@data-club/ai-hub-server 0.0.1

package/dist/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAmB,MAAM,MAAM,CAAC;AAI3D,0DAA0D;AAC1D,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAEnC,4EAA4E;AAC5E,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,qCAAqC;AACrC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEtD,kDAAkD;AAClD,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,CAAC;AAExD,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AA8C5D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,IAAuD;IAEvD,OAAO,IAAI,OAAO,CAAC;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,UAAU,CAAC;SACrB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;SACnB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,yBAAyB,GAAG,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,IAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC;QACjB,KAAK,EAAE,qBAAqB;KAC7B,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,UAAU,CAAC;SACrB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;SACnB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,iCAAiC,GAAG,CAAC;SAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,KAAa;IAEb,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3C,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAI,OAA+B,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;QACpC,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,OAAoC;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAI,OAA8B,CAAC,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAI,OAAkC,CAAC,QAAQ,CAAC;IAC9D,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,WAAW,CAAC,IAAI,CAAC;QAClB,OAAO,QAAQ,KAAK,QAAQ,EAC5B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAA6B,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,CACL,KAAK,KAAK,MAAM;QAChB,KAAK,KAAK,YAAY;QACtB,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,aAAa,CACxB,CAAC;AACJ,CAAC"}

package/dist/auth/middleware.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Role-enforcement middleware: `protectedRoute({...}, handler)`.
+ *
+ * Every protected endpoint runs through this exact §8.6 order:
+ *
+ * 1. Pull the bearer token from `Authorization: Bearer <token>` (401 on miss).
+ * 2. Load the signing key from `admin_setting.service_token_signing_key`
+ *    (500 if missing — should not happen after the first-boot seed).
+ * 3. `verifyServiceToken(key, token)` (401 on invalid signature, expiry,
+ *    issuer, or claim shape).
+ * 4. Reject password-change-only tokens unless the route opts into them
+ *    (401 — same envelope as 1/3 so no scope-leakage).
+ * 5. Load the user row by `sub` (401 if the user was deleted after the
+ *    token was minted — defensive).
+ * 6. For session tokens, if `requiredRole` is set and the token's role
+ *    claim doesn't satisfy it, return 403 with `forbidden`. The role check
+ *    uses the **JWT claim**, not the row — by spec design (§8.6 step 3):
+ *    rotating someone's role does not change their existing token (24 h max
+ *    impact), and the system invalidates everything in one cut via the
+ *    signing-key rotation.
+ * 7. Invoke the wrapped handler with the loaded user + the discriminator
+ *    so it knows what kind of token authenticated the call.
+ *
+ * Shield + min-count invariants are NOT enforced here — that's the job of
+ * the per-handler `apply*InTx` helpers (`auth/roleRules.ts`), each of which
+ * re-reads target state inside a SQLite transaction so two simultaneous
+ * mutations cannot race.
+ *
+ * The middleware lives at one boundary so a future external-IdP feature
+ * (§6.7 "Future direction", §17 question 5) can slot a parallel
+ * `verifyExternalToken` in alongside without touching every handler.
+ *
+ * @see SPECIFICATIONS.md §6.7 — auth model
+ * @see SPECIFICATIONS.md §8.6 — endpoint enforcement order
+ * @see SPECIFICATIONS.md §6.7 — single-function-boundary seam
+ */
+import type { AIHubRole } from "@data-club/ai-hub";
+import type { UserRow } from "../db/schema.js";
+import type { AIHubServerContext, RouteHandler } from "../handlers/types.js";
+import type { PasswordChangeTokenClaims, SessionTokenClaims } from "./jwt.js";
+/**
+ * Auth context handed to a protected handler. Carries both the loaded user
+ * row (so the handler doesn't re-query) and a discriminated kind so the
+ * handler can branch when it needs to (the `/auth/change-password` handler is
+ * the only one in v1 that cares — both token kinds reach it).
+ */
+export interface AuthContext {
+    /**
+     * The loaded user row. `auth.role` mirrors `claims.role` for session tokens
+     * but is read from the row for password-change-only tokens (which carry no
+     * role claim). Handlers should use the JWT-derived `role` for matrix checks
+     * and the row for anything else.
+     */
+    user: UserRow;
+    /**
+     * Role to use for matrix-style checks. For session tokens this is the JWT
+     * claim (per §8.6 step 3 — frozen at mint time). For password-change-only
+     * tokens this is `user.role` from the row; the change-only token only
+     * reaches `/auth/change-password`, which doesn't read this field.
+     */
+    role: AIHubRole;
+    /** Which kind of token authenticated the request. */
+    tokenKind: "session" | "password_change";
+    /**
+     * The raw verified claims, in case a handler wants to log them or branch
+     * on something the role/user/tokenKind don't expose.
+     */
+    claims: SessionTokenClaims | PasswordChangeTokenClaims;
+}
+/**
+ * Options accepted by `protectedRoute`. Both fields default to "session
+ * token required, any role." Endpoints that need more (e.g. role gate or
+ * password-change-only-token acceptance) set the appropriate field.
+ */
+export interface ProtectedRouteOptions {
+    /**
+     * Minimum role the caller must have. Default: any authenticated session
+     * (no role check). The matrix check uses the JWT's `role` claim, not the
+     * current row state — see file-level comment.
+     */
+    requiredRole?: AIHubRole;
+    /**
+     * `true` if the endpoint also accepts password-change-only tokens. Only
+     * `/auth/change-password` sets this in v1. Default: false (every other
+     * endpoint rejects change-only tokens with 401).
+     */
+    allowPasswordChangeToken?: boolean;
+}
+/** A handler that has been authenticated by `protectedRoute`. */
+export type AuthenticatedHandler = (req: Request, ctx: AIHubServerContext, auth: AuthContext, params: Readonly<Record<string, string>>) => Promise<Response>;
+/**
+ * Wraps a handler with the §8.6 enforcement order. Returns a plain
+ * `RouteHandler` that the route table mounts as if the auth check didn't
+ * exist.
+ *
+ * @param opts - per-route auth options.
+ * @param handler - the wrapped handler. Called only when auth succeeds.
+ * @returns a `RouteHandler` that runs auth, then delegates to `handler`.
+ */
+export declare function protectedRoute(opts: ProtectedRouteOptions, handler: AuthenticatedHandler): RouteHandler;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAG7E,OAAO,KAAK,EACV,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAGlB;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,qDAAqD;IACrD,SAAS,EAAE,SAAS,GAAG,iBAAiB,CAAC;IACzC;;;OAGG;IACH,MAAM,EAAE,kBAAkB,GAAG,yBAAyB,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,iEAAiE;AACjE,MAAM,MAAM,oBAAoB,GAAG,CACjC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,oBAAoB,GAC5B,YAAY,CA+Gd"}

package/dist/auth/middleware.js

@@ -0,0 +1,161 @@
+/**
+ * Role-enforcement middleware: `protectedRoute({...}, handler)`.
+ *
+ * Every protected endpoint runs through this exact §8.6 order:
+ *
+ * 1. Pull the bearer token from `Authorization: Bearer <token>` (401 on miss).
+ * 2. Load the signing key from `admin_setting.service_token_signing_key`
+ *    (500 if missing — should not happen after the first-boot seed).
+ * 3. `verifyServiceToken(key, token)` (401 on invalid signature, expiry,
+ *    issuer, or claim shape).
+ * 4. Reject password-change-only tokens unless the route opts into them
+ *    (401 — same envelope as 1/3 so no scope-leakage).
+ * 5. Load the user row by `sub` (401 if the user was deleted after the
+ *    token was minted — defensive).
+ * 6. For session tokens, if `requiredRole` is set and the token's role
+ *    claim doesn't satisfy it, return 403 with `forbidden`. The role check
+ *    uses the **JWT claim**, not the row — by spec design (§8.6 step 3):
+ *    rotating someone's role does not change their existing token (24 h max
+ *    impact), and the system invalidates everything in one cut via the
+ *    signing-key rotation.
+ * 7. Invoke the wrapped handler with the loaded user + the discriminator
+ *    so it knows what kind of token authenticated the call.
+ *
+ * Shield + min-count invariants are NOT enforced here — that's the job of
+ * the per-handler `apply*InTx` helpers (`auth/roleRules.ts`), each of which
+ * re-reads target state inside a SQLite transaction so two simultaneous
+ * mutations cannot race.
+ *
+ * The middleware lives at one boundary so a future external-IdP feature
+ * (§6.7 "Future direction", §17 question 5) can slot a parallel
+ * `verifyExternalToken` in alongside without touching every handler.
+ *
+ * @see SPECIFICATIONS.md §6.7 — auth model
+ * @see SPECIFICATIONS.md §8.6 — endpoint enforcement order
+ * @see SPECIFICATIONS.md §6.7 — single-function-boundary seam
+ */
+import { eq } from "drizzle-orm";
+import { adminSetting, user } from "../db/schema.js";
+import { forbidden, internalError, unauthorized } from "../handlers/responses.js";
+import { hasRoleAtLeast } from "./roleRules.js";
+import { verifyServiceToken } from "./jwt.js";
+/**
+ * Wraps a handler with the §8.6 enforcement order. Returns a plain
+ * `RouteHandler` that the route table mounts as if the auth check didn't
+ * exist.
+ *
+ * @param opts - per-route auth options.
+ * @param handler - the wrapped handler. Called only when auth succeeds.
+ * @returns a `RouteHandler` that runs auth, then delegates to `handler`.
+ */
+export function protectedRoute(opts, handler) {
+    return async (req, ctx, params) => {
+        // 1. Extract bearer token.
+        const token = extractBearer(req.headers.get("authorization"));
+        if (!token)
+            return unauthorized();
+        // 2. Load signing key from the singleton settings row.
+        const settings = ctx.db
+            .select()
+            .from(adminSetting)
+            .where(eq(adminSetting.id, 1))
+            .get();
+        if (!settings?.serviceTokenSigningKey) {
+            ctx.logger.error({ event: "missing_signing_key" }, "admin_setting.service_token_signing_key is empty; cannot verify token.");
+            return internalError("Server misconfigured");
+        }
+        // 3. Verify token signature + issuer + expiry + claim shape.
+        const verified = await verifyServiceToken(settings.serviceTokenSigningKey, token);
+        if (verified.kind === "invalid")
+            return unauthorized();
+        // 4. Reject password-change-only tokens unless this route opts in.
+        if (verified.kind === "password_change" && !opts.allowPasswordChangeToken) {
+            return unauthorized();
+        }
+        // 5. Load user row by sub. The row may be missing if the user was deleted
+        //    between mint and verify; a 401 (rather than 404) keeps the response
+        //    indistinguishable from an invalid-token response — no enumeration.
+        const subject = verified.claims.sub;
+        if (!subject)
+            return unauthorized();
+        const row = ctx.db.select().from(user).where(eq(user.id, subject)).get();
+        if (!row)
+            return unauthorized();
+        // 5b. Session-invalidation gate — for **session tokens only**, reject
+        //     JWTs issued before the user's last password mutation. This is
+        //     what makes admin-driven password resets (and voluntary changes)
+        //     sign out the affected user's other devices immediately rather
+        //     than waiting for the 24h JWT expiry. Change-only tokens are
+        //     allowed through; the change-password handler itself bumps
+        //     `passwordChangedAt` AND mints a fresh session token in one go,
+        //     so the user can still complete the forced-change flow.
+        //
+        //     Comparison runs in **second precision** because jose's `iat`
+        //     truncates to whole seconds — comparing higher precision would
+        //     occasionally reject a JWT minted in the same second as the
+        //     password mutation.
+        if (verified.kind === "session" && row.passwordChangedAt) {
+            const iatSeconds = verified.claims.iat;
+            const pwdChangedSeconds = Math.floor(Date.parse(row.passwordChangedAt) / 1000);
+            if (typeof iatSeconds === "number" &&
+                Number.isFinite(pwdChangedSeconds) &&
+                iatSeconds < pwdChangedSeconds) {
+                ctx.logger.info({
+                    user_id: row.id,
+                    jwt_iat: iatSeconds,
+                    password_changed_at: row.passwordChangedAt,
+                    event: "session_invalidated_by_password_change",
+                }, "Rejecting session token issued before last password change.");
+                return unauthorized();
+            }
+        }
+        // 6. Role check — drives off the **DB row's current role** rather than
+        //    the JWT claim's role. The JWT signature still proves identity
+        //    (we trust `sub`), but ACL decisions read the freshest source so:
+        //
+        //    - **Promotions take effect immediately** — a user just promoted
+        //      to admin can use admin endpoints without logging out + back in.
+        //    - **Demotions revoke access immediately** — a demoted admin
+        //      loses admin endpoints right away rather than retaining them
+        //      until their 24 h JWT expires.
+        //
+        //    The spec's §8.6 step 3 ("Extract the role claim") describes the
+        //    procedural shape but the security property it cares about
+        //    ("the user can't escalate privileges via a tampered token") is
+        //    preserved here — DB role can't be tampered with by the client.
+        //
+        //    Change-only tokens fall through with `row.role` too, so the same
+        //    code path handles both kinds.
+        const effectiveRole = row.role;
+        if (verified.kind === "session" && opts.requiredRole) {
+            if (!hasRoleAtLeast(effectiveRole, opts.requiredRole)) {
+                return forbidden(`Requires role at least ${opts.requiredRole}.`);
+            }
+        }
+        // 7. Invoke the wrapped handler.
+        const auth = {
+            user: row,
+            role: effectiveRole,
+            tokenKind: verified.kind,
+            claims: verified.claims,
+        };
+        return handler(req, ctx, auth, params ?? {});
+    };
+}
+/**
+ * Parses the `Authorization` header value, returning the bearer token or
+ * `null` when the header is missing or malformed.
+ *
+ * @param value - the raw header value (or `null` if absent).
+ * @returns the bearer token, or `null`.
+ */
+function extractBearer(value) {
+    if (!value)
+        return null;
+    const m = value.match(/^Bearer\s+(.+)$/i);
+    if (!m)
+        return null;
+    const token = m[1]?.trim() ?? "";
+    return token.length > 0 ? token : null;
+}
+//# sourceMappingURL=middleware.js.map

package/dist/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AA4D9C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,IAA2B,EAC3B,OAA6B;IAE7B,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAChC,2BAA2B;QAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK;YAAE,OAAO,YAAY,EAAE,CAAC;QAElC,uDAAuD;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aAC7B,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,QAAQ,EAAE,sBAAsB,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAChC,wEAAwE,CACzE,CAAC;YACF,OAAO,aAAa,CAAC,sBAAsB,CAAC,CAAC;QAC/C,CAAC;QAED,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,QAAQ,CAAC,sBAAsB,EAC/B,KAAK,CACN,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,YAAY,EAAE,CAAC;QAEvD,mEAAmE;QACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC1E,OAAO,YAAY,EAAE,CAAC;QACxB,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,YAAY,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACzE,IAAI,CAAC,GAAG;YAAE,OAAO,YAAY,EAAE,CAAC;QAEhC,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,qEAAqE;QACrE,6DAA6D;QAC7D,EAAE;QACF,mEAAmE;QACnE,oEAAoE;QACpE,iEAAiE;QACjE,yBAAyB;QACzB,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,IAAI,CACzC,CAAC;YACF,IACE,OAAO,UAAU,KAAK,QAAQ;gBAC9B,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAClC,UAAU,GAAG,iBAAiB,EAC9B,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,IAAI,CACb;oBACE,OAAO,EAAE,GAAG,CAAC,EAAE;oBACf,OAAO,EAAE,UAAU;oBACnB,mBAAmB,EAAE,GAAG,CAAC,iBAAiB;oBAC1C,KAAK,EAAE,wCAAwC;iBAChD,EACD,6DAA6D,CAC9D,CAAC;gBACF,OAAO,YAAY,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,mEAAmE;QACnE,qCAAqC;QACrC,EAAE;QACF,qEAAqE;QACrE,+DAA+D;QAC/D,oEAAoE;QACpE,oEAAoE;QACpE,EAAE;QACF,sEAAsE;QACtE,mCAAmC;QACnC,MAAM,aAAa,GAAc,GAAG,CAAC,IAAI,CAAC;QAC1C,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtD,OAAO,SAAS,CACd,0BAA0B,IAAI,CAAC,YAAY,GAAG,CAC/C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,IAAI,GAAgB;YACxB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,QAAQ,CAAC,IAAI;YACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;QACF,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAoB;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC"}

package/dist/auth/passwordPolicy.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Password complexity policy (§8.5).
+ *
+ * Every new password supplied to `/auth/change-password` must satisfy two
+ * checks:
+ *
+ * 1. **Minimum length** — `PASSWORD_MIN_LENGTH` (8) characters.
+ * 2. **Complexity** — at least **2 of these 3 categories** must appear in
+ *    the password:
+ *      - letters (any Unicode letter, `\p{L}`)
+ *      - digits (any Unicode number, `\p{N}`)
+ *      - special characters (anything that's neither letter nor digit nor
+ *        whitespace — symbols, punctuation, etc.)
+ *
+ * Examples:
+ *
+ * - `"12345678"` — only digits → **rejected**.
+ * - `"abcdefgh"` — only letters → **rejected**.
+ * - `"!!!!!!!!"` — only special → **rejected**.
+ * - `"abcd1234"` — letters + digits → **accepted**.
+ * - `"password!"` — letters + special → **accepted**.
+ * - `"1234!@#$"` — digits + special → **accepted**.
+ * - `"Aa1!Aa1!"` — all three → **accepted**.
+ *
+ * Whitespace does not count as "special" because allowing whitespace to
+ * tick the box would let `"password "` pass; we want at least one
+ * meaningfully non-letter character.
+ *
+ * This module is the single source of truth — the spec-mandated rule is
+ * defined here and consumed by handlers. Any future relaxation or
+ * tightening happens in one place.
+ *
+ * @see SPECIFICATIONS.md §8.5 — password requirements
+ */
+/** Minimum length for a new password (§8.5). */
+export declare const PASSWORD_MIN_LENGTH = 8;
+/** Minimum distinct character categories required (§8.5). */
+export declare const PASSWORD_REQUIRED_CATEGORIES = 2;
+/** Result of `validatePasswordPolicy`. */
+export type PasswordPolicyResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: PasswordPolicyErrorCode;
+    message: string;
+};
+/** Machine-readable codes the validator emits. */
+export type PasswordPolicyErrorCode = "password_too_short" | "password_too_simple";
+/**
+ * Validates `password` against the §8.5 policy. Returns a discriminated
+ * result the handler maps directly into a 400 response.
+ *
+ * @param password - the candidate plaintext password.
+ * @returns `{ ok: true }` on pass, `{ ok: false, code, message }` on fail.
+ */
+export declare function validatePasswordPolicy(password: string): PasswordPolicyResult;
+/**
+ * Counts how many of the three categories the password matches.
+ *
+ * Categories are mutually exclusive:
+ *
+ * - letter: any Unicode letter (`\p{L}`)
+ * - digit: any Unicode number (`\p{N}`)
+ * - special: everything else that is **not** whitespace (`\s`)
+ *
+ * Whitespace contributes to neither.
+ *
+ * @param password - the candidate plaintext password.
+ * @returns the count in `[0, 3]`.
+ */
+export declare function countCharacterCategories(password: string): number;
+//# sourceMappingURL=passwordPolicy.d.ts.map

package/dist/auth/passwordPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordPolicy.d.ts","sourceRoot":"","sources":["../../src/auth/passwordPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,0CAA0C;AAC1C,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,kDAAkD;AAClD,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,CAkB7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMjE"}

package/dist/auth/passwordPolicy.js

@@ -0,0 +1,88 @@
+/**
+ * Password complexity policy (§8.5).
+ *
+ * Every new password supplied to `/auth/change-password` must satisfy two
+ * checks:
+ *
+ * 1. **Minimum length** — `PASSWORD_MIN_LENGTH` (8) characters.
+ * 2. **Complexity** — at least **2 of these 3 categories** must appear in
+ *    the password:
+ *      - letters (any Unicode letter, `\p{L}`)
+ *      - digits (any Unicode number, `\p{N}`)
+ *      - special characters (anything that's neither letter nor digit nor
+ *        whitespace — symbols, punctuation, etc.)
+ *
+ * Examples:
+ *
+ * - `"12345678"` — only digits → **rejected**.
+ * - `"abcdefgh"` — only letters → **rejected**.
+ * - `"!!!!!!!!"` — only special → **rejected**.
+ * - `"abcd1234"` — letters + digits → **accepted**.
+ * - `"password!"` — letters + special → **accepted**.
+ * - `"1234!@#$"` — digits + special → **accepted**.
+ * - `"Aa1!Aa1!"` — all three → **accepted**.
+ *
+ * Whitespace does not count as "special" because allowing whitespace to
+ * tick the box would let `"password "` pass; we want at least one
+ * meaningfully non-letter character.
+ *
+ * This module is the single source of truth — the spec-mandated rule is
+ * defined here and consumed by handlers. Any future relaxation or
+ * tightening happens in one place.
+ *
+ * @see SPECIFICATIONS.md §8.5 — password requirements
+ */
+/** Minimum length for a new password (§8.5). */
+export const PASSWORD_MIN_LENGTH = 8;
+/** Minimum distinct character categories required (§8.5). */
+export const PASSWORD_REQUIRED_CATEGORIES = 2;
+/**
+ * Validates `password` against the §8.5 policy. Returns a discriminated
+ * result the handler maps directly into a 400 response.
+ *
+ * @param password - the candidate plaintext password.
+ * @returns `{ ok: true }` on pass, `{ ok: false, code, message }` on fail.
+ */
+export function validatePasswordPolicy(password) {
+    if (password.length < PASSWORD_MIN_LENGTH) {
+        return {
+            ok: false,
+            code: "password_too_short",
+            message: `New password must be at least ${PASSWORD_MIN_LENGTH} characters.`,
+        };
+    }
+    const categories = countCharacterCategories(password);
+    if (categories < PASSWORD_REQUIRED_CATEGORIES) {
+        return {
+            ok: false,
+            code: "password_too_simple",
+            message: "New password must contain at least two of these three: letters, digits, special characters.",
+        };
+    }
+    return { ok: true };
+}
+/**
+ * Counts how many of the three categories the password matches.
+ *
+ * Categories are mutually exclusive:
+ *
+ * - letter: any Unicode letter (`\p{L}`)
+ * - digit: any Unicode number (`\p{N}`)
+ * - special: everything else that is **not** whitespace (`\s`)
+ *
+ * Whitespace contributes to neither.
+ *
+ * @param password - the candidate plaintext password.
+ * @returns the count in `[0, 3]`.
+ */
+export function countCharacterCategories(password) {
+    let count = 0;
+    if (/\p{L}/u.test(password))
+        count++;
+    if (/\p{N}/u.test(password))
+        count++;
+    if (/[^\p{L}\p{N}\s]/u.test(password))
+        count++;
+    return count;
+}
+//# sourceMappingURL=passwordPolicy.js.map

package/dist/auth/passwordPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordPolicy.js","sourceRoot":"","sources":["../../src/auth/passwordPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAY9C;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,iCAAiC,mBAAmB,cAAc;SAC5E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,UAAU,GAAG,4BAA4B,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EACL,6FAA6F;SAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,KAAK,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,KAAK,EAAE,CAAC;IACrC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,KAAK,EAAE,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/auth/roleRules.d.ts

@@ -0,0 +1,200 @@
+/**
+ * Shield + min-count rules + the transactional helpers that compose them.
+ *
+ * Three concerns live here:
+ *
+ * 1. **Role hierarchy** — a tiny `ROLE_RANK` map + `hasRoleAtLeast` used by the
+ *    middleware to drive §8.2 matrix checks.
+ * 2. **Pure assertion helpers** — `assertCanChangeUserRole`,
+ *    `assertCanResetPassword`, `assertCanDeleteUser`. Each throws
+ *    `RoleRuleError` on a §8.1 shield or super-admin-min-count violation.
+ *    Pure functions of `(caller, target, newState, totalSuperAdmins)` so they
+ *    are trivial to unit-test against every cell.
+ * 3. **Transactional appliers** — `applyUserRoleChangeInTx`,
+ *    `applyPasswordResetInTx` (signature only; Step 4 wires the password
+ *    write), `applyUserDeletionInTx`. Each opens one SQLite transaction,
+ *    re-reads the target row + super-admin count inside the transaction so a
+ *    concurrent demote cannot bypass the invariant, calls the matching
+ *    assertion helper, then applies the write. Returns a discriminated
+ *    `{ ok: true, ... } | { ok: false, status, code, message }` so the
+ *    Step-4 handler maps it directly into a `Response`.
+ *
+ * Step 3 ships the helpers + extensive tests; Step 4 is the first endpoint
+ * that consumes them.
+ *
+ * @see SPECIFICATIONS.md §8.1 — role model + shield + min-count rules
+ * @see SPECIFICATIONS.md §8.5 — password reset
+ * @see SPECIFICATIONS.md §8.6 — endpoint enforcement order
+ */
+import type { AIHubRole } from "@data-club/ai-hub";
+import type { DrizzleDB } from "../db/connection.js";
+import type { UserRow } from "../db/schema.js";
+/**
+ * Role ordering — least → most privileged. Authoritative for any
+ * "is this role at least as privileged as X" comparison.
+ *
+ * @see SPECIFICATIONS.md §8.1
+ */
+export declare const ROLE_HIERARCHY: ReadonlyArray<AIHubRole>;
+/**
+ * Rank within the hierarchy — higher = more privileged. Driven by
+ * `ROLE_HIERARCHY` so a future role addition is one constant change.
+ *
+ * @see SPECIFICATIONS.md §8.1
+ */
+export declare const ROLE_RANK: Readonly<Record<AIHubRole, number>>;
+/**
+ * Returns `true` if `actual` is at least as privileged as `required`. Used by
+ * the role-enforcement middleware to gate every protected endpoint per the
+ * §8.2 matrix.
+ *
+ * @param actual - the role the caller's JWT carries.
+ * @param required - the minimum role the endpoint requires.
+ * @returns `true` if `actual >= required` in the hierarchy.
+ */
+export declare function hasRoleAtLeast(actual: AIHubRole, required: AIHubRole): boolean;
+/**
+ * Thrown by the assertion helpers below. The transactional helpers catch
+ * `RoleRuleError`s and translate them into the `{ ok: false, ... }` return
+ * shape; raw throws are reserved for unexpected programmer errors.
+ */
+export declare class RoleRuleError extends Error {
+    /** HTTP status the caller should return (typically 403, sometimes 404). */
+    readonly status: number;
+    /** Machine-readable code matching the §7.5 `AIHubError` codes. */
+    readonly code: string;
+    /**
+     * @param status - HTTP status code to surface.
+     * @param code - machine-readable code.
+     * @param message - human-readable description.
+     */
+    constructor(status: number, code: string, message: string);
+}
+/** A caller's identity bits — id + current role. */
+export interface RoleRuleCaller {
+    /** The caller's user id (from `auth.user.id`). */
+    id: string;
+    /** The caller's current role (from `auth.role`). */
+    role: AIHubRole;
+}
+/**
+ * Asserts a role-change is allowed under the §8.1 shield + min-count rules.
+ *
+ * The rules in plain English:
+ *
+ * - **Only `super_admin` can demote the last `super_admin`** — min-count rule.
+ *   Applies regardless of who the caller is (including the super_admin's own
+ *   self-demote when they are the only one).
+ * - **Only `super_admin` can promote anyone to `super_admin`**.
+ * - **`admin` callers can only mutate `user` / `power_user` targets** — they
+ *   cannot change the role of another `admin` or a `super_admin` (including
+ *   themselves — we block all admin-touches-admin, by an explicit decision
+ *   recorded in the Step-3 prompt).
+ * - **`power_user` and `user` cannot change any role** — the matrix gates
+ *   that at the endpoint level, but we double-check here so the helper is
+ *   safe to call from anywhere.
+ *
+ * @param caller - the caller's id + current role.
+ * @param target - the target user row (loaded inside the same transaction).
+ * @param newRole - the requested new role for `target`.
+ * @param totalSuperAdmins - count of super-admin rows in the DB, read inside
+ *   the same transaction so a concurrent demote can't bypass the rule.
+ * @throws {RoleRuleError} when the requested change violates any rule.
+ */
+export declare function assertCanChangeUserRole(caller: RoleRuleCaller, target: UserRow, newRole: AIHubRole, totalSuperAdmins: number): void;
+/**
+ * Asserts a password reset is allowed under the §8.1 shield + min-count rules.
+ *
+ * - `admin` cannot reset another `admin`'s or any `super_admin`'s password
+ *   (shield rule).
+ * - Cannot reset the only `super_admin`'s password — would amount to
+ *   demotion (min-count rule, §8.5).
+ *
+ * @param caller - the caller's id + current role.
+ * @param target - the target user row.
+ * @param totalSuperAdmins - count of super-admin rows read inside the same
+ *   transaction.
+ * @throws {RoleRuleError} on shield or min-count violation.
+ */
+export declare function assertCanResetPassword(caller: RoleRuleCaller, target: UserRow, totalSuperAdmins: number): void;
+/**
+ * Asserts a user deletion is allowed under the §8.1 shield + min-count rules.
+ *
+ * Same shape as `assertCanResetPassword`:
+ *
+ * - `admin` cannot delete another `admin` or any `super_admin`.
+ * - Cannot delete the only `super_admin`.
+ *
+ * @param caller - the caller's id + current role.
+ * @param target - the target user row.
+ * @param totalSuperAdmins - count of super-admin rows read inside the same
+ *   transaction.
+ * @throws {RoleRuleError} on shield or min-count violation.
+ */
+export declare function assertCanDeleteUser(caller: RoleRuleCaller, target: UserRow, totalSuperAdmins: number): void;
+/**
+ * Result shape returned by every `apply*InTx` helper. Step-4 endpoints branch
+ * on `ok` to produce the response.
+ */
+export type TxResult<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+};
+/**
+ * Applies a role change inside one SQLite transaction.
+ *
+ * Reads the target row + super-admin count inside the transaction so that a
+ * racing demote cannot win against the min-count rule. The Drizzle
+ * `db.transaction(fn)` API runs `fn` synchronously inside `BEGIN` / `COMMIT`;
+ * any thrown error inside `fn` triggers a `ROLLBACK` automatically.
+ *
+ * @param db - Drizzle client (the caller passes `ctx.db`; the helper opens
+ *   its own transaction internally).
+ * @param caller - caller's id + role.
+ * @param targetId - the user whose role is being changed.
+ * @param newRole - the new role.
+ * @returns the updated row on success, or an error result.
+ */
+export declare function applyUserRoleChangeInTx(db: DrizzleDB, caller: RoleRuleCaller, targetId: string, newRole: AIHubRole): TxResult<{
+    updated: UserRow;
+}>;
+/**
+ * Applies a user deletion inside one SQLite transaction. Same shape as
+ * `applyUserRoleChangeInTx` but DELETEs rather than UPDATEs.
+ *
+ * @param db - Drizzle client.
+ * @param caller - caller's id + role.
+ * @param targetId - the user to delete.
+ * @returns `{ ok: true, data: { deleted: <row before delete> } }` on success.
+ */
+export declare function applyUserDeletionInTx(db: DrizzleDB, caller: RoleRuleCaller, targetId: string): TxResult<{
+    deleted: UserRow;
+}>;
+/**
+ * Runs the password-reset assertion inside a transaction and yields the
+ * fresh target row. The caller (Step 4's `POST /admin/users/{id}/reset-password`
+ * handler) generates the new password, hashes it, and writes inside the
+ * same transaction — this helper exposes the read-and-assert plumbing so
+ * the write can happen alongside.
+ *
+ * The shape is slightly different from the role-change / delete helpers
+ * because the password generation + hashing is async (Argon2) and cannot
+ * happen inside better-sqlite3's synchronous transaction. The Step-4 handler
+ * will run this helper first (to validate + lock-read), then write outside
+ * the transaction. The risk of a concurrent role-change is small but real;
+ * Step 4 can re-verify after the write or accept the tiny window.
+ *
+ * @param db - Drizzle client.
+ * @param caller - caller's id + role.
+ * @param targetId - the user whose password is being reset.
+ * @returns the target row on success, or an error result.
+ */
+export declare function assertPasswordResetInTx(db: DrizzleDB, caller: RoleRuleCaller, targetId: string): TxResult<{
+    target: UserRow;
+}>;
+//# sourceMappingURL=roleRules.d.ts.map

package/dist/auth/roleRules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleRules.d.ts","sourceRoot":"","sources":["../../src/auth/roleRules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAM/C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,SAAS,CAK1C,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAKxD,CAAC;AAEH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,SAAS,GAClB,OAAO,CAET;AAMD;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,2EAA2E;IAC3E,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,kEAAkE;IAClE,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;gBACS,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAM1D;AAMD,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,SAAS,EAClB,gBAAgB,EAAE,MAAM,GACvB,IAAI,CA8CN;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,OAAO,EACf,gBAAgB,EAAE,MAAM,GACvB,IAAI,CA6BN;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,OAAO,EACf,gBAAgB,EAAE,MAAM,GACvB,IAAI,CA4BN;AAMD;;;GAGG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GACrB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AA2BjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,GACjB,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4ChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,GACf,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA2BhC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,GACf,QAAQ,CAAC;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B/B"}