@jini-ai/cms 0.1.0

package/dist/identity/agent-tools.d.ts

@@ -0,0 +1,101 @@
+/**
+ * @file The identity (users/roles) agent-tool catalog — this domain's instance of the
+ * per-domain `agent-tools.ts` convention already used by `features/content-types`,
+ * `features/database`, and `features/recovery`.
+ *
+ * Purpose:
+ * A static, in-process catalog describing every agent-callable identity tool and the permission
+ * each one carries. `assistant/tool-registrations.ts` maps these entries onto handlers that call
+ * `grant-service.ts` / `admin-crud-service.ts` — the SAME functions the human admin routes under
+ * `server/routes/admin/users/` call. There is deliberately no path from a tool to the database
+ * that skips those functions, because they are where the domain's authorization gates live.
+ *
+ * WHAT THIS CATALOG DELIBERATELY OMITS, and why (identity is the escalation-dense
+ * surface, so the omissions are part of the design rather than a backlog):
+ *
+ *   - `resetUserPassword` (REQ-17). The one identity transition that sets a credential on
+ *     an account the caller does not own, and — unlike `ASSIGN_ROLE`/`ATTACH_POLICY` — it carries
+ *     NO INV-07 grant-authority clamp. A `user.manage` holder may reset the OWNER's password and
+ *     then authenticate as owner, so it is a full account-takeover primitive rather than a
+ *     permission grant. An assistant is reachable by prompt injection through ordinary operator
+ *     content (a form submission, a comment) in a way a human clicking the admin button is not.
+ *     Left human-UI-only, mirroring `features/content-types/agent-tools.ts`'s reasoning for never
+ *     exposing the destructive-cleanup confirm() step to an agent.
+ *   - `writePolicyPermission` (INV-07). This is the one policy transition still
+ *     deliberately excluded, and on different grounds than the five wired below: unlike
+ *     `identity_role_assign`/`identity_policy_attach`, which each confer whatever a role/policy
+ *     ALREADY carries onto exactly one named target principal, `writePolicyPermission` MUTATES a
+ *     shared, reusable `PolicyRecord` in place — and any non-built-in, non-frozen policy can
+ *     already be attached to an arbitrary number of OTHER users via `identity_policy_attach` (or to
+ *     roles via the seed-only `role_policies` table) before this call happens. The INV-07 clamp
+ *     (`assertGrantClamp`) still bounds WHAT the caller can add — only a permission it itself holds
+ *     unconstrained — but it says nothing about WHO ends up holding it: every principal already
+ *     attached to that policy inherits the new permission the instant it is written, invisibly to
+ *     whoever asked for the one change. That is a materially different blast-radius shape than the
+ *     single-target primitives this catalog does wire (see the tool descriptions below), and exactly
+ *     the "grant that ripples to principals never named in the call" class this pass's directive
+ *     asks to be excluded and explained rather than wired reflexively. Left human-UI-only, where
+ *     `apps/admin/src/sections/Roles.tsx`'s "Add permission" control still lives.
+ *
+ * Every OTHER policy transition (`identity_policy_list`, `identity_policy_create`,
+ * `identity_policy_update`, `identity_policy_delete`, `identity_policy_attach`) IS wired below,
+ * mirroring the risk profile this catalog already accepted for the equivalent role transitions
+ * (`identity_role_list`/`identity_role_create`/`identity_role_rename`/`identity_role_delete`/
+ * `identity_role_assign`) — see each entry's own description for why its shape matches its role
+ * counterpart exactly.
+ *
+ *   - Role REVOCATION. Not a choice: no such operation exists anywhere in this codebase.
+ *     `PrincipalRoleRepoPort` (`ports.ts`) declares `listByPrincipalId`, `save`, and `listByRoleId`
+ *     — there is no `delete`, and no service function unassigns a role. A tool cannot be written
+ *     against an operation the domain does not have, and adding a repo-level delete here to
+ *     manufacture one would be exactly the "skip the service layer" failure this work exists to
+ *     close. The same is true of "detach a policy from a principal" — `PrincipalPolicyRepoPort`
+ *     has no delete either, so `identity_policy_attach` is one-directional exactly like
+ *     `identity_role_assign`.
+ *
+ * Architectural role:
+ * `identity` library declaration only. Performs no I/O and no enforcement — `authorize()` and each
+ * service function's own caller-permission gate enforce at call time. The local
+ * `AgentToolSideEffect`/`AgentToolActorClassRule`/`AgentToolDefinition` declarations mirror the
+ * house convention: `features/database/agent-tools.ts` and `features/recovery/agent-tools.ts` each
+ * declare their own structurally identical copy rather than importing another module's, so a
+ * low-level library like `identity` never acquires a dependency on a feature module.
+ */
+export type AgentToolSideEffect = "none" | "mutates-durable-state" | "mints-token";
+export type AgentToolActorClassRule = "confirmer-must-equal-own-delegatedBy" | "user-only" | "none";
+export interface AgentToolDefinition {
+    name: string;
+    description: string;
+    sideEffects: AgentToolSideEffect;
+    /**
+     * The permission the tool's underlying service function gates on.
+     *
+     * `orPermission` is present only where that gate is genuinely an OR — three identity transitions
+     * accept `user.manage` OR `member.manage` (the admin-onboarding gate, `grant-service.ts`'s
+     * `assertCallerHasAnyPermission`). Recording only the first would make this catalog quietly
+     * disagree with the code it describes; `__tests__/agent-tools.authorization.test.ts` derives its
+     * expected permission set from BOTH fields, so an undeclared OR fails the suite.
+     */
+    authorization: {
+        permission: string;
+        orPermission?: string;
+    };
+    actorClassRule?: AgentToolActorClassRule;
+    /**
+     * JSON Schema for this tool's `input`, published to the model via `ToolDescriptor.inputSchema`
+     * AND interpreted as the enforcing boundary parser by `agent-tool-input.ts`.
+     *
+     * Required, not optional as in `features/content-types/agent-tools.ts`: every entry here is
+     * wired, so there is no unwired entry whose input shape is undesigned.
+     */
+    inputSchema: Readonly<Record<string, unknown>>;
+}
+/**
+ * The identity domain's fixed agent-tool catalog.
+ *
+ * Ordered read-tools-first because that is the order a correct multi-step call chain uses: a model
+ * cannot assign a role without a `roleId`, and the only way to learn one for an EXISTING role
+ * (including the four seeded built-ins) is `identity_role_list`.
+ */
+export declare const identityAgentToolCatalog: AgentToolDefinition[];
+//# sourceMappingURL=agent-tools.d.ts.map

package/dist/identity/agent-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tools.d.ts","sourceRoot":"","sources":["../../src/identity/agent-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,uBAAuB,GAAG,aAAa,CAAC;AAEnF,MAAM,MAAM,uBAAuB,GAAG,sCAAsC,GAAG,WAAW,GAAG,MAAM,CAAC;AAEpG,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;;;;;OAQG;IACH,aAAa,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC;;;;;;OAMG;IACH,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAChD;AAgDD;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,mBAAmB,EAiMzD,CAAC"}

package/dist/identity/agent-tools.js

@@ -0,0 +1,290 @@
+/**
+ * @file The identity (users/roles) agent-tool catalog — this domain's instance of the
+ * per-domain `agent-tools.ts` convention already used by `features/content-types`,
+ * `features/database`, and `features/recovery`.
+ *
+ * Purpose:
+ * A static, in-process catalog describing every agent-callable identity tool and the permission
+ * each one carries. `assistant/tool-registrations.ts` maps these entries onto handlers that call
+ * `grant-service.ts` / `admin-crud-service.ts` — the SAME functions the human admin routes under
+ * `server/routes/admin/users/` call. There is deliberately no path from a tool to the database
+ * that skips those functions, because they are where the domain's authorization gates live.
+ *
+ * WHAT THIS CATALOG DELIBERATELY OMITS, and why (identity is the escalation-dense
+ * surface, so the omissions are part of the design rather than a backlog):
+ *
+ *   - `resetUserPassword` (REQ-17). The one identity transition that sets a credential on
+ *     an account the caller does not own, and — unlike `ASSIGN_ROLE`/`ATTACH_POLICY` — it carries
+ *     NO INV-07 grant-authority clamp. A `user.manage` holder may reset the OWNER's password and
+ *     then authenticate as owner, so it is a full account-takeover primitive rather than a
+ *     permission grant. An assistant is reachable by prompt injection through ordinary operator
+ *     content (a form submission, a comment) in a way a human clicking the admin button is not.
+ *     Left human-UI-only, mirroring `features/content-types/agent-tools.ts`'s reasoning for never
+ *     exposing the destructive-cleanup confirm() step to an agent.
+ *   - `writePolicyPermission` (INV-07). This is the one policy transition still
+ *     deliberately excluded, and on different grounds than the five wired below: unlike
+ *     `identity_role_assign`/`identity_policy_attach`, which each confer whatever a role/policy
+ *     ALREADY carries onto exactly one named target principal, `writePolicyPermission` MUTATES a
+ *     shared, reusable `PolicyRecord` in place — and any non-built-in, non-frozen policy can
+ *     already be attached to an arbitrary number of OTHER users via `identity_policy_attach` (or to
+ *     roles via the seed-only `role_policies` table) before this call happens. The INV-07 clamp
+ *     (`assertGrantClamp`) still bounds WHAT the caller can add — only a permission it itself holds
+ *     unconstrained — but it says nothing about WHO ends up holding it: every principal already
+ *     attached to that policy inherits the new permission the instant it is written, invisibly to
+ *     whoever asked for the one change. That is a materially different blast-radius shape than the
+ *     single-target primitives this catalog does wire (see the tool descriptions below), and exactly
+ *     the "grant that ripples to principals never named in the call" class this pass's directive
+ *     asks to be excluded and explained rather than wired reflexively. Left human-UI-only, where
+ *     `apps/admin/src/sections/Roles.tsx`'s "Add permission" control still lives.
+ *
+ * Every OTHER policy transition (`identity_policy_list`, `identity_policy_create`,
+ * `identity_policy_update`, `identity_policy_delete`, `identity_policy_attach`) IS wired below,
+ * mirroring the risk profile this catalog already accepted for the equivalent role transitions
+ * (`identity_role_list`/`identity_role_create`/`identity_role_rename`/`identity_role_delete`/
+ * `identity_role_assign`) — see each entry's own description for why its shape matches its role
+ * counterpart exactly.
+ *
+ *   - Role REVOCATION. Not a choice: no such operation exists anywhere in this codebase.
+ *     `PrincipalRoleRepoPort` (`ports.ts`) declares `listByPrincipalId`, `save`, and `listByRoleId`
+ *     — there is no `delete`, and no service function unassigns a role. A tool cannot be written
+ *     against an operation the domain does not have, and adding a repo-level delete here to
+ *     manufacture one would be exactly the "skip the service layer" failure this work exists to
+ *     close. The same is true of "detach a policy from a principal" — `PrincipalPolicyRepoPort`
+ *     has no delete either, so `identity_policy_attach` is one-directional exactly like
+ *     `identity_role_assign`.
+ *
+ * Architectural role:
+ * `identity` library declaration only. Performs no I/O and no enforcement — `authorize()` and each
+ * service function's own caller-permission gate enforce at call time. The local
+ * `AgentToolSideEffect`/`AgentToolActorClassRule`/`AgentToolDefinition` declarations mirror the
+ * house convention: `features/database/agent-tools.ts` and `features/recovery/agent-tools.ts` each
+ * declare their own structurally identical copy rather than importing another module's, so a
+ * low-level library like `identity` never acquires a dependency on a feature module.
+ */
+/** A workspace-scoped principal id, as returned by `identity_user_list` or `identity_user_create`. */
+const PRINCIPAL_ID_SCHEMA = {
+    type: "string",
+    minLength: 1,
+    description: "The user's principalId. Get it from identity_user_list, or from identity_user_create's result.",
+};
+/** A workspace-scoped role id, as returned by `identity_role_list` or `identity_role_create`. */
+const ROLE_ID_SCHEMA = {
+    type: "string",
+    minLength: 1,
+    description: "The role's id. Get it from identity_role_list, or from identity_role_create's result.",
+};
+/** A workspace-scoped policy id, as returned by `identity_policy_list` or `identity_policy_create`. */
+const POLICY_ID_SCHEMA = {
+    type: "string",
+    minLength: 1,
+    description: "The policy's id. Get it from identity_policy_list, or from identity_policy_create's result.",
+};
+/** A required, non-blank human-authored name. `minLength` is published because the service
+ * functions reject a blank/whitespace-only name — leaving it unstated would show the model a
+ * contract wider than the one enforced. */
+const REQUIRED_NAME_SCHEMA = {
+    type: "string",
+    minLength: 1,
+    description: "Human-readable name. Must not be blank or whitespace-only.",
+};
+/** The input shape of the three read tools — they take no arguments at all. */
+const NO_INPUT_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    required: [],
+    properties: {},
+};
+/** `{principalId}` — shared by the two principal-status transitions, which take exactly that. */
+const PRINCIPAL_ONLY_INPUT_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    required: ["principalId"],
+    properties: { principalId: PRINCIPAL_ID_SCHEMA },
+};
+/**
+ * The identity domain's fixed agent-tool catalog.
+ *
+ * Ordered read-tools-first because that is the order a correct multi-step call chain uses: a model
+ * cannot assign a role without a `roleId`, and the only way to learn one for an EXISTING role
+ * (including the four seeded built-ins) is `identity_role_list`.
+ */
+export const identityAgentToolCatalog = [
+    {
+        name: "identity_user_list",
+        description: "Lists the workspace's human operator users with their principalId, username, status, and assigned role ids. Read-only. Call this to find a user's principalId before updating, disabling, enabling, or assigning a role to them.",
+        sideEffects: "none",
+        authorization: { permission: "user.manage", orPermission: "member.manage" },
+        inputSchema: NO_INPUT_SCHEMA,
+    },
+    {
+        name: "identity_role_list",
+        description: "Lists the workspace's roles (the four built-ins plus any custom ones) with their id, name, and isBuiltin flag. Read-only. Call this to find a roleId before assigning, renaming, or deleting a role.",
+        sideEffects: "none",
+        authorization: { permission: "role.manage" },
+        inputSchema: NO_INPUT_SCHEMA,
+    },
+    {
+        name: "identity_policy_list",
+        description: "Lists the workspace's policies (built-ins plus any custom ones) with their id, name, description, isBuiltin, and isFrozen flags. Read-only. Call this to find a policyId before renaming, deleting, or attaching a policy.",
+        sideEffects: "none",
+        authorization: { permission: "role.manage" },
+        inputSchema: NO_INPUT_SCHEMA,
+    },
+    {
+        name: "identity_user_create",
+        description: "Creates a new human operator user, minting a new principal and its credential row together. The new user starts with NO roles and therefore no permissions — grant access afterwards with identity_role_assign. Fails if the username is already taken.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "user.manage", orPermission: "member.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["username", "password"],
+            properties: {
+                username: {
+                    type: "string",
+                    minLength: 1,
+                    description: "Login name. Stored lowercased and Unicode-NFC-normalized, and unique per workspace on that normalized form.",
+                },
+                password: {
+                    type: "string",
+                    minLength: 1,
+                    description: "Initial password. Hashed with argon2id before storage; never stored or returned in plaintext.",
+                },
+                email: { type: "string", description: "Optional contact email." },
+            },
+        },
+    },
+    {
+        name: "identity_user_update_email",
+        description: "Sets or clears an existing user's email address. Omitting 'email' (or passing an empty string) CLEARS the stored value rather than leaving it unchanged. Username and password are not editable through this tool.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "user.manage", orPermission: "member.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["principalId"],
+            properties: {
+                principalId: PRINCIPAL_ID_SCHEMA,
+                email: { type: "string", description: "The new email. Omit it or pass an empty string to clear the stored value." },
+            },
+        },
+    },
+    {
+        name: "identity_user_disable",
+        description: "Disables a user, revoking their access. Principals are never hard-deleted because the audit trail references them, so this is how a user is removed. Refuses to disable the seeded owner, and refuses any disable that would leave the workspace with no active owner. Already-disabled is a no-op.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "user.manage" },
+        inputSchema: PRINCIPAL_ONLY_INPUT_SCHEMA,
+    },
+    {
+        name: "identity_user_enable",
+        description: "Re-enables a previously disabled human user. Already-active is a no-op. Only kind='user' principals can be enabled this way.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "user.manage" },
+        inputSchema: PRINCIPAL_ONLY_INPUT_SCHEMA,
+    },
+    {
+        name: "identity_role_create",
+        description: "Creates a new custom role. The role starts with no policies attached and therefore confers no permissions until one is attached, which is not an agent-callable operation.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "role.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name"],
+            properties: { name: REQUIRED_NAME_SCHEMA },
+        },
+    },
+    {
+        name: "identity_role_assign",
+        description: "Assigns an existing role to an existing user. This is the step that actually grants permissions. The caller can only confer permissions it already holds itself unconstrained, so assigning a role more powerful than the caller's own is refused.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "role.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["principalId", "roleId"],
+            properties: { principalId: PRINCIPAL_ID_SCHEMA, roleId: ROLE_ID_SCHEMA },
+        },
+    },
+    {
+        name: "identity_role_rename",
+        description: "Renames a custom role. Built-in roles cannot be renamed — relabelling 'viewer' to read as trusted is a social-engineering variant of privilege escalation, so it is refused.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "role.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["roleId", "name"],
+            properties: { roleId: ROLE_ID_SCHEMA, name: REQUIRED_NAME_SCHEMA },
+        },
+    },
+    {
+        name: "identity_role_delete",
+        description: "Deletes a custom role. Built-in roles cannot be deleted. A role still assigned to at least one user is refused — this system has no unassign operation, so a role in use cannot be removed at all.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "role.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["roleId"],
+            properties: { roleId: ROLE_ID_SCHEMA },
+        },
+    },
+    {
+        name: "identity_policy_create",
+        description: "Creates a new custom policy. The policy starts with no permissions and therefore confers none until permissions are added, which is not an agent-callable operation — identity_policy_write_permission is deliberately not wired (see this file's own header comment). Attaching a freshly created, still-empty policy to anyone is a no-op.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "role.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name"],
+            properties: {
+                name: REQUIRED_NAME_SCHEMA,
+                description: { type: "string", description: "Optional human-readable description." },
+            },
+        },
+    },
+    {
+        name: "identity_policy_update",
+        description: "Renames and/or re-describes a custom policy. Built-in and frozen policies are refused. At least one of 'name'/'description' must be supplied.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "role.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["policyId"],
+            properties: {
+                policyId: POLICY_ID_SCHEMA,
+                name: { type: "string", minLength: 1, description: "New name. Omit to leave unchanged." },
+                description: { type: "string", description: "New description. Omit to leave unchanged." },
+            },
+        },
+    },
+    {
+        name: "identity_policy_delete",
+        description: "Deletes a custom policy. Built-in and frozen policies cannot be deleted. A policy still referenced by at least one role or attached to at least one user is refused — deletion fails safe (it only ever removes access, never orphans a reference) exactly like identity_role_delete.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "role.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["policyId"],
+            properties: { policyId: POLICY_ID_SCHEMA },
+        },
+    },
+    {
+        name: "identity_policy_attach",
+        description: "Attaches an existing policy directly to an existing user, granting every permission the policy carries. This is the direct-grant counterpart to identity_role_assign, targets exactly one named user per call, and carries the identical INV-07 clamp: the caller can only confer permissions it already holds itself unconstrained, so attaching a policy more powerful than the caller's own is refused. There is no detach operation.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "role.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["principalId", "policyId"],
+            properties: { principalId: PRINCIPAL_ID_SCHEMA, policyId: POLICY_ID_SCHEMA },
+        },
+    },
+];
+//# sourceMappingURL=agent-tools.js.map

package/dist/identity/agent-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tools.js","sourceRoot":"","sources":["../../src/identity/agent-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AA+BH,sGAAsG;AACtG,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,CAAC;IACZ,WAAW,EAAE,gGAAgG;CACrG,CAAC;AAEX,iGAAiG;AACjG,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,CAAC;IACZ,WAAW,EAAE,uFAAuF;CAC5F,CAAC;AAEX,uGAAuG;AACvG,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,CAAC;IACZ,WAAW,EAAE,6FAA6F;CAClG,CAAC;AAEX;;2CAE2C;AAC3C,MAAM,oBAAoB,GAAG;IAC3B,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,CAAC;IACZ,WAAW,EAAE,4DAA4D;CACjE,CAAC;AAEX,+EAA+E;AAC/E,MAAM,eAAe,GAAG;IACtB,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,EAAE;CACN,CAAC;AAEX,iGAAiG;AACjG,MAAM,2BAA2B,GAAG;IAClC,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,aAAa,CAAC;IACzB,UAAU,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;CACxC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA0B;IAC7D;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,kOAAkO;QACpO,WAAW,EAAE,MAAM;QACnB,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE;QAC3E,WAAW,EAAE,eAAe;KAC7B;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,sMAAsM;QACxM,WAAW,EAAE,MAAM;QACnB,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE,eAAe;KAC7B;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,4NAA4N;QAC9N,WAAW,EAAE,MAAM;QACnB,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE,eAAe;KAC7B;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,yPAAyP;QAC3P,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE;QAC3E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;YAClC,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EAAE,6GAA6G;iBAC3H;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EAAE,+FAA+F;iBAC7G;gBACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yBAAyB,EAAE;aAClE;SACF;KACF;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,oNAAoN;QACtN,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE;QAC3E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE;gBACV,WAAW,EAAE,mBAAmB;gBAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2EAA2E,EAAE;aACpH;SACF;KACF;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,qSAAqS;QACvS,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,8HAA8H;QAChI,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,4KAA4K;QAC9K,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,UAAU,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE;SAC3C;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,oPAAoP;QACtP,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;YACnC,UAAU,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,EAAE;SACzE;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,8KAA8K;QAChL,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC5B,UAAU,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE;SACnE;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,oMAAoM;QACtM,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,QAAQ,CAAC;YACpB,UAAU,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;SACvC;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,8UAA8U;QAChV,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,UAAU,EAAE;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;aACrF;SACF;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,+IAA+I;QACjJ,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,UAAU,EAAE;gBACV,QAAQ,EAAE,gBAAgB;gBAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE;gBACzF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2CAA2C,EAAE;aAC1F;SACF;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,uRAAuR;QACzR,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,UAAU,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;SAC3C;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,0aAA0a;QAC5a,WAAW,EAAE,uBAAuB;QACpC,aAAa,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;QAC5C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC;YACrC,UAAU,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;SAC7E;KACF;CACF,CAAC"}

package/dist/identity/auth-service.d.ts

@@ -0,0 +1,87 @@
+import type { ClockPort, IdGeneratorPort, ISODateTime, UUID } from "../core/ports.js";
+import type { IdentityRepos, PasswordHasherPort } from "./ports.js";
+import { type PrincipalRecord, type SessionRecord } from "./types.js";
+/**
+ * @file Login / logout / session validation (REQ-06, state.spec `LOGIN`/`LOGOUT`).
+ *
+ * Purpose:
+ * The credential-verification + session-lifecycle surface `middleware/dev-auth.ts`
+ * wires into HTTP. Session tokens are hashed with SHA-256 before storage — the
+ * same technique `members/write-service.ts` uses for magic-link/member-session
+ * tokens (INV-05: the raw token is never persisted). Password verification is
+ * argon2id (`hasher.ts`), never a raw comparison.
+ *
+ * Architectural role:
+ * Ordinary core functions (like `updatePost`/`membersWriteService`), not a
+ * port — session/credential logic has one implementation.
+ */
+/** RT-004/behavior.spec §4: absolute session lifetime, fixed at creation. */
+export declare const SESSION_TTL_MS: number;
+export interface AuthServiceDeps {
+    repos: IdentityRepos;
+    hasher: PasswordHasherPort;
+    clock: ClockPort;
+    idGen: IdGeneratorPort;
+}
+/**
+ * Verify `username`+`password` for an `active` principal and mint a session
+ * (AC-02, REQ-06). Constant-shaped failure: a nonexistent username, a
+ * disabled principal, and a wrong password are all `AuthInvalidCredentialsError`
+ * with the same message — no user-enumeration signal.
+ *
+ * @complexity O(1) — one username lookup, one principal lookup, one hash
+ * verify, one session write, one `lastLoginAt` write.
+ * @overallScore 100
+ */
+export declare function login(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        username: string;
+        password: string;
+        ip?: string;
+        userAgent?: string;
+    };
+}): Promise<{
+    principal: PrincipalRecord;
+    session: SessionRecord;
+    rawToken: string;
+}>;
+/**
+ * Resolve a session cookie's raw token to its principal, applying every
+ * fail-closed check server-side (EC-02/EC-03/EC-13, AC-05/AC-20): unknown
+ * token, revoked, past absolute `expiresAt`, or a disabled bound principal
+ * all resolve to `null` (the caller maps that to 401 `UNAUTHENTICATED` and
+ * never reaches `authorize()`).
+ *
+ * @complexity O(1) — one token-hash lookup, one principal lookup.
+ * @overallScore 100
+ */
+export declare function validateSession(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        rawToken: string;
+        nowIso?: ISODateTime;
+    };
+}): Promise<{
+    principal: PrincipalRecord;
+    session: SessionRecord;
+} | null>;
+/** Revoke the session bound to `rawToken`. Idempotent — already-revoked/unknown is a no-op. */
+export declare function logout(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        rawToken: string;
+    };
+}): Promise<void>;
+/** The introspection surface for `AUTH_ME` (REQ-07): dotted permission strings, `["*"]` for owner. */
+export declare function getEffectivePermissions(required: {
+    deps: IdentityRepos;
+    input: {
+        workspaceId: UUID;
+        principalId: UUID;
+    };
+}): Promise<string[]>;
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/identity/auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../src/identity/auth-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEtF,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAA+B,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGnG;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,cAAc,QAA2B,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;CACxB;AAeD;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnG,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA0CpF;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE;IAC9C,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;CACtE,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAAG,IAAI,CAAC,CAqBzE;AAED,+FAA+F;AAC/F,wBAAsB,MAAM,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAED,sGAAsG;AACtG,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE;IACtD,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,IAAI,CAAA;KAAE,CAAC;CACjD,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAapB"}

package/dist/identity/auth-service.js

@@ -0,0 +1,141 @@
+import { createHash, randomBytes } from "node:crypto";
+import { resolveEffectivePermissions } from "./authorize.js";
+import { AuthInvalidCredentialsError } from "./types.js";
+import { normalizeUsername } from "./username.js";
+/**
+ * @file Login / logout / session validation (REQ-06, state.spec `LOGIN`/`LOGOUT`).
+ *
+ * Purpose:
+ * The credential-verification + session-lifecycle surface `middleware/dev-auth.ts`
+ * wires into HTTP. Session tokens are hashed with SHA-256 before storage — the
+ * same technique `members/write-service.ts` uses for magic-link/member-session
+ * tokens (INV-05: the raw token is never persisted). Password verification is
+ * argon2id (`hasher.ts`), never a raw comparison.
+ *
+ * Architectural role:
+ * Ordinary core functions (like `updatePost`/`membersWriteService`), not a
+ * port — session/credential logic has one implementation.
+ */
+/** RT-004/behavior.spec §4: absolute session lifetime, fixed at creation. */
+export const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** SHA-256 hex digest of a raw bearer token (mirrors `members/write-service.ts`'s `hashToken`). */
+function hashToken(rawToken) {
+    return createHash("sha256").update(rawToken).digest("hex");
+}
+function newRawToken() {
+    return randomBytes(32).toString("hex");
+}
+function isoPlusMs(nowIso, ms) {
+    return new Date(new Date(nowIso).getTime() + ms).toISOString();
+}
+/**
+ * Verify `username`+`password` for an `active` principal and mint a session
+ * (AC-02, REQ-06). Constant-shaped failure: a nonexistent username, a
+ * disabled principal, and a wrong password are all `AuthInvalidCredentialsError`
+ * with the same message — no user-enumeration signal.
+ *
+ * @complexity O(1) — one username lookup, one principal lookup, one hash
+ * verify, one session write, one `lastLoginAt` write.
+ * @overallScore 100
+ */
+export async function login(required) {
+    const { deps, input } = required;
+    const username = normalizeUsername(input.username);
+    if (!username || !input.password) {
+        throw new AuthInvalidCredentialsError("invalid username or password");
+    }
+    const userRow = await deps.repos.users.findByUsername({ workspaceId: input.workspaceId, username });
+    if (!userRow) {
+        throw new AuthInvalidCredentialsError("invalid username or password");
+    }
+    const principal = await deps.repos.principals.findById({
+        workspaceId: input.workspaceId,
+        id: userRow.principalId,
+    });
+    if (!principal || principal.status !== "active") {
+        throw new AuthInvalidCredentialsError("invalid username or password");
+    }
+    const passwordOk = await deps.hasher.verify(userRow.passwordHash, input.password);
+    if (!passwordOk) {
+        throw new AuthInvalidCredentialsError("invalid username or password");
+    }
+    const nowIso = deps.clock.nowIso();
+    const rawToken = newRawToken();
+    const session = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        principalId: principal.id,
+        tokenHash: hashToken(rawToken),
+        createdAt: nowIso,
+        expiresAt: isoPlusMs(nowIso, SESSION_TTL_MS),
+        ip: input.ip,
+        userAgent: input.userAgent,
+    };
+    await deps.repos.sessions.save(session);
+    await deps.repos.users.save({ ...userRow, lastLoginAt: nowIso });
+    return { principal, session, rawToken };
+}
+/**
+ * Resolve a session cookie's raw token to its principal, applying every
+ * fail-closed check server-side (EC-02/EC-03/EC-13, AC-05/AC-20): unknown
+ * token, revoked, past absolute `expiresAt`, or a disabled bound principal
+ * all resolve to `null` (the caller maps that to 401 `UNAUTHENTICATED` and
+ * never reaches `authorize()`).
+ *
+ * @complexity O(1) — one token-hash lookup, one principal lookup.
+ * @overallScore 100
+ */
+export async function validateSession(required) {
+    const { deps, input } = required;
+    const nowIso = input.nowIso ?? deps.clock.nowIso();
+    const session = await deps.repos.sessions.findByTokenHash({
+        workspaceId: input.workspaceId,
+        tokenHash: hashToken(input.rawToken),
+    });
+    if (!session)
+        return null;
+    if (session.revokedAt)
+        return null;
+    // EC-13/AC-20: past absolute expiry is treated as revoked, never reaching authorize().
+    if (session.expiresAt <= nowIso)
+        return null;
+    const principal = await deps.repos.principals.findById({
+        workspaceId: input.workspaceId,
+        id: session.principalId,
+    });
+    // EC-02: a disabled principal's live session stops validating immediately.
+    if (!principal || principal.status !== "active")
+        return null;
+    return { principal, session };
+}
+/** Revoke the session bound to `rawToken`. Idempotent — already-revoked/unknown is a no-op. */
+export async function logout(required) {
+    const { deps, input } = required;
+    const session = await deps.repos.sessions.findByTokenHash({
+        workspaceId: input.workspaceId,
+        tokenHash: hashToken(input.rawToken),
+    });
+    if (!session || session.revokedAt)
+        return;
+    await deps.repos.sessions.revoke({
+        workspaceId: input.workspaceId,
+        id: session.id,
+        revokedAt: deps.clock.nowIso(),
+    });
+}
+/** The introspection surface for `AUTH_ME` (REQ-07): dotted permission strings, `["*"]` for owner. */
+export async function getEffectivePermissions(required) {
+    const rows = await resolveEffectivePermissions({
+        deps: {
+            principals: required.deps.principals,
+            principalRoles: required.deps.principalRoles,
+            rolePolicies: required.deps.rolePolicies,
+            principalPolicies: required.deps.principalPolicies,
+            policyPermissions: required.deps.policyPermissions,
+        },
+        principalId: required.input.principalId,
+        workspaceId: required.input.workspaceId,
+    });
+    return [...new Set(rows.map((row) => row.permission))];
+}
+//# sourceMappingURL=auth-service.js.map

package/dist/identity/auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../../src/identity/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,2BAA2B,EAA4C,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AASvD,mGAAmG;AACnG,SAAS,SAAS,CAAC,QAAgB;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,MAAmB,EAAE,EAAU;IAChD,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAG3B;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEnD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,2BAA2B,CAAC,8BAA8B,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,2BAA2B,CAAC,8BAA8B,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,EAAE,EAAE,OAAO,CAAC,WAAW;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,2BAA2B,CAAC,8BAA8B,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,2BAA2B,CAAC,8BAA8B,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAkB;QAC7B,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,SAAS,CAAC,EAAE;QACzB,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC9B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC;QAC5C,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAEjE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAGrC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAEnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;QACxD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,uFAAuF;IACvF,IAAI,OAAO,CAAC,SAAS,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,EAAE,EAAE,OAAO,CAAC,WAAW;KACxB,CAAC,CAAC;IACH,2EAA2E;IAC3E,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAG5B;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;QACxD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO;IAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAG7C;IACC,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC;QAC7C,IAAI,EAAE;YACJ,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;YACpC,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc;YAC5C,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY;YACxC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB;YAClD,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB;SACnD;QACD,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;QACvC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;KACxC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC"}