@endora-commerce/mod-api-keys 0.100.0

package/dist/backend/index.js

@@ -0,0 +1,57 @@
+import { lazyPort } from '@endora-commerce/platform/kernel';
+import { integrationsModule } from './plugin.js';
+import { ApiKey } from './entities/api-key.entity.js';
+export function registerModule(ctx) {
+    ctx.di.register({
+        // One registration holds the whole graph: the two gates close over the
+        // same `resolveScopedKey`, so building them separately would mean two
+        // authenticators disagreeing about what a scope means.
+        apiKeys: ctx
+            .asFunction(({ emFactory, auditLogService }) => integrationsModule({
+            emFactory,
+            auditLogService,
+            // Resolved per check rather than captured: `requireAdmin` is a
+            // transient port gate, and a captured one keeps admitting requests
+            // after `auth` is switched off.
+            requireAdmin: (permission) => async (req, reply) => ctx.cradle().requireAdmin(permission)(req, reply),
+            resolveAdminUserId: (request) => ctx.cradle().adminContextResolver(request).adminUserId,
+            // Feature 075 (D-87) — the two owners the binding rules ask about.
+            // Both were `em.getKnex().raw('select … from "organizations"')` and
+            // `… from "customer_accounts"` inside the service: raw SQL naming
+            // no specifier, so the boundary compiled and returned rows. Gated
+            // ports, so a singleton may not hold one directly.
+            bindingPorts: {
+                organizations: lazyPort(ctx, 'organizationDetailsPort'),
+                customerAccounts: lazyPort(ctx, 'customerAccountReadPort'),
+            },
+        }))
+            .singleton(),
+    });
+    ctx.di.providePort('apiKeyService', ctx.asFunction(({ apiKeys }) => apiKeys.handle.apiKeyService).singleton());
+    ctx.di.providePort('requireApiKey', ctx.asFunction(({ apiKeys }) => apiKeys.handle.requireApiKey).singleton());
+    ctx.di.providePort('requireBoundApiKey', ctx.asFunction(({ apiKeys }) => apiKeys.handle.requireBoundApiKey).singleton());
+    ctx.di.providePort('apiKeyResolver', ctx
+        .asFunction(({ apiKeys }) => async (token) => apiKeys.handle.apiKeyService.authenticate(token))
+        .singleton());
+    ctx.routes(async (app) => {
+        // The factory's own plugin, not a re-registration: it mounts the admin
+        // routes and nothing else, and duplicating that here would be a second
+        // place to keep in step.
+        await ctx.cradle().apiKeys.plugin(app);
+    });
+}
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export const entities = [
+    ApiKey,
+];
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAG5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAqDtD,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,uEAAuE;QACvE,sEAAsE;QACtE,uDAAuD;QACvD,OAAO,EAAE,GAAG;aACT,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,eAAe,EAAiB,EAAE,EAAE,CAChD,kBAAkB,CAAC;YACjB,SAAS;YACT,eAAe;YACf,+DAA+D;YAC/D,mEAAmE;YACnE,gCAAgC;YAChC,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CACjD,GAAG,CAAC,MAAM,EAAiB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC;YAClE,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,GAAG,CAAC,MAAM,EAAiB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,WAAW;YACvE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,mDAAmD;YACnD,YAAY,EAAE;gBACZ,aAAa,EAAE,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC;gBAChF,gBAAgB,EAAE,QAAQ,CACxB,GAAG,EACH,yBAAyB,CAC1B;aACF;SACF,CAAC,CACL;aACA,SAAS,EAAE;KACf,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,eAAe,EACf,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,EAAiB,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CACzF,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,eAAe,EACf,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,EAAiB,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CACzF,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,oBAAoB,EACpB,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,EAAiB,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAC9F,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,gBAAgB,EAChB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,OAAO,EAAiB,EAAE,EAAE,CAC7B,KAAK,EAAE,KAAa,EAAE,EAAE,CACtB,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CACrD;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,uEAAuE;QACvE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,GAAG,CAAC,MAAM,EAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,MAAM;CACP,CAAC"}

package/dist/backend/plugin.d.ts

@@ -0,0 +1,65 @@
+import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { ApiKeyService, type ApiKeyBindingPorts } from './services/api-key-service.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * Composition root for the US7 surface — API keys + webhooks.
+ * Returns a handle so other modules (e.g. catalog routes.api-key.ts) can
+ * consume the api-key gate this builds.
+ */
+export interface IntegrationsModuleOptions {
+    emFactory: () => EntityManager;
+    requireAdmin: RequireAdminFactory;
+    auditLogService: AuditPort;
+    /**
+     * `organizations`' and `customer_accounts`' published reads, which the
+     * binding rules B3 and B4 decide on (feature 075, D-87). Both were raw SQL
+     * against those modules' tables inside the service.
+     */
+    bindingPorts: ApiKeyBindingPorts;
+    /**
+     * Who the acting admin is, from the production actor (feature 080, T051).
+     * Threaded through to the admin routes, which used to read
+     * `request.testActor` — see `ApiKeysAdminDeps.resolveAdminUserId`.
+     */
+    resolveAdminUserId: (request: FastifyRequest) => string;
+}
+/**
+ * Feature 062 — the resolved binding `requireBoundApiKey` stashes on the
+ * request for the distributor services.
+ */
+export interface ApiKeyRequestBinding {
+    apiKeyId: string;
+    scopes: string[];
+    organizationId: string;
+    salesChannelId: string;
+    customerAccountId: string;
+}
+declare module 'fastify' {
+    interface FastifyRequest {
+        /** Set by `requireBoundApiKey` after a successful binding assertion. */
+        apiKeyBinding?: ApiKeyRequestBinding;
+    }
+}
+export interface IntegrationsModuleHandle {
+    apiKeyService: ApiKeyService;
+    /**
+     * Pre-handler factory that authenticates a Bearer token via ApiKeyService
+     * and gates on the requested scope. Used by api-key route surfaces (e.g.
+     * the catalog by-sku upsert in routes.api-key.ts) — out-of-scope returns
+     * 403 + an audit row tagging the api key (T220).
+     */
+    requireApiKey: (scope: string) => (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    /**
+     * Feature 062 — distributor gate: authenticate → scope (audited 403,
+     * unchanged) → binding assertion (403 `API_KEY_NOT_BOUND` + audit
+     * `api_key.not_bound`) → stash the resolved binding on the request.
+     */
+    requireBoundApiKey: (scope: string) => (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
+}
+export declare function integrationsModule(options: IntegrationsModuleOptions): {
+    plugin: (app: FastifyInstance) => Promise<void>;
+    handle: IntegrationsModuleHandle;
+};
+//# sourceMappingURL=plugin.d.ts.map

package/dist/backend/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,OAAO,EACL,aAAa,EACb,KAAK,kBAAkB,EAExB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;GAIG;AAEH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,SAAS,CAAC;IAC3B;;;;OAIG;IACH,YAAY,EAAE,kBAAkB,CAAC;IACjC;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CACzD;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,wEAAwE;QACxE,aAAa,CAAC,EAAE,oBAAoB,CAAC;KACtC;CACF;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,EAAE,CACb,KAAK,EAAE,MAAM,KACV,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;;OAIG;IACH,kBAAkB,EAAE,CAClB,KAAK,EAAE,MAAM,KACV,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG;IACtE,MAAM,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,EAAE,wBAAwB,CAAC;CAClC,CA4FA"}

package/dist/backend/plugin.js

@@ -0,0 +1,75 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { ApiKeyService, } from './services/api-key-service.js';
+import { registerApiKeysAdminRoutes } from './routes.js';
+export function integrationsModule(options) {
+    const apiKeyService = new ApiKeyService(options.emFactory, options.bindingPorts, options.auditLogService);
+    // Shared authenticate + scope assertion used by both gates.
+    const resolveScopedKey = async (request, scope) => {
+        const header = request.headers.authorization;
+        if (!header?.startsWith('Bearer ')) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'API key required.');
+        }
+        const token = header.slice('Bearer '.length).trim();
+        const resolved = await apiKeyService.authenticate(token);
+        if (!resolved) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'API key is invalid or revoked.');
+        }
+        if (!resolved.scopes.includes(scope)) {
+            if (options.auditLogService) {
+                await options.auditLogService.record({
+                    action: 'api_key.out_of_scope',
+                    objectType: 'api_key',
+                    objectId: resolved.apiKeyId,
+                    stateBefore: null,
+                    stateAfter: { attemptedScope: scope, grantedScopes: resolved.scopes },
+                });
+            }
+            throw new HttpError(403, ERROR_CODES.API_KEY_OUT_OF_SCOPE, `API key lacks the required scope: ${scope}.`);
+        }
+        return resolved;
+    };
+    const requireApiKey = (scope) => async (request) => {
+        await resolveScopedKey(request, scope);
+    };
+    // Feature 062 — distributor gate (contracts/api-key-binding.md §4).
+    const requireBoundApiKey = (scope) => async (request) => {
+        const resolved = await resolveScopedKey(request, scope);
+        if (!resolved.organizationId ||
+            !resolved.salesChannelId ||
+            !resolved.customerAccountId) {
+            if (options.auditLogService) {
+                await options.auditLogService.record({
+                    action: 'api_key.not_bound',
+                    objectType: 'api_key',
+                    objectId: resolved.apiKeyId,
+                    stateBefore: null,
+                    stateAfter: { attemptedScope: scope },
+                });
+            }
+            throw new HttpError(403, ERROR_CODES.API_KEY_NOT_BOUND, 'This endpoint requires a distributor-bound API key.');
+        }
+        request.apiKeyBinding = {
+            apiKeyId: resolved.apiKeyId,
+            scopes: resolved.scopes,
+            organizationId: resolved.organizationId,
+            salesChannelId: resolved.salesChannelId,
+            customerAccountId: resolved.customerAccountId,
+        };
+    };
+    return {
+        handle: {
+            apiKeyService,
+            requireApiKey,
+            requireBoundApiKey,
+        },
+        plugin: async (app) => {
+            await registerApiKeysAdminRoutes(app, {
+                apiKeyService,
+                requireAdmin: options.requireAdmin,
+                resolveAdminUserId: options.resolveAdminUserId,
+            });
+        },
+    };
+}
+//# sourceMappingURL=plugin.js.map

package/dist/backend/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EACL,aAAa,GAGd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAoEzD,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IAInE,MAAM,aAAa,GAAG,IAAI,aAAa,CACrC,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,eAAe,CACxB,CAAC;IAEF,4DAA4D;IAC5D,MAAM,gBAAgB,GAAG,KAAK,EAC5B,OAAuB,EACvB,KAAa,EACiB,EAAE;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;oBACnC,MAAM,EAAE,sBAAsB;oBAC9B,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,oBAAoB,EAChC,qCAAqC,KAAK,GAAG,CAC9C,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,aAAa,GACjB,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,EAAE,OAAuB,EAAiB,EAAE;QAClE,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC;IAEJ,oEAAoE;IACpE,MAAM,kBAAkB,GACtB,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,EAAE,OAAuB,EAAiB,EAAE;QAClE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxD,IACE,CAAC,QAAQ,CAAC,cAAc;YACxB,CAAC,QAAQ,CAAC,cAAc;YACxB,CAAC,QAAQ,CAAC,iBAAiB,EAC3B,CAAC;YACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;oBACnC,MAAM,EAAE,mBAAmB;oBAC3B,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,iBAAiB,EAC7B,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,aAAa,GAAG;YACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;SAC9C,CAAC;IACJ,CAAC,CAAC;IAEJ,OAAO;QACL,MAAM,EAAE;YACN,aAAa;YACb,aAAa;YACb,kBAAkB;SACnB;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,0BAA0B,CAAC,GAAG,EAAE;gBACpC,aAAa;gBACb,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aAC/C,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/routes.d.ts

@@ -0,0 +1,26 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { ApiKeyService } from './services/api-key-service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+export interface ApiKeysAdminDeps {
+    apiKeyService: ApiKeyService;
+    requireAdmin: RequireAdminFactory;
+    /**
+     * The acting admin's id, resolved from the request the guard in front of
+     * these routes has already accepted.
+     *
+     * Injected rather than read here, because the read used to be
+     * `testAdminUserId(request)` — `http/test-actor-carrier`, which
+     * `contracts/host-package.md` §1.4j classifies **A**: the file exists to
+     * narrow this repository's test-harness Fastify augmentation, and an
+     * installed package has no relationship to that harness. It also answered
+     * `undefined` in production for every request, because nothing under `src/`
+     * writes `request.testActor`.
+     *
+     * Both composition roots supply it from `adminContextResolver`, which reads
+     * the production actor and throws 401 for a non-admin. Every call site sits
+     * behind `requireAdmin(...)`, so the actor is an admin by the time it runs.
+     */
+    resolveAdminUserId: (request: FastifyRequest) => string;
+}
+export declare function registerApiKeysAdminRoutes(app: FastifyInstance, deps: ApiKeysAdminDeps): Promise<void>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/backend/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/backend/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CACzD;AAED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CA6Cf"}

package/dist/backend/routes.js

@@ -0,0 +1,51 @@
+import { createApiKeyRequestSchema } from '@endora-commerce/contracts';
+export async function registerApiKeysAdminRoutes(app, deps) {
+    const { apiKeyService, requireAdmin, resolveAdminUserId } = deps;
+    app.get('/api/v1/admin/api-keys', { preHandler: requireAdmin('integrations:manage') }, async () => {
+        const rows = await apiKeyService.list();
+        return { data: rows.map(serializeApiKey) };
+    });
+    app.post('/api/v1/admin/api-keys', {
+        preHandler: requireAdmin('integrations:manage'),
+        schema: { body: createApiKeyRequestSchema },
+    }, async (request, reply) => {
+        const body = createApiKeyRequestSchema.parse(request.body);
+        const result = await apiKeyService.create({
+            name: body.name,
+            scopes: body.scopes,
+            ...(body.binding !== undefined ? { binding: body.binding } : {}),
+            ...(body.expiresAt !== undefined ? { expiresAt: new Date(body.expiresAt) } : {}),
+            createdByAdminUserId: resolveAdminUserId(request),
+        });
+        reply.status(201);
+        return {
+            data: {
+                apiKey: serializeApiKey(result.apiKey),
+                bearerToken: result.bearerToken,
+            },
+        };
+    });
+    app.delete('/api/v1/admin/api-keys/:id', { preHandler: requireAdmin('integrations:manage') }, async (request, reply) => {
+        await apiKeyService.revoke(request.params.id);
+        return reply.status(204).send();
+    });
+}
+function serializeApiKey(a) {
+    return {
+        id: a.id,
+        name: a.name,
+        lastFour: a.lastFour,
+        scopes: a.scopes,
+        status: a.status,
+        lastUsedAt: a.lastUsedAt?.toISOString() ?? null,
+        revokedAt: a.revokedAt?.toISOString() ?? null,
+        createdAt: a.createdAt.toISOString(),
+        updatedAt: a.updatedAt.toISOString(),
+        // Feature 062 — additive binding/expiry fields (null for unbound keys).
+        organizationId: a.organizationId ?? null,
+        salesChannelId: a.salesChannelId ?? null,
+        customerAccountId: a.customerAccountId ?? null,
+        expiresAt: a.expiresAt?.toISOString() ?? null,
+    };
+}
+//# sourceMappingURL=routes.js.map

package/dist/backend/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/backend/routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AA2BvE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAoB,EACpB,IAAsB;IAEtB,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAEjE,GAAG,CAAC,GAAG,CACL,wBAAwB,EACxB,EAAE,UAAU,EAAE,YAAY,CAAC,qBAAqB,CAAC,EAAE,EACnD,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;IAC7C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,wBAAwB,EACxB;QACE,UAAU,EAAE,YAAY,CAAC,qBAAqB,CAAC;QAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE;KAC5C,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,oBAAoB,EAAE,kBAAkB,CAAC,OAAO,CAAC;SAClD,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO;YACL,IAAI,EAAE;gBACJ,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtC,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,4BAA4B,EAC5B,EAAE,UAAU,EAAE,YAAY,CAAC,qBAAqB,CAAC,EAAE,EACnD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;QAC/C,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;QAC7C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,wEAAwE;QACxE,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;QACxC,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;QACxC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;QAC9C,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;KAC9C,CAAC;AACJ,CAAC"}

package/dist/backend/services/api-key-service.d.ts

@@ -0,0 +1,72 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type ApiKeyBinding, type CustomerAccountReadPort, type OrganizationDetailsPort } from '@endora-commerce/contracts';
+import { ApiKey } from '../entities/api-key.entity.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * ApiKeyService (T227, extended by feature 062 — distributor binding).
+ *
+ * - create: generates a `sk_live_<random>` token, stores its sha256 hash, and
+ *   returns the raw token + ApiKey row. Caller must show the token once.
+ *   Validates the distributor binding rules B1–B5
+ *   (specs/062-distributor-api/contracts/api-key-binding.md §2).
+ * - revoke: marks status='revoked', sets revokedAt.
+ * - authenticate: hashes the supplied bearer, looks up by hash, validates
+ *   status + expiry. Returns the resolved identity (incl. binding) or null.
+ *   Used by the api-key auth gates and the ambient actor resolver.
+ */
+export interface CreateApiKeyResult {
+    apiKey: ApiKey;
+    /** Raw bearer token. Returned exactly once. */
+    bearerToken: string;
+}
+/** Resolved identity of an authenticated key, incl. the distributor binding. */
+export interface AuthenticatedApiKey {
+    apiKeyId: string;
+    scopes: string[];
+    organizationId: string | null;
+    salesChannelId: string | null;
+    customerAccountId: string | null;
+}
+/**
+ * The two owners this module asks about a binding it is being handed
+ * (feature 075, D-87).
+ *
+ * Both reads were `em.getKnex().raw('select … from "organizations" / …
+ * "customer_accounts" …')`. Raw SQL names no import specifier, so those two
+ * boundary crossings compiled, returned rows and were invisible to the import
+ * predicate until feature 077 taught the check to read table identifiers.
+ *
+ * Nothing about the isolation changes by resolving them as ports: `getKnex()`
+ * is `getConnection().getKnex()`, which takes its own pooled connection, so
+ * neither read could ever see the enclosing transaction's writes either. What
+ * changes is that an absent owner now refuses instead of answering — B3 and B4
+ * decide whether a distributor key may be minted, and a validation that
+ * silently found no organisation because the module holding organisations was
+ * gone would mint nothing and blame the operator's input.
+ */
+export interface ApiKeyBindingPorts {
+    organizations: OrganizationDetailsPort;
+    customerAccounts: CustomerAccountReadPort;
+}
+export declare class ApiKeyService {
+    #private;
+    private readonly emFactory;
+    private readonly bindingPorts;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, bindingPorts: ApiKeyBindingPorts, auditLog?: AuditPort | undefined);
+    create(input: {
+        name: string;
+        scopes: string[];
+        binding?: ApiKeyBinding;
+        expiresAt?: Date;
+        createdByAdminUserId?: string;
+    }): Promise<CreateApiKeyResult>;
+    list(): Promise<ApiKey[]>;
+    revoke(apiKeyId: string): Promise<void>;
+    /**
+     * Resolve a raw bearer token to the key's identity. Returns null if
+     * invalid / revoked / expired. Updates `lastUsedAt` on success.
+     */
+    authenticate(rawBearer: string): Promise<AuthenticatedApiKey | null>;
+}
+//# sourceMappingURL=api-key-service.d.ts.map

package/dist/backend/services/api-key-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/api-key-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC7B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAGvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,uBAAuB,CAAC;IACvC,gBAAgB,EAAE,uBAAuB,CAAC;CAC3C;AAED,qBAAa,aAAa;;IAEtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAFT,SAAS,EAAE,MAAM,aAAa,EAC9B,YAAY,EAAE,kBAAkB,EAChC,QAAQ,CAAC,EAAE,SAAS,YAAA;IASjC,MAAM,CAAC,KAAK,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,EAAE,aAAa,CAAC;QACxB,SAAS,CAAC,EAAE,IAAI,CAAC;QACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA0IzB,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKzB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY7C;;;OAGG;IACG,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;CAoB3E"}

package/dist/backend/services/api-key-service.js

@@ -0,0 +1,186 @@
+import { createHash, randomBytes } from 'crypto';
+import { ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { ApiKey } from '../entities/api-key.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+import { SalesChannel } from '@endora-commerce/platform/kernel';
+const TOKEN_PREFIX = 'sk_live_';
+export class ApiKeyService {
+    emFactory;
+    bindingPorts;
+    auditLog;
+    constructor(emFactory, bindingPorts, auditLog) {
+        this.emFactory = emFactory;
+        this.bindingPorts = bindingPorts;
+        this.auditLog = auditLog;
+    }
+    #audit(em, action, objectId, stateBefore, stateAfter) {
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, { action, objectType: 'api_key', objectId, stateBefore, stateAfter });
+        }
+    }
+    async create(input) {
+        const em = this.emFactory();
+        await this.#validateCreate(em, input);
+        const raw = randomBytes(32).toString('base64url');
+        const bearerToken = `${TOKEN_PREFIX}${raw}`;
+        const apiKey = em.create(ApiKey, {
+            name: input.name,
+            keyHash: sha256Hex(bearerToken),
+            lastFour: bearerToken.slice(-4),
+            scopes: input.scopes,
+            ...(input.binding
+                ? {
+                    organizationId: input.binding.organizationId,
+                    salesChannelId: input.binding.salesChannelId,
+                    customerAccountId: input.binding.customerAccountId,
+                }
+                : {}),
+            ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
+            ...(input.createdByAdminUserId !== undefined
+                ? { createdByAdminUserId: input.createdByAdminUserId }
+                : {}),
+        });
+        em.persist(apiKey);
+        this.#audit(em, 'api_key.create', apiKey.id, null, {
+            name: apiKey.name,
+            scopes: apiKey.scopes,
+            binding: input.binding
+                ? {
+                    organizationId: input.binding.organizationId,
+                    salesChannelId: input.binding.salesChannelId,
+                    customerAccountId: input.binding.customerAccountId,
+                }
+                : null,
+            expiresAt: input.expiresAt?.toISOString() ?? null,
+        });
+        await em.flush();
+        return { apiKey, bearerToken };
+    }
+    /**
+     * Creation rules B1–B5 (contracts/api-key-binding.md §2). The two foreign
+     * rows are read through their owners' published ports (see
+     * {@link ApiKeyBindingPorts}); the sales channel is the kernel's own entity
+     * and stays an ORM read on the caller's `em`.
+     */
+    async #validateCreate(em, input) {
+        const issues = [];
+        const hasOrdersScope = input.scopes.some((s) => s.startsWith('orders:'));
+        if (hasOrdersScope && !input.binding) {
+            // B1
+            issues.push({
+                path: 'binding',
+                issue: 'Orders scopes require a distributor binding (organization, sales channel, service account).',
+            });
+        }
+        if (input.binding && input.scopes.includes('catalog:write')) {
+            // B2
+            issues.push({
+                path: 'scopes',
+                issue: 'catalog:write is not allowed on a bound key — PIM writes stay unbound-only.',
+            });
+        }
+        if (input.binding) {
+            const organization = await this.bindingPorts.organizations.findById(input.binding.organizationId);
+            // B4. `deletedAt` is checked here rather than assumed of the port: the
+            // statement this replaced spelled `and "deleted_at" is null`, and a
+            // soft-deleted organisation is a binding target that must not resolve.
+            if (organization === null || organization.deletedAt !== null) {
+                issues.push({
+                    path: 'binding.organizationId',
+                    issue: 'Organization does not exist.',
+                });
+            }
+            /**
+             * The kernel's own entity, not `select 1 from "sales_channels"` (feature
+             * 075, D-87). `sales_channels` is the kernel's table since feature 072
+             * moved the resolution machinery there, and a module relating into the
+             * kernel by ORM is the sanctioned access.
+             *
+             * Read through the caller's `em`, not through
+             * `salesChannelResolutionPort.getById`: that accessor forks its own
+             * EntityManager, so a channel created earlier in this Command's
+             * transaction would not be visible to it and B4 would refuse a binding
+             * that is about to be valid.
+             */
+            const channel = await em.findOne(SalesChannel, { id: input.binding.salesChannelId });
+            if (channel === null) {
+                // B4 (active not required at creation — the key fails closed while inactive)
+                issues.push({
+                    path: 'binding.salesChannelId',
+                    issue: 'Sales channel does not exist.',
+                });
+            }
+            // The wider read on purpose: the four columns the statement selected are
+            // all on the record, and the three-way "active" predicate below is this
+            // module's rule to state, not the port's `activeOnly` shorthand — that
+            // one excludes soft-deleted accounts and says nothing about blocked or
+            // anonymized ones.
+            const account = await this.bindingPorts.customerAccounts.findById(input.binding.customerAccountId);
+            const accountActive = account !== null &&
+                account.blockedAt === null &&
+                account.deletedAt === null &&
+                account.anonymizedAt === null;
+            if (!account || !accountActive || account.organizationId !== input.binding.organizationId) {
+                // B3
+                issues.push({
+                    path: 'binding.customerAccountId',
+                    issue: 'Service account must be an active customer account of the bound organization.',
+                });
+            }
+        }
+        if (input.expiresAt !== undefined && input.expiresAt.getTime() <= Date.now()) {
+            // B5
+            issues.push({ path: 'expiresAt', issue: 'Expiry must be a future instant.' });
+        }
+        if (issues.length > 0) {
+            throw new HttpError(422, ERROR_CODES.VALIDATION_FAILED, 'API key creation failed binding validation.', issues);
+        }
+    }
+    async list() {
+        const em = this.emFactory();
+        return em.find(ApiKey, {}, { orderBy: { createdAt: 'desc' } });
+    }
+    async revoke(apiKeyId) {
+        const em = this.emFactory();
+        const apiKey = await em.findOne(ApiKey, { id: apiKeyId });
+        if (!apiKey) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'API key not found.');
+        }
+        apiKey.status = 'revoked';
+        apiKey.revokedAt = new Date();
+        this.#audit(em, 'api_key.revoke', apiKey.id, { name: apiKey.name }, null);
+        await em.flush();
+    }
+    /**
+     * Resolve a raw bearer token to the key's identity. Returns null if
+     * invalid / revoked / expired. Updates `lastUsedAt` on success.
+     */
+    async authenticate(rawBearer) {
+        // command-coverage-ignore: stamps last-used — high-volume auth bookkeeping,
+        // not an audited domain-state mutation.
+        if (!rawBearer.startsWith(TOKEN_PREFIX))
+            return null;
+        const em = this.emFactory();
+        const apiKey = await em.findOne(ApiKey, { keyHash: sha256Hex(rawBearer) });
+        if (!apiKey || apiKey.status !== 'active')
+            return null;
+        // Feature 062 (B5 runtime half) — an expired key is indistinguishable from
+        // an invalid one (401 UNAUTHORIZED at every gate).
+        if (apiKey.expiresAt && apiKey.expiresAt.getTime() <= Date.now())
+            return null;
+        apiKey.lastUsedAt = new Date();
+        await em.flush();
+        return {
+            apiKeyId: apiKey.id,
+            scopes: apiKey.scopes,
+            organizationId: apiKey.organizationId ?? null,
+            salesChannelId: apiKey.salesChannelId ?? null,
+            customerAccountId: apiKey.customerAccountId ?? null,
+        };
+    }
+}
+function sha256Hex(input) {
+    return createHash('sha256').update(input, 'utf8').digest('hex');
+}
+//# sourceMappingURL=api-key-service.js.map

package/dist/backend/services/api-key-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-service.js","sourceRoot":"","sources":["../../../src/backend/services/api-key-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EACL,WAAW,GAIZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AA+BhE,MAAM,YAAY,GAAG,UAAU,CAAC;AA0BhC,MAAM,OAAO,aAAa;IAEL;IACA;IACA;IAHnB,YACmB,SAA8B,EAC9B,YAAgC,EAChC,QAAoB;QAFpB,cAAS,GAAT,SAAS,CAAqB;QAC9B,iBAAY,GAAZ,YAAY,CAAoB;QAChC,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,MAAM,CAAC,EAAiB,EAAE,MAAc,EAAE,QAAgB,EAAE,WAA2C,EAAE,UAA0C;QACjJ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAMZ;QACC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEtC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,GAAG,YAAY,GAAG,GAAG,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC;YAC/B,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC;oBACE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;oBAC5C,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;oBAC5C,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;iBACnD;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE;YACjD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACpB,CAAC,CAAC;oBACE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;oBAC5C,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;oBAC5C,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;iBACnD;gBACH,CAAC,CAAC,IAAI;YACR,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;SAClD,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,EAAiB,EACjB,KAAsE;QAEtE,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAEzE,IAAI,cAAc,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,KAAK;YACL,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,6FAA6F;aACrG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,KAAK;YACL,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,6EAA6E;aACrF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CACjE,KAAK,CAAC,OAAO,CAAC,cAAc,CAC7B,CAAC;YACF,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;YACL,CAAC;YACD;;;;;;;;;;;eAWG;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YACrF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,6EAA6E;gBAC7E,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,KAAK,EAAE,+BAA+B;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,mBAAmB;YACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAC/D,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAChC,CAAC;YACF,MAAM,aAAa,GACjB,OAAO,KAAK,IAAI;gBAChB,OAAO,CAAC,SAAS,KAAK,IAAI;gBAC1B,OAAO,CAAC,SAAS,KAAK,IAAI;gBAC1B,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;YAChC,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC1F,KAAK;gBACL,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,+EAA+E;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7E,KAAK;YACL,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,iBAAiB,EAC7B,6CAA6C,EAC7C,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,4EAA4E;QAC5E,wCAAwC;QACxC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9E,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;YAC7C,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;YAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,IAAI;SACpD,CAAC;IACJ,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}