
+ * Contract: called once per dispatch per server, never throws (a failure is a `token_failed`
+ * result), and the value it returns is written STRAIGHT into the job body's `mcpServers` field. It
+ * never touches `AgentRunContext`, a prompt, or the telemetry snapshot — the same channel a
+ * resolved `secretKeys` value rides, for the same reason.
+ *
+ * Refreshing is this port's business, not its caller's: the implementation decides whether the
+ * stored access token is still usable and exchanges the refresh token when it is not.
+ */
+export interface McpOAuthTokenSource {
+    accessToken(input: {
+        workspaceId: string;
+        /** The tool server's id — the grant is stored per (workspace, server). */
+        serverId: string;
+        /** The remote server's url, which is the default `resource` indicator and discovery root. */
+        serverUrl: string;
+        /** The declaration's OAuth half. */
+        oauth: McpOAuthConfig;
+    }): Promise<McpOAuthTokenResult>;
+}
 //# sourceMappingURL=agent-tools.d.ts.map

package/dist/ports/agent-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-tools.d.ts","sourceRoot":"","sources":["../../src/ports/agent-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAEnE;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB;AAC3B,8EAA8E;AAC5E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE;AACrC;;;;GAIG;GACD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,KAAK,EAAE;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,wFAAwF;QACxF,OAAO,EAAE,iBAAiB,CAAA;QAC1B,wCAAwC;QACxC,IAAI,EAAE,YAAY,EAAE,CAAA;KACrB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACpC"}
+{"version":3,"file":"agent-tools.d.ts","sourceRoot":"","sources":["../../src/ports/agent-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAEnF;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB;AAC3B,8EAA8E;AAC5E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE;AACrC;;;;GAIG;GACD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,KAAK,EAAE;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,wFAAwF;QACxF,OAAO,EAAE,iBAAiB,CAAA;QAC1B,wCAAwC;QACxC,IAAI,EAAE,YAAY,EAAE,CAAA;KACrB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACpC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB;AAC7B,iFAAiF;AAC/E;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AACjD;;;;GAIG;GACD;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE;AAC7B;;;;;GAKG;GACD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,MAAM,CAAA;QACnB,0EAA0E;QAC1E,QAAQ,EAAE,MAAM,CAAA;QAChB,6FAA6F;QAC7F,SAAS,EAAE,MAAM,CAAA;QACjB,oCAAoC;QACpC,KAAK,EAAE,cAAc,CAAA;KACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;CACjC"}

package/dist/ports/audit.d.ts

@@ -0,0 +1,139 @@
+import type { AuditAction, AuditActorKind, AuditEventDetails, AuditTargetType, RetiredAuditValue } from '@cat-factory/contracts';
+/** WHO performed an audited action. */
+export type AuditActor = 
+/** A signed-in user, by internal id (`usr_*`). */
+{
+    kind: Extract<AuditActorKind, 'user'>;
+    userId: string;
+}
+/**
+ * A public-API key, by key id. Deliberately NOT the user who minted the key: attributing a
+ * key's actions to that person would make a leaked key indistinguishable from them.
+ */
+ | {
+    kind: Extract<AuditActorKind, 'apiKey'>;
+    apiKeyId: string;
+}
+/**
+ * The engine, with no human in the loop. ASSERTED by an engine-internal caller, never a
+ * fallback for an unresolved user: "the engine did it" and "we lost track of who did it" are
+ * different facts, and a log that renders them identically misattributes a human action.
+ */
+ | {
+    kind: Extract<AuditActorKind, 'system'>;
+};
+/**
+ * One audited action, as its writer states it.
+ *
+ * **`details` carries no secret material and no PROSE.** The values are machine-readable fields
+ * the viewer interpolates into translated copy (`AUDIT_ACTION_DETAIL_KEYS` in contracts names
+ * them per action), which is what lets a row written today be read in another locale years
+ * later. A credential-shaped event records the provider and the key NAME; never the value, never
+ * a decrypted blob, never model or prompt text.
+ */
+export interface AuditEvent {
+    /** The account the action belongs to; the only scope the viewer reads by. */
+    accountId: string;
+    /** The workspace it happened in, when the action is board-scoped. */
+    workspaceId?: string | null;
+    actor: AuditActor;
+    action: AuditAction;
+    /** What kind of thing was acted ON; `targetId` is an id within it. */
+    targetType: AuditTargetType;
+    /** Id of the thing acted on, within `targetType`. */
+    targetId: string;
+    /**
+     * What changed, as fields: `{ previousRole: 'viewer', role: 'admin' }`. Keyed by action in
+     * `AUDIT_ACTION_DETAIL_KEYS`, so the writer and the viewer agree about the slots rather than
+     * each deciding. Values safe to show only (a role set, a budget ceiling, an email).
+     */
+    details: AuditEventDetails;
+}
+/**
+ * An audit event as WRITTEN: an {@link AuditEvent} plus what the store assigned it.
+ *
+ * The vocabularies are still CLOSED here, which is the point of separating this from
+ * {@link AuditEventView}: nothing can append a value the build does not declare, while a read
+ * must cope with one a past build did.
+ */
+export interface AuditEventRecord extends AuditEvent {
+    /** Store-assigned id (`aud_*`). */
+    id: string;
+    /** Epoch ms the action committed. */
+    at: number;
+}
+/**
+ * An audit event as READ BACK, for a viewer to render.
+ *
+ * `action` and `targetType` widen to `| RetiredAuditValue` because both are closed vocabularies
+ * that are also persisted: a member retired from the type goes on existing in rows written
+ * before it was. Widening HERE is what forces every reader to say what it renders for one,
+ * instead of dropping the row or interpolating `undefined` (see `RetiredAuditValue` in
+ * contracts).
+ */
+export interface AuditEventView extends Omit<AuditEventRecord, 'action' | 'targetType'> {
+    action: AuditAction | RetiredAuditValue;
+    targetType: AuditTargetType | RetiredAuditValue;
+}
+/** One page of audit events, newest first. */
+export interface AuditEventPage {
+    events: AuditEventView[];
+    /**
+     * Cursor for the next (older) page, or null at the end. Opaque to the caller: a facade may
+     * change its encoding freely, and nothing but the same repository ever reads it.
+     */
+    nextCursor: string | null;
+}
+/**
+ * Persistence for the append-only audit log.
+ *
+ * **Append-only means append-only**: there is no update and no delete here. The retention
+ * sweep is a later slice and will add its own method; until then, nothing in the platform can
+ * rewrite or remove a recorded event, which is the property that makes the log worth reading.
+ *
+ * Reads are PAGINATED from the start. An audit table only grows, so the unbounded `SELECT`
+ * that is merely untidy on a young deployment is the one that times out on the deployment
+ * that has been running long enough to have something worth auditing.
+ */
+export interface AuditEventRepository {
+    /** Append one event. */
+    append(event: AuditEventRecord): Promise<void>;
+    /**
+     * One page of an account's events, newest first. `cursor` continues a previous page;
+     * absent starts at the newest. `limit` bounds the page.
+     */
+    listByAccount(accountId: string, options?: {
+        cursor?: string | null;
+        limit?: number;
+    }): Promise<AuditEventPage>;
+}
+/**
+ * The write seam a domain service depends on: state that something audit-worthy happened.
+ *
+ * `record` MUST NOT throw or reject. An audit write is a best-effort side channel: a store
+ * outage must cost the audit row, never the membership change the operator asked for. That
+ * swallow is the implementation's job (it logs through the kernel `Logger`, so a permanently
+ * broken audit store surfaces as warnings rather than as silence), which is why the port gives a
+ * service nothing to handle and no reason to wrap the call.
+ *
+ * It is AWAITED rather than fire-and-forget, and that is a correctness requirement, not a style
+ * choice: on the Worker an un-awaited write is dropped when the isolate is frozen after the
+ * response (the rule `@cat-factory/server`'s `http/waitUntil.ts` exists to state), so a
+ * fire-and-forget append would record nothing on the primary runtime while every test that
+ * drives a fake recorder still passed. A store round-trip is worth strictly more than the
+ * milliseconds it costs an admin action, because "nobody changed anything" is the exact
+ * assurance this log exists to give.
+ */
+export interface AuditRecorder {
+    record(event: AuditEvent): Promise<void>;
+}
+/**
+ * The no-op recorder, for a deployment or a test with no audit store wired.
+ *
+ * Named rather than an inline `{ record: async () => {} }` at each site, for the same reason
+ * `noopLogger` and `noopOperationalMetrics` are: a caller that audits nothing should have to
+ * SAY so in code, so "this deployment does not persist audit events" and "somebody forgot to
+ * wire the store" stop looking identical at the construction site.
+ */
+export declare const noopAuditRecorder: AuditRecorder;
+//# sourceMappingURL=audit.d.ts.map

package/dist/ports/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/ports/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EAClB,MAAM,wBAAwB,CAAA;AAc/B,uCAAuC;AACvC,MAAM,MAAM,UAAU;AACpB,kDAAkD;AAChD;IAAE,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC3D;;;GAGG;GACD;IAAE,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC/D;;;;GAIG;GACD;IAAE,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;CAAE,CAAA;AAE/C;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAA;IACjB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,WAAW,CAAA;IACnB,sEAAsE;IACtE,UAAU,EAAE,eAAe,CAAA;IAC3B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,mCAAmC;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAe,SAAQ,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,YAAY,CAAC;IACrF,MAAM,EAAE,WAAW,GAAG,iBAAiB,CAAA;IACvC,UAAU,EAAE,eAAe,GAAG,iBAAiB,CAAA;CAChD;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,wBAAwB;IACxB,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C;;;OAGG;IACH,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,cAAc,CAAC,CAAA;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAAmD,CAAA"}

package/dist/ports/audit.js

@@ -0,0 +1,10 @@
+/**
+ * The no-op recorder, for a deployment or a test with no audit store wired.
+ *
+ * Named rather than an inline `{ record: async () => {} }` at each site, for the same reason
+ * `noopLogger` and `noopOperationalMetrics` are: a caller that audits nothing should have to
+ * SAY so in code, so "this deployment does not persist audit events" and "somebody forgot to
+ * wire the store" stop looking identical at the construction site.
+ */
+export const noopAuditRecorder = { record: () => Promise.resolve() };
+//# sourceMappingURL=audit.js.map

package/dist/ports/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/ports/audit.ts"],"names":[],"mappings":"AAmJA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAA"}

package/dist/ports/caching.d.ts

@@ -5,6 +5,7 @@ import type { ResolvedCatalogEntry } from './fragment-repositories.js';
 import type { AccountSkillRecord } from './skill-repositories.js';
 import type { ResolvedFoundationalService } from '@cat-factory/contracts';
 export type { ResolvedFoundationalService };
+import type { SsoDiscoveryDocument } from './sso.js';
 import type { RepoContentEntry, RepoFileContent } from './github-client.js';
 import type { WorkspaceSettingsRepository } from './workspace-settings-repositories.js';
 import type { WorkspaceAccess } from '../domain/workspace-access.js';
@@ -271,6 +272,23 @@ export interface AppCaches {
      * own mutable D1 state, no cross-isolate bus), so it caches only on the Node/local facades.
      */
     workspaceAccess: GroupCacheHandle<WorkspaceAccessCacheValue>;
+    /**
+     * The deployment's discovered enterprise SSO provider — its
+     * `/.well-known/openid-configuration` metadata plus the JWKS its ID tokens verify against,
+     * grouped AND keyed by the configured issuer URL. Read twice per SSO sign-in (once to build
+     * the authorize redirect, once to verify the returned ID token), so without this every login
+     * pays two extra round-trips to the IdP before the user's own request can proceed.
+     *
+     * Unlike the invalidation-driven slices above, the cached SOURCE is an external document we
+     * never write, and it SELF-HEALS rather than needing a bus: an ID token signed with a `kid`
+     * absent from the cached JWKS drops the entry and refetches once (rate-limited by
+     * `fetchedAt`), because providers rotate signing keys with no notice and a rotation must cost
+     * one refetch rather than every login until the TTL lapses. That is the same "bounded by a
+     * probe, not indefinite" property that keeps `fragmentDocumentBody` and `repoFiles` enabled on
+     * the Worker, so this slice stays ENABLED there too — a peer isolate holding a pre-rotation
+     * key set heals on its own next login instead of failing until eviction.
+     */
+    ssoDiscovery: GroupCacheHandle<SsoDiscoveryDocument>;
     /** Release notification-bus resources (a no-op for bare in-memory caches). */
     close(): Promise<void>;
 }

package/dist/ports/caching.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caching.d.ts","sourceRoot":"","sources":["../../src/ports/caching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAIjE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AACzE,YAAY,EAAE,2BAA2B,EAAE,CAAA;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAYpE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,CAAC,CAAC,CAAA;IACb,gFAAgF;IAChF,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,8DAA8D;IAC9D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;CACzC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAA;AAEnG;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,MAAM,CAER;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,iFAAiF;IACjF,eAAe,EAAE,gBAAgB,CAAC,oBAAoB,EAAE,CAAC,CAAA;IACzD;;;;;;OAMG;IACH,YAAY,EAAE,gBAAgB,CAAC,kBAAkB,EAAE,CAAC,CAAA;IACpD;;;;;;;;;OASG;IACH,0BAA0B,EAAE,gBAAgB,CAAC,2BAA2B,EAAE,CAAC,CAAA;IAC3E;;;;;;;;OAQG;IACH,oBAAoB,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAA;IACvD;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAA;IAC9C;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAA;IAC3C;;;;;;;;;OASG;IACH,kBAAkB,EAAE,gBAAgB,CAAC,4BAA4B,CAAC,CAAA;IAClE;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;IAC1D;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,gBAAgB,CAAC,2BAA2B,CAAC,CAAA;IAChE;;;;;;;;OAQG;IACH,kBAAkB,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IAC3D;;;;;;OAMG;IACH,eAAe,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IACxD;;;;;;;;;;;;;OAaG;IACH,WAAW,EAAE,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,oBAAoB,EAAE,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAA;IACpD;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;IAClD;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IACpD;;;;;;;;;;;;;;;OAeG;IACH,eAAe,EAAE,gBAAgB,CAAC,yBAAyB,CAAC,CAAA;IAC5D,8EAA8E;IAC9E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,uFAAuF;AACvF,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACjC;AAED,8FAA8F;AAC9F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACnC;AAED,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,gBAAgB,CAAC,2BAA2B,CAAC,GAAG,SAAS,EAChE,UAAU,EAAE,2BAA2B,EACvC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAMnC"}
+{"version":3,"file":"caching.d.ts","sourceRoot":"","sources":["../../src/ports/caching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAIjE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AACzE,YAAY,EAAE,2BAA2B,EAAE,CAAA;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAYpE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,CAAC,CAAC,CAAA;IACb,gFAAgF;IAChF,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,8DAA8D;IAC9D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;CACzC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAA;AAEnG;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,MAAM,CAER;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,iFAAiF;IACjF,eAAe,EAAE,gBAAgB,CAAC,oBAAoB,EAAE,CAAC,CAAA;IACzD;;;;;;OAMG;IACH,YAAY,EAAE,gBAAgB,CAAC,kBAAkB,EAAE,CAAC,CAAA;IACpD;;;;;;;;;OASG;IACH,0BAA0B,EAAE,gBAAgB,CAAC,2BAA2B,EAAE,CAAC,CAAA;IAC3E;;;;;;;;OAQG;IACH,oBAAoB,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAA;IACvD;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAA;IAC9C;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAA;IAC3C;;;;;;;;;OASG;IACH,kBAAkB,EAAE,gBAAgB,CAAC,4BAA4B,CAAC,CAAA;IAClE;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;IAC1D;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,gBAAgB,CAAC,2BAA2B,CAAC,CAAA;IAChE;;;;;;;;OAQG;IACH,kBAAkB,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IAC3D;;;;;;OAMG;IACH,eAAe,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IACxD;;;;;;;;;;;;;OAaG;IACH,WAAW,EAAE,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,oBAAoB,EAAE,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAA;IACpD;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;IAClD;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IACpD;;;;;;;;;;;;;;;OAeG;IACH,eAAe,EAAE,gBAAgB,CAAC,yBAAyB,CAAC,CAAA;IAC5D;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;IACpD,8EAA8E;IAC9E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,uFAAuF;AACvF,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACjC;AAED,8FAA8F;AAC9F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACnC;AAED,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,gBAAgB,CAAC,2BAA2B,CAAC,GAAG,SAAS,EAChE,UAAU,EAAE,2BAA2B,EACvC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAMnC"}

package/dist/ports/caching.js.map

@@ -1 +1 @@
-{"version":3,"file":"caching.js","sourceRoot":"","sources":["../../src/ports/caching.ts"],"names":[],"mappings":"AA+EA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,cAAsB,EACtB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,OAAO,GAAG,cAAc,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE,CAAA;AAChF,CAAC;AA+PD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAgE,EAChE,UAAuC,EACvC,WAAmB;IAEnB,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1E,QAAQ,EAAE,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;KAC5C,CAAC,CAAC,CAAA;IACH,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"caching.js","sourceRoot":"","sources":["../../src/ports/caching.ts"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,cAAsB,EACtB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,OAAO,GAAG,cAAc,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE,CAAA;AAChF,CAAC;AAgRD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAgE,EAChE,UAAuC,EACvC,WAAmB;IAEnB,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1E,QAAQ,EAAE,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;KAC5C,CAAC,CAAC,CAAA;IACH,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/ports/index.d.ts

@@ -3,6 +3,8 @@ export { LIVE_EXECUTION_STATUSES } from './repositories.js';
 export type { AccountRecord, AccountRepository, AccountSettingsPatch, Membership, MembershipRepository, } from './account-repositories.js';
 export type { WorkspaceMemberRecord, WorkspaceMemberRepository, } from './workspace-member-repositories.js';
 export type { IdentityProvider, UserRecord, UserIdentityRecord, UserRepository, } from './user-repositories.js';
+export type { OidcProviderMetadata, SsoDiscoveryDocument } from './sso.js';
+export { oidcIdentitySubject } from './sso.js';
 export type { PasswordHasher } from './password-hasher.js';
 export type { EmailMessage, EmailSender, EmailProviderKind, EmailConnectionRecord, EmailConnectionRepository, } from './email-sender.js';
 export type { AccountInvitationRecord, AccountInvitationRepository, InvitationStatus, } from './invitation-repositories.js';
@@ -31,12 +33,12 @@ export { noopGateOutcomeRepository } from './gate-outcomes.js';
 export type { ReportActivityGroup, ReportRange, ReportScope, ReportSpendGroup, ReportSpendTrendBucket, ReportsRepository, } from './reports.js';
 export type { AgentContextFile, AgentContextFragment, AgentContextIndexQuery, AgentContextRecorder, AgentContextRunPageQuery, AgentContextSnapshot, AgentContextSnapshotIndex, AgentContextSnapshotRepository, RecordAgentContextInput, } from './agent-context.js';
 export type { AgentSearchQuery, AgentSearchQueryPageQuery, AgentSearchQueryRecorder, AgentSearchQueryRepository, RecordAgentSearchQueryInput, } from './agent-search-queries.js';
-export type { AgentToolCall, AgentToolCallPageQuery, AgentToolCallRecorder, AgentToolCallRepository, AgentToolCallTrajectoryQuery, RecordAgentToolCallInput, ToolCallBodiesState, } from './agent-tool-calls.js';
+export type { AgentToolCall, AgentToolCallPageQuery, AgentToolCallRecorder, AgentToolCallRepository, AgentToolCallSummary, AgentToolCallTrajectoryQuery, RecordAgentToolCallInput, ToolCallBodiesState, } from './agent-tool-calls.js';
 export type { LlmGenerationEvent, LlmRunSpan, LlmStepSpan, LlmToolSpan, LlmToolSpanContext, LlmTraceSink, InlineAttribution, InlineAttributionScope, InlineObservabilityContext, TraceSinkObservability, } from './llm-trace-sink.js';
 export { INLINE_OBSERVABILITY_NS, CompositeTraceSink, catFactoryObservability, composeTraceSinks, readInlineObservabilityContext, resolveInlineAttribution, } from './llm-trace-sink.js';
 export type { AgentDecisionRequest, AgentExecutor, AgentJobHandle, AgentJobUpdate, AgentRunContext, AgentRunResult, AgentTokenUsage, AsyncAgentExecutor, } from './agent-executor.js';
 export { isAsyncAgentExecutor } from './agent-executor.js';
-export type { ToolSecretResolver, ToolSecretSubject } from './agent-tools.js';
+export type { McpOAuthTokenResult, McpOAuthTokenSource, ToolSecretResolver, ToolSecretSubject, } from './agent-tools.js';
 export { type WorkRunner, NoopWorkRunner } from './work-runner.js';
 export { type ExecutionEventPublisher, NoopEventPublisher } from './execution-events.js';
 export type { CommitFilesResult, CreateReviewComment, CreateReviewInput, CreateReviewResult, ReviewCommentOutcome, GitHubChangedFile, GitHubClient, GitHubCodeSearchHit, GitHubIssueComment, GitHubIssueDetail, GitHubIssueSearchHit, GitHubPullRequestReview, GitHubReviewThread, GitHubReviewThreadComment, GitHubPullRequestComment, GitHubSubIssue, GitHubRepoRef, BranchProtectionState, BranchProtectionUnknownReason, BranchProtectionDetail, BranchProtectionSummary, InstallationMeta, InstallationSummary, ListOptions, Paged, RateLimitSnapshot, RepoContentEntry, RepoEntry, RepoFileContent, } from './github-client.js';
@@ -96,6 +98,8 @@ export type { PersonalSubscriptionRecord, PersonalSubscriptionRepository, Subscr
 export type { LocalModelEndpointRecord, LocalModelEndpointRepository, } from './local-model-repositories.js';
 export type { MachineNodeMint, MachineNodeMintOutcome, MachineNodeRecord, MachineNodeRepository, } from './machine-node-repositories.js';
 export type { AuthAttemptRecord, AuthAttemptRepository } from './auth-attempt-repositories.js';
+export type { AuditActor, AuditEvent, AuditEventPage, AuditEventRecord, AuditEventRepository, AuditEventView, AuditRecorder, } from './audit.js';
+export { noopAuditRecorder } from './audit.js';
 export type { UserSecretRecord, UserSecretRepository, ResolveUserGitHubToken, RunCredentialScope, RunInitiatorScope, } from './user-secret-repositories.js';
 export type { UserRepoAccessRecord, UserRepoAccessRepository, } from './user-repo-access-repositories.js';
 export type { ProviderModelCatalogRecord, ProviderModelCatalogRepository, } from './provider-model-catalog-repositories.js';
@@ -114,6 +118,7 @@ export type { SubscriptionQuotaSource, SubscriptionQuotaWindow, SubscriptionQuot
 export type { IncidentEnrichmentConnectionRecord, IncidentEnrichmentConnectionRepository, } from './incident-enrichment-repositories.js';
 export type { TestSecretRecord, TestSecretsRepository } from './test-secrets-repositories.js';
 export type { CapabilityCredentialRecord, CapabilityCredentialRepository, } from './capability-credential-repositories.js';
+export type { McpOAuthGrantRecord, McpOAuthGrantRepository } from './mcp-oauth-repositories.js';
 export type { ValidationConfigRecord, ValidationConfigRepository, } from './validation-repositories.js';
 export type { PackageRegistryConnectionRecord, PackageRegistryConnectionRepository, } from './package-registry-repositories.js';
 export type { AccountSettingsRecord, AccountSettingsRepository, ResolvedAccountSettings, } from './account-settings-repositories.js';

package/dist/ports/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,MAAM,EACN,aAAa,EACb,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,GACrB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,YAAY,EACV,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EACL,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,MAAM,EACX,KAAK,eAAe,EACpB,qBAAqB,EACrB,UAAU,GACX,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AACvF,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC7E,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,YAAY,EACV,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,6BAA6B,CAAA;AACpC,YAAY,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAC/E,YAAY,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAA;AAC/E,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACrF,YAAY,EACV,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAChF,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,GAClB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,GACd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAChF,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,YAAY,EACV,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gBAAgB,EAChB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,kBAAkB,EAClB,UAAU,EACV,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,eAAe,EACf,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,KAAK,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,KAAK,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACxF,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,KAAK,EACL,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,GAChB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,YAAY,EACV,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,MAAM,EACN,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,wBAAwB,EACxB,YAAY,EACZ,UAAU,EACV,cAAc,GACf,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,cAAc,EACd,WAAW,EACX,kBAAkB,GACnB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACpE,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,UAAU,EACV,OAAO,EACP,cAAc,GACf,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,wCAAwC,CAAA;AAC/C,YAAY,EACV,SAAS,EACT,4BAA4B,EAC5B,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAC/E,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAClF,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC7E,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAChF,OAAO,EAAE,KAAK,eAAe,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACvF,YAAY,EACV,2BAA2B,EAC3B,+BAA+B,EAC/B,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,4BAA4B,EAC5B,gCAAgC,EAChC,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,KAAK,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AACjF,YAAY,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,YAAY,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACvF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACvF,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,yCAAyC,CAAA;AAChD,YAAY,EACV,WAAW,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAClG,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,yCAAyC,CAAA;AAChD,YAAY,EACV,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,gCAAgC,CAAA;AACvC,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC9F,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,0CAA0C,CAAA;AACjD,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACtF,YAAY,EACV,6BAA6B,EAC7B,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,GACf,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC7F,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,0BAA0B,GAC3B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAA;AAC9E,YAAY,EACV,yBAAyB,EACzB,6BAA6B,EAC7B,iCAAiC,EACjC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,sCAAsC,CAAA;AAC7C,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,uCAAuC,CAAA;AAC9C,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,yCAAyC,CAAA;AAChD,YAAY,EACV,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,8BAA8B,CAAA;AACrC,YAAY,EACV,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AACpG,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC5E,YAAY,EACV,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,wCAAwC,CAAA;AAC/C,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAClF,YAAY,EACV,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACrF,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sCAAsC,CAAA;AAC7C,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAC9F,YAAY,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AACvF,YAAY,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAA;AACrF,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC7E,YAAY,EACV,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC3E,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC3E,YAAY,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAA;AACxF,YAAY,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAA;AACnG,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC1F,YAAY,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAA;AACnF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AACpG,YAAY,EACV,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAA;AAC1F,YAAY,EACV,+BAA+B,EAC/B,uBAAuB,EACvB,0BAA0B,EAC1B,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAA;AAC9F,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,2BAA2B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,MAAM,EACN,aAAa,EACb,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,GACrB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAC9C,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,YAAY,EACV,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EACL,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,MAAM,EACX,KAAK,eAAe,EACpB,qBAAqB,EACrB,UAAU,GACX,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AACvF,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC7E,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,YAAY,EACV,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,6BAA6B,CAAA;AACpC,YAAY,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAC/E,YAAY,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAA;AAC/E,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACrF,YAAY,EACV,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAChF,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,GAClB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,GACd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAChF,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,YAAY,EACV,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gBAAgB,EAChB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,kBAAkB,EAClB,UAAU,EACV,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,eAAe,EACf,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,KAAK,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,KAAK,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACxF,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,KAAK,EACL,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,GAChB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,YAAY,EACV,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,MAAM,EACN,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,wBAAwB,EACxB,YAAY,EACZ,UAAU,EACV,cAAc,GACf,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,cAAc,EACd,WAAW,EACX,kBAAkB,GACnB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACpE,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,UAAU,EACV,OAAO,EACP,cAAc,GACf,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,wCAAwC,CAAA;AAC/C,YAAY,EACV,SAAS,EACT,4BAA4B,EAC5B,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAC/E,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAClF,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC7E,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAChF,OAAO,EAAE,KAAK,eAAe,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACvF,YAAY,EACV,2BAA2B,EAC3B,+BAA+B,EAC/B,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,4BAA4B,EAC5B,gCAAgC,EAChC,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,KAAK,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AACjF,YAAY,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,YAAY,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACvF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACvF,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,yCAAyC,CAAA;AAChD,YAAY,EACV,WAAW,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAClG,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,yCAAyC,CAAA;AAChD,YAAY,EACV,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,gCAAgC,CAAA;AACvC,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC9F,YAAY,EACV,UAAU,EACV,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,0CAA0C,CAAA;AACjD,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACtF,YAAY,EACV,6BAA6B,EAC7B,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,GACf,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC7F,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,0BAA0B,GAC3B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAA;AAC9E,YAAY,EACV,yBAAyB,EACzB,6BAA6B,EAC7B,iCAAiC,EACjC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,sCAAsC,CAAA;AAC7C,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,uCAAuC,CAAA;AAC9C,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,yCAAyC,CAAA;AAChD,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AAC/F,YAAY,EACV,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,8BAA8B,CAAA;AACrC,YAAY,EACV,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AACpG,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC5E,YAAY,EACV,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,wCAAwC,CAAA;AAC/C,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAClF,YAAY,EACV,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACrF,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sCAAsC,CAAA;AAC7C,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAC9F,YAAY,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AACvF,YAAY,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAA;AACrF,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC7E,YAAY,EACV,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC3E,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC3E,YAAY,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAA;AACxF,YAAY,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAA;AACnG,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC1F,YAAY,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAA;AACnF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AACpG,YAAY,EACV,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAA;AAC1F,YAAY,EACV,+BAA+B,EAC/B,uBAAuB,EACvB,0BAA0B,EAC1B,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAA;AAC9F,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,2BAA2B,CAAA"}

package/dist/ports/index.js

@@ -1,4 +1,5 @@
 export { LIVE_EXECUTION_STATUSES } from './repositories.js';
+export { oidcIdentitySubject } from './sso.js';
 export { createRecordingLogger, noopLogger, } from './logging.js';
 export { createOperationalMetricsCollector, noopOperationalMetrics, } from './operational-metrics.js';
 export { inlineModelRef, resolveScopedModelProvider } from './model-provider.js';
@@ -20,6 +21,7 @@ export { NoopEnvConfigRepairRunner } from './env-config-repair.js';
 export { NoopEnvironmentTestRunner } from './environment-test.js';
 export { CONTAINER_EVICTION_ERROR } from './runner-transport.js';
 export { PREVIEW_HARNESS_JOB_ID, PREVIEW_PROVISION_TYPE } from './preview-transport.js';
+export { noopAuditRecorder } from './audit.js';
 export { CompositeIncidentEnrichmentProvider } from './incident-enrichment.js';
 export { RUN_LIFECYCLE_EVENTS, isRunLifecycleEventKind } from './run-lifecycle.js';
 export { PLATFORM_ALERT_EVENTS, isPlatformAlertEventKind } from './platform-alert.js';

package/dist/ports/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AA2C3D,OAAO,EAOL,qBAAqB,EACrB,UAAU,GACX,MAAM,cAAc,CAAA;AACrB,OAAO,EAQL,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,0BAA0B,CAAA;AAsBjC,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AA0BhF,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAWhF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAOvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAgD9D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qBAAqB,CAAA;AAW5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE1D,OAAO,EAAmB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAgC,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAuCxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AA8BpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AA4DjE,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAuD7B,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAW/E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAuC7E,OAAO,EAAwB,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAiCvF,OAAO,EAAwB,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAWjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAOlE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAiBjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAuFvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAA;AA8D9E,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAQlF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AA8CrF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAA;AAQ1F,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAA;AAC9F,OAAO,EAGL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,2BAA2B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAmB3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AA0B9C,OAAO,EAOL,qBAAqB,EACrB,UAAU,GACX,MAAM,cAAc,CAAA;AACrB,OAAO,EAQL,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,0BAA0B,CAAA;AAsBjC,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AA0BhF,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAWhF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAOvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAiD9D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qBAAqB,CAAA;AAW5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAO1D,OAAO,EAAmB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAgC,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAuCxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AA8BpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AA4DjE,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAuD7B,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAW/E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAuC7E,OAAO,EAAwB,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAiCvF,OAAO,EAAwB,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAWjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAOlE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAiBjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAkDvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AA+C9C,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAA;AA+D9E,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAQlF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AA8CrF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAA;AAQ1F,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAA;AAC9F,OAAO,EAGL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,2BAA2B,CAAA"}

package/dist/ports/mcp-oauth-repositories.d.ts

@@ -0,0 +1,58 @@
+/** One workspace's sealed OAuth grant for one tool server. */
+export interface McpOAuthGrantRecord {
+    workspaceId: string;
+    /** The tool server id the grant authorises (`McpServerDefinition.id`). */
+    serverId: string;
+    /**
+     * Sealed JSON of the token set: the access token, the refresh token when one was issued, the
+     * absolute expiry and the granted scope. Opaque to everything but `McpOAuthService`, which
+     * decrypts it to answer a dispatch and re-seals it after a refresh.
+     */
+    tokens: string;
+    /**
+     * Non-secret display summary as JSON (`McpOAuthGrantSummary`), so the operator surface can say
+     * what a board is connected to, when, by whom, and whether the last token exchange failed —
+     * without decrypting anything.
+     */
+    summary: string;
+    /**
+     * Optimistic-concurrency revision, bumped on every write. Two dispatches can reach an expired
+     * access token at the same instant and both try to refresh it; the rev is what makes one of them
+     * the writer and lets the other adopt the winner's tokens instead of overwriting them with a
+     * token set minted from a refresh token the server has already rotated away.
+     */
+    rev: number;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface McpOAuthGrantRepository {
+    get(workspaceId: string, serverId: string): Promise<McpOAuthGrantRecord | null>;
+    /**
+     * Every grant a workspace holds.
+     *
+     * The read the operator surface uses, and the reason it exists rather than a `get` per row: the
+     * tool-server inventory renders one row per DECLARED server and each needs its connection state,
+     * so a per-server read there is an N+1 over a list whose length is the deployment's whole
+     * registry.
+     */
+    listByWorkspace(workspaceId: string): Promise<McpOAuthGrantRecord[]>;
+    /**
+     * Blind write, for the two paths whose semantics ARE last-writer-wins: completing an
+     * authorization (a human just granted, and what they granted supersedes whatever was stored) and
+     * the first mint of a client-credentials token. Inserts with the record's `rev`; on conflict the
+     * STORED rev is bumped in SQL, so it stays monotonic and a concurrent `compareAndSwap` whose
+     * base predates this write reliably loses.
+     */
+    upsert(record: McpOAuthGrantRecord): Promise<void>;
+    /**
+     * Rev-guarded conditional write, for the REFRESH path: persists `record` only if the stored row
+     * still carries `expectedRev`. `expectedRev: null` means "expect NO row" (a conflict-do-nothing
+     * insert). False ⇒ another writer refreshed first, and the caller re-reads and uses THEIR tokens
+     * rather than re-applying its own — a rotated refresh token makes the loser's token set the
+     * stale one, so "reload and re-apply" would replace a working grant with a dead one.
+     */
+    compareAndSwap(record: McpOAuthGrantRecord, expectedRev: number | null): Promise<boolean>;
+    /** Disconnect: drop the grant. The next dispatch reports the server as `oauth_not_connected`. */
+    delete(workspaceId: string, serverId: string): Promise<void>;
+}
+//# sourceMappingURL=mcp-oauth-repositories.d.ts.map

package/dist/ports/mcp-oauth-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/mcp-oauth-repositories.ts"],"names":[],"mappings":"AAiBA,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAC/E;;;;;;;OAOG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD;;;;;;OAMG;IACH,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzF,iGAAiG;IACjG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7D"}

package/dist/ports/mcp-oauth-repositories.js

@@ -0,0 +1,18 @@
+// Persistence port for the PER-WORKSPACE OAuth grants a remote (`http`) tool server needs — the
+// tokens a board holds against a vendor's MCP server, and the machine tokens a client-credentials
+// declaration mints on demand.
+//
+// Mirrors across the D1 (Cloudflare) and Drizzle/Postgres (Node) facades; runtime parity is
+// mandatory. Values are sealed at rest by the facade's `SecretCipher` (info tag
+// `cat-factory:mcp-oauth`), so the record carries the sealed blob and never a token — which is
+// what lets it ride the mothership's persistence RPC, exactly like `CapabilityCredentialRepository`.
+//
+// ONE ROW PER (workspace, server), unlike the capability-credential store's one-blob-per-workspace.
+// The shapes differ because the WRITES do: a credential row is edited by a human filling in a
+// checklist, while a grant row is rewritten by a REFRESH on the dispatch path, and two dispatches
+// refreshing two different servers at the same moment are the ordinary case rather than the
+// pathological one. Per-server rows make those two writes touch different rows instead of
+// contending on one; the rev then only has to settle a race between two refreshes of the SAME
+// grant, which is what it is for.
+export {};
+//# sourceMappingURL=mcp-oauth-repositories.js.map

package/dist/ports/mcp-oauth-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-repositories.js","sourceRoot":"","sources":["../../src/ports/mcp-oauth-repositories.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,kGAAkG;AAClG,+BAA+B;AAC/B,EAAE;AACF,4FAA4F;AAC5F,gFAAgF;AAChF,+FAA+F;AAC/F,qGAAqG;AACrG,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,kGAAkG;AAClG,4FAA4F;AAC5F,0FAA0F;AAC1F,8FAA8F;AAC9F,kCAAkC"}

package/dist/ports/sso.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The subset of an OIDC provider's `/.well-known/openid-configuration` the login flow
+ * actually uses, validated at fetch time so a malformed or non-conforming document fails
+ * with an operator-readable message rather than deep inside the redirect.
+ *
+ * `issuer` is kept because it is the value an ID token's `iss` claim MUST equal, and it is
+ * the provider's own canonical spelling of itself — not the URL an operator happened to
+ * type. Everything downstream (the identity subject, the token audience check) keys off
+ * this one, so the discovered value is authoritative over the configured one.
+ */
+export interface OidcProviderMetadata {
+    /** The provider's canonical issuer identifier — what a valid ID token's `iss` equals. */
+    readonly issuer: string;
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly jwksUri: string;
+    /** Absent on a provider that exposes no userinfo endpoint (claims then come from the ID token). */
+    readonly userinfoEndpoint: string | null;
+    /**
+     * Whether the provider ADVERTISES PKCE S256 support. We send PKCE regardless (an unaware
+     * provider ignores the parameters), so this exists to be reported, never to gate: a
+     * provider whose metadata omits the field but implements the RFC is common enough that
+     * refusing on it would lock out working deployments.
+     */
+    readonly supportsPkceS256: boolean;
+}
+/**
+ * The `user_identities.subject` an OIDC login keys on: the provider's own canonical issuer,
+ * then its `sub`.
+ *
+ * An OIDC `sub` is unique WITHIN an issuer and carries no global guarantee, so keying a row on
+ * it alone would let two directories collide the day a deployment re-points at a second
+ * provider — one person inheriting another's account, silently. The separator is `#` because it
+ * cannot appear in a URL's path (it would start a fragment), so the pair can never be ambiguous
+ * however odd a `sub` is.
+ *
+ * The issuer used here is the DISCOVERED one (`OidcProviderMetadata.issuer`), never the URL an
+ * operator typed: those differ in trailing slashes and casing, and a subject that drifted with
+ * an operator's spelling would orphan every existing identity on the next config edit.
+ */
+export declare function oidcIdentitySubject(issuer: string, sub: string): string;
+/**
+ * A discovered provider: its metadata plus the signing keys its ID tokens verify against,
+ * fetched together so one cache entry is one coherent view of the provider.
+ *
+ * `jwks` is the raw JSON Web Key Set as served. It is kept unparsed (rather than as imported
+ * `CryptoKey`s) because a `CryptoKey` is not structured-cloneable across every runtime and the
+ * entry has to survive the cache's serialisation boundary; importing is cheap and happens per
+ * verification.
+ */
+export interface SsoDiscoveryDocument {
+    readonly metadata: OidcProviderMetadata;
+    readonly jwks: {
+        readonly keys: readonly Record<string, unknown>[];
+    };
+    /** When this view was fetched (epoch ms), so a key-rotation refetch can be rate-limited. */
+    readonly fetchedAt: number;
+}
+//# sourceMappingURL=sso.d.ts.map

package/dist/ports/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","sourceRoot":"","sources":["../../src/ports/sso.ts"],"names":[],"mappings":"AAeA;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,mGAAmG;IACnG,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;CACnC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAAA;IACpE,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B"}

package/dist/ports/sso.js

@@ -0,0 +1,32 @@
+// ---------------------------------------------------------------------------
+// Enterprise SSO: the shape of a discovered OpenID Connect provider.
+//
+// One generic OIDC adapter serves every enterprise identity provider (Okta, Entra ID,
+// Auth0, Keycloak, PingFederate, OneLogin, JumpCloud, a Shibboleth IdP running the OIDC
+// OP plugin), because a discovery document plus a client id/secret IS the whole
+// configuration. Nothing here may branch on WHICH provider answered: a per-vendor code path
+// would mean a provider is only supported once it is named, and would pin endpoints that the
+// provider itself is free to move. Vendor differences belong in the discovered document and
+// in a deployment's configuration, never in this layer.
+//
+// These types live in kernel because the CACHE that holds a discovered provider is declared
+// on the kernel `AppCaches` port, and `@cat-factory/server` owns the fetch that fills it.
+// ---------------------------------------------------------------------------
+/**
+ * The `user_identities.subject` an OIDC login keys on: the provider's own canonical issuer,
+ * then its `sub`.
+ *
+ * An OIDC `sub` is unique WITHIN an issuer and carries no global guarantee, so keying a row on
+ * it alone would let two directories collide the day a deployment re-points at a second
+ * provider — one person inheriting another's account, silently. The separator is `#` because it
+ * cannot appear in a URL's path (it would start a fragment), so the pair can never be ambiguous
+ * however odd a `sub` is.
+ *
+ * The issuer used here is the DISCOVERED one (`OidcProviderMetadata.issuer`), never the URL an
+ * operator typed: those differ in trailing slashes and casing, and a subject that drifted with
+ * an operator's spelling would orphan every existing identity on the next config edit.
+ */
+export function oidcIdentitySubject(issuer, sub) {
+    return `${issuer}#${sub}`;
+}
+//# sourceMappingURL=sso.js.map

package/dist/ports/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../src/ports/sso.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,sFAAsF;AACtF,wFAAwF;AACxF,gFAAgF;AAChF,4FAA4F;AAC5F,6FAA6F;AAC7F,4FAA4F;AAC5F,wDAAwD;AACxD,EAAE;AACF,4FAA4F;AAC5F,0FAA0F;AAC1F,8EAA8E;AA6B9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,GAAW;IAC7D,OAAO,GAAG,MAAM,IAAI,GAAG,EAAE,CAAA;AAC3B,CAAC"}