@kelpie/server 0.1.0

package/dist/modules/auth/index.js

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import { mountAuthRoutes } from './routes.js';
+import * as schema from './schema.js';
+import { createAuthService } from './service.js';
+/**
+ * Accounts, sessions, and password recovery.
+ *
+ * Registers before `workspace`, because `workspace_members.user_id` references
+ * `users`.
+ */
+const authConfigSchema = z.object({
+    /** Cookies go out `Secure` everywhere except development. */
+    NODE_ENV: z.enum(['development', 'test', 'production']),
+});
+export function createAuthModule(migrationsDirectory) {
+    return {
+        id: 'auth',
+        structural: true,
+        register(context) {
+            const config = context.config(authConfigSchema);
+            const service = createAuthService({
+                db: context.db,
+                transaction: context.transaction,
+                email: context.email,
+                createId: context.createId,
+                now: context.now,
+            });
+            context.schema(schema, migrationsDirectory);
+            context.routes((router) => {
+                mountAuthRoutes(router, {
+                    db: context.db,
+                    now: context.now,
+                    service,
+                    cookie: { secure: config.NODE_ENV === 'production' },
+                });
+            });
+            return Promise.resolve();
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/modules/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;;GAKG;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,6DAA6D;IAC7D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;CACxD,CAAC,CAAA;AAEF,MAAM,UAAU,gBAAgB,CAAC,mBAA2B;IAC1D,OAAO;QACL,EAAE,EAAE,MAAM;QACV,UAAU,EAAE,IAAI;QAEhB,QAAQ,CAAC,OAAO;YACd,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;YAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAA;YAEF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAE3C,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,eAAe,CAAC,MAAM,EAAE;oBACtB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,OAAO;oBACP,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE;iBACrD,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/auth/preferences.d.ts

@@ -0,0 +1,34 @@
+import type { ThemePreference } from '@kelpie/schemas';
+/**
+ * What an account's preferences are before anyone has saved any, and how a
+ * partial change becomes the whole row.
+ *
+ * `user_preferences` has no row until the first save. The alternative, seeding
+ * one at signup, would leave every account created before this table was written
+ * to without one, so the read path has to answer for a missing row regardless.
+ * Given that, defaults live here rather than in the database, where a `PATCH`
+ * would still have to know them to build an insert.
+ */
+export interface PreferenceValues {
+    readonly timezone: string;
+    readonly theme: ThemePreference;
+    readonly emailDigest: boolean;
+    readonly mentionEmails: boolean;
+    readonly productUpdates: boolean;
+}
+/**
+ * UTC, not the workspace's zone. An account is global and may belong to several
+ * workspaces in different zones, so deriving from one of them would be picking
+ * arbitrarily and calling it the person's answer.
+ */
+export declare const DEFAULT_PREFERENCES: PreferenceValues;
+export type PreferenceChanges = Partial<PreferenceValues>;
+/**
+ * Folds a `PATCH` body onto what is stored, or onto the defaults when nothing is.
+ *
+ * The result is always a complete row, which is what makes the write an upsert
+ * with no read-modify-write hazard in the caller: the same request applied twice
+ * produces the same row.
+ */
+export declare function applyPreferenceChanges(stored: PreferenceValues | undefined, changes: PreferenceChanges): PreferenceValues;
+//# sourceMappingURL=preferences.d.ts.map

package/dist/modules/auth/preferences.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preferences.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/preferences.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtD;;;;;;;;;GASG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CACjC;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,gBAMjC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAEzD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,EAAE,iBAAiB,GACzB,gBAAgB,CAUlB"}

package/dist/modules/auth/preferences.js

@@ -0,0 +1,30 @@
+/**
+ * UTC, not the workspace's zone. An account is global and may belong to several
+ * workspaces in different zones, so deriving from one of them would be picking
+ * arbitrarily and calling it the person's answer.
+ */
+export const DEFAULT_PREFERENCES = {
+    timezone: 'UTC',
+    theme: 'system',
+    emailDigest: true,
+    mentionEmails: true,
+    productUpdates: false,
+};
+/**
+ * Folds a `PATCH` body onto what is stored, or onto the defaults when nothing is.
+ *
+ * The result is always a complete row, which is what makes the write an upsert
+ * with no read-modify-write hazard in the caller: the same request applied twice
+ * produces the same row.
+ */
+export function applyPreferenceChanges(stored, changes) {
+    const current = stored ?? DEFAULT_PREFERENCES;
+    return {
+        timezone: changes.timezone ?? current.timezone,
+        theme: changes.theme ?? current.theme,
+        emailDigest: changes.emailDigest ?? current.emailDigest,
+        mentionEmails: changes.mentionEmails ?? current.mentionEmails,
+        productUpdates: changes.productUpdates ?? current.productUpdates,
+    };
+}
+//# sourceMappingURL=preferences.js.map

package/dist/modules/auth/preferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preferences.js","sourceRoot":"","sources":["../../../src/modules/auth/preferences.ts"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqB;IACnD,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,KAAK;CACtB,CAAA;AAID;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAoC,EACpC,OAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAAA;IAE7C,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;QACrC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW;QACvD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa;QAC7D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc;KACjE,CAAA;AACH,CAAC"}

package/dist/modules/auth/repository.d.ts

@@ -0,0 +1,54 @@
+import type { Database } from '../../lib/database.ts';
+import type { Transaction } from '../../runtime/transaction.ts';
+import { workspaceMembers } from '../workspace/schema.ts';
+import { passwordResetTokens, sessions, userPreferences, users } from './schema.ts';
+/**
+ * Drizzle queries for accounts and sessions. No business logic: the service
+ * decides, these read and write.
+ *
+ * Users and sessions are global rather than workspace-scoped, so unlike the CRM
+ * repositories these do not take a `workspaceId` first argument.
+ */
+/** Either the pool or an open transaction. Repositories never open one themselves. */
+export type Queryable = Database | Transaction;
+export type UserRecord = typeof users.$inferSelect;
+export type SessionRecord = typeof sessions.$inferSelect;
+export type UserPreferencesRecord = typeof userPreferences.$inferSelect;
+export declare function findUserByEmail(db: Queryable, email: string): Promise<UserRecord | undefined>;
+export declare function findUserById(db: Queryable, userId: string): Promise<UserRecord | undefined>;
+export declare function insertUser(db: Queryable, values: typeof users.$inferInsert): Promise<UserRecord>;
+export declare function updateUserPassword(db: Queryable, userId: string, passwordHash: string, now: Date): Promise<void>;
+/**
+ * Writes name and email. Not the password: that one has its own function because
+ * it also ends sessions, and the two must not be reachable through one call.
+ */
+export declare function updateUserProfile(db: Queryable, userId: string, changes: {
+    readonly name?: string;
+    readonly email?: string;
+}, now: Date): Promise<UserRecord | undefined>;
+export declare function findPreferences(db: Queryable, userId: string): Promise<UserPreferencesRecord | undefined>;
+/**
+ * Inserts the row or replaces it, since the caller always has a complete set of
+ * values. Repeating a save writes the same row rather than failing on the
+ * primary key.
+ */
+export declare function upsertPreferences(db: Queryable, values: typeof userPreferences.$inferInsert): Promise<UserPreferencesRecord>;
+export declare function insertSession(db: Queryable, values: typeof sessions.$inferInsert): Promise<SessionRecord>;
+/** Only returns sessions that have not expired; an expired row is not a session. */
+export declare function findLiveSessionByTokenHash(db: Queryable, tokenHash: string, now: Date): Promise<SessionRecord | undefined>;
+export declare function listSessionsForUser(db: Queryable, userId: string): Promise<SessionRecord[]>;
+export declare function touchSession(db: Queryable, sessionId: string, now: Date): Promise<void>;
+export declare function deleteSession(db: Queryable, userId: string, sessionId: string): Promise<number>;
+export declare function deleteAllSessionsForUser(db: Queryable, userId: string): Promise<void>;
+/** Signs every other device out while leaving the caller where they are. */
+export declare function deleteOtherSessionsForUser(db: Queryable, userId: string, keepSessionId: string): Promise<void>;
+export declare function setActiveWorkspace(db: Queryable, sessionId: string, workspaceId: string): Promise<void>;
+export declare function insertPasswordResetToken(db: Queryable, values: typeof passwordResetTokens.$inferInsert): Promise<void>;
+/** Unused and unexpired. A used or stale token is not a token. */
+export declare function findUsablePasswordResetToken(db: Queryable, tokenHash: string, now: Date): Promise<typeof passwordResetTokens.$inferSelect | undefined>;
+export declare function markPasswordResetTokenUsed(db: Queryable, id: string, now: Date): Promise<void>;
+/** The membership a session's active workspace resolves to, if any. */
+export declare function findMembership(db: Queryable, workspaceId: string, userId: string): Promise<typeof workspaceMembers.$inferSelect | undefined>;
+/** The workspace a returning user lands in when their session has no active one. */
+export declare function findFirstMembership(db: Queryable, userId: string): Promise<typeof workspaceMembers.$inferSelect | undefined>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/modules/auth/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/repository.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAEnF;;;;;;GAMG;AAEH,sFAAsF;AACtF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE9C,MAAM,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,YAAY,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAA;AACxD,MAAM,MAAM,qBAAqB,GAAG,OAAO,eAAe,CAAC,YAAY,CAAA;AAEvE,wBAAsB,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAInG;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAIjG;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAQtG;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQjC;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAQ5C;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,eAAe,CAAC,YAAY,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAYhC;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,QAAQ,CAAC,YAAY,GACnC,OAAO,CAAC,aAAa,CAAC,CAQxB;AAED,oFAAoF;AACpF,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAQpC;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEjG;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOrG;AAED,wBAAsB,wBAAwB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F;AAED,4EAA4E;AAC5E,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,mBAAmB,CAAC,YAAY,GAC9C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,kEAAkE;AAClE,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,mBAAmB,CAAC,YAAY,GAAG,SAAS,CAAC,CAc9D;AAED,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpG;AAED,uEAAuE;AACvE,wBAAsB,cAAc,CAClC,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,gBAAgB,CAAC,YAAY,GAAG,SAAS,CAAC,CAQ3D;AAED,oFAAoF;AACpF,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,gBAAgB,CAAC,YAAY,GAAG,SAAS,CAAC,CAS3D"}

package/dist/modules/auth/repository.js

@@ -0,0 +1,137 @@
+import { and, desc, eq, gt, isNull, ne } from 'drizzle-orm';
+import { workspaceMembers } from '../workspace/schema.js';
+import { passwordResetTokens, sessions, userPreferences, users } from './schema.js';
+export async function findUserByEmail(db, email) {
+    const [found] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+    return found;
+}
+export async function findUserById(db, userId) {
+    const [found] = await db.select().from(users).where(eq(users.id, userId)).limit(1);
+    return found;
+}
+export async function insertUser(db, values) {
+    const [created] = await db.insert(users).values(values).returning();
+    if (created === undefined) {
+        throw new Error(`Inserting user ${values.id} returned no row`);
+    }
+    return created;
+}
+export async function updateUserPassword(db, userId, passwordHash, now) {
+    await db
+        .update(users)
+        .set({ passwordHash, updatedAt: now })
+        .where(eq(users.id, userId));
+}
+/**
+ * Writes name and email. Not the password: that one has its own function because
+ * it also ends sessions, and the two must not be reachable through one call.
+ */
+export async function updateUserProfile(db, userId, changes, now) {
+    const [updated] = await db
+        .update(users)
+        .set({ ...changes, updatedAt: now })
+        .where(eq(users.id, userId))
+        .returning();
+    return updated;
+}
+export async function findPreferences(db, userId) {
+    const [found] = await db
+        .select()
+        .from(userPreferences)
+        .where(eq(userPreferences.userId, userId))
+        .limit(1);
+    return found;
+}
+/**
+ * Inserts the row or replaces it, since the caller always has a complete set of
+ * values. Repeating a save writes the same row rather than failing on the
+ * primary key.
+ */
+export async function upsertPreferences(db, values) {
+    const [saved] = await db
+        .insert(userPreferences)
+        .values(values)
+        .onConflictDoUpdate({ target: userPreferences.userId, set: values })
+        .returning();
+    if (saved === undefined) {
+        throw new Error(`Upserting preferences for ${values.userId} returned no row`);
+    }
+    return saved;
+}
+export async function insertSession(db, values) {
+    const [created] = await db.insert(sessions).values(values).returning();
+    if (created === undefined) {
+        throw new Error(`Inserting session ${values.id} returned no row`);
+    }
+    return created;
+}
+/** Only returns sessions that have not expired; an expired row is not a session. */
+export async function findLiveSessionByTokenHash(db, tokenHash, now) {
+    const [found] = await db
+        .select()
+        .from(sessions)
+        .where(and(eq(sessions.tokenHash, tokenHash), gt(sessions.expiresAt, now)))
+        .limit(1);
+    return found;
+}
+export async function listSessionsForUser(db, userId) {
+    return db.select().from(sessions).where(eq(sessions.userId, userId)).orderBy(desc(sessions.lastActiveAt));
+}
+export async function touchSession(db, sessionId, now) {
+    await db.update(sessions).set({ lastActiveAt: now }).where(eq(sessions.id, sessionId));
+}
+export async function deleteSession(db, userId, sessionId) {
+    const deleted = await db
+        .delete(sessions)
+        .where(and(eq(sessions.id, sessionId), eq(sessions.userId, userId)))
+        .returning({ id: sessions.id });
+    return deleted.length;
+}
+export async function deleteAllSessionsForUser(db, userId) {
+    await db.delete(sessions).where(eq(sessions.userId, userId));
+}
+/** Signs every other device out while leaving the caller where they are. */
+export async function deleteOtherSessionsForUser(db, userId, keepSessionId) {
+    await db.delete(sessions).where(and(eq(sessions.userId, userId), ne(sessions.id, keepSessionId)));
+}
+export async function setActiveWorkspace(db, sessionId, workspaceId) {
+    await db.update(sessions).set({ activeWorkspaceId: workspaceId }).where(eq(sessions.id, sessionId));
+}
+export async function insertPasswordResetToken(db, values) {
+    await db.insert(passwordResetTokens).values(values);
+}
+/** Unused and unexpired. A used or stale token is not a token. */
+export async function findUsablePasswordResetToken(db, tokenHash, now) {
+    const [found] = await db
+        .select()
+        .from(passwordResetTokens)
+        .where(and(eq(passwordResetTokens.tokenHash, tokenHash), isNull(passwordResetTokens.usedAt), gt(passwordResetTokens.expiresAt, now)))
+        .limit(1);
+    return found;
+}
+export async function markPasswordResetTokenUsed(db, id, now) {
+    await db
+        .update(passwordResetTokens)
+        .set({ usedAt: now })
+        .where(eq(passwordResetTokens.id, id));
+}
+/** The membership a session's active workspace resolves to, if any. */
+export async function findMembership(db, workspaceId, userId) {
+    const [found] = await db
+        .select()
+        .from(workspaceMembers)
+        .where(and(eq(workspaceMembers.workspaceId, workspaceId), eq(workspaceMembers.userId, userId)))
+        .limit(1);
+    return found;
+}
+/** The workspace a returning user lands in when their session has no active one. */
+export async function findFirstMembership(db, userId) {
+    const [found] = await db
+        .select()
+        .from(workspaceMembers)
+        .where(eq(workspaceMembers.userId, userId))
+        .orderBy(workspaceMembers.joinedAt)
+        .limit(1);
+    return found;
+}
+//# sourceMappingURL=repository.js.map

package/dist/modules/auth/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/modules/auth/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAI3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAiBnF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAa,EAAE,KAAa;IAChE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEpF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAa,EAAE,MAAc;IAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAElF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAa,EAAE,MAAiC;IAC/E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAA;IAEnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAA;IAChE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAa,EACb,MAAc,EACd,YAAoB,EACpB,GAAS;IAET,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAa,EACb,MAAc,EACd,OAA4D,EAC5D,GAAS;IAET,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACnC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC3B,SAAS,EAAE,CAAA;IAEd,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAa,EACb,MAAc;IAEd,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAa,EACb,MAA2C;IAE3C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,MAAM,CAAC;SACd,kBAAkB,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;SACnE,SAAS,EAAE,CAAA;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,MAAM,kBAAkB,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAa,EACb,MAAoC;IAEpC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAA;IAEtE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACnE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAa,EACb,SAAiB,EACjB,GAAS;IAET,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;SAC1E,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAa,EAAE,MAAc;IACrE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAA;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAa,EAAE,SAAiB,EAAE,GAAS;IAC5E,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAa,EAAE,MAAc,EAAE,SAAiB;IAClF,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,QAAQ,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SACnE,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjC,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAa,EAAE,MAAc;IAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAa,EACb,MAAc,EACd,aAAqB;IAErB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAa,EACb,SAAiB,EACjB,WAAmB;IAEnB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AACrG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAa,EACb,MAA+C;IAE/C,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACrD,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAa,EACb,SAAiB,EACjB,GAAS;IAET,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,EAC5C,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAClC,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CACvC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAa,EAAE,EAAU,EAAE,GAAS;IACnF,MAAM,EAAE;SACL,MAAM,CAAC,mBAAmB,CAAC;SAC3B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAa,EACb,WAAmB,EACnB,MAAc;IAEd,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SAC9F,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAa,EACb,MAAc;IAEd,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC1C,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC;SAClC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/modules/auth/routes.d.ts

@@ -0,0 +1,10 @@
+import type { Hono } from 'hono';
+import type { CredentialDependencies } from './credentials.ts';
+import type { AuthService } from './service.ts';
+import type { SessionCookieOptions } from './session.ts';
+export interface AuthRoutesDependencies extends CredentialDependencies {
+    readonly service: AuthService;
+    readonly cookie: SessionCookieOptions;
+}
+export declare function mountAuthRoutes(router: Hono, dependencies: AuthRoutesDependencies): void;
+//# sourceMappingURL=routes.d.ts.map

package/dist/modules/auth/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAA;AAQzC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAE9D,OAAO,KAAK,EAAe,WAAW,EAA8B,MAAM,cAAc,CAAA;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAwDxD,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CACtC;AAsDD,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAwHxF"}

package/dist/modules/auth/routes.js

@@ -0,0 +1,181 @@
+import { THEME_PREFERENCES } from '@kelpie/schemas';
+import { z } from 'zod';
+import { AppError, toErrorDetails } from '../../lib/errors.js';
+import { timezoneSchema } from '../../lib/timezones.js';
+import { requireSessionActor } from './actor.js';
+import { resolveActorFrom } from './credentials.js';
+import { clearSessionCookie, writeSessionCookie } from './session.js';
+/**
+ * Wire shapes for `/v1/auth/*`. Bodies are `snake_case` per `api.md`; the service
+ * layer speaks `camelCase`. The mapping happens here and nowhere else.
+ */
+const signUpBody = z.object({
+    email: z.string().min(1),
+    name: z.string().min(1),
+    password: z.string().min(1),
+});
+const logInBody = z.object({
+    email: z.string().min(1),
+    password: z.string().min(1),
+});
+const resetRequestBody = z.object({
+    email: z.string().min(1),
+    /** Where the emailed link points. `{token}` is replaced with the reset token. */
+    reset_url_template: z.string().min(1).includes('{token}'),
+});
+const resetConfirmBody = z.object({
+    token: z.string().min(1),
+    password: z.string().min(1),
+});
+const changePasswordBody = z.object({
+    current_password: z.string().min(1),
+    new_password: z.string().min(1),
+});
+const updateAccountBody = z
+    .strictObject({
+    name: z.string().min(1),
+    email: z.string().min(1),
+    current_password: z.string().min(1),
+})
+    .partial()
+    .refine((body) => body.email === undefined || body.current_password !== undefined, {
+    message: 'Current password is required to change email',
+    path: ['current_password'],
+});
+const updatePreferencesBody = z
+    .strictObject({
+    timezone: timezoneSchema,
+    theme: z.enum(THEME_PREFERENCES),
+    email_digest: z.boolean(),
+    mention_emails: z.boolean(),
+    product_updates: z.boolean(),
+})
+    .partial();
+/** Parses a body into `T` or throws the `422` `api.md` describes. */
+async function readBody(context, schema) {
+    const raw = await context.req.json().catch(() => {
+        throw new AppError('bad_request', 'Body must be valid JSON');
+    });
+    const parsed = schema.safeParse(raw);
+    if (!parsed.success) {
+        throw AppError.validationFailed('Request body is invalid', toErrorDetails(parsed.error.issues));
+    }
+    return parsed.data;
+}
+/** The device and location shown on the Security page come from the request itself. */
+function describeClient(context) {
+    const userAgent = context.req.header('User-Agent');
+    return userAgent === undefined ? {} : { device: userAgent };
+}
+function accountResponse(issued) {
+    return {
+        account: { id: issued.account.id, email: issued.account.email, name: issued.account.name },
+        active_workspace_id: issued.activeWorkspaceId,
+    };
+}
+function accountBody(account) {
+    return { id: account.id, email: account.email, name: account.name };
+}
+function preferencesResponse(preferences) {
+    return {
+        timezone: preferences.timezone,
+        theme: preferences.theme,
+        email_digest: preferences.emailDigest,
+        mention_emails: preferences.mentionEmails,
+        product_updates: preferences.productUpdates,
+    };
+}
+function sessionResponse(session) {
+    return {
+        id: session.id,
+        device: session.device,
+        location: session.location,
+        last_active_at: session.lastActiveAt.toISOString(),
+        current: session.current,
+    };
+}
+export function mountAuthRoutes(router, dependencies) {
+    /** Every endpoint here manages a human's own credentials, so a key cannot call them. */
+    const requireActor = async (context) => requireSessionActor(await resolveActorFrom(dependencies, context));
+    router.post('/auth/signup', async (context) => {
+        const body = await readBody(context, signUpBody);
+        const issued = await dependencies.service.signUp({ ...body, ...describeClient(context) });
+        writeSessionCookie(context, issued.sessionToken, dependencies.cookie);
+        return context.json(accountResponse(issued), 201);
+    });
+    router.post('/auth/login', async (context) => {
+        const body = await readBody(context, logInBody);
+        const issued = await dependencies.service.logIn({ ...body, ...describeClient(context) });
+        writeSessionCookie(context, issued.sessionToken, dependencies.cookie);
+        return context.json(accountResponse(issued), 200);
+    });
+    router.post('/auth/logout', async (context) => {
+        await dependencies.service.logOut(await requireActor(context));
+        clearSessionCookie(context, dependencies.cookie);
+        return context.body(null, 204);
+    });
+    router.get('/auth/me', async (context) => {
+        const actor = await requireActor(context);
+        return context.json({
+            user_id: actor.userId,
+            session_id: actor.sessionId,
+            workspace_id: actor.workspaceId,
+            role: actor.role,
+        });
+    });
+    /**
+     * `/account` rather than `/auth/account`: `/auth/*` is how a browser gets a
+     * session, and this is the person that session belongs to. The auth module
+     * owns both because it owns the `users` table.
+     */
+    router.get('/account', async (context) => context.json(accountBody(await dependencies.service.getAccount(await requireActor(context)))));
+    router.patch('/account', async (context) => {
+        const body = await readBody(context, updateAccountBody);
+        const account = await dependencies.service.updateAccount(await requireActor(context), {
+            ...(body.name === undefined ? {} : { name: body.name }),
+            ...(body.email === undefined ? {} : { email: body.email }),
+            ...(body.current_password === undefined ? {} : { currentPassword: body.current_password }),
+        });
+        return context.json(accountBody(account));
+    });
+    router.get('/account/preferences', async (context) => context.json(preferencesResponse(await dependencies.service.getPreferences(await requireActor(context)))));
+    router.patch('/account/preferences', async (context) => {
+        const body = await readBody(context, updatePreferencesBody);
+        const preferences = await dependencies.service.updatePreferences(await requireActor(context), {
+            ...(body.timezone === undefined ? {} : { timezone: body.timezone }),
+            ...(body.theme === undefined ? {} : { theme: body.theme }),
+            ...(body.email_digest === undefined ? {} : { emailDigest: body.email_digest }),
+            ...(body.mention_emails === undefined ? {} : { mentionEmails: body.mention_emails }),
+            ...(body.product_updates === undefined ? {} : { productUpdates: body.product_updates }),
+        });
+        return context.json(preferencesResponse(preferences));
+    });
+    router.get('/auth/sessions', async (context) => {
+        const sessions = await dependencies.service.listSessions(await requireActor(context));
+        return context.json({ data: sessions.map(sessionResponse), next_cursor: null });
+    });
+    router.delete('/auth/sessions/:id', async (context) => {
+        await dependencies.service.revokeSession(await requireActor(context), context.req.param('id'));
+        return context.body(null, 204);
+    });
+    router.patch('/auth/password', async (context) => {
+        const body = await readBody(context, changePasswordBody);
+        await dependencies.service.changePassword(await requireActor(context), body.current_password, body.new_password);
+        return context.body(null, 204);
+    });
+    /**
+     * Answers 202 whether or not the address is registered. A different answer
+     * would turn this endpoint into an account-existence oracle.
+     */
+    router.post('/auth/password-reset', async (context) => {
+        const body = await readBody(context, resetRequestBody);
+        await dependencies.service.requestPasswordReset(body.email, body.reset_url_template);
+        return context.body(null, 202);
+    });
+    router.post('/auth/password-reset/confirm', async (context) => {
+        const body = await readBody(context, resetConfirmBody);
+        await dependencies.service.confirmPasswordReset(body.token, body.password);
+        return context.body(null, 204);
+    });
+}
+//# sourceMappingURL=routes.js.map

package/dist/modules/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/modules/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAInD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGrE;;;GAGG;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,iFAAiF;IACjF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;CAC1D,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC;KACxB,YAAY,CAAC;IACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC;KACD,OAAO,EAAE;KACT,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE;IACjF,OAAO,EAAE,8CAA8C;IACvD,IAAI,EAAE,CAAC,kBAAkB,CAAC;CAC3B,CAAC,CAAA;AAEJ,MAAM,qBAAqB,GAAG,CAAC;KAC5B,YAAY,CAAC;IACZ,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;CAC7B,CAAC;KACD,OAAO,EAAE,CAAA;AAOZ,qEAAqE;AACrE,KAAK,UAAU,QAAQ,CAAI,OAAgB,EAAE,MAAoB;IAC/D,MAAM,GAAG,GAAY,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACvD,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAEpC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED,uFAAuF;AACvF,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAElD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;AAC7D,CAAC;AAED,SAAS,eAAe,CAAC,MAAqB;IAC5C,OAAO;QACL,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1F,mBAAmB,EAAE,MAAM,CAAC,iBAAiB;KAC9C,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAoB;IACvC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;AACrE,CAAC;AAED,SAAS,mBAAmB,CAAC,WAA6B;IACxD,OAAO;QACL,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,YAAY,EAAE,WAAW,CAAC,WAAW;QACrC,cAAc,EAAE,WAAW,CAAC,aAAa;QACzC,eAAe,EAAE,WAAW,CAAC,cAAc;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAoB;IAC3C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE;QAClD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAY,EAAE,YAAoC;IAChF,wFAAwF;IACxF,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAyB,EAAE,CACrE,mBAAmB,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAA;IAEpE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAEzF,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;QAErE,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAExF,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;QAErE,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5C,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9D,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;QAEhD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QAEzC,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF;;;;OAIG;IACH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACvC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAC9F,CAAA;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE;YACpF,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;SAC3F,CAAC,CAAA;QAEF,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACnD,OAAO,CAAC,IAAI,CACV,mBAAmB,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAC5F,CACF,CAAA;IAED,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAA;QAC3D,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE;YAC5F,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9E,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpF,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;SACxF,CAAC,CAAA;QAEF,OAAO,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;QAErF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpD,MAAM,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAE9F,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;QACxD,MAAM,YAAY,CAAC,OAAO,CAAC,cAAc,CACvC,MAAM,YAAY,CAAC,OAAO,CAAC,EAC3B,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,YAAY,CAClB,CAAA;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF;;;OAGG;IACH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;QACtD,MAAM,YAAY,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAEpF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;QACtD,MAAM,YAAY,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAE1E,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC"}