@hilbras/keystone 1.9.0 → 2.5.0

package/dist/services/connectors/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtG,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C"}

package/dist/services/domain/authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,EAA6E,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIxH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC1H,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAC/E;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEhG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJtB,YACmB,KAAK,EAAE,cAAc,EACrB,YAAY,EAAE,qBAAqB,EACnC,aAAa,EAAE,sBAAsB,EACrC,GAAG,EAAE,UAAU,EAC9B;YAEU,cAAc;IAYtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CA4EnE;IAEK,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CA4E3D;YAEa,WAAW;IAoBzB;;;;OAIG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAgChC;IAEK,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAS7G;IAEK,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAKzD;IAEK,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC,CAgBnG;IAEK,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CA8CtF;CACF"}
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAI3E,OAAO,EAA6E,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIxH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC1H,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAC/E;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEhG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJtB,YACmB,KAAK,EAAE,cAAc,EACrB,YAAY,EAAE,qBAAqB,EACnC,aAAa,EAAE,sBAAsB,EACrC,GAAG,EAAE,UAAU,EAC9B;YAEU,cAAc;IAYtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CA4EnE;IAEK,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CA4E3D;YAEa,WAAW;IAoBzB;;;;OAIG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAgChC;IAEK,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAS7G;IAEK,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAKzD;IAEK,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC,CAgBnG;IAEK,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAuDtF;CACF"}

package/dist/services/domain/authentication.js

@@ -1,8 +1,10 @@
 import crypto from "node:crypto";
-import { eq, and, gt, isNull } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { config, isZitadelConfigured } from "../../config.js";
 import { db } from "../../db/index.js";
 import { users, passwordResetTokens } from "../../db/schema.js";
+import { consumePasswordResetTokenRow } from "../singleUse.js";
+import { revokeAllUserCredentials } from "../sessionRevocation.js";
 import { createHumanUser, verifyPassword as verifyZitadelPassword } from "../zitadel.js";
 import { createTokenSet, rotateRefreshToken, revokeRefreshToken } from "../tokens.js";
 import { isPasswordBreached } from "../hibp.js";
@@ -244,15 +246,22 @@ export class AuthenticationDomainService {
     async resetPasswordWithToken(token, newPassword) {
         const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
         const now = new Date();
-        const [record] = await db
-            .select()
-            .from(passwordResetTokens)
-            .where(and(eq(passwordResetTokens.tokenHash, tokenHash), gt(passwordResetTokens.expiresAt, now), isNull(passwordResetTokens.usedAt)))
-            .limit(1);
-        if (!record) {
-            return err({ code: "INVALID_TOKEN", message: "Invalid or expired reset token.", statusCode: 400 });
+        // Claim the token before doing any work. A conditional SELECT followed by an
+        // unconditional UPDATE would let parallel requests all pass the check and
+        // each write a different password, last writer winning — so the claim is
+        // the gate, and it happens first.
+        const claim = await consumePasswordResetTokenRow(tokenHash, now);
+        if (claim.outcome !== "consumed" || !claim.record) {
+            if (claim.reason === "replayed") {
+                await emit({ type: "password_reset_token_replayed", payload: {} });
+            }
+            return err({
+                code: "INVALID_TOKEN",
+                message: claim.reason === "expired" ? "This reset link has expired." : "Invalid or expired reset token.",
+                statusCode: 400,
+            });
         }
-        const user = await this.users.findById(record.userId);
+        const user = await this.users.findById(claim.record.userId);
         if (!user?.isActive) {
             return err({ code: "ACCOUNT_DEACTIVATED", message: "This account is deactivated.", statusCode: 403 });
         }
@@ -263,17 +272,25 @@ export class AuthenticationDomainService {
             }
         }
         const passwordHash = await hashPassword(newPassword);
-        await db.transaction(async (tx) => {
-            await tx
-                .update(passwordResetTokens)
-                .set({ usedAt: now })
-                .where(eq(passwordResetTokens.id, record.id));
-            await tx
-                .update(users)
-                .set({ passwordHash, updatedAt: now })
-                .where(eq(users.id, user.id));
+        await db
+            .update(users)
+            .set({ passwordHash, updatedAt: now })
+            .where(eq(users.id, user.id));
+        // A reset is the standard response to a suspected compromise, so it has to
+        // actually remove the intruder. Changing the password while leaving live
+        // sessions and refresh tokens would let whoever prompted the reset keep
+        // using the account. Also spends any other reset token issued alongside
+        // this one, so an intercepted earlier email cannot be completed later.
+        const revoked = await revokeAllUserCredentials(user.id);
+        await emit({
+            type: "password_reset_completed",
+            payload: {
+                userId: user.id,
+                revokedSessions: revoked.sessions,
+                revokedRefreshTokens: revoked.refreshTokens,
+                revokedRecoveryCredentials: revoked.recoveryCredentials,
+            },
         });
-        await emit({ type: "password_reset_completed", payload: { userId: user.id } });
         return ok(user);
     }
 }

package/dist/services/domain/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAa,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,cAAc,IAAI,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAoC,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGxC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmDnE,MAAM,OAAO,2BAA2B;IAEnB,KAAK;IACL,YAAY;IACZ,aAAa;IACb,GAAG;IAJtB,YACmB,KAAqB,EACrB,YAAmC,EACnC,aAAqC,EACrC,GAAe;qBAHf,KAAK;4BACL,YAAY;6BACZ,aAAa;mBACb,GAAG;IACnB,CAAC;IAEI,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,QAAiB;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QAEpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9E,OAAO;YACL,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACxF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACvG,CAAC;QAEF,IAAI,aAAiC,CAAC;QACtC,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,eAAe,CAAC;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YAClC,YAAY;YACZ,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,CAAC,MAAM,CAAC,2BAA2B;YAClD,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAC1E,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACjD,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE;gBACP,QAAQ,EAAE,UAAU;gBACpB,aAAa;gBACb,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,mBAAmB,EAAE,EAAE,CAAC;gBAC1B,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,MAAM,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3G,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iFAAiF,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtJ,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAEpG,MAAM,QAAQ,GAAG,OAAO,EAAE,mBAAmB,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;gBAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBACnD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kEAAkE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE;gBAC5F,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvF,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE;SAChI,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAAU,EACV,OAAoB,EACpB,SAAkB,EAClB,SAAkB,EAClB,SAAwB;QAExB,OAAO,cAAc,CACnB,IAAI,EACJ,SAAS,EACT,SAAS,EACT;YACE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;YACzD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,cAAsB,EACtB,IAAY,EACZ,MAAiB,EACjB,SAAkB,EAClB,SAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE7D,IAAI,MAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/E,OAAO,GAAG,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,qDAAqD;gBAC9D,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,GAAG,EAAE,MAAM;gBACX,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QAElE,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS;YACT,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,EAC5C,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,EACtC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAChC,MAAM,EAAE;iBACL,MAAM,CAAC,mBAAmB,CAAC;iBAC3B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;iBACpB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,MAAM,EAAE;iBACL,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAa,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,cAAc,IAAI,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAoC,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGxC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmDnE,MAAM,OAAO,2BAA2B;IAEnB,KAAK;IACL,YAAY;IACZ,aAAa;IACb,GAAG;IAJtB,YACmB,KAAqB,EACrB,YAAmC,EACnC,aAAqC,EACrC,GAAe;qBAHf,KAAK;4BACL,YAAY;6BACZ,aAAa;mBACb,GAAG;IACnB,CAAC;IAEI,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,QAAiB;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QAEpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9E,OAAO;YACL,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACxF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACvG,CAAC;QAEF,IAAI,aAAiC,CAAC;QACtC,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,eAAe,CAAC;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YAClC,YAAY;YACZ,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,CAAC,MAAM,CAAC,2BAA2B;YAClD,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAC1E,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACjD,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE;gBACP,QAAQ,EAAE,UAAU;gBACpB,aAAa;gBACb,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,mBAAmB,EAAE,EAAE,CAAC;gBAC1B,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,MAAM,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3G,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iFAAiF,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtJ,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAEpG,MAAM,QAAQ,GAAG,OAAO,EAAE,mBAAmB,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;gBAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBACnD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kEAAkE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE;gBAC5F,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvF,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE;SAChI,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAAU,EACV,OAAoB,EACpB,SAAkB,EAClB,SAAkB,EAClB,SAAwB;QAExB,OAAO,cAAc,CACnB,IAAI,EACJ,SAAS,EACT,SAAS,EACT;YACE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;YACzD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,cAAsB,EACtB,IAAY,EACZ,MAAiB,EACjB,SAAkB,EAClB,SAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE7D,IAAI,MAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/E,OAAO,GAAG,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,qDAAqD;gBAC9D,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,GAAG,EAAE,MAAM;gBACX,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QAElE,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS;YACT,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,6EAA6E;QAC7E,0EAA0E;QAC1E,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,GAAG,CAAC;gBACT,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,iCAAiC;gBACxG,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;aACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEhC,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAExD,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,eAAe,EAAE,OAAO,CAAC,QAAQ;gBACjC,oBAAoB,EAAE,OAAO,CAAC,aAAa;gBAC3C,0BAA0B,EAAE,OAAO,CAAC,mBAAmB;aACxD;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;CACF"}

package/dist/services/domain/organization.d.ts

@@ -40,8 +40,10 @@ export declare class OrganizationDomainService {
         name: string;
         redirectUris?: string[];
         allowedOrigins?: string[];
+        clientType?: "confidential" | "public";
+        allowedScopes?: string[];
     }): Promise<Result<Application & {
-        clientSecret: string;
+        clientSecret: string | null;
     }>>;
     listOrganizationApplications(orgId: string): Promise<Application[]>;
     updateApplication(appId: string, orgId: string, updates: Partial<{
@@ -52,6 +54,8 @@ export declare class OrganizationDomainService {
         blockedIps: string[];
         isActive: boolean;
         branding: Record<string, unknown>;
+        clientType: "confidential" | "public";
+        allowedScopes: string[];
     }>): Promise<Result<Application>>;
 }
 //# sourceMappingURL=organization.d.ts.map

package/dist/services/domain/organization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAA2B,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAE/H,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEtE,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAF/B,YACmB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EAClD;IAEE,kBAAkB,CACtB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAoB/B;IAEK,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAI/D;IAEK,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAEnE;IAEK,gBAAgB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAM9G;IAEK,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAIjF;IAEK,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAehC;IAEK,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,CAW1F;IAEK,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;SAEjC;IAEK,iBAAiB,CAAC,KAAK,EAAE;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAI1D;IAEK,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAExE;IAEK,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GACrL,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAK9B;CACF"}
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAA2B,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAE/H,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEtE,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAF/B,YACmB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EAClD;IAEE,kBAAkB,CACtB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAoB/B;IAEK,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAI/D;IAEK,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAEnE;IAEK,gBAAgB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAM9G;IAEK,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAIjF;IAEK,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAehC;IAEK,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,CAW1F;IAEK,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;SAEjC;IAEK,iBAAiB,CAAC,KAAK,EAAE;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,UAAU,CAAC,EAAE,cAAc,GAAG,QAAQ,CAAC;QACvC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAIjE;IAEK,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAExE;IAEK,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,EAAE,cAAc,GAAG,QAAQ,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,GACrP,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAK9B;CACF"}

package/dist/services/domain/organization.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAA2D,MAAM,6BAA6B,CAAC;AAC/H,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAgB,MAAM,oBAAoB,CAAC;AAItE,MAAM,OAAO,yBAAyB;IAEjB,aAAa;IACb,YAAY;IAF/B,YACmB,aAAqC,EACrC,YAAmC;6BADnC,aAAa;4BACb,YAAY;IAC5B,CAAC;IAEJ,KAAK,CAAC,kBAAkB,CACtB,KAAqD,EACrD,MAAc;QAEd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,oDAAoD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE;gBACP,MAAM;gBACN,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,QAAQ,EAAE;oBACR,YAAY,EAAE,MAAM;oBACpB,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,UAAU,CAAC,IAAI;oBACxB,MAAM,EAAE,sBAAsB;iBAC/B;aACF;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAuD;QAC5E,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,2BAA2B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,MAAc,EACd,IAAa;QAEb,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,2BAA2B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACnF,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7G,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7G,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAKvB;QACC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,KAAa;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,KAAa,EACb,OAAsL;QAEtL,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAA2D,MAAM,6BAA6B,CAAC;AAC/H,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAgB,MAAM,oBAAoB,CAAC;AAItE,MAAM,OAAO,yBAAyB;IAEjB,aAAa;IACb,YAAY;IAF/B,YACmB,aAAqC,EACrC,YAAmC;6BADnC,aAAa;4BACb,YAAY;IAC5B,CAAC;IAEJ,KAAK,CAAC,kBAAkB,CACtB,KAAqD,EACrD,MAAc;QAEd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,oDAAoD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE;gBACP,MAAM;gBACN,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,QAAQ,EAAE;oBACR,YAAY,EAAE,MAAM;oBACpB,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,UAAU,CAAC,IAAI;oBACxB,MAAM,EAAE,sBAAsB;iBAC/B;aACF;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAuD;QAC5E,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,2BAA2B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,MAAc,EACd,IAAa;QAEb,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,2BAA2B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACnF,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7G,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7G,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAOvB;QACC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,KAAa;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,KAAa,EACb,OAAsP;QAEtP,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;CACF"}

package/dist/services/events/types.d.ts

@@ -23,5 +23,5 @@ export interface KeystoneEvent {
 export type EventHandler = (event: KeystoneEvent) => void | Promise<void>;
 export declare const EVENT_VERSIONS: Record<string, number>;
 export declare function eventVersion(type: string): number;
-export type AuditEventType = "user_registered" | "user_login" | "user_login_failed" | "user_logout" | "token_refresh" | "token_refresh_failed" | "oauth_callback" | "oauth2_authorize" | "oauth2_token" | "oauth2_refresh" | "oauth2_refresh_failed" | "oauth2_client_credentials" | "oauth2_revoke" | "oauth2_consent" | "password_reset_requested" | "password_reset_completed" | "api_key_created" | "api_key_revoked" | "api_key_used" | "service_account_created" | "service_account_updated" | "unauthorized_access" | "organization_created" | "organization_updated" | "organization_plan_updated" | "billing_customer_provisioned" | "organization_member_invited" | "organization_member_removed" | "organization_member_role_updated" | "permission_created" | "permission_deleted" | "permission_role_updated" | "application_created" | "application_updated" | "magic_link_sent" | "magic_link_verified" | "totp_enrolled" | "totp_verify_failed" | "totp_enabled" | "totp_disable_failed" | "totp_disabled" | "webauthn_registered" | "webauthn_authenticated" | "new_device_detected" | "sms_otp_sent" | "sms_otp_verify_failed" | "sms_otp_verified" | "authz_check" | "saml_sso_login" | "oidc_enterprise_login" | "saml_connection_created" | "saml_connection_deleted" | "oidc_connection_created" | "oidc_connection_deleted" | "scim_user_created" | "scim_user_updated" | "scim_user_deleted" | "federation_login" | "workflow_triggered" | "workflow_step_executed" | "workflow_created" | "workflow_deleted" | "workflow_blocked" | "platform_user_updated" | "platform_role_changed" | "platform_user_deactivated" | "platform_account_reviewed" | "platform_signing_key_rotated" | "platform_plugin_unregistered" | "platform_feature_flag_updated" | "platform_feature_flag_deleted" | "profile_updated" | "email_verification_sent" | "email_verified" | "platform_webhook_created" | "platform_webhook_updated" | "platform_webhook_deleted" | "platform_webhook_secret_rotated" | "federation_identity_linked" | "user_token_login" | "session_revoked" | "sessions_revoked_all" | "mfa_challenge_created" | "mfa_challenge_failed" | "mfa_challenge_expired" | "mfa_challenge_rejected" | "mfa_verified" | "mfa_bypass_blocked" | "mfa_backup_code_regenerated" | "scim_connection_created" | "scim_connection_rotated" | "scim_connection_revoked" | "scim_authentication_failed" | "scim_access_denied" | "scim_group_created" | "scim_group_updated" | "scim_group_deleted";
+export type AuditEventType = "user_registered" | "user_login" | "user_login_failed" | "user_logout" | "token_refresh" | "token_refresh_failed" | "oauth_callback" | "oauth2_authorize" | "oauth2_token" | "oauth2_refresh" | "oauth2_refresh_failed" | "oauth2_client_credentials" | "oauth2_revoke" | "oauth2_consent" | "password_reset_requested" | "password_reset_completed" | "api_key_created" | "api_key_revoked" | "api_key_used" | "service_account_created" | "service_account_updated" | "magic_link_replayed" | "sms_otp_replayed" | "password_reset_token_replayed" | "service_account_certificate_bound" | "service_account_certificate_unbound" | "service_account_revoked" | "unauthorized_access" | "organization_created" | "organization_updated" | "organization_plan_updated" | "billing_customer_provisioned" | "organization_member_invited" | "organization_member_removed" | "organization_member_role_updated" | "permission_created" | "permission_deleted" | "permission_role_updated" | "application_created" | "application_updated" | "magic_link_sent" | "magic_link_verified" | "totp_enrolled" | "totp_verify_failed" | "totp_enabled" | "totp_disable_failed" | "totp_disabled" | "webauthn_registered" | "webauthn_authenticated" | "new_device_detected" | "sms_otp_sent" | "sms_otp_verify_failed" | "sms_otp_verified" | "authz_check" | "saml_sso_login" | "oidc_enterprise_login" | "saml_connection_created" | "saml_connection_deleted" | "oidc_connection_created" | "oidc_connection_deleted" | "scim_user_created" | "scim_user_updated" | "scim_user_deleted" | "federation_login" | "workflow_triggered" | "workflow_step_executed" | "workflow_created" | "workflow_deleted" | "workflow_blocked" | "platform_user_updated" | "platform_role_changed" | "platform_user_deactivated" | "platform_account_reviewed" | "platform_signing_key_rotated" | "platform_plugin_unregistered" | "platform_feature_flag_updated" | "platform_feature_flag_deleted" | "profile_updated" | "email_verification_sent" | "email_verified" | "platform_webhook_created" | "platform_webhook_updated" | "platform_webhook_deleted" | "platform_webhook_secret_rotated" | "federation_identity_linked" | "user_token_login" | "session_revoked" | "sessions_revoked_all" | "mfa_challenge_created" | "mfa_challenge_failed" | "mfa_challenge_expired" | "mfa_challenge_rejected" | "mfa_verified" | "mfa_bypass_blocked" | "mfa_backup_code_regenerated" | "scim_connection_created" | "scim_connection_rotated" | "scim_connection_revoked" | "scim_authentication_failed" | "scim_access_denied" | "scim_group_created" | "scim_group_updated" | "scim_group_deleted";
 //# sourceMappingURL=types.d.ts.map

package/dist/services/events/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,uBAAuB,GACvB,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,6BAA6B,GAC7B,kCAAkC,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,2BAA2B,GAC3B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,iCAAiC,GACjC,4BAA4B,GAC5B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,GACtB,uBAAuB,GACvB,sBAAsB,GACtB,uBAAuB,GACvB,wBAAwB,GACxB,cAAc,GACd,oBAAoB,GACpB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,4BAA4B,GAC5B,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,uBAAuB,GACvB,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,kBAAkB,GAClB,+BAA+B,GAC/B,mCAAmC,GACnC,qCAAqC,GACrC,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,6BAA6B,GAC7B,kCAAkC,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,2BAA2B,GAC3B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,iCAAiC,GACjC,4BAA4B,GAC5B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,GACtB,uBAAuB,GACvB,sBAAsB,GACtB,uBAAuB,GACvB,wBAAwB,GACxB,cAAc,GACd,oBAAoB,GACpB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,4BAA4B,GAC5B,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,CAAC"}

package/dist/services/events/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAsGD,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAqB1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYnE"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA4GD,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAqB1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYnE"}

package/dist/services/events/validate.js

@@ -21,6 +21,12 @@ const VALID_EVENT_TYPES = new Set([
     "api_key_used",
     "service_account_created",
     "service_account_updated",
+    "magic_link_replayed",
+    "sms_otp_replayed",
+    "password_reset_token_replayed",
+    "service_account_certificate_bound",
+    "service_account_certificate_unbound",
+    "service_account_revoked",
     "unauthorized_access",
     "organization_created",
     "organization_updated",

package/dist/services/events/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,yBAAyB;IACzB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,kCAAkC;IAClC,oBAAoB;IACpB,oBAAoB;IACpB,yBAAyB;IACzB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,iCAAiC;IACjC,4BAA4B;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,sBAAsB;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,cAAc;IACd,oBAAoB;IACpB,6BAA6B;IAC7B,yBAAyB;IACzB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,yBAAyB;IACzB,yBAAyB;IACzB,qBAAqB;IACrB,kBAAkB;IAClB,+BAA+B;IAC/B,mCAAmC;IACnC,qCAAqC;IACrC,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,kCAAkC;IAClC,oBAAoB;IACpB,oBAAoB;IACpB,yBAAyB;IACzB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,iCAAiC;IACjC,4BAA4B;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,sBAAsB;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,cAAc;IACd,oBAAoB;IACpB,6BAA6B;IAC7B,yBAAyB;IACzB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/dist/services/magicLinks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"magicLinks.d.ts","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAG/D,wBAAgB,iBAAiB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIxE;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;;;;;;;GAUtF;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAsB/E;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}
+{"version":3,"file":"magicLinks.d.ts","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAK/D,wBAAgB,iBAAiB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIxE;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;;;;;;;GAUtF;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAiB/E;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/services/magicLinks.js

@@ -1,8 +1,10 @@
 import crypto from "node:crypto";
-import { eq, and, gt, isNull } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { magicLinks, users } from "../db/schema.js";
 import { config } from "../config.js";
+import { consumeMagicLinkRow } from "./singleUse.js";
+import { emit } from "./events/bus.js";
 export function generateMagicLink() {
     const token = crypto.randomBytes(48).toString("base64url");
     const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
@@ -22,15 +24,17 @@ export async function storeMagicLink(userId, tokenHash, expiresAt) {
 export async function consumeMagicLink(token) {
     const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
     const now = new Date();
-    const [record] = await db
-        .select()
-        .from(magicLinks)
-        .where(and(eq(magicLinks.tokenHash, tokenHash), gt(magicLinks.expiresAt, now), isNull(magicLinks.usedAt)))
-        .limit(1);
-    if (!record)
+    // Claim atomically. A conditional SELECT followed by an unconditional UPDATE
+    // would let any number of parallel redemptions all pass the check and all log
+    // in, so the write is the gate.
+    const result = await consumeMagicLinkRow(tokenHash, now);
+    if (result.outcome !== "consumed" || !result.record) {
+        if (result.reason === "replayed") {
+            emit({ type: "magic_link_replayed", payload: {} });
+        }
         return undefined;
-    await db.update(magicLinks).set({ usedAt: now }).where(eq(magicLinks.id, record.id));
-    const [user] = await db.select().from(users).where(eq(users.id, record.userId)).limit(1);
+    }
+    const [user] = await db.select().from(users).where(eq(users.id, result.record.userId)).limit(1);
     return user;
 }
 export function magicLinkExpiresAt() {

package/dist/services/magicLinks.js.map

@@ -1 +1 @@
-{"version":3,"file":"magicLinks.js","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,SAAe;IACrF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC;QACN,MAAM;QACN,SAAS;QACT,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EACnC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,EAC7B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAC1B,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAErF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"magicLinks.js","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,SAAe;IACrF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC;QACN,MAAM;QACN,SAAS;QACT,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,6EAA6E;IAC7E,8EAA8E;IAC9E,gCAAgC;IAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;AACrE,CAAC"}

package/dist/services/oauth2.d.ts

@@ -1,4 +1,4 @@
-import { oauth2AuthorizationCodes, type User, type Application } from "../db/schema.js";
+import { oauth2AuthorizationCodes, oauth2Consents, type User, type Application } from "../db/schema.js";
 import { type MfaAssertion } from "./tokens.js";
 export interface AuthorizationCodeInput {
     appId: string;
@@ -31,8 +31,78 @@ export declare function storeAuthorizationCode(input: AuthorizationCodeInput): P
     userId: string;
 }>;
 export declare function consumeAuthorizationCode(code: string, appId: string, redirectUri?: string): Promise<typeof oauth2AuthorizationCodes.$inferSelect | undefined>;
-export declare function verifyPKCE(challenge: string | null | undefined, method: string | null | undefined, verifier: string): boolean;
+/**
+ * Verify a PKCE code verifier against a stored challenge.
+ *
+ * `requireChallenge` exists because the previous shape of this function was the
+ * whole PKCE story at the token endpoint, and it was not a check at all:
+ *
+ * ```ts
+ * if (!challenge) return true;   // no challenge was registered -> accept
+ * ```
+ *
+ * A client that omitted `code_challenge` at `/authorize` and then sent any
+ * string as `code_verifier` at `/token` passed. The endpoint required a
+ * verifier to be *present*, so the requirement looked enforced while proving
+ * nothing. For a public client — an SPA or a mobile app that cannot hold a
+ * secret — PKCE is the only thing standing between an intercepted authorization
+ * code and a stolen account, so "optional" meant "unprotected".
+ *
+ * The two failure modes are now separated deliberately:
+ *  - no challenge and `requireChallenge` false: a confidential client that chose
+ *    not to use PKCE. Permitted, because it authenticates with a secret.
+ *  - a challenge but a mismatched or malformed verifier: always a failure.
+ */
+export declare function verifyPKCE(challenge: string | null | undefined, method: string | null | undefined, verifier: string | null | undefined, options?: {
+    requireChallenge?: boolean;
+}): boolean;
+/**
+ * A client that cannot keep a secret must use PKCE.
+ *
+ * Today every application has a non-null `client_secret_hash`, so this reduces to
+ * "the client has no usable secret" — which is the honest test regardless of how
+ * the column is populated, and stays correct if secretless public clients are
+ * introduced later.
+ */
+export declare function requiresPkce(clientSecretHash: string | null | undefined): boolean;
+/**
+ * Reduce requested scopes to the ones actually granted.
+ *
+ * The effective set is the intersection of what the client is registered to ask
+ * for, what it asked for, and what the user consented to. Previously the
+ * client's `scope` parameter was stored verbatim and the only filter applied was
+ * consent, so a client could put any string it liked into the issued token.
+ *
+ * Rejecting rather than silently dropping is deliberate: a client asking for
+ * something it was never registered for is a misconfiguration or an attempt to
+ * escalate, and quietly handing back a lesser scope set hides both. The error
+ * names the offending scope so the client can be fixed.
+ *
+ * An empty `allowedScopes` means "no restriction registered", which preserves
+ * every existing application. Once an application has an allowlist, it is
+ * enforced.
+ */
+export declare function resolveEffectiveScopes(input: {
+    requested: string[];
+    allowed: string[];
+    consented: string[] | null;
+}): {
+    ok: true;
+    scopes: string[];
+} | {
+    ok: false;
+    error: string;
+    scope: string;
+};
 export declare function hasConsent(userId: string, appId: string, requestedScopes: string[]): Promise<boolean>;
+/**
+ * The user's current consent record, or undefined if they have never consented
+ * or have revoked it.
+ *
+ * Kept separate from `hasConsent` because the scope intersection needs the
+ * granted set itself, not a yes/no answer to it.
+ */
+export declare function findConsent(userId: string, appId: string): Promise<typeof oauth2Consents.$inferSelect | undefined>;
 export declare function grantConsent(userId: string, appId: string, scopes: string[]): Promise<{
     appId: string;
     grantedAt: Date;

package/dist/services/oauth2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,EAIxB,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAA0D,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAExG,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,wBAAgB,yBAAyB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAI9E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB;;;;;;;;;;;;;;;GAqBzE;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,wBAAwB,CAAC,YAAY,GAAG,SAAS,CAAC,CAsBnE;AAED,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GACf,OAAO,CAKT;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;;;;;;;GAoBjF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhF;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM;;;;;;;KAKtD;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,GAAE;IACJ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,YAAY,CAAC;CACrB,oCAqCP;AAED,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlG;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAWlC"}
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,EACxB,cAAc,EAGd,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAA0D,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAExG,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,wBAAgB,yBAAyB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAI9E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB;;;;;;;;;;;;;;;GAqBzE;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,wBAAwB,CAAC,YAAY,GAAG,SAAS,CAAC,CAuBnE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,OAAO,CAYT;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEjF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC5B,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAiB/E;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,cAAc,CAAC,YAAY,GAAG,SAAS,CAAC,CAazD;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;;;;;;;GAoBjF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhF;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM;;;;;;;KAKtD;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,GAAE;IACJ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,YAAY,CAAC;CACrB,oCAwCP;AAED,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlG;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAWlC"}

package/dist/services/oauth2.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { eq, and, gt, isNull, or } from "drizzle-orm";
+import { eq, and, gt, isNull } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { oauth2AuthorizationCodes, oauth2Consents, applications, orgMemberships, } from "../db/schema.js";
 import { config } from "../config.js";
@@ -38,8 +38,11 @@ export async function consumeAuthorizationCode(code, appId, redirectUri) {
         gt(oauth2AuthorizationCodes.expiresAt, now),
         isNull(oauth2AuthorizationCodes.usedAt),
     ];
+    // Exact match, no exceptions. `redirect_uri` is required at /authorize, so
+    // there is always a stored value to compare against; tolerating a missing one
+    // here would let a stolen code be redeemed against any redirect URI.
     if (redirectUri) {
-        conditions.push(or(isNull(oauth2AuthorizationCodes.redirectUri), eq(oauth2AuthorizationCodes.redirectUri, redirectUri)));
+        conditions.push(eq(oauth2AuthorizationCodes.redirectUri, redirectUri));
     }
     const [record] = await db
         .update(oauth2AuthorizationCodes)
@@ -48,13 +51,92 @@ export async function consumeAuthorizationCode(code, appId, redirectUri) {
         .returning();
     return record;
 }
-export function verifyPKCE(challenge, method, verifier) {
-    if (!challenge)
-        return true;
+/**
+ * Verify a PKCE code verifier against a stored challenge.
+ *
+ * `requireChallenge` exists because the previous shape of this function was the
+ * whole PKCE story at the token endpoint, and it was not a check at all:
+ *
+ * ```ts
+ * if (!challenge) return true;   // no challenge was registered -> accept
+ * ```
+ *
+ * A client that omitted `code_challenge` at `/authorize` and then sent any
+ * string as `code_verifier` at `/token` passed. The endpoint required a
+ * verifier to be *present*, so the requirement looked enforced while proving
+ * nothing. For a public client — an SPA or a mobile app that cannot hold a
+ * secret — PKCE is the only thing standing between an intercepted authorization
+ * code and a stolen account, so "optional" meant "unprotected".
+ *
+ * The two failure modes are now separated deliberately:
+ *  - no challenge and `requireChallenge` false: a confidential client that chose
+ *    not to use PKCE. Permitted, because it authenticates with a secret.
+ *  - a challenge but a mismatched or malformed verifier: always a failure.
+ */
+export function verifyPKCE(challenge, method, verifier, options = {}) {
+    if (!challenge) {
+        // No challenge to verify against. Only acceptable when PKCE was not
+        // required for this client.
+        return !options.requireChallenge;
+    }
+    if (typeof verifier !== "string" || verifier === "")
+        return false;
     if (method?.toLowerCase() !== "s256")
         return false;
     const hash = crypto.createHash("sha256").update(verifier).digest("base64url");
-    return hash === challenge;
+    return timingSafeEqual(hash, challenge);
+}
+/** Constant-time comparison, so a verifier cannot be recovered byte by byte. */
+function timingSafeEqual(a, b) {
+    const bufA = Buffer.from(a, "utf8");
+    const bufB = Buffer.from(b, "utf8");
+    if (bufA.length !== bufB.length)
+        return false;
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+/**
+ * A client that cannot keep a secret must use PKCE.
+ *
+ * Today every application has a non-null `client_secret_hash`, so this reduces to
+ * "the client has no usable secret" — which is the honest test regardless of how
+ * the column is populated, and stays correct if secretless public clients are
+ * introduced later.
+ */
+export function requiresPkce(clientSecretHash) {
+    return !clientSecretHash || clientSecretHash === "";
+}
+/**
+ * Reduce requested scopes to the ones actually granted.
+ *
+ * The effective set is the intersection of what the client is registered to ask
+ * for, what it asked for, and what the user consented to. Previously the
+ * client's `scope` parameter was stored verbatim and the only filter applied was
+ * consent, so a client could put any string it liked into the issued token.
+ *
+ * Rejecting rather than silently dropping is deliberate: a client asking for
+ * something it was never registered for is a misconfiguration or an attempt to
+ * escalate, and quietly handing back a lesser scope set hides both. The error
+ * names the offending scope so the client can be fixed.
+ *
+ * An empty `allowedScopes` means "no restriction registered", which preserves
+ * every existing application. Once an application has an allowlist, it is
+ * enforced.
+ */
+export function resolveEffectiveScopes(input) {
+    const requested = [...new Set(input.requested.filter(Boolean))];
+    const allowed = new Set(input.allowed);
+    const consented = input.consented === null ? null : new Set(input.consented);
+    const effective = [];
+    for (const scope of requested) {
+        if (allowed.size > 0 && !allowed.has(scope)) {
+            return { ok: false, error: "invalid_scope", scope };
+        }
+        if (consented && !consented.has(scope)) {
+            return { ok: false, error: "invalid_scope", scope };
+        }
+        effective.push(scope);
+    }
+    return { ok: true, scopes: effective };
 }
 export async function hasConsent(userId, appId, requestedScopes) {
     if (requestedScopes.length === 0)
@@ -69,6 +151,21 @@ export async function hasConsent(userId, appId, requestedScopes) {
     const granted = new Set(consent.scopes);
     return requestedScopes.every((scope) => granted.has(scope));
 }
+/**
+ * The user's current consent record, or undefined if they have never consented
+ * or have revoked it.
+ *
+ * Kept separate from `hasConsent` because the scope intersection needs the
+ * granted set itself, not a yes/no answer to it.
+ */
+export async function findConsent(userId, appId) {
+    const [consent] = await db
+        .select()
+        .from(oauth2Consents)
+        .where(and(eq(oauth2Consents.appId, appId), eq(oauth2Consents.userId, userId), isNull(oauth2Consents.revokedAt)))
+        .limit(1);
+    return consent;
+}
 export async function grantConsent(userId, appId, scopes) {
     const now = new Date();
     const [record] = await db
@@ -114,6 +211,9 @@ export async function createTokenResponse(user, app, scopes, opts = {}) {
         appId: app.id,
         orgId: app.orgId,
         clientId: app.clientId,
+        // The granted set is persisted on the refresh token so it survives rotation
+        // instead of being dropped at the first refresh.
+        ...(scopes.length > 0 ? { scopes } : {}),
         ...(opts.mfaFactor ? { mfaFactor: opts.mfaFactor } : {}),
     };
     const tokenSet = await createTokenSet(user, opts.ip, opts.userAgent, tokenOpts, opts.deviceFingerprint);