@hilbras/keystone 1.1.0

package/dist/services/secrets/vault.js

@@ -0,0 +1,133 @@
+import crypto from "node:crypto";
+import { importPKCS8, importSPKI, exportPKCS8, exportSPKI, generateKeyPair } from "jose";
+import { hashPassword, verifyPassword } from "./password.js";
+/**
+ * HashiCorp Vault secrets provider.
+ *
+ * This is a reference implementation. In production it should call the
+ * Vault HTTP API (or use a Vault client library) to retrieve signing keys,
+ * encryption keys, and credentials. The password hashing helpers are reused
+ * locally because they are compute-bound and do not need external storage.
+ */
+export class VaultSecretsProvider {
+    name = "vault";
+    hashPassword = hashPassword;
+    verifyPassword = verifyPassword;
+    vaultAddr;
+    vaultToken;
+    mountPath;
+    constructor() {
+        this.vaultAddr = (process.env.VAULT_ADDR || "").replace(/\/$/, "");
+        this.vaultToken = process.env.VAULT_TOKEN || "";
+        this.mountPath = (process.env.VAULT_MOUNT_PATH || "secret").replace(/(^\/)|(\/$)/g, "");
+        if (!this.vaultAddr || !this.vaultToken) {
+            throw new Error("VaultSecretsProvider requires VAULT_ADDR and VAULT_TOKEN");
+        }
+    }
+    hashApiKey(key) {
+        return crypto.createHash("sha256").update(key).digest("hex");
+    }
+    hashClientSecret(secret) {
+        return crypto.createHash("sha256").update(secret).digest("hex");
+    }
+    generateClientSecret() {
+        return `cs_${crypto.randomBytes(32).toString("base64url")}`;
+    }
+    generateApiKey() {
+        const key = `ks_${crypto.randomBytes(32).toString("base64url")}`;
+        return { key, prefix: key.slice(0, 7) };
+    }
+    async getActiveSigningKey() {
+        const stored = await this.readPath("jwt/active");
+        if (stored?.private && stored?.public) {
+            const privateKey = await importPKCS8(String(stored.private), "RS256");
+            const publicKey = await importSPKI(String(stored.public), "RS256");
+            return { keyId: String(stored.keyId ?? "vault-active"), privateKey, publicKey };
+        }
+        return this.rotateSigningKeys();
+    }
+    async getSigningKeyById(keyId) {
+        const active = await this.getActiveSigningKey();
+        if (active.keyId === keyId)
+            return active;
+        const stored = await this.readPath(`jwt/${keyId}`);
+        if (!stored?.private)
+            return undefined;
+        const privateKey = await importPKCS8(String(stored.private), "RS256");
+        const publicKey = await importSPKI(String(stored.public), "RS256");
+        return { keyId, privateKey, publicKey };
+    }
+    async rotateSigningKeys() {
+        const pair = await generateKeyPair("RS256", { extractable: true });
+        const privatePem = await exportPKCS8(pair.privateKey);
+        const publicPem = await exportSPKI(pair.publicKey);
+        const keyId = `vault-${crypto.randomBytes(8).toString("base64url")}`;
+        await this.writePath("jwt/active", { keyId, private: privatePem, public: publicPem, rotatedAt: new Date().toISOString() });
+        return { keyId, privateKey: pair.privateKey, publicKey: pair.publicKey };
+    }
+    async listActiveSigningKeys() {
+        const active = await this.getActiveSigningKey();
+        return [{ keyId: active.keyId, createdAt: new Date(), expiresAt: null }];
+    }
+    async listValidSigningKeys() {
+        const active = await this.getActiveSigningKey();
+        return [active];
+    }
+    async getEncryptionKey() {
+        const stored = await this.readPath("encryption/active");
+        if (stored?.value) {
+            return Buffer.from(String(stored.value), "base64url");
+        }
+        const value = crypto.randomBytes(32);
+        await this.writePath("encryption/active", { value: value.toString("base64url") });
+        return value;
+    }
+    async encryptSecret(plain) {
+        const key = await this.getEncryptionKey();
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+        const encrypted = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const payload = Buffer.concat([iv, tag, encrypted]);
+        return `aes-256-gcm$${payload.toString("base64url")}`;
+    }
+    async decryptSecret(cipherText) {
+        if (!cipherText.startsWith("aes-256-gcm$")) {
+            throw new Error("Unsupported cipher format");
+        }
+        const key = await this.getEncryptionKey();
+        const payload = Buffer.from(cipherText.slice("aes-256-gcm$".length), "base64url");
+        const iv = payload.subarray(0, 16);
+        const tag = payload.subarray(16, 32);
+        const encrypted = payload.subarray(32);
+        const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf8");
+    }
+    async readPath(path) {
+        const url = `${this.vaultAddr}/v1/${this.mountPath}/data/${path}`;
+        const res = await fetch(url, {
+            headers: { "X-Vault-Token": this.vaultToken },
+        });
+        if (res.status === 404)
+            return undefined;
+        if (!res.ok)
+            throw new Error(`Vault read failed: ${res.status}`);
+        const data = (await res.json());
+        return data.data?.data;
+    }
+    async writePath(path, data) {
+        const url = `${this.vaultAddr}/v1/${this.mountPath}/data/${path}`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: {
+                "X-Vault-Token": this.vaultToken,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ data }),
+        });
+        if (!res.ok)
+            throw new Error(`Vault write failed: ${res.status}`);
+    }
+}
+//# sourceMappingURL=vault.js.map

package/dist/services/secrets/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/services/secrets/vault.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAEzF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,OAAO,CAAC;IAExB,YAAY,GAAG,YAAY,CAAC;IAC5B,cAAc,GAAG,cAAc,CAAC;IAExB,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,SAAS,CAAS;IAE1B;QACE,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,oBAAoB;QAClB,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,cAAc;QACZ,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;YACnE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,SAAS,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAErE,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAE3H,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACxD,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,OAAO,eAAe,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;QAClF,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAY;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,SAAS,SAAS,IAAI,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,UAAU,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAC;QACjF,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,IAA6B;QACjE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,SAAS,SAAS,IAAI,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,IAAI,CAAC,UAAU;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/services/secrets.d.ts

@@ -0,0 +1,2 @@
+export * from "./secrets/index.js";
+//# sourceMappingURL=secrets.d.ts.map

package/dist/services/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/services/secrets.ts"],"names":[],"mappings":"AACA,cAAc,oBAAoB,CAAC"}

package/dist/services/secrets.js

@@ -0,0 +1,3 @@
+// Backwards-compatible re-export of the secrets provider layer.
+export * from "./secrets/index.js";
+//# sourceMappingURL=secrets.js.map

package/dist/services/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/services/secrets.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,cAAc,oBAAoB,CAAC"}

package/dist/services/serviceAccounts.d.ts

@@ -0,0 +1,24 @@
+import { type ServiceAccount } from "../db/schema.js";
+export declare function createServiceAccount(input: {
+    orgId: string;
+    name: string;
+    description?: string;
+}): Promise<ServiceAccount>;
+export declare function findServiceAccountsByOrgId(orgId: string): Promise<ServiceAccount[]>;
+export declare function findServiceAccountById(id: string, orgId: string): Promise<ServiceAccount | undefined>;
+export declare function updateServiceAccount(id: string, orgId: string, updates: Partial<{
+    name: string;
+    description: string;
+    isActive: boolean;
+}>): Promise<ServiceAccount | undefined>;
+export declare function listServiceAccountApiKeys(serviceAccountId: string): Promise<{
+    id: string;
+    name: string | null;
+    prefix: string;
+    scopes: string[];
+    lastUsedAt: Date | null;
+    expiresAt: Date | null;
+    revokedAt: Date | null;
+    createdAt: Date;
+}[]>;
+//# sourceMappingURL=serviceAccounts.d.ts.map

package/dist/services/serviceAccounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAccounts.d.ts","sourceRoot":"","sources":["../../src/services/serviceAccounts.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhF,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAU1B;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAMzF;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAarC;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,GACzE,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAOrC;AAED,wBAAsB,yBAAyB,CAAC,gBAAgB,EAAE,MAAM;;;;;;;;;KAcvE"}

package/dist/services/serviceAccounts.js

@@ -0,0 +1,53 @@
+import { eq, and, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { serviceAccounts, apiKeys } from "../db/schema.js";
+export async function createServiceAccount(input) {
+    const [record] = await db
+        .insert(serviceAccounts)
+        .values({
+        orgId: input.orgId,
+        name: input.name,
+        description: input.description ?? null,
+    })
+        .returning();
+    return record;
+}
+export async function findServiceAccountsByOrgId(orgId) {
+    return db
+        .select()
+        .from(serviceAccounts)
+        .where(and(eq(serviceAccounts.orgId, orgId), eq(serviceAccounts.isActive, true)))
+        .orderBy(serviceAccounts.name);
+}
+export async function findServiceAccountById(id, orgId) {
+    const [record] = await db
+        .select()
+        .from(serviceAccounts)
+        .where(and(eq(serviceAccounts.id, id), eq(serviceAccounts.orgId, orgId), eq(serviceAccounts.isActive, true)))
+        .limit(1);
+    return record;
+}
+export async function updateServiceAccount(id, orgId, updates) {
+    const [updated] = await db
+        .update(serviceAccounts)
+        .set({ ...updates, updatedAt: sql `now()` })
+        .where(and(eq(serviceAccounts.id, id), eq(serviceAccounts.orgId, orgId)))
+        .returning();
+    return updated;
+}
+export async function listServiceAccountApiKeys(serviceAccountId) {
+    return db
+        .select({
+        id: apiKeys.id,
+        name: apiKeys.name,
+        prefix: apiKeys.prefix,
+        scopes: apiKeys.scopes,
+        lastUsedAt: apiKeys.lastUsedAt,
+        expiresAt: apiKeys.expiresAt,
+        revokedAt: apiKeys.revokedAt,
+        createdAt: apiKeys.createdAt,
+    })
+        .from(apiKeys)
+        .where(eq(apiKeys.serviceAccountId, serviceAccountId));
+}
+//# sourceMappingURL=serviceAccounts.js.map

package/dist/services/serviceAccounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../src/services/serviceAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAuB,MAAM,iBAAiB,CAAC;AAEhF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;KACvC,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAa;IAC5D,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAU,EACV,KAAa;IAEb,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAChC,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CACnC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAU,EACV,KAAa,EACb,OAA0E;IAE1E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,eAAe,CAAC;SACvB,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;SAC1C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SACxE,SAAS,EAAE,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,gBAAwB;IACtE,OAAO,EAAE;SACN,MAAM,CAAC;QACN,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;SACD,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/services/setup/configWriter.d.ts

@@ -0,0 +1,18 @@
+import { type Result } from "../../lib/result.js";
+import type { ConfigWriter } from "./types.js";
+export declare class EnvFileConfigWriter implements ConfigWriter {
+    private readonly filePath;
+    constructor(filePath?: string);
+    read(): Promise<Record<string, string | undefined>>;
+    write(values: Record<string, string>): Promise<Result<void>>;
+    backup(): Promise<Result<string>>;
+}
+export declare class JsonConfigWriter implements ConfigWriter {
+    private readonly filePath;
+    constructor(filePath?: string);
+    read(): Promise<Record<string, string | undefined>>;
+    write(values: Record<string, string>): Promise<Result<void>>;
+    backup(): Promise<Result<string>>;
+}
+export declare function createConfigWriter(): ConfigWriter;
+//# sourceMappingURL=configWriter.d.ts.map

package/dist/services/setup/configWriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configWriter.d.ts","sourceRoot":"","sources":["../../../src/services/setup/configWriter.ts"],"names":[],"mappings":"AAGA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA8B/C,qBAAa,mBAAoB,YAAW,YAAY;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,CAAC,EAAE,MAAM;IAIvB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAiBnD,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmD5D,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;CAexC;AAED,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,CAAC,EAAE,MAAM;IAIvB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAkBnD,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAa5D,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;CAexC;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CAMjD"}

package/dist/services/setup/configWriter.js

@@ -0,0 +1,192 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { ok, err } from "../../lib/result.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+function formatEnvValue(value) {
+    // Quote values that contain whitespace or special characters.
+    if (/[\s#'"]/.test(value)) {
+        const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+        return `"${escaped}"`;
+    }
+    return value;
+}
+function parseEnvLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+        return { comment: true };
+    }
+    const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
+    if (!match)
+        return { comment: true };
+    let value = match[2];
+    if (value.startsWith('"') && value.endsWith('"')) {
+        value = value
+            .slice(1, -1)
+            .replace(/\\"/g, '"')
+            .replace(/\\\\/g, "\\");
+    }
+    return { key: match[1], value };
+}
+export class EnvFileConfigWriter {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath || path.resolve(__dirname, "../../../.env");
+    }
+    async read() {
+        try {
+            const content = await fs.readFile(this.filePath, "utf-8");
+            const values = {};
+            for (const line of content.split(/\r?\n/)) {
+                const { key, value } = parseEnvLine(line);
+                if (key)
+                    values[key] = value;
+            }
+            return values;
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                return {};
+            }
+            throw error;
+        }
+    }
+    async write(values) {
+        try {
+            const stats = await fs.stat(this.filePath).catch(() => null);
+            if (stats && !stats.isFile()) {
+                return err({ code: "NOT_A_FILE", message: `${this.filePath} is not a regular file`, statusCode: 400 });
+            }
+            const existing = await this.read();
+            const merged = { ...existing, ...values };
+            // Preserve comments and ordering from existing file when possible.
+            let lines = [];
+            try {
+                const content = await fs.readFile(this.filePath, "utf-8");
+                lines = content.split(/\r?\n/);
+            }
+            catch {
+                // File does not exist yet; start fresh.
+            }
+            const seen = new Set();
+            const updatedLines = [];
+            for (const line of lines) {
+                const { key } = parseEnvLine(line);
+                if (key && key in merged) {
+                    updatedLines.push(`${key}=${formatEnvValue(merged[key])}`);
+                    seen.add(key);
+                }
+                else {
+                    updatedLines.push(line);
+                }
+            }
+            // Append any new keys at the end.
+            const newKeys = Object.keys(merged).filter((k) => !seen.has(k));
+            if (newKeys.length > 0) {
+                if (updatedLines.length > 0 && updatedLines[updatedLines.length - 1] !== "") {
+                    updatedLines.push("");
+                }
+                for (const key of newKeys) {
+                    updatedLines.push(`${key}=${formatEnvValue(merged[key])}`);
+                }
+            }
+            await fs.writeFile(this.filePath, updatedLines.join("\n") + "\n", { mode: 0o600 });
+            return ok(undefined);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return err({ code: "WRITE_FAILED", message, statusCode: 500 });
+        }
+    }
+    async backup() {
+        try {
+            const stats = await fs.stat(this.filePath).catch(() => null);
+            if (!stats || !stats.isFile()) {
+                return ok("");
+            }
+            const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+            const backupPath = `${this.filePath}.backup-${timestamp}`;
+            await fs.copyFile(this.filePath, backupPath);
+            return ok(backupPath);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return err({ code: "BACKUP_FAILED", message, statusCode: 500 });
+        }
+    }
+}
+export class JsonConfigWriter {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath || path.resolve(__dirname, "../../../config/keystone.json");
+    }
+    async read() {
+        try {
+            const content = await fs.readFile(this.filePath, "utf-8");
+            const parsed = JSON.parse(content);
+            if (typeof parsed !== "object" || parsed === null)
+                return {};
+            const result = {};
+            for (const [key, value] of Object.entries(parsed)) {
+                result[key] = typeof value === "string" ? value : String(value);
+            }
+            return result;
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                return {};
+            }
+            throw error;
+        }
+    }
+    async write(values) {
+        try {
+            const existing = await this.read();
+            const merged = { ...existing, ...values };
+            await fs.mkdir(path.dirname(this.filePath), { recursive: true });
+            await fs.writeFile(this.filePath, JSON.stringify(merged, null, 2) + "\n", { mode: 0o600 });
+            return ok(undefined);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return err({ code: "WRITE_FAILED", message, statusCode: 500 });
+        }
+    }
+    async backup() {
+        try {
+            const stats = await fs.stat(this.filePath).catch(() => null);
+            if (!stats || !stats.isFile()) {
+                return ok("");
+            }
+            const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+            const backupPath = `${this.filePath}.backup-${timestamp}`;
+            await fs.copyFile(this.filePath, backupPath);
+            return ok(backupPath);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return err({ code: "BACKUP_FAILED", message, statusCode: 500 });
+        }
+    }
+}
+export function createConfigWriter() {
+    const mode = process.env.KEYSTONE_CONFIG_MODE?.toLowerCase();
+    if (mode === "json" || isRunningInDocker()) {
+        return new JsonConfigWriter();
+    }
+    return new EnvFileConfigWriter();
+}
+function isRunningInDocker() {
+    // Best-effort detection: presence of /.dockerenv or docker in cgroup.
+    try {
+        const fs = require("node:fs");
+        if (fs.existsSync("/.dockerenv"))
+            return true;
+        const cgroup = fs.readFileSync("/proc/self/cgroup", "utf-8");
+        return cgroup.includes("docker") || cgroup.includes("containerd");
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=configWriter.js.map

package/dist/services/setup/configWriter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configWriter.js","sourceRoot":"","sources":["../../../src/services/setup/configWriter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAG3D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,KAAa;IACnC,8DAA8D;IAC9D,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,IAAI,OAAO,GAAG,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,KAAK,GAAG,KAAK;aACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACZ,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,QAAQ,CAAS;IAElC,YAAY,QAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAuC,EAAE,CAAC;YACtD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAA8B;QACxC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC7B,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,wBAAwB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;YAE1C,mEAAmE;YACnE,IAAI,KAAK,GAAa,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC1D,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,GAAG,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;oBACzB,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAE,CAAC,EAAE,CAAC,CAAC;oBAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;oBAC5E,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxB,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;oBAC1B,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAE,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC9B,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,QAAQ,WAAW,SAAS,EAAE,CAAC;YAC1D,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IACV,QAAQ,CAAS;IAElC,YAAY,QAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAuC,EAAE,CAAC;YACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAA8B;QACxC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;YAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3F,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC9B,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,QAAQ,WAAW,SAAS,EAAE,CAAC;YAC1D,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,EAAE,CAAC;IAC7D,IAAI,IAAI,KAAK,MAAM,IAAI,iBAAiB,EAAE,EAAE,CAAC;QAC3C,OAAO,IAAI,gBAAgB,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,mBAAmB,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB;IACxB,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/services/setup/diagnostics.d.ts

@@ -0,0 +1,7 @@
+export interface DiagnosticCheck {
+    name: string;
+    status: "ok" | "error" | "warning" | "skipped";
+    message?: string;
+}
+export declare function runSetupDiagnostics(): Promise<DiagnosticCheck[]>;
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/services/setup/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../../src/services/setup/diagnostics.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CA+DtE"}

package/dist/services/setup/diagnostics.js

@@ -0,0 +1,73 @@
+import { sql } from "drizzle-orm";
+import { config } from "../../config.js";
+import { db } from "../../db/index.js";
+import { redis } from "../redis.js";
+import { getPublicJwks } from "../tokens.js";
+export async function runSetupDiagnostics() {
+    const checks = [];
+    // Database
+    try {
+        if (db) {
+            await db.execute(sql `SELECT 1`);
+            checks.push({ name: "Database connectivity", status: "ok" });
+        }
+        else {
+            checks.push({ name: "Database connectivity", status: "error", message: "Database not initialized" });
+        }
+    }
+    catch (err) {
+        checks.push({ name: "Database connectivity", status: "error", message: err instanceof Error ? err.message : String(err) });
+    }
+    // Redis
+    try {
+        if (redis.status === "ready" || redis.status === "connect") {
+            await redis.ping();
+            checks.push({ name: "Redis connectivity", status: "ok" });
+        }
+        else {
+            checks.push({ name: "Redis connectivity", status: "warning", message: "Redis not connected" });
+        }
+    }
+    catch (err) {
+        checks.push({ name: "Redis connectivity", status: "error", message: err instanceof Error ? err.message : String(err) });
+    }
+    // JWT keys
+    try {
+        const jwks = await getPublicJwks();
+        if (jwks.keys.length > 0) {
+            checks.push({ name: "JWT signing keys", status: "ok", message: `${jwks.keys.length} key(s) available` });
+        }
+        else {
+            checks.push({ name: "JWT signing keys", status: "error", message: "No signing keys available" });
+        }
+    }
+    catch (err) {
+        checks.push({ name: "JWT signing keys", status: "error", message: err instanceof Error ? err.message : String(err) });
+    }
+    // Internal API key
+    if (config.INTERNAL_API_KEY) {
+        checks.push({ name: "Internal API key", status: "ok" });
+    }
+    else {
+        checks.push({ name: "Internal API key", status: "warning", message: "Internal API key is not set" });
+    }
+    // Email provider
+    if (config.EMAIL_PROVIDER === "none") {
+        checks.push({ name: "Email provider", status: "skipped", message: "No email provider configured" });
+    }
+    else if (config.EMAIL_PROVIDER === "console") {
+        checks.push({ name: "Email provider", status: "ok", message: "Console email provider" });
+    }
+    else {
+        checks.push({ name: "Email provider", status: "ok", message: `${config.EMAIL_PROVIDER} configured` });
+    }
+    // Allowed origins
+    if (config.ALLOWED_ORIGINS.length > 0) {
+        checks.push({ name: "CORS origins", status: "ok", message: `${config.ALLOWED_ORIGINS.length} origin(s) configured` });
+    }
+    else {
+        checks.push({ name: "CORS origins", status: "warning", message: "No allowed origins configured" });
+    }
+    return checks;
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/services/setup/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../../src/services/setup/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ7C,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,WAAW;IACX,IAAI,CAAC;QACH,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,UAAU,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;IAED,QAAQ;IACR,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3D,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,WAAW;IACX,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,mBAAmB,EAAE,CAAC,CAAC;QAC3G,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACtG,CAAC;SAAM,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,cAAc,aAAa,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,uBAAuB,EAAE,CAAC,CAAC;IACxH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/setup/token.d.ts

@@ -0,0 +1,5 @@
+export declare function getSetupToken(): string | undefined;
+export declare function generateSetupToken(): string;
+export declare function validateSetupToken(token: string | undefined): boolean;
+export declare function printSetupToken(): void;
+//# sourceMappingURL=token.d.ts.map

package/dist/services/setup/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/services/setup/token.ts"],"names":[],"mappings":"AAMA,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAK3C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAcrE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAQtC"}

package/dist/services/setup/token.js

@@ -0,0 +1,37 @@
+import crypto from "node:crypto";
+const SETUP_TOKEN_ENV = "KEYSTONE_SETUP_TOKEN";
+let generatedToken = null;
+export function getSetupToken() {
+    return process.env[SETUP_TOKEN_ENV] || generatedToken || undefined;
+}
+export function generateSetupToken() {
+    if (!generatedToken) {
+        generatedToken = crypto.randomBytes(32).toString("hex");
+    }
+    return generatedToken;
+}
+export function validateSetupToken(token) {
+    if (!token)
+        return false;
+    const expected = getSetupToken();
+    if (!expected)
+        return false;
+    // Ignore accidental whitespace / newlines when pasting from the terminal.
+    const cleanToken = token.trim().toLowerCase();
+    const cleanExpected = expected.trim().toLowerCase();
+    if (cleanToken.length !== cleanExpected.length) {
+        console.log(`[debug] token length mismatch: sent=${cleanToken.length} expected=${cleanExpected.length}`);
+        return false;
+    }
+    return crypto.timingSafeEqual(Buffer.from(cleanToken), Buffer.from(cleanExpected));
+}
+export function printSetupToken() {
+    const token = getSetupToken();
+    if (token) {
+        // eslint-disable-next-line no-console
+        console.log(`\n🔐 Keystone setup token: ${token}\n`);
+        // eslint-disable-next-line no-console
+        console.log(`   Use this token to complete setup at http://localhost:${process.env.PORT || 4001}/setup\n`);
+    }
+}
+//# sourceMappingURL=token.js.map

package/dist/services/setup/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/services/setup/token.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAE/C,IAAI,cAAc,GAAkB,IAAI,CAAC;AAEzC,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,cAAc,IAAI,SAAS,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,0EAA0E;IAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEpD,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,uCAAuC,UAAU,CAAC,MAAM,aAAa,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,EAAE,CAAC;QACV,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,IAAI,CAAC,CAAC;QACrD,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,2DAA2D,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC"}