@hilbras/keystone 1.1.0

package/dist/db/seed.js

@@ -0,0 +1,139 @@
+import crypto from "node:crypto";
+import { eq, and } from "drizzle-orm";
+import { db } from "./index.js";
+import { organizations, users, orgMemberships, applications, workflows } from "./schema.js";
+import { config } from "../config.js";
+import { createApplication } from "../services/applications.js";
+import { hashPassword } from "../services/secrets.js";
+async function seed() {
+    const clientAppUrl = process.env.CLIENT_APP_URL || "http://localhost:5173";
+    const aiAppUrl = process.env.AI_APP_URL || "http://localhost:5174";
+    const landingAppUrl = process.env.LANDING_APP_URL || "http://localhost:5175";
+    // Idempotently create the Hilbras organization.
+    let [hilbrasOrg] = await db.select().from(organizations).where(eq(organizations.slug, "hilbras")).limit(1);
+    if (!hilbrasOrg) {
+        [hilbrasOrg] = await db
+            .insert(organizations)
+            .values({ name: "Hilbras", slug: "hilbras", plan: "enterprise" })
+            .returning();
+        console.log(`[seed] created organization ${hilbrasOrg.id}`);
+    }
+    else {
+        console.log(`[seed] organization Hilbras already exists`);
+    }
+    const appDefinitions = [
+        {
+            name: "hilbras-os",
+            clientId: "hilbras-os",
+            secretEnv: "HILBRAS_OS_CLIENT_SECRET",
+            defaultSecret: "cs_os_default_secret_replace_in_production",
+            redirectUris: [`${clientAppUrl}/auth/callback`, `${clientAppUrl}/callback`],
+            allowedOrigins: [clientAppUrl],
+        },
+        {
+            name: "hilbras-ai",
+            clientId: "hilbras-ai",
+            secretEnv: "HILBRAS_AI_CLIENT_SECRET",
+            defaultSecret: "cs_ai_default_secret_replace_in_production",
+            redirectUris: [`${aiAppUrl}/auth/callback`, `${aiAppUrl}/callback`],
+            allowedOrigins: [aiAppUrl],
+        },
+        {
+            name: "hilbras-landing",
+            clientId: "hilbras-landing",
+            secretEnv: "HILBRAS_LANDING_CLIENT_SECRET",
+            defaultSecret: "cs_landing_default_secret_replace_in_production",
+            redirectUris: [`${landingAppUrl}/auth/callback`, `${landingAppUrl}/callback`],
+            allowedOrigins: [landingAppUrl],
+        },
+    ];
+    for (const def of appDefinitions) {
+        const existing = await db.select().from(applications).where(eq(applications.clientId, def.clientId)).limit(1);
+        if (existing.length > 0) {
+            console.log(`[seed] application ${def.clientId} already exists`);
+            continue;
+        }
+        const secret = process.env[def.secretEnv] || def.defaultSecret;
+        const app = await createApplication({
+            orgId: hilbrasOrg.id,
+            name: def.name,
+            clientId: def.clientId,
+            clientSecret: secret,
+            redirectUris: def.redirectUris,
+            allowedOrigins: def.allowedOrigins,
+        });
+        console.log(`[seed] created application ${app.clientId} (${app.id})`);
+    }
+    // Ensure a seed owner exists and owns the Hilbras org.
+    const ownerEmail = config.SEED_OWNER_EMAIL;
+    const ownerPassword = process.env.KEYSTONE_SEED_OWNER_PASSWORD || crypto.randomUUID();
+    if (ownerEmail) {
+        let [owner] = await db.select().from(users).where(eq(users.email, ownerEmail.toLowerCase())).limit(1);
+        if (!owner) {
+            const username = ownerEmail.split("@")[0].replace(/[^a-z0-9_-]/g, "-").slice(0, 32);
+            [owner] = await db
+                .insert(users)
+                .values({
+                email: ownerEmail.toLowerCase(),
+                username,
+                name: username,
+                provider: "password",
+                emailVerified: true,
+                passwordHash: await hashPassword(ownerPassword),
+            })
+                .returning();
+            console.log(`[seed] created owner user ${owner.id}`);
+            if (!process.env.KEYSTONE_SEED_OWNER_PASSWORD) {
+                console.log(`[seed] generated owner password: ${ownerPassword}`);
+            }
+        }
+        else {
+            console.log(`[seed] owner user already exists`);
+        }
+        const existingMembership = await db
+            .select()
+            .from(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, hilbrasOrg.id), eq(orgMemberships.userId, owner.id)))
+            .limit(1);
+        if (existingMembership.length === 0) {
+            await db.insert(orgMemberships).values({
+                orgId: hilbrasOrg.id,
+                userId: owner.id,
+                role: "owner",
+            });
+            console.log(`[seed] added owner membership`);
+        }
+    }
+    // Seed the default signup workflow.
+    const [existingWorkflow] = await db.select().from(workflows).where(eq(workflows.trigger, "user_registered")).limit(1);
+    if (!existingWorkflow) {
+        await db.insert(workflows).values({
+            orgId: hilbrasOrg.id,
+            name: "Default signup",
+            trigger: "user_registered",
+            definition: {
+                steps: [
+                    { type: "assign_role", role: "user" },
+                    { type: "create_organization", orgName: "{{username}}-personal", slug: "{{username}}-personal", outputKey: "personalOrgId" },
+                    { type: "add_membership", orgRef: "personalOrgId", role: "owner" },
+                    { type: "add_app_membership", role: "member" },
+                    { type: "send_welcome_email" },
+                ],
+            },
+        });
+        console.log("[seed] created default signup workflow");
+    }
+    else {
+        console.log("[seed] default signup workflow already exists");
+    }
+    console.log("[seed] done");
+}
+seed()
+    .catch((err) => {
+    console.error("[seed] failed:", err);
+    process.exit(1);
+})
+    .finally(async () => {
+    process.exit(0);
+});
+//# sourceMappingURL=seed.js.map

package/dist/db/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/db/seed.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,KAAK,UAAU,IAAI;IACjB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,uBAAuB,CAAC;IACnE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,uBAAuB,CAAC;IAE7E,gDAAgD;IAChD,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3G,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;aAChE,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,+BAA+B,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,cAAc,GAAG;QACrB;YACE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,0BAA0B;YACrC,aAAa,EAAE,4CAA4C;YAC3D,YAAY,EAAE,CAAC,GAAG,YAAY,gBAAgB,EAAE,GAAG,YAAY,WAAW,CAAC;YAC3E,cAAc,EAAE,CAAC,YAAY,CAAC;SAC/B;QACD;YACE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,0BAA0B;YACrC,aAAa,EAAE,4CAA4C;YAC3D,YAAY,EAAE,CAAC,GAAG,QAAQ,gBAAgB,EAAE,GAAG,QAAQ,WAAW,CAAC;YACnE,cAAc,EAAE,CAAC,QAAQ,CAAC;SAC3B;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,iBAAiB;YAC3B,SAAS,EAAE,+BAA+B;YAC1C,aAAa,EAAE,iDAAiD;YAChE,YAAY,EAAE,CAAC,GAAG,aAAa,gBAAgB,EAAE,GAAG,aAAa,WAAW,CAAC;YAC7E,cAAc,EAAE,CAAC,aAAa,CAAC;SAChC;KACF,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,QAAQ,iBAAiB,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,EAAE;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,MAAM;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,cAAc,EAAE,GAAG,CAAC,cAAc;SACnC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IACtF,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;iBACf,MAAM,CAAC,KAAK,CAAC;iBACb,MAAM,CAAC;gBACN,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;gBAC/B,QAAQ;gBACR,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,UAAU;gBACpB,aAAa,EAAE,IAAI;gBACnB,YAAY,EAAE,MAAM,YAAY,CAAC,aAAa,CAAC;aAChD,CAAC;iBACD,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,oCAAoC,aAAa,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,EAAE;aAChC,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;aACxF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;gBACrC,KAAK,EAAE,UAAU,CAAC,EAAE;gBACpB,MAAM,EAAE,KAAK,CAAC,EAAE;gBAChB,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,CAAC,gBAAgB,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;YAChC,KAAK,EAAE,UAAU,CAAC,EAAE;YACpB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,iBAAiB;YAC1B,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;oBACrC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,eAAe,EAAE;oBAC5H,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE;oBAClE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC9C,EAAE,IAAI,EAAE,oBAAoB,EAAE;iBAC/B;aACF;SACF,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAC7B,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;KACD,OAAO,CAAC,KAAK,IAAI,EAAE;IAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/di.d.ts

@@ -0,0 +1,12 @@
+import { type Container } from "./container.js";
+import { AuthorizationDomainService } from "./services/domain/index.js";
+import { AuthenticationApplicationService, IdentityApplicationService, OrganizationApplicationService } from "./services/application/index.js";
+export declare function buildContainer(overrides?: Partial<Container>): Container;
+export declare function initializeContainer(overrides?: Partial<Container>): Container;
+export declare function buildApplicationServices(container: Container): {
+    auth: AuthenticationApplicationService;
+    identity: IdentityApplicationService;
+    organization: OrganizationApplicationService;
+    authorization: AuthorizationDomainService;
+};
+//# sourceMappingURL=di.d.ts.map

package/dist/di.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"di.d.ts","sourceRoot":"","sources":["../src/di.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAgB9D,OAAO,EAEL,0BAA0B,EAG3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,8BAA8B,EAC/B,MAAM,iCAAiC,CAAC;AAEzC,wBAAgB,cAAc,CAAC,SAAS,GAAE,OAAO,CAAC,SAAS,CAAM,GAAG,SAAS,CAgC5E;AAED,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAI7E;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,SAAS;;;;;EAY5D"}

package/dist/di.js

@@ -0,0 +1,56 @@
+import { setContainer } from "./container.js";
+import { ConfigurationService } from "./services/configuration.js";
+import { DefaultFeatureFlagService } from "./services/features.js";
+import { DrizzleUserRepository, DrizzleIdentityRepository, DrizzleOrganizationRepository, DrizzleApplicationRepository, DrizzleAuditRepository, DrizzlePermissionRepository, DrizzleApiKeyRepository, DrizzleSamlConnectionRepository, DrizzleOidcConnectionRepository, } from "./repositories/index.js";
+import { secretsProvider } from "./services/secrets/index.js";
+import { queue } from "./services/queue/index.js";
+import { AuthenticationDomainService, AuthorizationDomainService, IdentityDomainService, OrganizationDomainService, } from "./services/domain/index.js";
+import { AuthenticationApplicationService, IdentityApplicationService, OrganizationApplicationService, } from "./services/application/index.js";
+export function buildContainer(overrides = {}) {
+    const config = new ConfigurationService();
+    const features = new DefaultFeatureFlagService(config);
+    const userRepository = new DrizzleUserRepository();
+    const identityRepository = new DrizzleIdentityRepository();
+    const organizationRepository = new DrizzleOrganizationRepository();
+    const applicationRepository = new DrizzleApplicationRepository();
+    const auditRepository = new DrizzleAuditRepository();
+    const permissionRepository = new DrizzlePermissionRepository();
+    const apiKeyRepository = new DrizzleApiKeyRepository();
+    const samlConnectionRepository = new DrizzleSamlConnectionRepository();
+    const oidcConnectionRepository = new DrizzleOidcConnectionRepository();
+    const container = {
+        config,
+        features,
+        userRepository,
+        identityRepository,
+        organizationRepository,
+        applicationRepository,
+        auditRepository,
+        permissionRepository,
+        apiKeyRepository,
+        samlConnectionRepository,
+        oidcConnectionRepository,
+        secretsProvider,
+        queue,
+        ...overrides,
+    };
+    return container;
+}
+export function initializeContainer(overrides) {
+    const container = buildContainer(overrides);
+    setContainer(container);
+    return container;
+}
+export function buildApplicationServices(container) {
+    const authorizationDomain = new AuthorizationDomainService(container.organizationRepository, container.permissionRepository);
+    const authenticationDomain = new AuthenticationDomainService(container.userRepository, container.applicationRepository);
+    const identityDomain = new IdentityDomainService(container.userRepository, container.identityRepository);
+    const organizationDomain = new OrganizationDomainService(container.organizationRepository, container.applicationRepository, container.userRepository);
+    return {
+        auth: new AuthenticationApplicationService(authenticationDomain),
+        identity: new IdentityApplicationService(identityDomain),
+        organization: new OrganizationApplicationService(organizationDomain, authorizationDomain, identityDomain),
+        authorization: authorizationDomain,
+    };
+}
+//# sourceMappingURL=di.js.map

package/dist/di.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"di.js","sourceRoot":"","sources":["../src/di.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAkB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,6BAA6B,EAC7B,4BAA4B,EAC5B,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAClD,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,MAAM,UAAU,cAAc,CAAC,YAAgC,EAAE;IAC/D,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,cAAc,GAAG,IAAI,qBAAqB,EAAE,CAAC;IACnD,MAAM,kBAAkB,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC3D,MAAM,sBAAsB,GAAG,IAAI,6BAA6B,EAAE,CAAC;IACnE,MAAM,qBAAqB,GAAG,IAAI,4BAA4B,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACrD,MAAM,oBAAoB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAC/D,MAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACvD,MAAM,wBAAwB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IACvE,MAAM,wBAAwB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAEvE,MAAM,SAAS,GAAc;QAC3B,MAAM;QACN,QAAQ;QACR,cAAc;QACd,kBAAkB;QAClB,sBAAsB;QACtB,qBAAqB;QACrB,eAAe;QACf,oBAAoB;QACpB,gBAAgB;QAChB,wBAAwB;QACxB,wBAAwB;QACxB,eAAe;QACf,KAAK;QACL,GAAG,SAAS;KACb,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAA8B;IAChE,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5C,YAAY,CAAC,SAAS,CAAC,CAAC;IACxB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAoB;IAC3D,MAAM,mBAAmB,GAAG,IAAI,0BAA0B,CAAC,SAAS,CAAC,sBAAsB,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC7H,MAAM,oBAAoB,GAAG,IAAI,2BAA2B,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACxH,MAAM,cAAc,GAAG,IAAI,qBAAqB,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACzG,MAAM,kBAAkB,GAAG,IAAI,yBAAyB,CAAC,SAAS,CAAC,sBAAsB,EAAE,SAAS,CAAC,qBAAqB,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;IAEtJ,OAAO;QACL,IAAI,EAAE,IAAI,gCAAgC,CAAC,oBAAoB,CAAC;QAChE,QAAQ,EAAE,IAAI,0BAA0B,CAAC,cAAc,CAAC;QACxD,YAAY,EAAE,IAAI,8BAA8B,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,CAAC;QACzG,aAAa,EAAE,mBAAmB;KACnC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+import fastify from "fastify";
+export declare function buildApp(): Promise<fastify.FastifyInstance<import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, fastify.FastifyBaseLogger, fastify.FastifyTypeProviderDefault>>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,OAAiC,MAAM,SAAS,CAAC;AAiFxD,wBAAsB,QAAQ,uSAsL7B"}

package/dist/index.js

@@ -0,0 +1,295 @@
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import fastify from "fastify";
+import cors from "@fastify/cors";
+import cookie from "@fastify/cookie";
+import swagger from "@fastify/swagger";
+import swaggerUi from "@fastify/swagger-ui";
+import { migrate } from "drizzle-orm/postgres-js/migrator";
+import { config } from "./config.js";
+import { db } from "./db/index.js";
+import { initializeContainer } from "./di.js";
+import { redis } from "./services/redis.js";
+import { loadSigningKeys, getPublicJwks } from "./services/tokens.js";
+import { loadWorkflows } from "./services/workflows/engine.js";
+import { startTracing, stopTracing } from "./plugins/tracing.js";
+import authPlugin from "./plugins/auth.js";
+import auditPlugin from "./plugins/audit.js";
+import requestLogger from "./plugins/requestLogger.js";
+import { subscribe, subscribeAll } from "./services/events/bus.js";
+import { auditLogSubscriber } from "./services/events/subscribers/auditLog.js";
+import { webhookSubscriber } from "./services/events/subscribers/webhook.js";
+import { webhookDispatchSubscriber } from "./services/events/subscribers/webhookDispatch.js";
+import { startWebhookWorker } from "./services/webhooks.js";
+import { anomalySubscriber } from "./services/events/subscribers/anomaly.js";
+import { queue } from "./services/queue/index.js";
+import { cache } from "./services/cache.js";
+import { emailProvider } from "./services/email.js";
+import { registerPlugin } from "./services/plugins/registry.js";
+import appContextPlugin from "./plugins/appContext.js";
+import permissionsPlugin from "./plugins/permissions.js";
+import mtlsPlugin from "./plugins/mtls.js";
+import metricsPlugin from "./plugins/metrics.js";
+import { globalRateLimit } from "./plugins/rateLimit.js";
+import authRoutes from "./routes/auth.js";
+import oauthRoutes from "./routes/oauth.js";
+import oauth2Routes from "./routes/oauth2.js";
+import passwordRoutes from "./routes/password.js";
+import apiKeyRoutes from "./routes/apiKeys.js";
+import adminRoutes from "./routes/admin.js";
+import serviceAccountRoutes from "./routes/serviceAccounts.js";
+import magicLinkRoutes from "./routes/magicLinks.js";
+import totpRoutes from "./routes/totp.js";
+import webauthnRoutes from "./routes/webauthn.js";
+import smsOtpRoutes from "./routes/smsOtp.js";
+import authzRoutes from "./routes/authz.js";
+import samlRoutes from "./routes/saml.js";
+import oidcEnterpriseRoutes from "./routes/oidcEnterprise.js";
+import scimRoutes from "./routes/scim.js";
+import federationRoutes from "./routes/federation.js";
+import workflowRoutes from "./routes/workflows.js";
+import setupRoutes from "./routes/setup.js";
+import sdkRoutes from "./routes/sdk.js";
+import configRoutes from "./routes/config.js";
+import sessionRoutes from "./routes/sessions.js";
+import profileRoutes from "./routes/profile.js";
+import emailVerificationRoutes from "./routes/emailVerification.js";
+import { generateSetupToken, printSetupToken } from "./services/setup/token.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+async function loadPluginsFromEnv(app) {
+    const pluginPaths = (config.KEYSTONE_PLUGINS || "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    for (const pluginPath of pluginPaths) {
+        try {
+            const module = await import(pluginPath);
+            const plugin = module.default || module.plugin || module;
+            if (plugin && typeof plugin === "object" && "metadata" in plugin) {
+                registerPlugin(plugin);
+                app.log.info(`Loaded plugin from ${pluginPath}: ${plugin.metadata.name}`);
+            }
+            else {
+                app.log.warn(`Plugin ${pluginPath} did not export a valid KeystonePlugin`);
+            }
+        }
+        catch (err) {
+            app.log.warn({ err }, `Failed to load plugin ${pluginPath}`);
+        }
+    }
+}
+export async function buildApp() {
+    const container = initializeContainer();
+    const app = fastify({
+        logger: { level: config.NODE_ENV === "production" ? "info" : "debug" },
+        trustProxy: true,
+        genReqId: () => crypto.randomUUID(),
+    });
+    app.decorate("container", container);
+    await app.register(requestLogger);
+    await app.register(swagger, {
+        openapi: {
+            info: {
+                title: "Hilbras Keystone API",
+                description: "Identity platform API for Hilbras products and third-party apps.",
+                version: "1.0.0",
+            },
+            servers: [{ url: config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}` }],
+            tags: [
+                { name: "Auth", description: "Authentication and session management" },
+                { name: "Admin", description: "Organization and application management" },
+                { name: "Discovery", description: "JWKS and health endpoints" },
+            ],
+        },
+    });
+    await app.register(swaggerUi, {
+        routePrefix: "/documentation",
+    });
+    await app.register(cors, {
+        origin: (origin, cb) => {
+            if (!origin)
+                return cb(null, true);
+            if (config.ALLOWED_ORIGINS.length === 0)
+                return cb(null, true);
+            if (config.ALLOWED_ORIGINS.includes(origin))
+                return cb(null, true);
+            // In development, allow any localhost origin so external test projects
+            // can connect without pre-registering them in ALLOWED_ORIGINS.
+            if (config.NODE_ENV !== "production" && origin?.startsWith("http://localhost:")) {
+                return cb(null, true);
+            }
+            cb(new Error("Origin not allowed"), false);
+        },
+        credentials: true,
+    });
+    await app.register(cookie, {
+        secret: config.INTERNAL_API_KEY || undefined,
+        parseOptions: {},
+    });
+    await app.register(auditPlugin);
+    // Wire up event-bus subscribers.
+    subscribeAll(auditLogSubscriber);
+    subscribeAll(webhookSubscriber);
+    subscribeAll(webhookDispatchSubscriber);
+    subscribe("user_login_failed", anomalySubscriber);
+    subscribe("new_device_detected", anomalySubscriber);
+    // Register background job processors.
+    queue.process("email", async (job) => {
+        const { message } = job.payload;
+        await emailProvider.send(message);
+    });
+    startWebhookWorker();
+    queue.process("webhook", async (job) => {
+        const { url, method, body, headers } = job.payload;
+        await fetch(url, {
+            method: method || "POST",
+            headers: { "Content-Type": "application/json", ...(headers || {}) },
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    });
+    queue.process("workflow_run", async (job) => {
+        const { runId, workflowId } = job.payload;
+        const { executeRunById } = await import("./services/workflows/engine.js");
+        await executeRunById(runId, workflowId);
+    });
+    // Expose plugin registration on the Fastify instance.
+    app.decorate("registerPlugin", (plugin) => {
+        registerPlugin(plugin);
+        app.log.info(`Registered plugin: ${plugin.metadata.name}`);
+    });
+    // Load plugins configured via env (comma-separated list of module paths).
+    await loadPluginsFromEnv(app);
+    app.addHook("onClose", async () => {
+        await queue.close?.();
+        // The cache owns its own Redis connection (opened eagerly when REDIS_URL
+        // is set); without this it keeps a socket open after shutdown.
+        await cache.close().catch(() => { });
+    });
+    // Global API rate limiting to protect the platform from abuse.
+    app.addHook("onRequest", globalRateLimit({
+        maxRequests: Number(config.GLOBAL_RATE_LIMIT_MAX) || 100,
+        windowSeconds: Number(config.GLOBAL_RATE_LIMIT_WINDOW) || 60,
+    }));
+    await app.register(appContextPlugin);
+    await app.register(authPlugin);
+    await app.register(permissionsPlugin);
+    await app.register(mtlsPlugin);
+    await app.register(metricsPlugin);
+    await app.register(authRoutes, { prefix: "/auth" });
+    await app.register(sessionRoutes, { prefix: "/auth" });
+    await app.register(profileRoutes, { prefix: "/auth" });
+    await app.register(emailVerificationRoutes, { prefix: "/auth" });
+    await app.register(oauthRoutes, { prefix: "/auth" });
+    await app.register(oauth2Routes, { prefix: "/oauth2" });
+    await app.register(passwordRoutes, { prefix: "/auth" });
+    await app.register(apiKeyRoutes, { prefix: "/auth" });
+    await app.register(adminRoutes, { prefix: "/v1/admin" });
+    await app.register(serviceAccountRoutes, { prefix: "/v1/admin" });
+    await app.register(magicLinkRoutes, { prefix: "/auth" });
+    await app.register(totpRoutes, { prefix: "/auth" });
+    await app.register(webauthnRoutes, { prefix: "/auth" });
+    await app.register(smsOtpRoutes, { prefix: "/auth" });
+    await app.register(authzRoutes, { prefix: "/v1" });
+    await app.register(samlRoutes, { prefix: "/sso" });
+    await app.register(oidcEnterpriseRoutes, { prefix: "/sso" });
+    await app.register(scimRoutes, { prefix: "/" });
+    await app.register(federationRoutes, { prefix: "/federation" });
+    await app.register(workflowRoutes, { prefix: "/v1/admin" });
+    await app.register(sdkRoutes, { prefix: "/sdk" });
+    await app.register(configRoutes, { prefix: "/v1/admin/config" });
+    const issuer = config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
+    app.get("/.well-known/openid-configuration", { schema: { tags: ["Discovery"] } }, async () => ({
+        issuer,
+        authorization_endpoint: `${issuer}/oauth2/authorize`,
+        token_endpoint: `${issuer}/oauth2/token`,
+        userinfo_endpoint: `${issuer}/oauth2/userinfo`,
+        revocation_endpoint: `${issuer}/oauth2/revoke`,
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token", "client_credentials"],
+        subject_types_supported: ["public"],
+        id_token_signing_alg_values_supported: ["RS256"],
+        scopes_supported: ["openid", "profile", "email"],
+        token_endpoint_auth_methods_supported: ["client_secret_post", "client_secret_basic"],
+        code_challenge_methods_supported: ["S256"],
+    }));
+    app.get("/.well-known/jwks.json", { schema: { tags: ["Discovery"] } }, async () => {
+        return getPublicJwks();
+    });
+    app.get("/health", { schema: { tags: ["Discovery"] } }, async () => ({ status: "ok" }));
+    await app.register(setupRoutes, { prefix: "/setup" });
+    app.setErrorHandler((error, request, reply) => {
+        if (error && typeof error === "object" && "validation" in error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return reply.status(400).send({ error: "Invalid input", details: message });
+        }
+        if (error instanceof Error && "statusCode" in error) {
+            const statusCode = error.statusCode;
+            const code = error.code;
+            if (statusCode >= 400 && statusCode < 600) {
+                return reply.status(statusCode).send({ error: error.message, code });
+            }
+        }
+        request.log.error({ err: error }, "Unhandled error");
+        const message = config.NODE_ENV === "production" ? "Internal server error" : String(error);
+        return reply.status(500).send({ error: message });
+    });
+    return app;
+}
+async function start() {
+    startTracing();
+    await redis.connect().catch((err) => {
+        console.warn("Redis not available; rate limiting will fail open", err);
+    });
+    const app = await buildApp();
+    try {
+        await migrate(db, { migrationsFolder: path.resolve(__dirname, "./db/migrations") });
+        app.log.info("Database migrations applied");
+    }
+    catch (err) {
+        app.log.error({ err }, "Database migration failed — the application may not work correctly");
+    }
+    try {
+        await loadSigningKeys();
+        app.log.info("JWT signing keys loaded");
+    }
+    catch (err) {
+        app.log.error({ err }, "JWT signing key loading failed — token signing will not work");
+    }
+    try {
+        generateSetupToken();
+        printSetupToken();
+    }
+    catch (err) {
+        app.log.warn({ err }, "Could not generate setup token (may already exist)");
+    }
+    try {
+        await app.container.permissionRepository.ensureRolePermissionsSeeded();
+        app.log.info("Role permissions seeded");
+    }
+    catch (err) {
+        app.log.error({ err }, "Role permission seeding failed — authorization may not work correctly");
+    }
+    try {
+        await loadWorkflows();
+        app.log.info("Workflows loaded");
+    }
+    catch (err) {
+        app.log.warn({ err }, "Workflow loading failed (workflows feature may be unavailable)");
+    }
+    app.addHook("onClose", async () => {
+        await stopTracing();
+    });
+    try {
+        await app.listen({ port: config.PORT, host: config.HOST });
+        app.log.info(`Hilbras Keystone running on http://${config.HOST}:${config.PORT}`);
+    }
+    catch (err) {
+        app.log.error(err);
+        process.exit(1);
+    }
+}
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+    start();
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,OAAO,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,UAAU,MAAM,mBAAmB,CAAC;AAC3C,OAAO,WAAW,MAAM,oBAAoB,CAAC;AAC7C,OAAO,aAAa,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,UAAU,MAAM,mBAAmB,CAAC;AAC3C,OAAO,aAAa,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,YAAY,MAAM,qBAAqB,CAAC;AAC/C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,eAAe,MAAM,wBAAwB,CAAC;AACrD,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,oBAAoB,MAAM,4BAA4B,CAAC;AAC9D,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,gBAAgB,MAAM,wBAAwB,CAAC;AACtD,OAAO,cAAc,MAAM,uBAAuB,CAAC;AACnD,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,aAAa,MAAM,sBAAsB,CAAC;AACjD,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAChD,OAAO,uBAAuB,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEhF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,KAAK,UAAU,kBAAkB,CAAC,GAAoB;IACpD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;SAChD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;YACzD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBACjE,cAAc,CAAC,MAAwB,CAAC,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,UAAU,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,UAAU,wCAAwC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,UAAU,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACtE,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAErC,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAElC,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC1B,OAAO,EAAE;YACP,IAAI,EAAE;gBACJ,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,kEAAkE;gBAC/E,OAAO,EAAE,OAAO;aACjB;YACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnF,IAAI,EAAE;gBACJ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,uCAAuC,EAAE;gBACtE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE;gBACzE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,2BAA2B,EAAE;aAChE;SACF;KACF,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC5B,WAAW,EAAE,gBAAgB;KAC9B,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE;YACrB,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnE,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAChF,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,EAAE,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS;QAC5C,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEhC,iCAAiC;IACjC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IACjC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAChC,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACxC,SAAS,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IAClD,SAAS,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;IAEpD,sCAAsC;IACtC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,OAAkE,CAAC;QAC3F,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,kBAAkB,EAAE,CAAC;IACrB,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,OAK1C,CAAC;QACF,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM,IAAI,MAAM;YACxB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;YACnE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,OAAgD,CAAC;QACnF,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC1E,MAAM,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAsB,EAAE,EAAE;QACxD,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAE9B,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,GAAG;QACxD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE;KAC7D,CAAC,CAAC,CAAC;IAEJ,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACrC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACtC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAElC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/E,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7F,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,mBAAmB;QACpD,cAAc,EAAE,GAAG,MAAM,eAAe;QACxC,iBAAiB,EAAE,GAAG,MAAM,kBAAkB;QAC9C,mBAAmB,EAAE,GAAG,MAAM,gBAAgB;QAC9C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC;QACpF,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;QAChD,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QAChD,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;QACpF,gCAAgC,EAAE,CAAC,MAAM,CAAC;KAC3C,CAAC,CAAC,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAChF,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAExF,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtD,GAAG,CAAC,eAAe,CAAC,CAAC,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,KAAK,YAAY,KAAK,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YACpD,MAAM,UAAU,GAAI,KAAwC,CAAC,UAAU,CAAC;YACxE,MAAM,IAAI,GAAI,KAAmC,CAAC,IAAI,CAAC;YACvD,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,YAAY,EAAE,CAAC;IACf,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC3C,OAAO,CAAC,IAAI,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACpF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,eAAe,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,CAAC;QACH,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oDAAoD,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,2BAA2B,EAAE,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uEAAuE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,gEAAgE,CAAC,CAAC;IAC1F,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,WAAW,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,KAAK,EAAE,CAAC;AACV,CAAC"}

package/dist/lib/errors.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Public OAuth/OIDC/Federation error codes. These are the only values we
+ * expose to browsers or third-party clients; internal failure details stay
+ * in server logs.
+ */
+export type OAuthErrorCode = "invalid_request" | "invalid_client" | "invalid_grant" | "access_denied" | "server_error" | "identity_broker_failure";
+export interface OAuthErrorResponse {
+    statusCode: number;
+    body: {
+        error: OAuthErrorCode;
+        error_description?: string;
+    };
+}
+/**
+ * Map an internal error to a stable public OAuth-style code and HTTP status.
+ *
+ * The mapping is intentionally conservative: anything that could reveal
+ * implementation details or provider-specific behaviour collapses into a
+ * small set of opaque codes. Detailed diagnostics are written to server logs
+ * by the caller before this helper is invoked.
+ */
+export declare function classifyOAuthError(error: unknown): {
+    code: OAuthErrorCode;
+    statusCode: number;
+};
+export interface OAuthRedirectOptions {
+    /** OAuth `state` value that must be echoed back to the client. */
+    state?: string;
+    /** Override whether to include the original error message. Defaults to `true` only in development. */
+    includeDescription?: boolean;
+}
+/**
+ * Build a redirect URL that carries only a sanitized error code (and, in
+ * development, an optional description). Any existing query parameters on
+ * `redirectUrl` are preserved.
+ */
+export declare function buildOAuthErrorRedirect(error: unknown, redirectUrl: string, options?: OAuthRedirectOptions): string;
+export interface OAuthResponseOptions {
+    /** Override whether to include the original error message. Defaults to `true` only in development. */
+    includeDescription?: boolean;
+}
+/**
+ * Build a sanitized JSON error response for endpoints that do not redirect.
+ */
+export declare function buildOAuthErrorResponse(error: unknown, options?: OAuthResponseOptions): OAuthErrorResponse;
+//# sourceMappingURL=errors.d.ts.map

package/dist/lib/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,cAAc,GACd,yBAAyB,CAAC;AAE9B,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE;QACJ,KAAK,EAAE,cAAc,CAAC;QACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAUD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAyC/F;AAED,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sGAAsG;IACtG,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,MAAM,CAgBR;AAED,MAAM,WAAW,oBAAoB;IACnC,sGAAsG;IACtG,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,oBAAoB,GAC7B,kBAAkB,CAWpB"}