@hilbras/keystone 1.1.0

package/dist/routes/workflows.js

@@ -0,0 +1,140 @@
+import { z } from "zod";
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { workflows, orgMemberships } from "../db/schema.js";
+import { registerWorkflow, listWorkflowRuns } from "../services/workflows/engine.js";
+const WorkflowStepSchema = z.object({
+    type: z.string(),
+    name: z.string().optional(),
+});
+const CreateWorkflowSchema = z.object({
+    orgId: z.string().uuid(),
+    name: z.string().min(1).max(255),
+    trigger: z.enum(["user_registered", "user_login", "organization_created"]),
+    definition: z.object({
+        steps: z.array(WorkflowStepSchema.and(z.record(z.unknown()))),
+    }),
+    isActive: z.boolean().optional(),
+});
+async function requireOrgMembership(request, reply, orgId) {
+    await request.server.authenticate(request, reply);
+    if (reply.sent)
+        return false;
+    const userId = request.user.id;
+    const [membership] = await db
+        .select()
+        .from(orgMemberships)
+        .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+        .limit(1);
+    if (!membership) {
+        reply.status(403).send({ error: "Forbidden: not a member of this organization" });
+        return false;
+    }
+    return true;
+}
+export default async function workflowRoutes(app) {
+    app.get("/workflows", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const query = request.query;
+        const orgId = query?.orgId;
+        if (!orgId) {
+            return reply.status(400).send({ error: "orgId query parameter is required" });
+        }
+        // Verify org membership
+        const userId = request.user.id;
+        const [membership] = await db
+            .select()
+            .from(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+            .limit(1);
+        if (!membership) {
+            return reply.status(403).send({ error: "Forbidden: not a member of this organization" });
+        }
+        const all = await db.select().from(workflows).where(eq(workflows.orgId, orgId));
+        return { workflows: all };
+    });
+    app.post("/workflows", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const body = CreateWorkflowSchema.parse(request.body);
+        // Verify org membership
+        const userId = request.user.id;
+        const [membership] = await db
+            .select()
+            .from(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, body.orgId), eq(orgMemberships.userId, userId)))
+            .limit(1);
+        if (!membership) {
+            return reply.status(403).send({ error: "Forbidden: not a member of this organization" });
+        }
+        const workflow = await registerWorkflow({
+            orgId: body.orgId,
+            name: body.name,
+            trigger: body.trigger,
+            definition: body.definition,
+        });
+        await request.audit("workflow_created", { workflowId: workflow.id, trigger: body.trigger, orgId: body.orgId });
+        return reply.status(201).send(workflow);
+    });
+    app.get("/workflows/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const { id } = request.params;
+        const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
+        if (!workflow)
+            return reply.status(404).send({ error: "Workflow not found" });
+        // Verify org membership
+        if (workflow.orgId) {
+            const userId = request.user.id;
+            const [membership] = await db
+                .select()
+                .from(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
+                .limit(1);
+            if (!membership) {
+                return reply.status(403).send({ error: "Forbidden" });
+            }
+        }
+        return { workflow };
+    });
+    app.delete("/workflows/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const { id } = request.params;
+        const userId = request.user.id;
+        // Find the workflow and verify org membership
+        const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
+        if (!workflow)
+            return reply.status(404).send({ error: "Workflow not found" });
+        // Verify org membership
+        if (workflow.orgId) {
+            const [membership] = await db
+                .select()
+                .from(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
+                .limit(1);
+            if (!membership) {
+                return reply.status(403).send({ error: "Forbidden" });
+            }
+        }
+        const [record] = await db.delete(workflows).where(eq(workflows.id, id)).returning();
+        if (!record)
+            return reply.status(404).send({ error: "Workflow not found" });
+        await request.audit("workflow_deleted", { workflowId: record.id });
+        return { success: true };
+    });
+    app.get("/workflows/:id/runs", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const { id } = request.params;
+        const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
+        if (!workflow)
+            return reply.status(404).send({ error: "Workflow not found" });
+        // Verify org membership
+        if (workflow.orgId) {
+            const userId = request.user.id;
+            const [membership] = await db
+                .select()
+                .from(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
+                .limit(1);
+            if (!membership) {
+                return reply.status(403).send({ error: "Forbidden" });
+            }
+        }
+        const runs = await listWorkflowRuns(id);
+        return { runs };
+    });
+}
+//# sourceMappingURL=workflows.js.map

package/dist/routes/workflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/routes/workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAErF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;KAC9D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,KAAK,UAAU,oBAAoB,CAAC,OAAuB,EAAE,KAAmB,EAAE,KAAa;IAC7F,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;IAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC;QAE3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAClF,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtD,wBAAwB;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACnF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9E,wBAAwB;QACxB,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACvF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACxF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;QAEhC,8CAA8C;QAC9C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9E,wBAAwB;QACxB,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACvF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACpF,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1F,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9E,wBAAwB;QACxB,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACvF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sdk/index.d.ts

@@ -0,0 +1,5 @@
+import type { KeystoneSdk } from "./types.js";
+export declare function getSdk(): KeystoneSdk;
+export declare function setSdk(sdk: KeystoneSdk): void;
+export type { KeystoneSdk, AuthenticationSdk, IdentitySdk, OrganizationSdk, AuthorizationSdk } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/sdk/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAqE,MAAM,YAAY,CAAC;AAsIjH,wBAAgB,MAAM,IAAI,WAAW,CAWpC;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAE7C;AAED,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/sdk/index.js

@@ -0,0 +1,125 @@
+import { getContainer } from "../container.js";
+import { buildApplicationServices } from "../di.js";
+class SdkAuthenticationClient {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+    register(input) {
+        return this.app.register(input);
+    }
+    login(input) {
+        return this.app.login(input);
+    }
+    async refresh(refreshToken, clientId) {
+        const result = await this.app.refresh(refreshToken, clientId);
+        if (!result.success)
+            return result;
+        return { success: true, data: { accessToken: result.data.accessToken, refreshToken: result.data.refreshToken, expiresAt: result.data.expiresAt } };
+    }
+    logout(refreshToken) {
+        return this.app.logout(refreshToken);
+    }
+    createPasswordResetToken(email) {
+        return this.app.createPasswordResetToken(email);
+    }
+    resetPasswordWithToken(token, newPassword) {
+        return this.app.resetPasswordWithToken(token, newPassword);
+    }
+}
+class SdkIdentityClient {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+    findUser(id) {
+        return this.app.findUser(id);
+    }
+    findUserByEmail(email) {
+        return this.app.findUserByEmail(email);
+    }
+    upsertInvitedUser(input) {
+        return this.app.upsertInvitedUser(input);
+    }
+    updateUserProfile(userId, updates) {
+        return this.app.updateUserProfile(userId, updates);
+    }
+    deactivate(userId) {
+        return this.app.deactivate(userId);
+    }
+    listOrganizationUsers(orgId) {
+        return this.app.listOrganizationUsers(orgId);
+    }
+    linkUserIdentity(userId, providerId, providerType, externalSub, email) {
+        return this.app.linkUserIdentity(userId, providerId, providerType, externalSub, email);
+    }
+    getFederationAuthorizeUrl(provider, state, redirectUri) {
+        return this.app.getFederationAuthorizeUrl(provider, state, redirectUri);
+    }
+    completeFederationLogin(provider, code, redirectUri) {
+        return this.app.completeFederationLogin(provider, code, redirectUri);
+    }
+}
+class SdkOrganizationClient {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+    createOrganization(userId, input) {
+        return this.app.createOrganization(userId, input);
+    }
+    getOrganization(userId, orgId) {
+        return this.app.getOrganization(userId, orgId);
+    }
+    listUserOrganizations(userId) {
+        return this.app.listUserOrganizations(userId);
+    }
+    inviteMember(actorId, orgId, input) {
+        return this.app.inviteMember(actorId, orgId, input);
+    }
+    createApplication(actorId, orgId, input) {
+        return this.app.createApplication(actorId, orgId, input);
+    }
+    listOrganizationApplications(actorId, orgId) {
+        return this.app.listOrganizationApplications(actorId, orgId);
+    }
+    updateApplication(actorId, orgId, appId, updates) {
+        return this.app.updateApplication(actorId, orgId, appId, updates);
+    }
+}
+class SdkAuthorizationClient {
+    domain;
+    constructor(domain) {
+        this.domain = domain;
+    }
+    hasPermission(role, resource, action) {
+        return this.domain.hasPermission(role, resource, action);
+    }
+    requirePermission(role, resource, action) {
+        return this.domain.requirePermission(role, resource, action);
+    }
+    requireOrgRole(userId, orgId, allowedRoles) {
+        return this.domain.requireOrgRole(userId, orgId, allowedRoles);
+    }
+    isOrgMember(userId, orgId) {
+        return this.domain.isOrgMember(userId, orgId);
+    }
+}
+let cachedSdk = null;
+export function getSdk() {
+    if (cachedSdk)
+        return cachedSdk;
+    const container = getContainer();
+    const apps = buildApplicationServices(container);
+    cachedSdk = {
+        authentication: new SdkAuthenticationClient(apps.auth),
+        identity: new SdkIdentityClient(apps.identity),
+        organization: new SdkOrganizationClient(apps.organization),
+        authorization: new SdkAuthorizationClient(apps.authorization),
+    };
+    return cachedSdk;
+}
+export function setSdk(sdk) {
+    cachedSdk = sdk;
+}
+//# sourceMappingURL=index.js.map

package/dist/sdk/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAEpD,MAAM,uBAAuB;IACE;IAA7B,YAA6B,GAAqC;QAArC,QAAG,GAAH,GAAG,CAAkC;IAAG,CAAC;IAEtE,QAAQ,CAAC,KAAkI;QACzI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAA6D;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;IAC9J,CAAC;IAED,MAAM,CAAC,YAAqB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAED,wBAAwB,CAAC,KAAa;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,iBAAiB;IACQ;IAA7B,YAA6B,GAA+B;QAA/B,QAAG,GAAH,GAAG,CAA4B;IAAG,CAAC;IAEhE,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,iBAAiB,CAAC,KAA0D;QAC1E,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,OAA0F;QAC1H,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,qBAAqB,CAAC,KAAa;QACjC,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,UAAkB,EAAE,YAAoB,EAAE,WAAmB,EAAE,KAAc;QAC5G,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACzF,CAAC;IAED,yBAAyB,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,uBAAuB,CAAC,QAAgB,EAAE,IAAY,EAAE,WAAmB;QACzE,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;CACF;AAED,MAAM,qBAAqB;IACI;IAA7B,YAA6B,GAAmC;QAAnC,QAAG,GAAH,GAAG,CAAgC;IAAG,CAAC;IAEpE,kBAAkB,CAAC,MAAc,EAAE,KAAqD;QACtF,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,eAAe,CAAC,MAAc,EAAE,KAAa;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,qBAAqB,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,KAAa,EAAE,KAA4D;QACvG,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,iBAAiB,CAAC,OAAe,EAAE,KAAa,EAAE,KAA2E;QAC3H,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,KAAa;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,iBAAiB,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa,EAAE,OAAsL;QACrP,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;CACF;AAED,MAAM,sBAAsB;IACG;IAA7B,YAA6B,MAAkC;QAAlC,WAAM,GAAN,MAAM,CAA4B;IAAG,CAAC;IAEnE,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,iBAAiB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,cAAc,CAAC,MAAc,EAAE,KAAa,EAAE,YAAiD;QAC7F,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACjE,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,KAAa;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;CACF;AAED,IAAI,SAAS,GAAuB,IAAI,CAAC;AAEzC,MAAM,UAAU,MAAM;IACpB,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACjD,SAAS,GAAG;QACV,cAAc,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QACtD,QAAQ,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9C,YAAY,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;QAC1D,aAAa,EAAE,IAAI,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC;KAC9D,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAgB;IACrC,SAAS,GAAG,GAAG,CAAC;AAClB,CAAC"}

package/dist/sdk/types.d.ts

@@ -0,0 +1,110 @@
+import type { User, Organization, Application, OrgMembership } from "../db/schema.js";
+import type { Result } from "../lib/result.js";
+export interface AuthResponse {
+    user: User;
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: Date;
+}
+export interface AuthenticationSdk {
+    register(input: {
+        username: string;
+        email: string;
+        password: string;
+        name?: string;
+        clientId?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<Result<AuthResponse>>;
+    login(input: {
+        email: string;
+        password: string;
+        clientId?: string;
+    }): Promise<Result<AuthResponse>>;
+    refresh(refreshToken: string, clientId?: string): Promise<Result<{
+        accessToken: string;
+        refreshToken: string;
+        expiresAt: Date;
+    }>>;
+    logout(refreshToken?: string): Promise<Result<void>>;
+    createPasswordResetToken(email: string): Promise<Result<{
+        token: string;
+        user: User;
+    } | null>>;
+    resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>>;
+}
+export interface IdentitySdk {
+    findUser(id: string): Promise<Result<User>>;
+    findUserByEmail(email: string): Promise<Result<User>>;
+    upsertInvitedUser(input: {
+        email: string;
+        name?: string;
+        username?: string;
+    }): Promise<Result<User>>;
+    updateUserProfile(userId: string, updates: Partial<{
+        name: string;
+        username: string;
+        role: string;
+        emailVerified: boolean;
+    }>): Promise<Result<User>>;
+    deactivate(userId: string): Promise<Result<void>>;
+    listOrganizationUsers(orgId: string): Promise<User[]>;
+    linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
+    getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{
+        url: string;
+    }>>;
+    completeFederationLogin(provider: string, code: string, redirectUri: string): Promise<Result<{
+        user: User;
+        tokens: {
+            accessToken: string;
+            refreshToken: string;
+        };
+    }>>;
+}
+export interface OrganizationSdk {
+    createOrganization(userId: string, input: {
+        name: string;
+        slug?: string;
+        plan?: string;
+    }): Promise<Result<Organization>>;
+    getOrganization(userId: string, orgId: string): Promise<Result<Organization>>;
+    listUserOrganizations(userId: string): Promise<Organization[]>;
+    inviteMember(actorId: string, orgId: string, input: {
+        email: string;
+        role: "owner" | "admin" | "member";
+    }): Promise<Result<{
+        user: {
+            id: string;
+        };
+        membership: OrgMembership;
+    }>>;
+    createApplication(actorId: string, orgId: string, input: {
+        name: string;
+        redirectUris?: string[];
+        allowedOrigins?: string[];
+    }): Promise<Result<Application & {
+        clientSecret: string;
+    }>>;
+    listOrganizationApplications(actorId: string, orgId: string): Promise<Result<Application[]>>;
+    updateApplication(actorId: string, orgId: string, appId: string, updates: Partial<{
+        name: string;
+        redirectUris: string[];
+        allowedOrigins: string[];
+        allowedIps: string[];
+        blockedIps: string[];
+        isActive: boolean;
+        branding: Record<string, unknown>;
+    }>): Promise<Result<Application>>;
+}
+export interface AuthorizationSdk {
+    hasPermission(role: string, resource: string, action: string): Promise<boolean>;
+    requirePermission(role: string, resource: string, action: string): Promise<Result<void>>;
+    requireOrgRole(userId: string, orgId: string, allowedRoles: Array<"owner" | "admin" | "member">): Promise<Result<OrgMembership>>;
+    isOrgMember(userId: string, orgId: string): Promise<OrgMembership | undefined>;
+}
+export interface KeystoneSdk {
+    authentication: AuthenticationSdk;
+    identity: IdentitySdk;
+    organization: OrganizationSdk;
+    authorization: AuthorizationSdk;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/sdk/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sdk/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5K,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACpG,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAClI,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC/F,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,iBAAiB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrJ,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvI,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClH,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC,CAAC;CACtK;AAED,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACzH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9E,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC,CAAC;IACjL,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACxL,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7F,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;CACxR;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACjI,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,iBAAiB,CAAC;IAClC,QAAQ,EAAE,WAAW,CAAC;IACtB,YAAY,EAAE,eAAe,CAAC;IAC9B,aAAa,EAAE,gBAAgB,CAAC;CACjC"}

package/dist/sdk/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/sdk/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sdk/types.ts"],"names":[],"mappings":""}

package/dist/services/anomalyDetection.d.ts

@@ -0,0 +1,14 @@
+export declare function recordFailedLogin(identifier: string): Promise<number>;
+export declare function isFailedLoginAnomaly(identifier: string): Promise<boolean>;
+export declare function recordNewDevice(userId: string): Promise<number>;
+export declare function isNewDeviceAnomaly(userId: string): Promise<boolean>;
+/**
+ * Records the login location (IP) for a user and returns true when the
+ * previous login happened from a *different* IP within the impossible-travel
+ * window. Without a GeoIP database this is an approximation: physically
+ * changing networks within a few minutes usually indicates credential misuse
+ * (or a VPN/mobile network switch, so alerts should say "suspicious", not
+ * "blocked").
+ */
+export declare function checkImpossibleTravel(userId: string, ip: string | undefined): Promise<boolean>;
+//# sourceMappingURL=anomalyDetection.d.ts.map

package/dist/services/anomalyDetection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomalyDetection.d.ts","sourceRoot":"","sources":["../../src/services/anomalyDetection.ts"],"names":[],"mappings":"AASA,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAa3E;AAED,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG/E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAarE;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGzE;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAepG"}

package/dist/services/anomalyDetection.js

@@ -0,0 +1,68 @@
+import { redis } from "./redis.js";
+const ANOMALY_WINDOW_SECONDS = 300;
+const FAILED_LOGIN_THRESHOLD = 10;
+const NEW_DEVICE_THRESHOLD = 3;
+// Two logins from different IPs within this window are flagged as
+// suspicious (approximation of impossible travel without a GeoIP database).
+const IMPOSSIBLE_TRAVEL_WINDOW_SECONDS = 900;
+export async function recordFailedLogin(identifier) {
+    if (redis.status !== "ready" && redis.status !== "connect")
+        return 0;
+    const key = `anomaly:failed_login:${identifier}`;
+    const now = Date.now();
+    const windowStart = now - ANOMALY_WINDOW_SECONDS * 1000;
+    const pipeline = redis.pipeline();
+    pipeline.zremrangebyscore(key, 0, windowStart);
+    pipeline.zadd(key, now, `${now}:${Math.random().toString(36).slice(2)}`);
+    pipeline.zcard(key);
+    pipeline.pexpire(key, ANOMALY_WINDOW_SECONDS * 1000);
+    const results = await pipeline.exec();
+    return results?.[2]?.[1] ?? 0;
+}
+export async function isFailedLoginAnomaly(identifier) {
+    const count = await recordFailedLogin(identifier);
+    return count >= FAILED_LOGIN_THRESHOLD;
+}
+export async function recordNewDevice(userId) {
+    if (redis.status !== "ready" && redis.status !== "connect")
+        return 0;
+    const key = `anomaly:new_device:${userId}`;
+    const now = Date.now();
+    const windowStart = now - ANOMALY_WINDOW_SECONDS * 1000;
+    const pipeline = redis.pipeline();
+    pipeline.zremrangebyscore(key, 0, windowStart);
+    pipeline.zadd(key, now, `${now}:${Math.random().toString(36).slice(2)}`);
+    pipeline.zcard(key);
+    pipeline.pexpire(key, ANOMALY_WINDOW_SECONDS * 1000);
+    const results = await pipeline.exec();
+    return results?.[2]?.[1] ?? 0;
+}
+export async function isNewDeviceAnomaly(userId) {
+    const count = await recordNewDevice(userId);
+    return count >= NEW_DEVICE_THRESHOLD;
+}
+/**
+ * Records the login location (IP) for a user and returns true when the
+ * previous login happened from a *different* IP within the impossible-travel
+ * window. Without a GeoIP database this is an approximation: physically
+ * changing networks within a few minutes usually indicates credential misuse
+ * (or a VPN/mobile network switch, so alerts should say "suspicious", not
+ * "blocked").
+ */
+export async function checkImpossibleTravel(userId, ip) {
+    if (!ip || (redis.status !== "ready" && redis.status !== "connect"))
+        return false;
+    const key = `anomaly:last_login:${userId}`;
+    const now = Date.now();
+    const previous = await redis.hgetall(key);
+    await redis
+        .multi()
+        .hset(key, "ip", ip, "ts", String(now))
+        .pexpire(key, 30 * 24 * 60 * 60 * 1000)
+        .exec();
+    if (!previous?.ip || !previous?.ts)
+        return false;
+    const elapsed = now - Number(previous.ts);
+    return previous.ip !== ip && elapsed < IMPOSSIBLE_TRAVEL_WINDOW_SECONDS * 1000;
+}
+//# sourceMappingURL=anomalyDetection.js.map

package/dist/services/anomalyDetection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomalyDetection.js","sourceRoot":"","sources":["../../src/services/anomalyDetection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,kEAAkE;AAClE,4EAA4E;AAC5E,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,wBAAwB,UAAU,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,GAAG,GAAG,sBAAsB,GAAG,IAAI,CAAC;IAExD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,OAAQ,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,KAAK,IAAI,sBAAsB,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,sBAAsB,MAAM,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,GAAG,GAAG,sBAAsB,GAAG,IAAI,CAAC;IAExD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,OAAQ,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,KAAK,IAAI,oBAAoB,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc,EAAE,EAAsB;IAChF,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,MAAM,GAAG,GAAG,sBAAsB,MAAM,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,KAAK;SACR,KAAK,EAAE;SACP,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;SACtC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;SACtC,IAAI,EAAE,CAAC;IAEV,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,OAAO,GAAG,gCAAgC,GAAG,IAAI,CAAC;AACjF,CAAC"}

package/dist/services/application/authentication.d.ts

@@ -0,0 +1,38 @@
+import type { AuthenticationDomainService } from "../domain/authentication.js";
+import type { TokenSet } from "../tokens.js";
+import type { User } from "../../db/schema.js";
+import type { Result } from "../../lib/result.js";
+export interface RegisterRequest {
+    username: string;
+    email: string;
+    password: string;
+    name?: string;
+    clientId?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface LoginRequest {
+    email: string;
+    password: string;
+    clientId?: string;
+}
+export interface AuthResponse {
+    user: User;
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: Date;
+}
+export declare class AuthenticationApplicationService {
+    private readonly domain;
+    constructor(domain: AuthenticationDomainService);
+    register(request: RegisterRequest): Promise<Result<AuthResponse>>;
+    login(request: LoginRequest): Promise<Result<AuthResponse>>;
+    refresh(refreshToken: string, clientId?: string): Promise<Result<TokenSet>>;
+    logout(refreshToken?: string): Promise<Result<void>>;
+    createPasswordResetToken(email: string): Promise<Result<{
+        token: string;
+        user: User;
+    } | null>>;
+    resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>>;
+    private toAuthResponse;
+}
+//# sourceMappingURL=authentication.d.ts.map

package/dist/services/application/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/application/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,gCAAgC;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,2BAA2B;IAE1D,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IASjE,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAS3D,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAM3E,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIpD,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAI9F,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIvF,OAAO,CAAC,cAAc;CAQvB"}

package/dist/services/application/authentication.js

@@ -0,0 +1,48 @@
+export class AuthenticationApplicationService {
+    domain;
+    constructor(domain) {
+        this.domain = domain;
+    }
+    async register(request) {
+        const result = await this.domain.register(request);
+        if (!result.success)
+            return result;
+        return {
+            success: true,
+            data: this.toAuthResponse(result.data.user, result.data.tokens),
+        };
+    }
+    async login(request) {
+        const result = await this.domain.login(request);
+        if (!result.success)
+            return result;
+        return {
+            success: true,
+            data: this.toAuthResponse(result.data.user, result.data.tokens),
+        };
+    }
+    async refresh(refreshToken, clientId) {
+        const result = await this.domain.refresh(refreshToken, clientId);
+        if (!result.success)
+            return result;
+        return { success: true, data: result.data.tokens };
+    }
+    async logout(refreshToken) {
+        return this.domain.logout(refreshToken);
+    }
+    async createPasswordResetToken(email) {
+        return this.domain.createPasswordResetToken(email);
+    }
+    async resetPasswordWithToken(token, newPassword) {
+        return this.domain.resetPasswordWithToken(token, newPassword);
+    }
+    toAuthResponse(user, tokens) {
+        return {
+            user,
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            expiresAt: tokens.expiresAt,
+        };
+    }
+}
+//# sourceMappingURL=authentication.js.map

package/dist/services/application/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/application/authentication.ts"],"names":[],"mappings":"AA2BA,MAAM,OAAO,gCAAgC;IACd;IAA7B,YAA6B,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;IAAG,CAAC;IAEpE,KAAK,CAAC,QAAQ,CAAC,OAAwB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAEO,cAAc,CAAC,IAAU,EAAE,MAAgB;QACjD,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;CACF"}