@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/types/model/service/SignUpManager.d.ts

@@ -1,28 +1,32 @@
-import { PersonRow } from '../queries';
-import { SignUpErrorCode, WeakPasswordReason } from '../../schema';
-import { Response } from '../utils/Response';
-import { DatabaseContext } from '../utils';
-import { MaybePassword } from '../dtos';
-import { EmailValidator } from './EmailValidator';
-import { PasswordStrengthValidator } from './PasswordStrengthValidator';
+import { PersonRow } from '../queries/index.js';
+import { SignUpErrorCode, SignUpRecommendedAction, WeakPasswordReason } from '../../schema/index.js';
+import { Response } from '../utils/Response.js';
+import { DatabaseContext } from '../utils/index.js';
+import { MaybePassword } from '../dtos/index.js';
+import { EmailValidator } from './EmailValidator.js';
+import { PasswordStrengthValidator } from './PasswordStrengthValidator.js';
+import { Config } from '../type/Config.js';
 type SignUpUser = {
     email: string;
     name?: string;
     password: MaybePassword;
     roles?: readonly string[];
+    config: Config;
 };
 export declare class SignUpManager {
     private readonly emailValidator;
     private readonly passwordStrengthValidator;
     constructor(emailValidator: EmailValidator, passwordStrengthValidator: PasswordStrengthValidator);
-    signUp(dbContext: DatabaseContext, { email, password, roles }: SignUpUser): Promise<SignUpResponse>;
+    signUp(dbContext: DatabaseContext, args: SignUpUser): Promise<SignUpResponse>;
 }
 export declare class SignUpResult {
     readonly person: Omit<PersonRow, 'roles'>;
-    constructor(person: Omit<PersonRow, 'roles'>);
+    readonly emailVerificationRequired: boolean;
+    constructor(person: Omit<PersonRow, 'roles'>, emailVerificationRequired?: boolean);
 }
 export type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {
     weakPasswordReasons?: WeakPasswordReason[];
+    recommendedAction?: SignUpRecommendedAction;
 }>;
 export {};
 //# sourceMappingURL=SignUpManager.d.ts.map

package/dist/types/model/service/SignUpManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignUpManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,SAAS,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EAAE,QAAQ,EAAc,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,KAAK,UAAU,GAAG;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,aAAa,CAAA;IACvB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzB,CAAA;AAED,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;gBADzB,cAAc,EAAE,cAAc,EAC9B,yBAAyB,EAAE,yBAAyB;IAIhE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAU,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;CAqB9G;AAED,qBAAa,YAAY;aACI,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;gBAAhC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;CAC5D;AACD,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE;IACpE,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;CAC1C,CAAC,CAAA"}
+{"version":3,"file":"SignUpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignUpManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAEpG,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAE1E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,KAAK,UAAU,GAAG;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,aAAa,CAAA;IACvB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAED,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;gBADzB,cAAc,EAAE,cAAc,EAC9B,yBAAyB,EAAE,yBAAyB;IAIhE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;CAwCnF;AAED,qBAAa,YAAY;aAEP,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,yBAAyB,EAAE,OAAO;gBADlC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAChC,yBAAyB,GAAE,OAAe;CAE3D;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE;IACpE,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAC1C,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;CAC3C,CAAC,CAAA"}

package/dist/types/model/service/apiKey/ApiKeyManager.d.ts

@@ -1,19 +1,37 @@
-import { Response } from '../../utils/Response';
-import { DatabaseContext, TokenHash } from '../../utils';
-import { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService';
+import { ApiKeyRequestInfo } from '../../commands/index.js';
+import { Response } from '../../utils/Response.js';
+import { DatabaseContext, TokenHash } from '../../utils/index.js';
+import { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService.js';
 import { Acl } from '@contember/schema';
-import { ApiKeyRow } from '../../queries';
+import { ApiKeyRow } from '../../queries/index.js';
+import { AuthPolicyResolver } from '../AuthPolicyResolver.js';
+import { AuthLogService } from '../AuthLogService.js';
+import { IdpSessionRevalidator } from '../idp/IdpSessionRevalidator.js';
+import { UnpersistedApiKeyManager } from './UnpersistedApiKeyManager.js';
 export declare class ApiKeyManager {
     private readonly apiKeyService;
-    constructor(apiKeyService: ApiKeyService);
-    verifyAndProlong(dbContext: DatabaseContext, readDbContext: DatabaseContext, token: string): Promise<VerifyResponse>;
-    createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number): Promise<string>;
+    private readonly authPolicyResolver;
+    private readonly authLogService;
+    private readonly unpersistedApiKeyManager;
+    private readonly idpSessionRevalidator?;
+    constructor(apiKeyService: ApiKeyService, authPolicyResolver: AuthPolicyResolver, authLogService: AuthLogService, unpersistedApiKeyManager?: UnpersistedApiKeyManager, idpSessionRevalidator?: IdpSessionRevalidator | undefined);
+    verifyAndProlong(dbContext: DatabaseContext, readDbContext: DatabaseContext, token: string, requestInfo?: ApiKeyRequestInfo, forwardedInfo?: ApiKeyRequestInfo): Promise<VerifyResponse>;
+    createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean): Promise<string>;
+    /**
+     * Like {@link createSessionApiKey} but also returns the api_key id — needed when the
+     * caller has to bind another row to the session (e.g. an `idp_session` for IdP
+     * re-validation).
+     */
+    createSessionApiKeyWithId(dbContext: DatabaseContext, identityId: string, expiration?: number, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean): Promise<{
+        id: string;
+        token: string;
+    }>;
     findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null>;
     disableOneOffApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<void>;
     disableApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<boolean>;
     disableIdentityApiKeys(dbContext: DatabaseContext, identityId: string): Promise<void>;
-    createGlobalPermanentApiKey(dbContext: DatabaseContext, description: string, roles: readonly string[], tokenHash?: TokenHash): Promise<CreateApiKeyResponse>;
-    createProjectPermanentApiKey(dbContext: DatabaseContext, projectId: string, memberships: readonly Acl.Membership[], description: string, tokenHash?: TokenHash): Promise<CreateApiKeyResponse>;
+    createGlobalPermanentApiKey(dbContext: DatabaseContext, description: string, roles: readonly string[], tokenHash?: TokenHash, trustForwardedInfo?: boolean): Promise<CreateApiKeyResponse>;
+    createProjectPermanentApiKey(dbContext: DatabaseContext, projectId: string, memberships: readonly Acl.Membership[], description: string, tokenHash?: TokenHash, trustForwardedInfo?: boolean): Promise<CreateApiKeyResponse>;
 }
 export type VerifyResponse = Response<VerifyResult, VerifyErrorCode>;
 export declare class VerifyResult {
@@ -21,8 +39,9 @@ export declare class VerifyResult {
     readonly apiKeyId: string;
     readonly roles: string[];
     readonly personId: string | null;
+    readonly trustForwardedInfo: boolean;
     readonly valid = true;
-    constructor(identityId: string, apiKeyId: string, roles: string[], personId: string | null);
+    constructor(identityId: string, apiKeyId: string, roles: string[], personId: string | null, trustForwardedInfo?: boolean);
 }
 export declare enum VerifyErrorCode {
     NOT_FOUND = "not_found",

package/dist/types/model/service/apiKey/ApiKeyManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyManager.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAErE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAuC,SAAS,EAAsB,MAAM,eAAe,CAAA;AAKlG,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAGxC,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,CAAC;IAgCpB,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYzG,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMnF,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhF,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E,sBAAsB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,2BAA2B,CAChC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,CAAC,EAAE,SAAS,GACnB,OAAO,CAAC,oBAAoB,CAAC;IAM1B,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,GACnB,OAAO,CAAC,oBAAoB,CAAC;CAKhC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aAIP,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,KAAK,EAAE,MAAM,EAAE;aACf,QAAQ,EAAE,MAAM,GAAG,IAAI;IANxC,QAAQ,CAAC,KAAK,QAAO;gBAGJ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,GAAG,IAAI;CAExC;AAED,oBAAY,eAAe;IAC1B,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC3C"}
+{"version":3,"file":"ApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EAOjB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAExE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAuC,SAAS,EAAqC,MAAM,wBAAwB,CAAA;AAI1H,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAExE,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBAJtB,aAAa,EAAE,aAAa,EAC5B,kBAAkB,EAAE,kBAAkB,EACtC,cAAc,EAAE,cAAc,EAC9B,wBAAwB,GAAE,wBAAyD,EACnF,qBAAqB,CAAC,EAAE,qBAAqB,YAAA;IAGzD,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,iBAAiB,EAC/B,aAAa,CAAC,EAAE,iBAAiB,GAC/B,OAAO,CAAC,cAAc,CAAC;IAsHpB,mBAAmB,CACxB,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,MAAM,CAAC;IAKlB;;;;OAIG;IACG,yBAAyB,CAC9B,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA0EnC,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMnF,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhF,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E,sBAAsB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,2BAA2B,CAChC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,oBAAoB,CAAC;IAM1B,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,oBAAoB,CAAC;CAKhC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aAIP,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,KAAK,EAAE,MAAM,EAAE;aACf,QAAQ,EAAE,MAAM,GAAG,IAAI;aACvB,kBAAkB,EAAE,OAAO;IAP5C,QAAQ,CAAC,KAAK,QAAO;gBAGJ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,kBAAkB,GAAE,OAAe;CAEpD;AAED,oBAAY,eAAe;IAC1B,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC3C"}

package/dist/types/model/service/apiKey/ApiKeyService.d.ts

@@ -1,10 +1,10 @@
-import { DatabaseContext, TokenHash } from '../../utils';
-import { Response, ResponseOk } from '../../utils/Response';
-import { ApiKeyWithToken } from '../../../schema';
+import { DatabaseContext, TokenHash } from '../../utils/index.js';
+import { Response, ResponseOk } from '../../utils/Response.js';
+import { ApiKeyWithToken } from '../../../schema/index.js';
 import { Acl } from '@contember/schema';
 export declare class ApiKeyService {
-    createPermanentApiKey(db: DatabaseContext, description: string, roles?: readonly string[], tokenHash?: TokenHash): Promise<ResponseOk<CreateApiKeyResult>>;
-    createProjectPermanentApiKey(db: DatabaseContext, projectId: string, memberships: readonly Acl.Membership[], description: string, tokenHash?: TokenHash): Promise<ResponseOk<CreateApiKeyResult>>;
+    createPermanentApiKey(db: DatabaseContext, description: string, roles?: readonly string[], tokenHash?: TokenHash, trustForwardedInfo?: boolean): Promise<ResponseOk<CreateApiKeyResult>>;
+    createProjectPermanentApiKey(db: DatabaseContext, projectId: string, memberships: readonly Acl.Membership[], description: string, tokenHash?: TokenHash, trustForwardedInfo?: boolean): Promise<ResponseOk<CreateApiKeyResult>>;
 }
 export type CreateApiKeyResponse = Response<CreateApiKeyResult, never>;
 export declare class CreateApiKeyResult {

package/dist/types/model/service/apiKey/ApiKeyService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyService.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAKxD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,aAAa;IACnB,qBAAqB,CAC1B,EAAE,EAAE,eAAe,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,SAAS,CAAC,EAAE,SAAS;IAQhB,4BAA4B,CACjC,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS;CAYtB;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;AAEtE,qBAAa,kBAAkB;aACF,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;aAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;gBAAtG,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAGlI,iBAAiB,IAAI,eAAe;CAUpC"}
+{"version":3,"file":"ApiKeyService.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAKjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,aAAa;IACnB,qBAAqB,CAC1B,EAAE,EAAE,eAAe,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO;IAevB,4BAA4B,CACjC,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO;CAY7B;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;AAEtE,qBAAa,kBAAkB;aACF,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;aAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;gBAAtG,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAGlI,iBAAiB,IAAI,eAAe;CAWpC"}

package/dist/types/model/service/apiKey/UnpersistedApiKeyManager.d.ts

@@ -0,0 +1,38 @@
+import { TokenHash } from '../../utils/index.js';
+import { VerifyResult } from './ApiKeyManager.js';
+/**
+ * Well-known identity id used for super-admin identities authenticated via an
+ * unpersisted (configured) root token. The id is stable so that audit logs and
+ * created entities consistently reference the same virtual identity, even
+ * though no row exists in the `identity` table.
+ */
+export declare const UNPERSISTED_ROOT_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000001";
+export interface UnpersistedApiKey {
+    readonly tokenHash: TokenHash;
+    readonly identityId: string;
+    readonly roles: readonly string[];
+}
+/**
+ * Verifies incoming tokens against a fixed set of root tokens configured out of
+ * band (env/config) instead of being stored in the database. This enables token
+ * rotation without database writes and avoids persisting the token hash.
+ *
+ * Token hashes are compared in constant time to avoid leaking information about
+ * the configured secret.
+ */
+export declare class UnpersistedApiKeyManager {
+    private readonly apiKeys;
+    constructor(apiKeys?: readonly UnpersistedApiKey[]);
+    get isEmpty(): boolean;
+    verify(token: string): VerifyResult | null;
+    static createRootApiKey(tokenHash: TokenHash): UnpersistedApiKey;
+    /**
+     * Builds a manager for unpersisted super-admin root tokens from configured
+     * plain tokens and/or pre-computed token hashes.
+     */
+    static createForRootTokens(input: {
+        tokens?: readonly string[];
+        tokenHashes?: readonly string[];
+    }): UnpersistedApiKeyManager;
+}
+//# sourceMappingURL=UnpersistedApiKeyManager.d.ts.map

package/dist/types/model/service/apiKey/UnpersistedApiKeyManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnpersistedApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEtG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAA;AAElF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAE1C,OAAO,GAAE,SAAS,iBAAiB,EAAO;IAItD,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IA0B1C,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,iBAAiB;IAQhE;;;OAGG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACjC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAC/B,GAAG,wBAAwB;CAoB5B"}

package/dist/types/model/service/apiKey/index.d.ts

@@ -1,3 +1,4 @@
-export * from './ApiKeyManager';
-export * from './ApiKeyService';
+export * from './ApiKeyManager.js';
+export * from './ApiKeyService.js';
+export * from './UnpersistedApiKeyManager.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/service/apiKey/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,+BAA+B,CAAA"}

package/dist/types/model/service/captcha/CaptchaProvider.d.ts

@@ -0,0 +1,24 @@
+export interface CaptchaProviderHandler {
+    /**
+     * Verify a client-submitted captcha token with the provider. Implementations
+     * should never throw on remote failure — return `verifyError` so the caller
+     * can decide whether to fail-open or fail-closed.
+     */
+    verify(args: CaptchaVerifyArgs): Promise<CaptchaVerifyResult>;
+}
+export interface CaptchaVerifyArgs {
+    readonly token: string;
+    readonly secret: string;
+    readonly remoteIp?: string;
+    /** Score gate for v3-style providers; ignored by binary providers. */
+    readonly threshold: number | null;
+}
+export type CaptchaVerifyResult = {
+    ok: true;
+    score?: number;
+} | {
+    ok: false;
+    reason: 'invalid' | 'low_score' | 'expired' | 'verify_error';
+    detail?: string;
+};
+//# sourceMappingURL=CaptchaProvider.d.ts.map

package/dist/types/model/service/captcha/CaptchaProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaptchaProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/CaptchaProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACtC;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA"}

package/dist/types/model/service/captcha/CaptchaValidator.d.ts

@@ -0,0 +1,37 @@
+import { Config } from '../../type/Config.js';
+import { CaptchaProvider as CaptchaProviderKey } from '../../../schema/index.js';
+import { CaptchaProviderHandler, CaptchaVerifyResult } from './CaptchaProvider.js';
+/** Mutations that can be individually gated by captcha (config.captcha.protect). */
+export type CaptchaProtectedFlow = 'signUp' | 'passwordReset' | 'passwordlessInit' | 'emailVerification';
+export interface CaptchaConfig {
+    readonly provider: CaptchaProviderKey | null;
+    readonly secret: string | null;
+    readonly threshold: number | null;
+    readonly protect: Record<CaptchaProtectedFlow, boolean>;
+}
+export declare class CaptchaValidator {
+    private readonly providers;
+    constructor(providers: Record<CaptchaProviderKey, CaptchaProviderHandler>);
+    /** True when the tenant has opted into captcha (provider+secret both set). */
+    isEnabled(config: CaptchaConfig): boolean;
+    /**
+     * True when captcha is configured AND enforced for the given flow. A single
+     * provider/secret is shared; `config.captcha.protect` decides per-flow which
+     * mutations actually require a token.
+     */
+    isEnabledFor(config: CaptchaConfig, flow: CaptchaProtectedFlow): boolean;
+    /**
+     * Extract just the captcha-relevant fields from a loaded tenant Config so
+     * services only pass what they need.
+     */
+    extractConfig(config: Config): CaptchaConfig;
+    verify(args: {
+        config: CaptchaConfig;
+        token: string | null | undefined;
+        remoteIp?: string;
+    }): Promise<CaptchaVerifyResult | {
+        ok: true;
+        skipped: true;
+    }>;
+}
+//# sourceMappingURL=CaptchaValidator.d.ts.map

package/dist/types/model/service/captcha/CaptchaValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaptchaValidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/CaptchaValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,eAAe,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAElF,oFAAoF;AACpF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,eAAe,GAAG,kBAAkB,GAAG,mBAAmB,CAAA;AAExG,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;CACvD;AAED,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;IAG/E,8EAA8E;IACvE,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAIhD;;;;OAIG;IACI,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO;IAI/E;;;OAGG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAc7C,MAAM,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,aAAa,CAAA;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;CAkB9D"}

package/dist/types/model/service/captcha/HCaptchaProvider.d.ts

@@ -0,0 +1,9 @@
+import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js';
+/** hCaptcha. Binary success/failure — `threshold` is ignored. */
+export declare class HCaptchaProvider implements CaptchaProviderHandler {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    constructor(endpoint?: string, fetchImpl?: typeof fetch);
+    verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult>;
+}
+//# sourceMappingURL=HCaptchaProvider.d.ts.map

package/dist/types/model/service/captcha/HCaptchaProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HCaptchaProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/HCaptchaProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG,iEAAiE;AACjE,qBAAa,gBAAiB,YAAW,sBAAsB;IAE7D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,GAAE,MAA0C,EACpD,SAAS,GAAE,OAAO,KAAa;IAG3C,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAqB1F"}

package/dist/types/model/service/captcha/RecaptchaV3Provider.d.ts

@@ -0,0 +1,12 @@
+import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js';
+/**
+ * Google reCAPTCHA v3 — score-based. Falls back to DEFAULT_THRESHOLD when no
+ * config-level threshold is set.
+ */
+export declare class RecaptchaV3Provider implements CaptchaProviderHandler {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    constructor(endpoint?: string, fetchImpl?: typeof fetch);
+    verify({ token, secret, remoteIp, threshold }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult>;
+}
+//# sourceMappingURL=RecaptchaV3Provider.d.ts.map

package/dist/types/model/service/captcha/RecaptchaV3Provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecaptchaV3Provider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/RecaptchaV3Provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAIrG;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,GAAE,MAA0D,EACpE,SAAS,GAAE,OAAO,KAAa;IAG3C,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA0BrG"}

package/dist/types/model/service/captcha/TurnstileProvider.d.ts

@@ -0,0 +1,12 @@
+import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js';
+/**
+ * Cloudflare Turnstile. Binary success/failure — `threshold` is ignored.
+ * https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
+ */
+export declare class TurnstileProvider implements CaptchaProviderHandler {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    constructor(endpoint?: string, fetchImpl?: typeof fetch);
+    verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult>;
+}
+//# sourceMappingURL=TurnstileProvider.d.ts.map

package/dist/types/model/service/captcha/TurnstileProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TurnstileProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/TurnstileProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,sBAAsB;IAE9D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,GAAE,MAAoE,EAC9E,SAAS,GAAE,OAAO,KAAa;IAG3C,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAyB1F"}

package/dist/types/model/service/captcha/index.d.ts

@@ -0,0 +1,6 @@
+export * from './CaptchaProvider.js';
+export * from './CaptchaValidator.js';
+export * from './HCaptchaProvider.js';
+export * from './RecaptchaV3Provider.js';
+export * from './TurnstileProvider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/model/service/captcha/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA"}

package/dist/types/model/service/helpers/getPreferredProject.d.ts

@@ -1,3 +1,3 @@
-import { Project } from '../../type';
+import { Project } from '../../type/index.js';
 export declare const getPreferredProject: (projects: Project[], preferredProjectSlug: string | null) => Project | null;
 //# sourceMappingURL=getPreferredProject.d.ts.map

package/dist/types/model/service/helpers/getPreferredProject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getPreferredProject.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/getPreferredProject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,eAAO,MAAM,mBAAmB,GAAI,UAAU,OAAO,EAAE,EAAE,sBAAsB,MAAM,GAAG,IAAI,KAAG,OAAO,GAAG,IAQxG,CAAA"}
+{"version":3,"file":"getPreferredProject.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/getPreferredProject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,eAAO,MAAM,mBAAmB,GAAI,UAAU,OAAO,EAAE,EAAE,sBAAsB,MAAM,GAAG,IAAI,KAAG,OAAO,GAAG,IAQxG,CAAA"}

package/dist/types/model/service/helpers/isPasswordlessEnabled.d.ts

@@ -0,0 +1,10 @@
+import { ConfigPolicy } from '../../../schema/index.js';
+/**
+ * Resolves whether passwordless sign-in is effectively available for a person,
+ * combining the tenant-wide policy with the person's own flag. This is the same
+ * gate the passwordless sign-in flow applies, so any caller that reasons about a
+ * person's usable sign-in methods (e.g. the IdP disconnect lock-out check) stays
+ * consistent with what sign-in actually permits.
+ */
+export declare const isPasswordlessEnabled: (globalValue: ConfigPolicy, personValue: boolean | null) => boolean;
+//# sourceMappingURL=isPasswordlessEnabled.d.ts.map

package/dist/types/model/service/helpers/isPasswordlessEnabled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isPasswordlessEnabled.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/isPasswordlessEnabled.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,YAAY,EAAE,aAAa,OAAO,GAAG,IAAI,KAAG,OAW9F,CAAA"}

package/dist/types/model/service/idp/BackchannelLogoutManager.d.ts

@@ -0,0 +1,34 @@
+import { DatabaseContext } from '../../utils/index.js';
+import { IDPHandlerRegistry } from './IDPHandlerRegistry.js';
+export type BackchannelLogoutResult = {
+    status: 'ok';
+    revokedCount: number;
+} | {
+    status: 'provider_not_found';
+} | {
+    status: 'not_supported';
+} | {
+    status: 'invalid_token';
+    message: string;
+};
+/**
+ * Handles an incoming OIDC Back-Channel Logout request (A10). Runs entirely on the HTTP auth path
+ * (no GraphQL resolver), so — like {@link IdpSessionRevalidator} — it owns its own audit write
+ * rather than deferring to a resolver. Flow:
+ *   1. resolve the IdP by slug (the back-channel endpoint carries a `?provider=` query param, since
+ *      the IdP only knows which client it is calling, not the Contember tenant/provider record);
+ *   2. validate the IdP-signed logout token and extract `sid` / `sub`;
+ *   3. look up the local federated session(s) the token targets and revoke their api_key(s).
+ *
+ * A logout token with a `sid` targets that single IdP session; a `sub`-only token (rare — most IdPs
+ * send a `sid`) targets *all* of that subject's federated sessions under the provider. Either way, a
+ * token that matches no live session is reported as `revokedCount: 0` and audited, not failed.
+ */
+export declare class BackchannelLogoutManager {
+    private readonly idpRegistry;
+    constructor(idpRegistry: IDPHandlerRegistry);
+    logout(db: DatabaseContext, providerSlug: string, logoutToken: string): Promise<BackchannelLogoutResult>;
+    private resolveTargetSessions;
+    private audit;
+}
+//# sourceMappingURL=BackchannelLogoutManager.d.ts.map

package/dist/types/model/service/idp/BackchannelLogoutManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackchannelLogoutManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/BackchannelLogoutManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAOtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D,MAAM,MAAM,uBAAuB,GAChC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAC3B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,kBAAkB;IAG3C,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;YAuChG,qBAAqB;YAerB,KAAK;CAoCnB"}

package/dist/types/model/service/idp/IDPHandlerRegistry.d.ts

@@ -1,4 +1,4 @@
-import { IdentityProviderHandler } from './IdentityProviderHandler';
+import { IdentityProviderHandler } from './IdentityProviderHandler.js';
 export declare class IDPHandlerRegistry {
     private providers;
     registerHandler(type: string, provider: IdentityProviderHandler<any>): void;

package/dist/types/model/service/idp/IDPHandlerRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IDPHandlerRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPHandlerRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AAGnE,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,SAAS,CAAmD;IAE7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI;IAI3E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,GAAG,IAAI;IAIlE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC;CAO5D"}
+{"version":3,"file":"IDPHandlerRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPHandlerRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAGtE,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,SAAS,CAAmD;IAE7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI;IAI3E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,GAAG,IAAI;IAIlE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC;CAO5D"}

package/dist/types/model/service/idp/IDPManager.d.ts

@@ -1,10 +1,10 @@
-import { Response } from '../../utils/Response';
-import { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema';
-import { DatabaseContext } from '../../utils';
-import { IdentityProviderData } from '../../type';
-import { IDPHandlerRegistry } from './IDPHandlerRegistry';
-import { UpdateIdpData } from '../../commands/idp/UpdateIdpCommand';
-import { IdentityProviderDto } from '../../queries/idp/types';
+import { Response } from '../../utils/Response.js';
+import { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema/index.js';
+import { DatabaseContext } from '../../utils/index.js';
+import { IdentityProviderData } from '../../type/index.js';
+import { IDPHandlerRegistry } from './IDPHandlerRegistry.js';
+import { UpdateIdpData } from '../../commands/idp/UpdateIdpCommand.js';
+import { IdentityProviderDto } from '../../queries/idp/types.js';
 export declare class IDPManager {
     private readonly idpRegistry;
     constructor(idpRegistry: IDPHandlerRegistry);

package/dist/types/model/service/idp/IDPManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IDPManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC9G,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAKzD,OAAO,EAAoB,aAAa,EAAE,MAAM,qCAAqC,CAAA;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAE7D,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,kBAAkB;IAIpC,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBpF,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa1E,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAaxE,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmD1H,OAAO,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAWzE;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;AACpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA"}
+{"version":3,"file":"IDPManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACvH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAG1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAK5D,OAAO,EAAoB,aAAa,EAAE,MAAM,wCAAwC,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,kBAAkB;IAIpC,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBpF,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa1E,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAaxE,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmD1H,OAAO,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAWzE;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;AACpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA"}

package/dist/types/model/service/idp/IDPRevalidation.d.ts

@@ -0,0 +1,54 @@
+import * as Typesafe from '@contember/typesafe';
+/**
+ * Provider-agnostic re-validation settings, stored on an IdP's `configuration.revalidation`.
+ * Read both by the provider (to decide whether to capture session state at sign-in) and by
+ * the generic verify hook (`ApiKeyManager.verifyAndProlong`) to drive re-validation.
+ *
+ * The cadence is driven by the **access-token lifetime**, not a fixed interval: while the
+ * token is fresh the session is vouched-for and nothing happens; past `softRefreshThreshold`
+ * of its lifetime a proactive background (SWR) refresh kicks in; once the token has actually
+ * expired the refresh becomes blocking. See {@link IdpSessionRevalidator}.
+ *
+ * All fields optional; absent / `enabled: false` reproduces the pre-A24 behaviour exactly.
+ */
+export declare const IDPRevalidationConfig: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly enabled?: boolean | undefined;
+        readonly softRefreshThreshold?: number | undefined;
+        readonly minInterval?: string | undefined;
+        readonly fallbackInterval?: string | undefined;
+        readonly mode?: "auto" | "blocking" | undefined;
+        readonly onFailure?: "revoke" | undefined;
+    };
+    inner: {
+        enabled: Typesafe.Type<boolean>;
+        /**
+         * Fraction (0–1) of the access-token lifetime after which a proactive background (SWR)
+         * refresh starts — e.g. 0.5 = refresh once the token is half-expired. Default 0.5.
+         */
+        softRefreshThreshold: Typesafe.Type<number>;
+        /**
+         * Single-flight floor as a Postgres interval string: the minimum gap between revalidation
+         * attempts, so a burst of requests past the threshold triggers only one refresh.
+         * Default "10 seconds".
+         */
+        minInterval: Typesafe.Type<string>;
+        /**
+         * Throttle used when the IdP returns no token expiry (so the lifetime-based cadence can't
+         * apply), as a Postgres interval string. Default "5 minutes".
+         */
+        fallbackInterval: Typesafe.Type<string>;
+        /**
+         * `auto` (default): SWR/background before expiry, blocking once expired. `blocking`: always
+         * synchronous (zero revocation lag, at the cost of latency on the revalidation tick).
+         */
+        mode: Typesafe.Type<"auto" | "blocking">;
+        /** What to do when the IdP reports the session as gone. Currently only `revoke`. */
+        onFailure: Typesafe.Type<"revoke">;
+    };
+};
+export type IDPRevalidationConfig = ReturnType<typeof IDPRevalidationConfig>;
+export declare const REVALIDATION_DEFAULT_SOFT_THRESHOLD = 0.5;
+export declare const REVALIDATION_DEFAULT_MIN_INTERVAL = "10 seconds";
+export declare const REVALIDATION_DEFAULT_FALLBACK_INTERVAL = "5 minutes";
+//# sourceMappingURL=IDPRevalidation.d.ts.map

package/dist/types/model/service/idp/IDPRevalidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPRevalidation.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPRevalidation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;QAEjC;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;WAGG;;QAEH;;;WAGG;;QAEH,oFAAoF;;;CAEnF,CAAA;AAEF,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAE5E,eAAO,MAAM,mCAAmC,MAAM,CAAA;AACtD,eAAO,MAAM,iCAAiC,eAAe,CAAA;AAC7D,eAAO,MAAM,sCAAsC,cAAc,CAAA"}

package/dist/types/model/service/idp/IdentityProviderHandler.d.ts

@@ -2,15 +2,81 @@ export interface InitIDPAuthResult {
     authUrl: string;
     sessionData: unknown;
 }
+/**
+ * Provider-specific federated-session state persisted alongside a Contember session
+ * (see the `idp_session` table) so the session can be re-validated against the IdP
+ * after the initial sign-in. Opaque to the core — only the owning provider's
+ * `revalidate` interprets `tokens`. Token material is encrypted at rest.
+ */
+export type IDPSessionState = {
+    /** OIDC `sid` claim / SAML `SessionIndex`, when the IdP provides one. */
+    sessionId?: string;
+    /** Provider-specific token payload (e.g. OIDC refresh/id token). Encrypted at rest. */
+    tokens?: Record<string, unknown>;
+    /** IdP-asserted absolute expiry of the federated session, if known. */
+    expiresAt?: Date;
+};
 export type IDPResponse = {
     externalIdentifier: string;
     email?: string;
     name?: string;
+    /** Whether the provider asserts the e-mail address is verified (OIDC `email_verified`). */
+    emailVerified?: boolean;
+    /**
+     * Federated-session state to persist for continuous re-validation. Present only when
+     * the provider supports it and revalidation is enabled on the IdP configuration;
+     * otherwise undefined and the session behaves like a plain password session.
+     */
+    idpSession?: IDPSessionState;
 } & Record<string, unknown>;
+/** Input for building an RP-initiated (front-channel) logout redirect URL. */
+export type LogoutUrlRequest = {
+    /** The ID token issued at sign-in, used as `id_token_hint`. */
+    idToken?: string;
+    /** Where the IdP should redirect the browser after it has logged the user out. */
+    postLogoutRedirectUri?: string;
+};
+/** Claims extracted from a validated OIDC back-channel logout token (the subset we act on). */
+export type LogoutTokenClaims = {
+    /** The IdP session id (`sid`) the logout applies to, when the token targets a single session. */
+    sid?: string;
+    /** The subject (`sub`) the logout applies to, when the token targets all the subject's sessions. */
+    sub?: string;
+};
+/** Outcome of a federated-session re-validation against the IdP. */
+export type RevalidationResult = {
+    status: 'valid';
+    /** Fresh claims, if the revalidation method returned any (e.g. userinfo). */
+    claims?: Record<string, unknown>;
+    /** Updated session state to persist (e.g. a rotated refresh token). */
+    idpSession?: IDPSessionState;
+} | {
+    status: 'revoked';
+    reason: string;
+};
 export interface IdentityProviderHandler<Configuration extends {}> {
     initAuth: (configuration: Configuration, data: unknown) => Promise<InitIDPAuthResult>;
     processResponse: (configuration: Configuration, responseData: unknown) => Promise<IDPResponse>;
     validateConfiguration: (config: unknown) => Configuration;
     getPublicConfiguration?: (config: Configuration) => Partial<Configuration>;
+    /**
+     * Re-validate a previously established federated session against the IdP.
+     * Present only on providers that support continuous re-validation (OIDC); absent on
+     * providers that cannot (Apple, Facebook, SAML — which rely on a short max lifetime + SLO).
+     */
+    revalidate?: (configuration: Configuration, session: IDPSessionState) => Promise<RevalidationResult>;
+    /**
+     * Build an RP-initiated (front-channel) logout redirect URL for this session (A10).
+     * Returns null when the IdP advertises no `end_session_endpoint` — the caller then falls
+     * back to a local-only logout. Present only on providers that support Single Logout (OIDC).
+     */
+    buildLogoutUrl?: (configuration: Configuration, request: LogoutUrlRequest) => Promise<string | null>;
+    /**
+     * Validate an IdP-signed back-channel logout token (A10) and extract the targeted
+     * `sid` / `sub`. Throws when the token is invalid (bad signature, wrong issuer/audience,
+     * missing the back-channel `events` claim, etc.). Present only on providers that support
+     * OIDC back-channel logout.
+     */
+    validateLogoutToken?: (configuration: Configuration, logoutToken: string) => Promise<LogoutTokenClaims>;
 }
 //# sourceMappingURL=IdentityProviderHandler.d.ts.map

package/dist/types/model/service/idp/IdentityProviderHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProviderHandler.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdentityProviderHandler.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,MAAM,WAAW,GAAG;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,MAAM,WAAW,uBAAuB,CAAC,aAAa,SAAS,EAAE;IAChE,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErF,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAE9F,qBAAqB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,aAAa,CAAA;IAEzD,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;CAC1E"}
+{"version":3,"file":"IdentityProviderHandler.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdentityProviderHandler.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,OAAO,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC9B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC9B,CAAA;AAED,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG;IAC/B,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,oEAAoE;AACpE,MAAM,MAAM,kBAAkB,GAC3B;IACD,MAAM,EAAE,OAAO,CAAA;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,uEAAuE;IACvE,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GACC;IACD,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAEF,MAAM,WAAW,uBAAuB,CAAC,aAAa,SAAS,EAAE;IAChE,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErF,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAE9F,qBAAqB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,aAAa,CAAA;IAEzD,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;IAE1E;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAEpG;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEpG;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACvG"}