@de-otio/trellis 0.6.1 → 0.7.1

package/dist/lib/routes/agent-authorize.js

@@ -0,0 +1,479 @@
+"use strict";
+/**
+ * Interactive agent-authorization page (T9b-d).
+ *
+ *   GET  /agents/authorize?user_code=XXXX-XXXX
+ *   POST /agents/authorize/approve
+ *
+ * The GET renders a minimal HTML approval form. The POST verifies the
+ * admin's session, enforces:
+ *   - tenant ManageAgentSessions capability
+ *   - MFA in the last hour (step-up if missing)
+ *   - per-IP rate limit (5/min)
+ *   - per-device_code lockout (10 failed lookups)
+ * and on success calls Cognito AdminInitiateAuth to mint tokens, seals
+ * them under the device_code, and writes the agent-session row.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentAuthorizeRoutes = void 0;
+exports._setAgentAuthorizeDepsForTest = _setAgentAuthorizeDepsForTest;
+exports._resetAgentAuthorizeDepsForTest = _resetAgentAuthorizeDepsForTest;
+const zod_1 = require("zod");
+const node_crypto_1 = require("node:crypto");
+const db_1 = require("../../db");
+const capabilities_1 = require("../auth/capabilities");
+const require_1 = require("../auth/require");
+const device_authorization_1 = require("../oauth/device-authorization");
+const emit_1 = require("../audit/emit");
+const event_types_1 = require("../audit/event-types");
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const cognito_issuer_1 = require("../oauth/cognito-issuer");
+const refresh_detection_1 = require("../oauth/refresh-detection");
+const middleware_1 = require("../middleware");
+const trusted_client_ip_1 = require("../net/trusted-client-ip");
+const rate_limit_1 = require("../rate-limit");
+const secret_resolver_1 = require("../secret-resolver");
+const security_headers_1 = require("../security-headers");
+const session_manager_1 = require("../session-manager");
+const errors_1 = require("./errors");
+/** Per-IP ceiling on approvals (G4 CRITICAL-3). */
+const APPROVE_RATE_LIMIT = 5;
+const APPROVE_RATE_WINDOW_SECONDS = 60;
+/**
+ * Global, IP-independent ceiling on `/agents/authorize` lookups (G4
+ * CRITICAL-3, MEDIUM-2). Even when XFF parsing is bypassed or a single
+ * IP can spoof many sources via cloud-supplied headers, this bucket
+ * caps the surface system-wide.
+ */
+const APPROVE_GLOBAL_LIMIT = 200;
+const APPROVE_GLOBAL_WINDOW_SECONDS = 60;
+/** Per-IP ceiling on user_code → device_code resolution misses (MEDIUM-2). */
+const VERIFY_MISS_LIMIT = 30;
+const VERIFY_MISS_WINDOW_SECONDS = 60;
+const MFA_FRESHNESS_MS = 60 * 60 * 1000; // 1 hour
+const ApproveSchema = zod_1.z
+    .object({
+    user_code: zod_1.z.string().min(4).max(32),
+})
+    .strict();
+/** Module-level deps; tests can override. */
+let deps = {};
+function _setAgentAuthorizeDepsForTest(d) {
+    deps = d;
+}
+function _resetAgentAuthorizeDepsForTest() {
+    deps = {};
+}
+function getIssuer() {
+    if (deps.issuer)
+        return deps.issuer;
+    return new cognito_issuer_1.AwsCognitoIssuer(new client_cognito_identity_provider_1.CognitoIdentityProviderClient({
+        region: process.env.COGNITO_REGION || process.env.AWS_REGION || "us-east-1",
+    }));
+}
+function getAudit() {
+    return deps.auditEmitter ?? new emit_1.AuditEventEmitter();
+}
+function getRateLimiter() {
+    return deps.rateLimiter ?? new rate_limit_1.RateLimiter();
+}
+function htmlResponse(body, status = 200) {
+    return new Response(body, {
+        status,
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+            "x-content-type-options": "nosniff",
+        },
+    });
+}
+function jsonError(env, body, status) {
+    const sec = new security_headers_1.SecurityHeaders(env);
+    return sec.createSecureResponse(JSON.stringify(body), {
+        status,
+        headers: { "content-type": "application/json", "cache-control": "no-store" },
+    });
+}
+function escape(input) {
+    return input
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+function renderApprovalPage(input) {
+    const heading = input.mfaRequired
+        ? "Verify a fresh MFA code, then approve"
+        : "Approve agent session";
+    const mfaNotice = input.mfaRequired
+        ? `<p class="warn">Your most recent MFA verification is older than 1 hour.
+        Verify with a TOTP code at <a href="/api/mfa/verify">/api/mfa/verify</a>
+        and reload this page.</p>`
+        : "";
+    // HIGH-4: agentLabel is supplied by the polling agent and is not a
+    // value the platform has authenticated. Render it inside a code block
+    // and warn the operator that the label is untrusted before they approve.
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Approve agent session</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 32em; margin: 4em auto; }
+    .code { font-family: monospace; font-size: 1.4em; }
+    .label-block { display: block; margin: 0.5em 0; padding: 0.5em 0.75em;
+                   background: #f4f4f4; border-left: 3px solid #888;
+                   font-family: monospace; word-break: break-all; }
+    .caveat { background: #fff8e1; border: 1px solid #f0c36d;
+              padding: 0.75em 1em; margin: 1em 0; border-radius: 4px; }
+    .warn { color: #b00; }
+    button[disabled] { opacity: 0.5; cursor: not-allowed; }
+  </style>
+</head>
+<body>
+  <h1>${escape(heading)}</h1>
+  <p>An agent identifying itself as:</p>
+  <code class="label-block">${escape(input.agentLabel ?? "(unknown client)")}</code>
+  <p>has requested access to your tenant from this address:</p>
+  <p>Source IP: <span class="code">${escape(input.sourceIp)}</span></p>
+  <div class="caveat">
+    The agent name above is supplied by the agent and is not verified by
+    Skybber. Verify with the person who initiated this flow before
+    approving.
+  </div>
+  <p>Code:
+     <span class="code">${escape(input.userCode)}</span></p>
+  ${mfaNotice}
+  <form method="POST" action="/agents/authorize/approve">
+    <input type="hidden" name="user_code" value="${escape(input.userCode)}" />
+    ${input.csrfToken ? `<input type="hidden" name="csrf_token" value="${escape(input.csrfToken)}" />` : ""}
+    <button type="submit"${input.mfaRequired ? " disabled" : ""}>Approve</button>
+  </form>
+</body>
+</html>`;
+}
+async function buildAuthContext(session, env) {
+    // Minimal AuthContext from the cookie session — the agent-approval flow
+    // only needs userId/tenantId/role for capability check and audit. The
+    // real Cognito JWT auth-middleware path is for token-bearing API calls;
+    // here the admin is using the web session.
+    if (!session.userId)
+        return null;
+    // We need tenantRole. Look up via Prisma.
+    const prisma = (0, db_1.createPrisma)(env);
+    const memberWithTenant = await prisma.tenantMember.findFirst({
+        where: { userId: session.userId, status: "ACTIVE" },
+        orderBy: { joinedAt: "asc" },
+        include: { tenant: true },
+    });
+    if (!memberWithTenant)
+        return null;
+    // HIGH-5: resolve the real Cognito sub from the User row. We previously
+    // used session.userId (the trellis user id) as the cognitoSub fallback,
+    // which would have caused AdminUserGlobalSignOut to be called against
+    // the wrong identifier. Block agent approval if the sub cannot be
+    // resolved rather than silently writing a value that won't revoke.
+    const userRow = await prisma.user.findUnique({
+        where: { id: session.userId },
+        select: { cognitoSub: true },
+    });
+    if (!userRow?.cognitoSub) {
+        return null;
+    }
+    // Use globalRole from session.role if present; fallback to END_USER.
+    const globalRole = session.role ?? "END_USER";
+    return {
+        cognitoSub: userRow.cognitoSub,
+        userId: session.userId,
+        globalRole,
+        activeTenantId: memberWithTenant.tenantId,
+        tenantSlug: memberWithTenant.tenant.slug,
+        tenantRole: memberWithTenant.role,
+        handle: session.email,
+        membershipsLoader: async () => [memberWithTenant],
+    };
+}
+exports.agentAuthorizeRoutes = [
+    {
+        path: "/agents/authorize",
+        method: "GET",
+        handler: async (request, env) => {
+            const url = new URL(request.url);
+            const rawUserCode = url.searchParams.get("user_code");
+            if (!rawUserCode) {
+                return htmlResponse("<p>Missing user_code parameter</p>", 400);
+            }
+            const sessionManager = new session_manager_1.SessionManager();
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                const returnTo = encodeURIComponent(`/agents/authorize?user_code=${rawUserCode}`);
+                return new Response(null, {
+                    status: 302,
+                    headers: { Location: `/auth/login?return=${returnTo}` },
+                });
+            }
+            // Capability check — admins only.
+            const auth = await buildAuthContext(session, env);
+            if (!auth) {
+                return htmlResponse("<p>Active tenant membership required.</p>", 403);
+            }
+            const denied = (0, require_1.requireCapability)(auth, capabilities_1.Capability.ManageAgentSessions);
+            if (denied) {
+                return htmlResponse("<p>You are not permitted to approve agents for this tenant.</p>", 403);
+            }
+            // CRITICAL-3: enforce a global ceiling on resolution attempts so
+            // the surface stays bounded even when per-IP keys are spoofable.
+            const rl = getRateLimiter();
+            const globalLimited = await rl.applyRateLimitKV(env, request, "/agents/authorize:global", APPROVE_GLOBAL_LIMIT, APPROVE_GLOBAL_WINDOW_SECONDS, 
+            // Keying on a fixed userId forces the limiter to a single bucket
+            // shared by all callers regardless of headers.
+            undefined, undefined, "global");
+            if (globalLimited)
+                return globalLimited;
+            // Resolve the user_code → device_code lookup. Don't reveal whether
+            // the code is valid in the page body to avoid easy brute-force —
+            // but we can still tell the user the page renders.
+            const userCode = (0, device_authorization_1.normaliseUserCode)(rawUserCode);
+            const deviceCode = await (0, device_authorization_1.lookupDeviceCodeByUserCode)(userCode);
+            const record = deviceCode ? await (0, device_authorization_1.loadByDeviceCode)(deviceCode) : null;
+            // MEDIUM-2: charge a miss against the per-IP miss bucket whenever
+            // the user_code did not resolve. Combined with the global ceiling
+            // above, a single source cannot enumerate user_codes by spamming
+            // GETs without hitting either bucket first.
+            if (!deviceCode) {
+                await rl
+                    .applyRateLimitKV(env, request, "/agents/authorize:miss", VERIFY_MISS_LIMIT, VERIFY_MISS_WINDOW_SECONDS)
+                    .catch(() => null);
+            }
+            // LOW-2: use abs() so future clock skew (mfaVerifiedAt > now) does
+            // not bypass the freshness gate. The tolerance window is symmetric;
+            // anything outside ±MFA_FRESHNESS_MS counts as stale.
+            const mfaFresh = Boolean(session.mfaVerified) &&
+                typeof session.mfaVerifiedAt === "number" &&
+                Math.abs(Date.now() - session.mfaVerifiedAt) < MFA_FRESHNESS_MS;
+            return htmlResponse(renderApprovalPage({
+                userCode: rawUserCode,
+                agentLabel: record?.agentLabel,
+                sourceIp: (0, trusted_client_ip_1.trustedClientIp)(request, env),
+                mfaRequired: !mfaFresh,
+                csrfToken: session.csrfToken,
+            }));
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "Render the agent-approval page",
+    },
+    {
+        path: "/agents/authorize/approve",
+        method: "POST",
+        handler: async (request, env) => {
+            const rl = getRateLimiter();
+            // CRITICAL-3: global, IP-independent ceiling first. Even if the
+            // per-IP limiter below is bypassable via spoofed proxy headers,
+            // this bucket caps the surface system-wide.
+            const globalLimited = await rl.applyRateLimitKV(env, request, "/agents/authorize/approve:global", APPROVE_GLOBAL_LIMIT, APPROVE_GLOBAL_WINDOW_SECONDS, undefined, undefined, "global");
+            if (globalLimited)
+                return globalLimited;
+            // Per-IP rate limit on the approval surface.
+            const limited = await rl.applyRateLimitKV(env, request, "/agents/authorize/approve", APPROVE_RATE_LIMIT, APPROVE_RATE_WINDOW_SECONDS);
+            if (limited)
+                return limited;
+            const sessionManager = new session_manager_1.SessionManager();
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                return (0, errors_1.structuredError)(401, {
+                    error: "UNAUTHORIZED",
+                    message: "Authentication required.",
+                    remediation: "Sign in at /auth/login and retry.",
+                });
+            }
+            // MFA freshness gate — refuse if MFA wasn't recently verified.
+            // LOW-2: use abs() so future clock skew (mfaVerifiedAt > now)
+            // cannot satisfy the freshness check.
+            const mfaFresh = Boolean(session.mfaVerified) &&
+                typeof session.mfaVerifiedAt === "number" &&
+                Math.abs(Date.now() - session.mfaVerifiedAt) < MFA_FRESHNESS_MS;
+            if (!mfaFresh) {
+                return (0, errors_1.structuredError)(401, {
+                    error: "MFA_REQUIRED",
+                    message: "Step up with a fresh MFA verification before approving an agent.",
+                    remediation: "POST /api/mfa/verify with a TOTP code, then retry this approval.",
+                });
+            }
+            const auth = await buildAuthContext(session, env);
+            if (!auth) {
+                return (0, errors_1.structuredError)(401, {
+                    error: "UNAUTHORIZED",
+                    message: "Authentication required.",
+                    remediation: "Sign in at /auth/login with an active tenant membership and retry.",
+                });
+            }
+            const denied = (0, require_1.requireCapability)(auth, capabilities_1.Capability.ManageAgentSessions);
+            if (denied)
+                return denied;
+            // Read form / json body.
+            const ct = request.headers.get("content-type") || "";
+            let body;
+            if (ct.includes("application/x-www-form-urlencoded")) {
+                const text = await request.text();
+                body = Object.fromEntries(new URLSearchParams(text).entries());
+            }
+            else if (ct.includes("application/json")) {
+                body = (await request.json());
+            }
+            else {
+                return (0, errors_1.structuredError)(400, {
+                    error: "INVALID_REQUEST",
+                    message: "Request body must be form-encoded or JSON.",
+                    remediation: "Set Content-Type to application/x-www-form-urlencoded or application/json.",
+                });
+            }
+            const parsed = ApproveSchema.safeParse(body);
+            if (!parsed.success) {
+                return (0, errors_1.structuredError)(400, {
+                    error: "INVALID_REQUEST",
+                    message: "user_code is required.",
+                    remediation: "Include the user_code displayed on the agent device.",
+                    field: "user_code",
+                });
+            }
+            const userCode = (0, device_authorization_1.normaliseUserCode)(parsed.data.user_code);
+            const deviceCode = await (0, device_authorization_1.lookupDeviceCodeByUserCode)(userCode);
+            if (!deviceCode) {
+                // MEDIUM-2: charge the per-IP miss bucket on every unresolved
+                // user_code so enumeration is bounded even when the device-code
+                // table holds no row to attach the failed-lookup counter to.
+                await rl
+                    .applyRateLimitKV(env, request, "/agents/authorize:miss", VERIFY_MISS_LIMIT, VERIFY_MISS_WINDOW_SECONDS)
+                    .catch(() => null);
+                return (0, errors_1.structuredError)(404, {
+                    error: "INVALID_USER_CODE",
+                    message: "User code not found or expired.",
+                    remediation: "Verify the code displayed on the agent device and try again.",
+                    field: "user_code",
+                });
+            }
+            const record = await (0, device_authorization_1.loadByDeviceCode)(deviceCode);
+            if (!record) {
+                await rl
+                    .applyRateLimitKV(env, request, "/agents/authorize:miss", VERIFY_MISS_LIMIT, VERIFY_MISS_WINDOW_SECONDS)
+                    .catch(() => null);
+                return (0, errors_1.structuredError)(404, {
+                    error: "INVALID_USER_CODE",
+                    message: "User code not found or expired.",
+                    remediation: "Verify the code displayed on the agent device and try again.",
+                    field: "user_code",
+                });
+            }
+            // Verify the supplied user_code actually matches the record's hash.
+            const expected = (0, device_authorization_1.hashUserCode)(userCode);
+            if (expected !== record.userCodeHash) {
+                const after = await (0, device_authorization_1.incrementFailedLookup)(deviceCode);
+                if (after >= device_authorization_1.USER_CODE_FAILURE_LIMIT) {
+                    return (0, errors_1.structuredError)(410, {
+                        error: "DEVICE_CODE_LOCKED",
+                        message: "Too many failed attempts. This device code has been locked.",
+                        remediation: "Restart the agent authorization flow to get a new code.",
+                    });
+                }
+                return (0, errors_1.structuredError)(404, {
+                    error: "INVALID_USER_CODE",
+                    message: "User code not found or expired.",
+                    remediation: "Verify the code displayed on the agent device and try again.",
+                    field: "user_code",
+                });
+            }
+            if (record.failedLookups >= device_authorization_1.USER_CODE_FAILURE_LIMIT) {
+                return (0, errors_1.structuredError)(410, {
+                    error: "DEVICE_CODE_LOCKED",
+                    message: "Too many failed attempts. This device code has been locked.",
+                    remediation: "Restart the agent authorization flow to get a new code.",
+                });
+            }
+            const userPoolId = env.COGNITO_USER_POOL_ID;
+            const agentClientId = env.COGNITO_AGENT_CLIENT_ID;
+            if (!userPoolId || !agentClientId) {
+                return jsonError(env, { error: "not_configured" }, 503);
+            }
+            // Pull the admin's refresh token off the cookie session — it's the
+            // input to AdminInitiateAuth(REFRESH_TOKEN_AUTH).
+            const refreshToken = session.refreshToken;
+            if (!refreshToken) {
+                return (0, errors_1.structuredError)(400, {
+                    error: "SESSION_MISSING_REFRESH_TOKEN",
+                    message: "This session has no Cognito refresh token.",
+                    remediation: "Sign in via the agent client and retry.",
+                });
+            }
+            const issuer = getIssuer();
+            const tokens = await issuer.issueForAgent({
+                userPoolId,
+                clientId: agentClientId,
+                username: auth.cognitoSub,
+                refreshToken,
+            });
+            const sessionId = `s_${(0, node_crypto_1.randomBytes)(16).toString("base64url")}`;
+            // Naive jti extraction from the new refresh token — Cognito refresh
+            // tokens are opaque, so we derive a jti from the token bytes via
+            // a stable hash.
+            const initialJti = `j_${(0, node_crypto_1.randomBytes)(16).toString("base64url")}`;
+            await (0, device_authorization_1.approveDeviceAuth)({
+                deviceCode,
+                approvedByUserId: auth.userId,
+                cognitoSub: auth.cognitoSub,
+                tenantId: auth.activeTenantId,
+                tokens,
+                sessionId,
+            });
+            const requestIp = (0, trusted_client_ip_1.trustedClientIp)(request, env);
+            const sessionRow = {
+                sessionId,
+                userId: auth.userId,
+                cognitoSub: auth.cognitoSub,
+                tenantId: auth.activeTenantId,
+                currentJti: initialJti,
+                status: "active",
+                agentLabel: record.agentLabel,
+                sourceIp: requestIp,
+                createdAt: Math.floor(Date.now() / 1000),
+                lastUsedAt: Math.floor(Date.now() / 1000),
+            };
+            await (0, refresh_detection_1.recordAgentSession)({ session: sessionRow, initialJti });
+            // Audit: agent session approved.
+            try {
+                const audit = getAudit();
+                const prisma = (0, db_1.createPrisma)(env);
+                // MEDIUM-6: do not include a hash of the device_code in the audit
+                // payload — it can be replayed against a stolen device_code as a
+                // confirmation oracle. Use agentSessionId as the correlator and
+                // generate a fresh UUID for any further cross-event linking.
+                await audit.emit({
+                    type: event_types_1.AuditEventType.AUTH_AGENT_SESSION_APPROVED,
+                    tenantId: auth.activeTenantId,
+                    actorUserId: auth.userId,
+                    payload: {
+                        agentLabel: record.agentLabel ?? "(unknown)",
+                        // G4 N1: cap raw User-Agent in the audit payload to match
+                        // the 256-byte agent-label cap applied at oauth.ts:36.
+                        userAgent: (request.headers.get("user-agent") ?? "(unknown)").slice(0, 256),
+                        correlationId: (0, node_crypto_1.randomUUID)(),
+                    },
+                    sourceIp: requestIp,
+                    agentSessionId: sessionId,
+                }, prisma);
+            }
+            catch {
+                // Audit failures don't block approval — the AuditEventEmitter
+                // logs an audit-fallback line itself.
+            }
+            const sec = new security_headers_1.SecurityHeaders(env);
+            return sec.createSecureResponse(JSON.stringify({ status: "approved" }), {
+                status: 200,
+                headers: { "content-type": "application/json", "cache-control": "no-store" },
+            });
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Approve a pending agent session",
+    },
+];
+//# sourceMappingURL=agent-authorize.js.map

package/dist/lib/routes/agent-authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-authorize.js","sourceRoot":"","sources":["../../../src/lib/routes/agent-authorize.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAuEH,sEAEC;AAED,0EAEC;AA3ED,6BAAwB;AACxB,6CAAsD;AACtD,iCAAwC;AACxC,uDAAkD;AAClD,6CAAoD;AAEpD,wEAQuC;AACvC,wCAAkD;AAClD,sDAAsD;AACtD,gGAA0F;AAC1F,4DAGiC;AACjC,kEAGoC;AACpC,8CAA+D;AAC/D,gEAA2D;AAC3D,8CAA4C;AAC5C,wDAA6C;AAC7C,0DAAsD;AACtD,wDAAkE;AAClE,qCAA2C;AAG3C,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AACzC,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAElD,MAAM,aAAa,GAAG,OAAC;KACpB,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAWZ,6CAA6C;AAC7C,IAAI,IAAI,GAAuB,EAAE,CAAC;AAElC,SAAgB,6BAA6B,CAAC,CAAqB;IACjE,IAAI,GAAG,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,+BAA+B;IAC7C,IAAI,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,iCAAgB,CACzB,IAAI,gEAA6B,CAAC;QAChC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;KAC5E,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,wBAAiB,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,WAAW,IAAI,IAAI,wBAAW,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,wBAAwB,EAAE,SAAS;SACpC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,IAAa,EAAE,MAAc;IAC5D,MAAM,GAAG,GAAG,IAAI,kCAAe,CAAC,GAAY,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACpD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAM3B;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;QAC/B,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,uBAAuB,CAAC;IAE5B,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW;QACjC,CAAC,CAAC;;kCAE4B;QAC9B,CAAC,CAAC,EAAE,CAAC;IAEP,mEAAmE;IACnE,sEAAsE;IACtE,yEAAyE;IACzE,OAAO;;;;;;;;;;;;;;;;;;QAkBD,MAAM,CAAC,OAAO,CAAC;;8BAEO,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC;;qCAEvC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;;;;;;;0BAOjC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC5C,SAAS;;mDAEsC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;MACnE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,iDAAiD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;2BAChF,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;;;QAGvD,CAAC;AACT,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,GAAY;IAEZ,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,2CAA2C;IAC3C,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACjC,0CAA0C;IAC1C,MAAM,MAAM,GAAG,IAAA,iBAAY,EAAC,GAAY,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;QAC3D,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QACnD,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE;QAC7B,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,MAAM,UAAU,GAAI,OAAO,CAAC,IAAkC,IAAI,UAAU,CAAC;IAE7E,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU;QACV,cAAc,EAAE,gBAAgB,CAAC,QAAQ;QACzC,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI;QACxC,UAAU,EAAE,gBAAgB,CAAC,IAAI;QACjC,MAAM,EAAE,OAAO,CAAC,KAAK;QACrB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,gBAAyB,CAAC;KAC3D,CAAC;AACJ,CAAC;AAEY,QAAA,oBAAoB,GAAY;IAC3C;QACE,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,YAAY,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,gCAAc,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAG,CACJ,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,kBAAkB,CAAC,+BAA+B,WAAW,EAAE,CAAC,CAAC;gBAClF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,sBAAsB,QAAQ,EAAE,EAAE;iBACxD,CAAC,CAAC;YACL,CAAC;YAED,kCAAkC;YAClC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,YAAY,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,2BAAiB,EAAC,IAAI,EAAE,yBAAU,CAAC,mBAAmB,CAAC,CAAC;YACvE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,YAAY,CAAC,iEAAiE,EAAE,GAAG,CAAC,CAAC;YAC9F,CAAC;YAED,iEAAiE;YACjE,iEAAiE;YACjE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;YAC5B,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAC7C,GAAG,EACH,OAAO,EACP,0BAA0B,EAC1B,oBAAoB,EACpB,6BAA6B;YAC7B,iEAAiE;YACjE,+CAA+C;YAC/C,SAAS,EACT,SAAS,EACT,QAAQ,CACT,CAAC;YACF,IAAI,aAAa;gBAAE,OAAO,aAAa,CAAC;YAExC,mEAAmE;YACnE,iEAAiE;YACjE,mDAAmD;YACnD,MAAM,QAAQ,GAAG,IAAA,wCAAiB,EAAC,WAAW,CAAC,CAAC;YAChD,MAAM,UAAU,GAAG,MAAM,IAAA,iDAA0B,EAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,IAAA,uCAAgB,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAEtE,kEAAkE;YAClE,kEAAkE;YAClE,iEAAiE;YACjE,4CAA4C;YAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,EAAE;qBACL,gBAAgB,CACf,GAAG,EACH,OAAO,EACP,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,CAC3B;qBACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAED,mEAAmE;YACnE,oEAAoE;YACpE,sDAAsD;YACtD,MAAM,QAAQ,GACZ,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC5B,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;gBACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,gBAAgB,CAAC;YAElE,OAAO,YAAY,CACjB,kBAAkB,CAAC;gBACjB,QAAQ,EAAE,WAAW;gBACrB,UAAU,EAAE,MAAM,EAAE,UAAU;gBAC9B,QAAQ,EAAE,IAAA,mCAAe,EAAC,OAAO,EAAE,GAAG,CAAC;gBACvC,WAAW,EAAE,CAAC,QAAQ;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;QAC9B,WAAW,EAAE,gCAAgC;KAC9C;IAED;QACE,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;YAE5B,gEAAgE;YAChE,gEAAgE;YAChE,4CAA4C;YAC5C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAC7C,GAAG,EACH,OAAO,EACP,kCAAkC,EAClC,oBAAoB,EACpB,6BAA6B,EAC7B,SAAS,EACT,SAAS,EACT,QAAQ,CACT,CAAC;YACF,IAAI,aAAa;gBAAE,OAAO,aAAa,CAAC;YAExC,6CAA6C;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,gBAAgB,CACvC,GAAG,EACH,OAAO,EACP,2BAA2B,EAC3B,kBAAkB,EAClB,2BAA2B,CAC5B,CAAC;YACF,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAE5B,MAAM,cAAc,GAAG,IAAI,gCAAc,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAG,CACJ,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,0BAA0B;oBACnC,WAAW,EAAE,mCAAmC;iBACjD,CAAC,CAAC;YACL,CAAC;YAED,+DAA+D;YAC/D,8DAA8D;YAC9D,sCAAsC;YACtC,MAAM,QAAQ,GACZ,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC5B,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;gBACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,gBAAgB,CAAC;YAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,kEAAkE;oBAC3E,WAAW,EAAE,kEAAkE;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,0BAA0B;oBACnC,WAAW,EAAE,oEAAoE;iBAClF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,2BAAiB,EAAC,IAAI,EAAE,yBAAU,CAAC,mBAAmB,CAAC,CAAC;YACvE,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAE1B,yBAAyB;YACzB,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACrD,IAAI,IAA4B,CAAC;YACjC,IAAI,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC3C,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,4CAA4C;oBACrD,WAAW,EAAE,4EAA4E;iBAC1F,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,wBAAwB;oBACjC,WAAW,EAAE,sDAAsD;oBACnE,KAAK,EAAE,WAAW;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,wCAAiB,EAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,IAAA,iDAA0B,EAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,8DAA8D;gBAC9D,gEAAgE;gBAChE,6DAA6D;gBAC7D,MAAM,EAAE;qBACL,gBAAgB,CACf,GAAG,EACH,OAAO,EACP,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,CAC3B;qBACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,iCAAiC;oBAC1C,WAAW,EAAE,8DAA8D;oBAC3E,KAAK,EAAE,WAAW;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAgB,EAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,EAAE;qBACL,gBAAgB,CACf,GAAG,EACH,OAAO,EACP,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,CAC3B;qBACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,iCAAiC;oBAC1C,WAAW,EAAE,8DAA8D;oBAC3E,KAAK,EAAE,WAAW;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,MAAM,QAAQ,GAAG,IAAA,mCAAY,EAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,IAAA,4CAAqB,EAAC,UAAU,CAAC,CAAC;gBACtD,IAAI,KAAK,IAAI,8CAAuB,EAAE,CAAC;oBACrC,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;wBAC1B,KAAK,EAAE,oBAAoB;wBAC3B,OAAO,EAAE,6DAA6D;wBACtE,WAAW,EAAE,yDAAyD;qBACvE,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,iCAAiC;oBAC1C,WAAW,EAAE,8DAA8D;oBAC3E,KAAK,EAAE,WAAW;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,CAAC,aAAa,IAAI,8CAAuB,EAAE,CAAC;gBACpD,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,oBAAoB;oBAC3B,OAAO,EAAE,6DAA6D;oBACtE,WAAW,EAAE,yDAAyD;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC;YAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,uBAAuB,CAAC;YAClD,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;YAED,mEAAmE;YACnE,kDAAkD;YAClD,MAAM,YAAY,GAAI,OAA+C,CAAC,YAAY,CAAC;YACnF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,+BAA+B;oBACtC,OAAO,EAAE,4CAA4C;oBACrD,WAAW,EAAE,yCAAyC;iBACvD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;gBACxC,UAAU;gBACV,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;gBACzB,YAAY;aACb,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,KAAK,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,oEAAoE;YACpE,iEAAiE;YACjE,iBAAiB;YACjB,MAAM,UAAU,GAAG,KAAK,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAEhE,MAAM,IAAA,wCAAiB,EAAC;gBACtB,UAAU;gBACV,gBAAgB,EAAE,IAAI,CAAC,MAAM;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,cAAc;gBAC7B,MAAM;gBACN,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAA,mCAAe,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,UAAU,GAAuB;gBACrC,SAAS;gBACT,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,cAAc;gBAC7B,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBACxC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aAC1C,CAAC;YACF,MAAM,IAAA,sCAAkB,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAE9D,iCAAiC;YACjC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,IAAA,iBAAY,EAAC,GAAY,CAAC,CAAC;gBAC1C,kEAAkE;gBAClE,iEAAiE;gBACjE,gEAAgE;gBAChE,6DAA6D;gBAC7D,MAAM,KAAK,CAAC,IAAI,CACd;oBACE,IAAI,EAAE,4BAAc,CAAC,2BAA2B;oBAChD,QAAQ,EAAE,IAAI,CAAC,cAAc;oBAC7B,WAAW,EAAE,IAAI,CAAC,MAAM;oBACxB,OAAO,EAAE;wBACP,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,WAAW;wBAC5C,0DAA0D;wBAC1D,uDAAuD;wBACvD,SAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC3E,aAAa,EAAE,IAAA,wBAAU,GAAE;qBAC5B;oBACD,QAAQ,EAAE,SAAS;oBACnB,cAAc,EAAE,SAAS;iBAC1B,EACD,MAAe,CAChB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;gBAC9D,sCAAsC;YACxC,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,kCAAe,CAAC,GAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC,oBAAoB,CAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EACtC;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;aAC7E,CACF,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,iCAAiC;KAC/C;CACF,CAAC"}

package/dist/lib/routes/agent-sessions.d.ts

@@ -0,0 +1,20 @@
+/**
+ * User-facing agent session management (T9b-d).
+ *
+ *   GET  /api/users/me/agent-sessions
+ *   POST /api/users/me/agent-sessions/{id}/revoke
+ *
+ * Backed by the AGENT_REFRESH_TABLE rows written by the device-auth flow.
+ */
+import { type CognitoRevoker } from "../oauth/refresh-detection";
+import { AuditEventEmitter } from "../audit/emit";
+import type { Route } from "./types";
+interface AgentSessionDeps {
+    cognito?: CognitoRevoker;
+    auditEmitter?: AuditEventEmitter;
+}
+export declare function _setAgentSessionDepsForTest(d: AgentSessionDeps): void;
+export declare function _resetAgentSessionDepsForTest(): void;
+export declare const agentSessionsRoutes: Route[];
+export {};
+//# sourceMappingURL=agent-sessions.d.ts.map

package/dist/lib/routes/agent-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-sessions.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/agent-sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAUlD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,UAAU,gBAAgB;IACxB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAID,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAErE;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAmCD,eAAO,MAAM,mBAAmB,EAAE,KAAK,EAgFtC,CAAC"}

package/dist/lib/routes/agent-sessions.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * User-facing agent session management (T9b-d).
+ *
+ *   GET  /api/users/me/agent-sessions
+ *   POST /api/users/me/agent-sessions/{id}/revoke
+ *
+ * Backed by the AGENT_REFRESH_TABLE rows written by the device-auth flow.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentSessionsRoutes = void 0;
+exports._setAgentSessionDepsForTest = _setAgentSessionDepsForTest;
+exports._resetAgentSessionDepsForTest = _resetAgentSessionDepsForTest;
+const refresh_detection_1 = require("../oauth/refresh-detection");
+const auth_middleware_1 = require("../auth/auth-middleware");
+const emit_1 = require("../audit/emit");
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const db_1 = require("../../db");
+const middleware_1 = require("../middleware");
+const trusted_client_ip_1 = require("../net/trusted-client-ip");
+const security_headers_1 = require("../security-headers");
+const errors_1 = require("./errors");
+let deps = {};
+function _setAgentSessionDepsForTest(d) {
+    deps = d;
+}
+function _resetAgentSessionDepsForTest() {
+    deps = {};
+}
+function getCognito() {
+    if (deps.cognito)
+        return deps.cognito;
+    const region = process.env.COGNITO_REGION || process.env.AWS_REGION || "us-east-1";
+    const client = new client_cognito_identity_provider_1.CognitoIdentityProviderClient({ region });
+    return {
+        async globalSignOut(input) {
+            await client.send(new client_cognito_identity_provider_1.AdminUserGlobalSignOutCommand({
+                UserPoolId: input.userPoolId,
+                Username: input.cognitoUsername,
+            }));
+        },
+    };
+}
+function getAudit() {
+    return deps.auditEmitter ?? new emit_1.AuditEventEmitter();
+}
+function publicShape(rec) {
+    return {
+        id: rec.sessionId,
+        agentLabel: rec.agentLabel ?? null,
+        sourceIp: rec.sourceIp ?? null,
+        createdAt: new Date(rec.createdAt * 1000).toISOString(),
+        lastUsedAt: new Date(rec.lastUsedAt * 1000).toISOString(),
+        status: rec.status,
+    };
+}
+const REVOKE_RE = /^\/api\/users\/me\/agent-sessions\/([^/]+)\/revoke$/;
+exports.agentSessionsRoutes = [
+    {
+        path: "/api/users/me/agent-sessions",
+        method: "GET",
+        handler: async (request, env) => {
+            const sec = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(sec);
+            const sessions = await (0, refresh_detection_1.listAgentSessions)(auth.userId);
+            return sec.createSecureResponse(JSON.stringify({ sessions: sessions.map(publicShape) }), { status: 200, headers: { "content-type": "application/json" } });
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "List active agent sessions for the current user",
+    },
+    {
+        path: REVOKE_RE,
+        method: "POST",
+        handler: async (request, env, { pathname }) => {
+            const sec = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(sec);
+            const sessionId = pathname.match(REVOKE_RE)?.[1];
+            if (!sessionId) {
+                return (0, errors_1.structuredError)(400, {
+                    error: "INVALID_REQUEST",
+                    message: "Session ID is required.",
+                    remediation: "Ensure the session ID is included in the URL path.",
+                }, sec);
+            }
+            const session = await (0, refresh_detection_1.getAgentSession)(sessionId);
+            if (!session || session.userId !== auth.userId) {
+                // 404 — don't reveal cross-user existence.
+                return (0, errors_1.structuredError)(404, {
+                    error: "NOT_FOUND",
+                    message: "Agent session not found.",
+                    remediation: "Verify the session ID and ensure it belongs to your account.",
+                }, sec);
+            }
+            const userPoolId = env.COGNITO_USER_POOL_ID;
+            if (!userPoolId) {
+                return sec.createSecureResponse(JSON.stringify({ error: "not_configured" }), { status: 503, headers: { "content-type": "application/json" } });
+            }
+            const cognito = getCognito();
+            const audit = getAudit();
+            // Audit emitter wants a Prisma client — supply the standard shape.
+            const prisma = (0, db_1.createPrisma)(env);
+            await (0, refresh_detection_1.revokeAgentSession)({
+                sessionId,
+                userPoolId,
+                cognitoUsername: session.cognitoSub,
+                cognito,
+                audit: {
+                    emit: async (input) => audit.emit(input, prisma),
+                },
+                tenantId: session.tenantId,
+                actorUserId: auth.userId,
+                sourceIp: (0, trusted_client_ip_1.trustedClientIp)(request, env),
+            });
+            return sec.createSecureResponse(JSON.stringify({ status: "revoked" }), { status: 200, headers: { "content-type": "application/json" } });
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Revoke an agent session",
+    },
+];
+//# sourceMappingURL=agent-sessions.js.map