@hilbras/keystone 1.5.0 → 1.9.0

package/dist/repositories/scimConnection.js

@@ -0,0 +1,123 @@
+import { and, eq, gt, isNull, lte, or, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { scimConnections } from "../db/schema.js";
+/**
+ * Per-organization SCIM credentials.
+ *
+ * The bearer token is never stored: only its SHA-256 digest, which is also what
+ * authentication looks up. That removes both the plaintext-at-rest problem and
+ * the timing side channel of comparing secrets in application code, because the
+ * comparison happens inside the database's index lookup.
+ */
+export class DrizzleScimConnectionRepository {
+    async create(input) {
+        const [record] = await db
+            .insert(scimConnections)
+            .values({
+            orgId: input.orgId,
+            name: input.name,
+            tokenHash: input.tokenHash,
+            tokenHint: input.tokenHint,
+            previousTokenHash: input.previousTokenHash ?? null,
+            previousTokenValidUntil: input.previousTokenValidUntil ?? null,
+            createdByUserId: input.createdByUserId ?? null,
+            expiresAt: input.expiresAt ?? null,
+        })
+            .returning();
+        return record;
+    }
+    async findById(id) {
+        const [record] = await db
+            .select()
+            .from(scimConnections)
+            .where(eq(scimConnections.id, id))
+            .limit(1);
+        return record;
+    }
+    async findActiveByOrg(orgId) {
+        const [record] = await db
+            .select()
+            .from(scimConnections)
+            .where(and(eq(scimConnections.orgId, orgId), isNull(scimConnections.revokedAt)))
+            .limit(1);
+        return record;
+    }
+    async listByOrg(orgId) {
+        return db
+            .select()
+            .from(scimConnections)
+            .where(eq(scimConnections.orgId, orgId))
+            .orderBy(sql `${scimConnections.createdAt} desc`);
+    }
+    async listAll() {
+        return db.select().from(scimConnections).orderBy(sql `${scimConnections.createdAt} desc`);
+    }
+    /**
+     * Resolve a presented token to its connection. Accepts the current token and,
+     * inside the rotation grace window, the previous one. Revoked and expired
+     * connections never resolve.
+     */
+    async findByTokenHash(tokenHash, now = new Date()) {
+        const [record] = await db
+            .select()
+            .from(scimConnections)
+            .where(and(isNull(scimConnections.revokedAt), or(eq(scimConnections.tokenHash, tokenHash), and(eq(scimConnections.previousTokenHash, tokenHash), gt(scimConnections.previousTokenValidUntil, now)))))
+            .limit(1);
+        return record;
+    }
+    /**
+     * Issue a new token. The previous one keeps working until
+     * `previousTokenValidUntil`, so a rotation does not drop in-flight IdM traffic.
+     */
+    async rotate(id, input) {
+        const now = input.now ?? new Date();
+        const validUntil = new Date(now.getTime() + input.graceSeconds * 1000);
+        return db.transaction(async (tx) => {
+            const [current] = await tx
+                .select()
+                .from(scimConnections)
+                .where(and(eq(scimConnections.id, id), isNull(scimConnections.revokedAt)))
+                .limit(1);
+            if (!current)
+                return undefined;
+            // The token being replaced becomes the grace-period token; the new one
+            // becomes the only primary token. Reading first is required because a
+            // single UPDATE cannot reference the column it is replacing.
+            const [record] = await tx
+                .update(scimConnections)
+                .set({
+                previousTokenHash: current.tokenHash,
+                previousTokenValidUntil: validUntil,
+                tokenHash: input.tokenHash,
+                tokenHint: input.tokenHint,
+                lastRotatedAt: now,
+                updatedAt: now,
+            })
+                .where(and(eq(scimConnections.id, id), isNull(scimConnections.revokedAt)))
+                .returning();
+            return record;
+        });
+    }
+    async revoke(id, now = new Date()) {
+        const [record] = await db
+            .update(scimConnections)
+            .set({ revokedAt: now, previousTokenHash: null, previousTokenValidUntil: null, updatedAt: now })
+            .where(and(eq(scimConnections.id, id), isNull(scimConnections.revokedAt)))
+            .returning();
+        return record;
+    }
+    async touch(id, now = new Date()) {
+        await db
+            .update(scimConnections)
+            .set({ lastUsedAt: now })
+            .where(eq(scimConnections.id, id));
+    }
+    async deleteRevokedBefore(cutoff) {
+        const rows = await db
+            .delete(scimConnections)
+            .where(and(sql `revoked_at is not null`, lte(scimConnections.revokedAt, cutoff)))
+            .returning({ id: scimConnections.id });
+        return rows.length;
+    }
+}
+//# sourceMappingURL=scimConnection.js.map

package/dist/repositories/scimConnection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scimConnection.js","sourceRoot":"","sources":["../../src/repositories/scimConnection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AAKvE;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C,KAAK,CAAC,MAAM,CAAC,KAAgC;QAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,IAAI;YAC9D,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC9C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;SACnC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACjC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aAC/E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACvC,OAAO,CAAC,GAAG,CAAA,GAAG,eAAe,CAAC,SAAS,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,CAAA,GAAG,eAAe,CAAC,SAAS,OAAO,CAAC,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QACvD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CACJ,GAAG,CACD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EACjC,EAAE,CACA,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EACxC,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAChD,EAAE,CAAC,eAAe,CAAC,uBAAuB,EAAE,GAAG,CAAC,CACjD,CACF,CACF,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,EAAU,EACV,KAAiF;QAEjF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QAEvE,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,EAAE;iBACR,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;iBACzE,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAE/B,uEAAuE;YACvE,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,eAAe,CAAC;iBACvB,GAAG,CAAC;gBACH,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,uBAAuB,EAAE,UAAU;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,GAAG;gBAClB,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;iBACzE,SAAS,EAAE,CAAC;YAEf,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QACvC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;aAC/F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACzE,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QACtC,MAAM,EAAE;aACL,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAY;QACpC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAA,wBAAwB,EAAE,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;aAC/E,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}

package/dist/repositories/scimGroup.d.ts

@@ -0,0 +1,36 @@
+import { type ScimGroup } from "../db/schema.js";
+import type { CreateScimGroupInput, ScimGroupRepository } from "./types.js";
+/**
+ * Organization-scoped SCIM groups.
+ *
+ * Every read and write takes `orgId` and filters on it, so a group id from
+ * another tenant resolves to "not found" rather than to that tenant's group.
+ */
+export declare class DrizzleScimGroupRepository implements ScimGroupRepository {
+    create(input: CreateScimGroupInput): Promise<ScimGroup>;
+    findByIdInOrg(orgId: string, groupId: string): Promise<ScimGroup | undefined>;
+    listByOrg(orgId: string): Promise<ScimGroup[]>;
+    updateInOrg(orgId: string, groupId: string, input: {
+        displayName?: string;
+        description?: string | null;
+        externalId?: string | null;
+    }): Promise<ScimGroup | undefined>;
+    deleteInOrg(orgId: string, groupId: string): Promise<boolean>;
+    /**
+     * Members of a group in `orgId`. The organization is verified by joining
+     * through the group row, so membership can never leak across tenants.
+     */
+    listMembers(orgId: string, groupId: string): Promise<{
+        userId: string;
+        email: string;
+        name: string | null;
+    }[]>;
+    /**
+     * Add a member, enforcing both halves in one statement: the group must belong
+     * to `orgId`, and the user must be a member of `orgId`. Callers cannot bypass
+     * the tenancy check by passing a foreign group or user id.
+     */
+    addMember(orgId: string, groupId: string, userId: string): Promise<boolean>;
+    removeMember(orgId: string, groupId: string, userId: string): Promise<boolean>;
+}
+//# sourceMappingURL=scimGroup.d.ts.map

package/dist/repositories/scimGroup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scimGroup.d.ts","sourceRoot":"","sources":["../../src/repositories/scimGroup.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE5E;;;;;GAKG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IAC9D,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,CAW5D;IAEK,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAOlF;IAEK,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAMnD;IAEK,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACvF,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAYhC;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMlE;IAED;;;OAGG;IACG,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAgBnE;IAED;;;;OAIG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBhF;IAEK,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASnF;CACF"}

package/dist/repositories/scimGroup.js

@@ -0,0 +1,113 @@
+import { and, eq, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { scimGroupMembers, scimGroups, orgMemberships, users, } from "../db/schema.js";
+/**
+ * Organization-scoped SCIM groups.
+ *
+ * Every read and write takes `orgId` and filters on it, so a group id from
+ * another tenant resolves to "not found" rather than to that tenant's group.
+ */
+export class DrizzleScimGroupRepository {
+    async create(input) {
+        const [record] = await db
+            .insert(scimGroups)
+            .values({
+            orgId: input.orgId,
+            displayName: input.displayName,
+            description: input.description ?? null,
+            externalId: input.externalId ?? null,
+        })
+            .returning();
+        return record;
+    }
+    async findByIdInOrg(orgId, groupId) {
+        const [record] = await db
+            .select()
+            .from(scimGroups)
+            .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)))
+            .limit(1);
+        return record;
+    }
+    async listByOrg(orgId) {
+        return db
+            .select()
+            .from(scimGroups)
+            .where(eq(scimGroups.orgId, orgId))
+            .orderBy(sql `${scimGroups.displayName} asc`);
+    }
+    async updateInOrg(orgId, groupId, input) {
+        const [record] = await db
+            .update(scimGroups)
+            .set({
+            ...(input.displayName !== undefined ? { displayName: input.displayName } : {}),
+            ...(input.description !== undefined ? { description: input.description } : {}),
+            ...(input.externalId !== undefined ? { externalId: input.externalId } : {}),
+            updatedAt: sql `now()`,
+        })
+            .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)))
+            .returning();
+        return record;
+    }
+    async deleteInOrg(orgId, groupId) {
+        const rows = await db
+            .delete(scimGroups)
+            .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)))
+            .returning({ id: scimGroups.id });
+        return rows.length === 1;
+    }
+    /**
+     * Members of a group in `orgId`. The organization is verified by joining
+     * through the group row, so membership can never leak across tenants.
+     */
+    async listMembers(orgId, groupId) {
+        return db
+            .select({ userId: scimGroupMembers.userId, email: users.email, name: users.name })
+            .from(scimGroupMembers)
+            .innerJoin(scimGroups, eq(scimGroupMembers.groupId, scimGroups.id))
+            .innerJoin(users, eq(scimGroupMembers.userId, users.id))
+            // Only users who are *currently* members: a removed member's email and
+            // name must stop being readable by the organization that removed them.
+            .innerJoin(orgMemberships, and(eq(orgMemberships.userId, scimGroupMembers.userId), eq(orgMemberships.orgId, orgId)))
+            .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)));
+    }
+    /**
+     * Add a member, enforcing both halves in one statement: the group must belong
+     * to `orgId`, and the user must be a member of `orgId`. Callers cannot bypass
+     * the tenancy check by passing a foreign group or user id.
+     */
+    async addMember(orgId, groupId, userId) {
+        return db.transaction(async (tx) => {
+            const [group] = await tx
+                .select({ id: scimGroups.id })
+                .from(scimGroups)
+                .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)))
+                .limit(1);
+            if (!group)
+                return false;
+            const [member] = await tx
+                .select({ id: orgMemberships.id })
+                .from(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+                .limit(1);
+            if (!member)
+                return false;
+            const rows = await tx
+                .insert(scimGroupMembers)
+                .values({ groupId, userId })
+                .onConflictDoNothing({ target: [scimGroupMembers.groupId, scimGroupMembers.userId] })
+                .returning({ id: scimGroupMembers.id });
+            return rows.length === 1;
+        });
+    }
+    async removeMember(orgId, groupId, userId) {
+        const group = await this.findByIdInOrg(orgId, groupId);
+        if (!group)
+            return false;
+        const rows = await db
+            .delete(scimGroupMembers)
+            .where(and(eq(scimGroupMembers.groupId, groupId), eq(scimGroupMembers.userId, userId)))
+            .returning({ id: scimGroupMembers.id });
+        return rows.length === 1;
+    }
+}
+//# sourceMappingURL=scimGroup.js.map

package/dist/repositories/scimGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scimGroup.js","sourceRoot":"","sources":["../../src/repositories/scimGroup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,KAAK,GAEN,MAAM,iBAAiB,CAAC;AAGzB;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAC,MAAM,CAAC,KAA2B;QACtC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;SACrC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,OAAe;QAChD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACnE,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aAClC,OAAO,CAAC,GAAG,CAAA,GAAG,UAAU,CAAC,WAAW,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAa,EACb,OAAe,EACf,KAAwF;QAExF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,SAAS,EAAE,GAAG,CAAA,OAAO;SACtB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACnE,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAAe;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,UAAU,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACnE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,OAAe;QAEf,OAAO,EAAE;aACN,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;aACjF,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;aAClE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACxD,uEAAuE;YACvE,uEAAuE;aACtE,SAAS,CACR,cAAc,EACd,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAClD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAChC,CACF;aACA,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,MAAc;QAC5D,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;iBAC7B,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;iBACnE,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YAEzB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;iBACjC,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAE1B,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,gBAAgB,CAAC;iBACxB,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;iBAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;iBACpF,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;YAE1C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,OAAe,EAAE,MAAc;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,gBAAgB,CAAC;aACxB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACtF,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3B,CAAC;CACF"}

package/dist/repositories/session.d.ts

@@ -8,19 +8,19 @@ export interface CreateSessionInput {
 }
 export declare class SessionRepository {
     create(input: CreateSessionInput): Promise<{
-        id: string;
         createdAt: Date;
-        userId: string;
-        refreshTokenId: string;
         deviceFingerprint: string | null;
+        expiresAt: Date;
+        id: string;
         ipAddress: string | null;
-        userAgent: string | null;
         lastSeenAt: Date;
-        expiresAt: Date;
+        refreshTokenId: string;
+        revokedAt: Date | null;
+        userAgent: string | null;
+        userId: string;
     }>;
     listByUser(userId: string): Promise<{
         id: string;
-        createdAt: Date;
         userId: string;
         refreshTokenId: string;
         deviceFingerprint: string | null;
@@ -28,10 +28,11 @@ export declare class SessionRepository {
         userAgent: string | null;
         lastSeenAt: Date;
         expiresAt: Date;
+        revokedAt: Date | null;
+        createdAt: Date;
     }[]>;
     findByRefreshTokenId(refreshTokenId: string): Promise<{
         id: string;
-        createdAt: Date;
         userId: string;
         refreshTokenId: string;
         deviceFingerprint: string | null;
@@ -39,10 +40,11 @@ export declare class SessionRepository {
         userAgent: string | null;
         lastSeenAt: Date;
         expiresAt: Date;
+        revokedAt: Date | null;
+        createdAt: Date;
     }>;
     findById(id: string): Promise<{
         id: string;
-        createdAt: Date;
         userId: string;
         refreshTokenId: string;
         deviceFingerprint: string | null;
@@ -50,6 +52,8 @@ export declare class SessionRepository {
         userAgent: string | null;
         lastSeenAt: Date;
         expiresAt: Date;
+        revokedAt: Date | null;
+        createdAt: Date;
     }>;
     updateLastSeen(id: string): Promise<void>;
     deleteById(id: string, userId: string): Promise<boolean>;
@@ -57,17 +61,23 @@ export declare class SessionRepository {
     deleteExpired(): Promise<void>;
     deleteAllForUser(userId: string, exceptRefreshTokenId?: string): Promise<void>;
     revokeRefreshToken(tokenId: string): Promise<void>;
+    /**
+     * Mark every active session for a user as ended. Used when a security-relevant
+     * account change (such as enabling MFA) must invalidate existing sessions.
+     */
+    revokeAllForUser(userId: string): Promise<number>;
     findRefreshTokenByHash(tokenHash: string): Promise<{
         id: string;
-        createdAt: Date;
         userId: string;
-        deviceFingerprint: string | null;
-        ipAddress: string | null;
-        userAgent: string | null;
-        expiresAt: Date;
         appId: string | null;
         tokenHash: string;
+        expiresAt: Date;
         revokedAt: Date | null;
+        createdAt: Date;
+        ipAddress: string | null;
+        userAgent: string | null;
+        deviceFingerprint: string | null;
+        mfaFactor: string | null;
     }>;
 }
 //# sourceMappingURL=session.d.ts.map

package/dist/repositories/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/repositories/session.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,iBAAiB;IACtB,MAAM,CAAC,KAAK,EAAE,kBAAkB;;;;;;;;;;;IAYhC,UAAU,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;IAMzB,oBAAoB,CAAC,cAAc,EAAE,MAAM;;;;;;;;;;;IAO3C,QAAQ,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;IAOnB,cAAc,CAAC,EAAE,EAAE,MAAM;IAMzB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAMrC,sBAAsB,CAAC,cAAc,EAAE,MAAM;IAK7C,aAAa;IAKb,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM;IAS9D,kBAAkB,CAAC,OAAO,EAAE,MAAM;IAIlC,sBAAsB,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;;;CAI/C"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/repositories/session.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,iBAAiB;IACtB,MAAM,CAAC,KAAK,EAAE,kBAAkB;;;;;;;;;;;OAUrC;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;SAI9B;IAEK,oBAAoB,CAAC,cAAc,EAAE,MAAM;;;;;;;;;;;OAKhD;IAEK,QAAQ,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;OAKxB;IAEK,cAAc,CAAC,EAAE,EAAE,MAAM,iBAI9B;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAI1C;IAEK,sBAAsB,CAAC,cAAc,EAAE,MAAM,iBAGlD;IAEK,aAAa,kBAGlB;IAEK,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,iBAOnE;IAEK,kBAAkB,CAAC,OAAO,EAAE,MAAM,iBAEvC;IAED;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOtD;IAEK,sBAAsB,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;;;OAG7C;CACF"}

package/dist/repositories/session.js

@@ -1,6 +1,6 @@
 import { db } from "../db/index.js";
 import { userSessions, refreshTokens } from "../db/schema.js";
-import { eq, and, lt, desc } from "drizzle-orm";
+import { eq, and, isNull, lt, desc } from "drizzle-orm";
 export class SessionRepository {
     async create(input) {
         const [session] = await db.insert(userSessions).values({
@@ -60,6 +60,18 @@ export class SessionRepository {
     async revokeRefreshToken(tokenId) {
         await db.update(refreshTokens).set({ revokedAt: new Date() }).where(eq(refreshTokens.id, tokenId));
     }
+    /**
+     * Mark every active session for a user as ended. Used when a security-relevant
+     * account change (such as enabling MFA) must invalidate existing sessions.
+     */
+    async revokeAllForUser(userId) {
+        const rows = await db
+            .update(userSessions)
+            .set({ revokedAt: new Date() })
+            .where(and(eq(userSessions.userId, userId), isNull(userSessions.revokedAt)))
+            .returning({ id: userSessions.id });
+        return rows.length;
+    }
     async findRefreshTokenByHash(tokenHash) {
         const [row] = await db.select().from(refreshTokens).where(eq(refreshTokens.tokenHash, tokenHash)).limit(1);
         return row;

package/dist/repositories/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/repositories/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAWhD,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YACrD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aAClC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACtC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,cAAsB;QAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aACnD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aACtD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aACnD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,MAAc;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aACzC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,cAAsB;QACjD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,oBAA6B;QAClE,IAAI,oBAAoB,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;iBAC1B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,SAAiB;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3G,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/repositories/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAWxD,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YACrD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aAClC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACtC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,cAAsB;QAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aACnD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aACtD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aACnD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,MAAc;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aACzC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,cAAsB;QACjD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,oBAA6B;QAClE,IAAI,oBAAoB,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;iBAC1B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACrG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;aAC3E,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,SAAiB;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3G,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/repositories/types.d.ts

@@ -1,4 +1,8 @@
-import type { User, Organization, OrgMembership, Application, auditLog, Permission } from "../db/schema.js";
+import type { User, Organization, OrgMembership, Application, auditLog, MfaChallenge, Permission, ScimConnection, ScimGroup } from "../db/schema.js";
+export declare class LastOwnerInvariantError extends Error {
+    readonly code: "LAST_OWNER";
+    constructor(message?: string);
+}
 export interface CreateUserInput {
     email: string;
     username: string;
@@ -14,11 +18,12 @@ export interface UpdateUserInput {
     name?: string;
     email?: string;
     username?: string;
-    role?: string;
     emailVerified?: boolean;
     avatarUrl?: string | null;
     phoneNumber?: string | null;
     phoneVerified?: boolean;
+    isActive?: boolean;
+    accountReviewRequired?: boolean;
     metadata?: Record<string, unknown>;
 }
 export interface UserRepository {
@@ -26,14 +31,39 @@ export interface UserRepository {
     findByEmail(email: string): Promise<User | undefined>;
     create(input: CreateUserInput): Promise<User>;
     update(id: string, input: UpdateUserInput): Promise<User | undefined>;
+    updateRole(id: string, role: "owner" | "user"): Promise<User | undefined>;
     deactivate(id: string): Promise<void>;
     listByOrg(orgId: string): Promise<User[]>;
     listAll(): Promise<User[]>;
+    countByRole(role: string): Promise<number>;
     updateLastSeen(id: string): Promise<void>;
     ensureUniqueUsername(base: string, excludeId?: string): Promise<string>;
     recordFailedLogin(id: string): Promise<User | undefined>;
     resetFailedLogins(id: string): Promise<void>;
     lockAccount(id: string, until: Date): Promise<void>;
+    /** Resolve a user only through a membership in `orgId`. */
+    findByIdInOrg(orgId: string, userId: string): Promise<User | undefined>;
+    /**
+     * Update a user only when they are a member of `orgId`. Returns undefined
+     * when the user is outside the organization, so callers cannot accidentally
+     * fall back to a global update.
+     */
+    updateInOrg(orgId: string, userId: string, input: UpdateUserInput): Promise<User | undefined>;
+    /** Organizations the user belongs to. */
+    listOrgIdsForUser(userId: string): Promise<string[]>;
+    /**
+     * Remove a user from an organization as seen by SCIM.
+     *
+     * `outcome` distinguishes the two cases that matter for tenant safety:
+     *  - `membership_removed` — the user belongs to other organizations, so only
+     *    this membership is removed and the shared account is left untouched.
+     *  - `deactivated` — the organization was the user's only membership, so the
+     *    account itself is deactivated and its sessions are revoked.
+     */
+    removeFromOrg(orgId: string, userId: string): Promise<{
+        outcome: "membership_removed" | "deactivated" | "not_found" | "last_owner";
+        user?: User;
+    } | undefined>;
     setTotpSecret(userId: string, totpSecret: string): Promise<void>;
     enableTotp(userId: string): Promise<void>;
     disableTotp(userId: string): Promise<void>;
@@ -45,7 +75,7 @@ export interface CreateOrganizationInput {
     plan?: string;
 }
 export interface OrganizationRepository {
-    create(input: CreateOrganizationInput): Promise<Organization>;
+    createWithOwner(input: CreateOrganizationInput, userId: string): Promise<Organization>;
     findById(id: string): Promise<Organization | undefined>;
     findBySlug(slug: string): Promise<Organization | undefined>;
     listByUserId(userId: string): Promise<Organization[]>;
@@ -58,10 +88,10 @@ export interface OrganizationRepository {
     addMembership(input: {
         orgId: string;
         userId: string;
-        role: string;
+        role: "owner" | "admin" | "member";
     }): Promise<OrgMembership>;
     findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined>;
-    updateMembershipRole(orgId: string, userId: string, role: string): Promise<OrgMembership | undefined>;
+    updateMembershipRole(orgId: string, userId: string, role: "owner" | "admin" | "member"): Promise<OrgMembership | undefined>;
     removeMembership(orgId: string, userId: string): Promise<boolean>;
     countOwners(orgId: string): Promise<number>;
     listMembers(orgId: string): Promise<{
@@ -72,6 +102,7 @@ export interface OrganizationRepository {
             username: string;
             name: string | null;
             avatarUrl: string | null;
+            platformRole: string;
         };
     }[]>;
 }
@@ -95,6 +126,82 @@ export interface IdentityRepository {
         };
     }[]>;
 }
+export type MfaFlow = "login" | "token_login";
+export type MfaChallengeStatus = "requires_mfa" | "consumed" | "failed" | "expired";
+export interface CreateMfaChallengeInput {
+    challengeHash: string;
+    userId: string;
+    flow: MfaFlow;
+    clientId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    expiresAt: Date;
+    maxAttempts: number;
+}
+export interface MfaChallengeRepository {
+    create(input: CreateMfaChallengeInput): Promise<MfaChallenge>;
+    findByHash(challengeHash: string): Promise<MfaChallenge | undefined>;
+    /** Atomically record a failed attempt; returns the updated challenge or undefined when already locked. */
+    recordFailedAttempt(id: string, now: Date): Promise<MfaChallenge | undefined>;
+    /** Atomically consume an active challenge; returns undefined when missing, expired, or already consumed. */
+    consume(id: string, now: Date): Promise<MfaChallenge | undefined>;
+    /** Mark every outstanding challenge for a user as failed (used when a factor is enrolled/reset). */
+    invalidateUserChallenges(userId: string, now: Date): Promise<void>;
+    deleteExpired(now: Date): Promise<number>;
+}
+export interface CreateScimConnectionInput {
+    orgId: string;
+    name: string;
+    tokenHash: string;
+    tokenHint: string;
+    previousTokenHash?: string | null;
+    previousTokenValidUntil?: Date | null;
+    createdByUserId?: string | null;
+    expiresAt?: Date | null;
+}
+export interface ScimConnectionRepository {
+    create(input: CreateScimConnectionInput): Promise<ScimConnection>;
+    findById(id: string): Promise<ScimConnection | undefined>;
+    findActiveByOrg(orgId: string): Promise<ScimConnection | undefined>;
+    listByOrg(orgId: string): Promise<ScimConnection[]>;
+    listAll(): Promise<ScimConnection[]>;
+    /** Resolve a presented token; accepts the grace-period token until its deadline. */
+    findByTokenHash(tokenHash: string, now?: Date): Promise<ScimConnection | undefined>;
+    rotate(id: string, input: {
+        tokenHash: string;
+        tokenHint: string;
+        graceSeconds: number;
+        now?: Date;
+    }): Promise<ScimConnection | undefined>;
+    revoke(id: string, now?: Date): Promise<ScimConnection | undefined>;
+    touch(id: string, now?: Date): Promise<void>;
+    deleteRevokedBefore(cutoff: Date): Promise<number>;
+}
+export interface CreateScimGroupInput {
+    orgId: string;
+    displayName: string;
+    description?: string | null;
+    externalId?: string | null;
+}
+export interface ScimGroupRepository {
+    create(input: CreateScimGroupInput): Promise<ScimGroup>;
+    /** Groups are always looked up through their organization, never by id alone. */
+    findByIdInOrg(orgId: string, groupId: string): Promise<ScimGroup | undefined>;
+    listByOrg(orgId: string): Promise<ScimGroup[]>;
+    updateInOrg(orgId: string, groupId: string, input: {
+        displayName?: string;
+        description?: string | null;
+        externalId?: string | null;
+    }): Promise<ScimGroup | undefined>;
+    deleteInOrg(orgId: string, groupId: string): Promise<boolean>;
+    listMembers(orgId: string, groupId: string): Promise<{
+        userId: string;
+        email: string;
+        name: string | null;
+    }[]>;
+    addMember(orgId: string, groupId: string, userId: string): Promise<boolean>;
+    removeMember(orgId: string, groupId: string, userId: string): Promise<boolean>;
+}
 export interface AuditRepository {
     list(opts: {
         orgId?: string;

package/dist/repositories/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/repositories/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE5G,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACtE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACzD,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACxD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACpH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9F,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACtG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC5K;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC5F,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC1H;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,IAAI,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACnE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACtG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACpD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/repositories/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,IAAI,EACJ,YAAY,EACZ,aAAa,EACb,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,cAAc,EACd,SAAS,EACV,MAAM,iBAAiB,CAAC;AAEzB,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,YAAY,CAAU;IAEtC,YAAY,OAAO,SAAgD,EAGlE;CACF;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACtE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC1E,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACzD,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,2DAA2D;IAC3D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACxE;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC9F,yCAAyC;IACzC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD;;;;;;;;OAQG;IACH,aAAa,CACX,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CACN;QAAE,OAAO,EAAE,oBAAoB,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,GAC3F,SAAS,CACZ,CAAC;IACF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,CAAC,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvF,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACxD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACpH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpH,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC5H,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAClM;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC5F,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC1H;AAED,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,aAAa,CAAC;AAC9C,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpF,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACrE,0GAA0G;IAC1G,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC9E,4GAA4G;IAC5G,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAClE,oGAAoG;IACpG,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,aAAa,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,uBAAuB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpE,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpD,OAAO,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACrC,oFAAoF;IACpF,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,GAChF,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,mBAAmB,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,iFAAiF;IACjF,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAC9E,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACvF,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAClC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAAC;IAC/G,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,IAAI,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACnE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACtG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACpD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG"}