@maadb/core 0.0.1 → 0.7.10-rc.3

package/dist/auth/token-store.js

@@ -0,0 +1,464 @@
+// ============================================================================
+// TokenStore — 0.7.0 Scoped Auth registry primitive (dec-maadb-069 +
+//              dec-maadb-071)
+//
+// Loads and mutates `<instance-root>/_auth/tokens.yaml`. In-memory indexes
+// by hash (lookup key) and by id (CLI / admin tools). Writes are atomic via
+// tmp-file + rename.
+//
+// Scope of this module:
+//   - load, lookupByHash, lookupById, list, stats
+//   - issue (generates plaintext + hash, persists)
+//   - revoke (sets revokedAt, persists)
+//   - rotate (revokes old + issues new with preserved capabilities)
+//
+// NOT in scope here (later phases):
+//   - HTTP middleware resolveToken() — uses this store but lives in mcp/transport/auth.ts (P2)
+//   - Three-cap role composition — with-session.ts (P2)
+//   - CLI + admin MCP tools that call issue/revoke/rotate — P3
+// ============================================================================
+import { existsSync } from 'node:fs';
+import { readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+import { createHash, randomBytes } from 'node:crypto';
+import yaml from 'js-yaml';
+import { ok, singleErr } from '../errors.js';
+import { tokenId as toTokenId, tokenHash as toTokenHash, } from './types.js';
+const TOKEN_PLAINTEXT_PREFIX = 'maad_pat_';
+const TOKEN_PLAINTEXT_RANDOM_BYTES = 16; // 128 bits → 32 hex chars
+const TOKEN_ID_RANDOM_BYTES = 6; // 48 bits → 12 hex chars
+export const TOKENS_FILE_RELATIVE = path.join('_auth', 'tokens.yaml');
+/**
+ * Generate a new plaintext bearer in the locked format: maad_pat_<32hex>.
+ * Shell-safe (hex only), 128 bits random, prefix visible in logs / scanners.
+ */
+export function generatePlaintext() {
+    const random = randomBytes(TOKEN_PLAINTEXT_RANDOM_BYTES).toString('hex');
+    return `${TOKEN_PLAINTEXT_PREFIX}${random}`;
+}
+/** Plaintext → SHA-256 hex. The sole lookup key that persists. */
+export function hashPlaintext(plaintext) {
+    return toTokenHash(createHash('sha256').update(plaintext, 'utf8').digest('hex'));
+}
+/** Format check — cheap defensive filter before hashing arbitrary bearers. */
+export function looksLikeToken(bearer) {
+    if (!bearer.startsWith(TOKEN_PLAINTEXT_PREFIX))
+        return false;
+    const random = bearer.slice(TOKEN_PLAINTEXT_PREFIX.length);
+    return /^[0-9a-f]{32}$/.test(random);
+}
+function generateId() {
+    return toTokenId(`tok-${randomBytes(TOKEN_ID_RANDOM_BYTES).toString('hex')}`);
+}
+export class TokenStore {
+    filePath;
+    registryName;
+    byHash = new Map();
+    byId = new Map();
+    records = [];
+    constructor(filePath, registryName) {
+        this.filePath = filePath;
+        this.registryName = registryName;
+    }
+    /**
+     * Load tokens.yaml from `<instanceRoot>/_auth/tokens.yaml`. Returns an empty
+     * store if the file is absent — caller decides whether HTTP mode can boot
+     * against that state (the HTTP boot-mode matrix in the 0.7.0 spec).
+     *
+     * Parse errors are NOT silent: TOKENS_FILE_INVALID is returned with the
+     * file path + js-yaml message so operators can fix the file without
+     * guessing.
+     */
+    static async load(instanceRoot) {
+        const filePath = path.join(instanceRoot, TOKENS_FILE_RELATIVE);
+        const store = new TokenStore(filePath, undefined);
+        if (!existsSync(filePath))
+            return ok(store);
+        let raw;
+        try {
+            raw = await readFile(filePath, 'utf8');
+        }
+        catch (e) {
+            return singleErr('TOKENS_FILE_INVALID', `Failed to read tokens file ${filePath}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        let data;
+        try {
+            data = yaml.load(raw);
+        }
+        catch (e) {
+            return singleErr('TOKENS_FILE_INVALID', `tokens.yaml parse error at ${filePath}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        const shape = validateShape(data, filePath);
+        if (!shape.ok)
+            return shape;
+        store.registryName = shape.value.name;
+        for (const raw of shape.value.tokens) {
+            const record = normalizeRecord(raw);
+            store.records.push(record);
+            store.byHash.set(record.hash, record);
+            store.byId.set(record.id, record);
+        }
+        return ok(store);
+    }
+    /** Absolute path to the backing file. */
+    path() { return this.filePath; }
+    /**
+     * 0.7.0 — Re-read tokens.yaml from disk and swap the in-memory indexes
+     * in-place. Captures of the TokenStore reference stay valid (so the HTTP
+     * transport doesn't need a getter). Parse errors leave the existing
+     * in-memory state untouched. Called by the SIGHUP handler alongside
+     * instance reload.
+     */
+    async reload() {
+        if (!existsSync(this.filePath)) {
+            // File was removed — empty the store. Same boot semantics as an
+            // absent file (HTTP transport keeps running; next lookup misses).
+            this.records = [];
+            this.byHash.clear();
+            this.byId.clear();
+            this.registryName = undefined;
+            return ok({ total: 0, active: 0 });
+        }
+        let raw;
+        try {
+            raw = await readFile(this.filePath, 'utf8');
+        }
+        catch (e) {
+            return singleErr('TOKENS_FILE_INVALID', `Failed to re-read tokens file ${this.filePath}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        let data;
+        try {
+            data = yaml.load(raw);
+        }
+        catch (e) {
+            return singleErr('TOKENS_FILE_INVALID', `tokens.yaml parse error at ${this.filePath}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        const shape = validateShape(data, this.filePath);
+        if (!shape.ok)
+            return shape;
+        // Swap in-place only after validation succeeds — preserves existing state
+        // on parse failure.
+        this.records = [];
+        this.byHash.clear();
+        this.byId.clear();
+        this.registryName = shape.value.name;
+        for (const raw of shape.value.tokens) {
+            const record = normalizeRecord(raw);
+            this.records.push(record);
+            this.byHash.set(record.hash, record);
+            this.byId.set(record.id, record);
+        }
+        return ok({ total: this.records.length, active: this.activeCount() });
+    }
+    /** Optional human label recorded at the top of tokens.yaml. */
+    name() { return this.registryName; }
+    /** Total records including revoked. */
+    size() { return this.records.length; }
+    /** Records with no revokedAt and no expiresAt-in-the-past. */
+    activeCount(now = new Date()) {
+        let n = 0;
+        for (const r of this.records)
+            if (isActive(r, now))
+                n++;
+        return n;
+    }
+    /** O(1) lookup by hash. Returns undefined for unknown bearers. */
+    lookupByHash(hash) {
+        return this.byHash.get(hash);
+    }
+    /** Secondary lookup by readable id (CLI / admin paths). */
+    lookupById(id) {
+        return this.byId.get(id);
+    }
+    /** Snapshot of all records. Caller receives a shallow copy. */
+    list() { return [...this.records]; }
+    /**
+     * Issue a new token. Generates plaintext + hash, appends the record,
+     * persists the file atomically. Returns both the record and the plaintext —
+     * plaintext is never recoverable after this call.
+     */
+    async issue(spec) {
+        const plaintext = generatePlaintext();
+        const hash = hashPlaintext(plaintext);
+        // Defensive: SHA-256 collisions are astronomically unlikely but we still
+        // refuse to persist a duplicate hash rather than silently overwrite.
+        if (this.byHash.has(hash)) {
+            return singleErr('TOKEN_MALFORMED', 'hash collision on newly generated plaintext; retry');
+        }
+        const record = {
+            id: generateId(),
+            hash,
+            role: spec.role,
+            projects: spec.projects,
+            createdAt: new Date().toISOString(),
+        };
+        if (spec.name !== undefined)
+            record.name = spec.name;
+        if (spec.agentId !== undefined)
+            record.agentId = spec.agentId;
+        if (spec.userId !== undefined)
+            record.userId = spec.userId;
+        if (spec.expiresAt !== undefined)
+            record.expiresAt = spec.expiresAt;
+        this.records.push(record);
+        this.byHash.set(record.hash, record);
+        this.byId.set(record.id, record);
+        const persisted = await this.persist();
+        if (!persisted.ok) {
+            // Roll back in-memory state so the store stays consistent with disk.
+            this.records.pop();
+            this.byHash.delete(record.hash);
+            this.byId.delete(record.id);
+            return persisted;
+        }
+        return ok({ record, plaintext });
+    }
+    /**
+     * Mark a token as revoked. Sets revokedAt; the record stays in the registry
+     * so audit queries can resolve historic token IDs. Idempotent — revoking
+     * an already-revoked record is a no-op and returns the existing record.
+     */
+    async revoke(id) {
+        const record = this.byId.get(id);
+        if (!record)
+            return singleErr('TOKEN_NOT_FOUND', `No token with id ${id}`);
+        if (record.revokedAt !== undefined)
+            return ok(record);
+        record.revokedAt = new Date().toISOString();
+        const persisted = await this.persist();
+        if (!persisted.ok) {
+            delete record.revokedAt;
+            return persisted;
+        }
+        return ok(record);
+    }
+    /**
+     * Rotate a token: issue a new token with the SAME capabilities (role,
+     * projects, agentId, userId, expiresAt, name) and revoke the old one.
+     * Immediate cutover — no grace window (deferred per dec-maadb-069 lock #10).
+     * Returns the new record + plaintext; old record retains its id with
+     * revokedAt set.
+     */
+    async rotate(id) {
+        const existing = this.byId.get(id);
+        if (!existing)
+            return singleErr('TOKEN_NOT_FOUND', `No token with id ${id}`);
+        if (existing.revokedAt !== undefined) {
+            return singleErr('TOKEN_REVOKED', `Token ${id} is already revoked; rotate requires an active token`);
+        }
+        // Build IssueSpec from the existing record's capabilities. Cloning
+        // projects array defensively so mutations on the new record never leak.
+        const spec = {
+            role: existing.role,
+            projects: existing.projects.map(p => ({ ...p })),
+        };
+        if (existing.name !== undefined)
+            spec.name = existing.name;
+        if (existing.agentId !== undefined)
+            spec.agentId = existing.agentId;
+        if (existing.userId !== undefined)
+            spec.userId = existing.userId;
+        if (existing.expiresAt !== undefined)
+            spec.expiresAt = existing.expiresAt;
+        const issued = await this.issue(spec);
+        if (!issued.ok)
+            return issued;
+        // Mark the old record revoked after the new one persists so a crash mid-rotate
+        // leaves at most an extra active token, not a gap with neither.
+        existing.revokedAt = new Date().toISOString();
+        const persisted = await this.persist();
+        if (!persisted.ok) {
+            delete existing.revokedAt;
+            return persisted;
+        }
+        return issued;
+    }
+    /**
+     * Atomic write via `<path>.tmp` + rename. Creates `_auth/` if missing.
+     * Errors don't leak partial state because writeFile+rename is atomic on
+     * both POSIX and Windows.
+     */
+    async persist() {
+        // Serialized shape uses snake_case keys for on-disk yaml; the in-memory
+        // TokenRecord shape is camelCase. Keep them distinct here rather than
+        // reshaping the public type.
+        const shape = {
+            ...(this.registryName !== undefined ? { name: this.registryName } : {}),
+            tokens: this.records.map(serializeRecord),
+        };
+        const yamlText = yaml.dump(shape, { noRefs: true, lineWidth: 120 });
+        const dir = path.dirname(this.filePath);
+        try {
+            await mkdir(dir, { recursive: true });
+        }
+        catch (e) {
+            return singleErr('TOKENS_FILE_INVALID', `Failed to create ${dir}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        const tmp = `${this.filePath}.tmp`;
+        try {
+            await writeFile(tmp, yamlText, { encoding: 'utf8', mode: 0o600 });
+            await rename(tmp, this.filePath);
+        }
+        catch (e) {
+            return singleErr('TOKENS_FILE_INVALID', `Failed to persist tokens.yaml at ${this.filePath}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        return ok(undefined);
+    }
+}
+// --- Internal helpers ------------------------------------------------------
+function validateShape(data, filePath) {
+    if (data === null || data === undefined) {
+        // Empty file = empty registry.
+        return ok({ tokens: [] });
+    }
+    if (typeof data !== 'object' || Array.isArray(data)) {
+        return singleErr('TOKENS_FILE_INVALID', `tokens.yaml at ${filePath} must be a mapping, got ${Array.isArray(data) ? 'sequence' : typeof data}`);
+    }
+    const obj = data;
+    const name = obj['name'];
+    if (name !== undefined && typeof name !== 'string') {
+        return singleErr('TOKENS_FILE_INVALID', `tokens.yaml \`name\` must be a string if present`);
+    }
+    const rawTokens = obj['tokens'];
+    if (rawTokens === undefined) {
+        return ok({ tokens: [], ...(typeof name === 'string' ? { name } : {}) });
+    }
+    if (!Array.isArray(rawTokens)) {
+        return singleErr('TOKENS_FILE_INVALID', `tokens.yaml \`tokens\` must be an array`);
+    }
+    const tokens = [];
+    for (let i = 0; i < rawTokens.length; i++) {
+        const entry = rawTokens[i];
+        if (typeof entry !== 'object' || entry === null) {
+            return singleErr('TOKENS_FILE_INVALID', `tokens[${i}] must be a mapping`);
+        }
+        const parsed = parseRecord(entry, i);
+        if (!parsed.ok)
+            return parsed;
+        tokens.push(parsed.value);
+    }
+    const result = { tokens };
+    if (typeof name === 'string')
+        result.name = name;
+    return ok(result);
+}
+function parseRecord(raw, index) {
+    const loc = (f) => `tokens[${index}].${f}`;
+    const getString = (f, required) => {
+        const v = raw[f];
+        if (v === undefined) {
+            if (required)
+                return singleErr('TOKENS_FILE_INVALID', `${loc(f)} is required`);
+            return ok(undefined);
+        }
+        if (typeof v !== 'string')
+            return singleErr('TOKENS_FILE_INVALID', `${loc(f)} must be a string`);
+        return ok(v);
+    };
+    const id = getString('id', true);
+    if (!id.ok)
+        return id;
+    const hash = getString('hash', true);
+    if (!hash.ok)
+        return hash;
+    const roleRaw = getString('role', true);
+    if (!roleRaw.ok)
+        return roleRaw;
+    const createdAt = getString('created_at', true);
+    if (!createdAt.ok)
+        return createdAt;
+    const name = getString('name', false);
+    if (!name.ok)
+        return name;
+    const agentId = getString('agent_id', false);
+    if (!agentId.ok)
+        return agentId;
+    const userId = getString('user_id', false);
+    if (!userId.ok)
+        return userId;
+    const expiresAt = getString('expires_at', false);
+    if (!expiresAt.ok)
+        return expiresAt;
+    const revokedAt = getString('revoked_at', false);
+    if (!revokedAt.ok)
+        return revokedAt;
+    if (!['reader', 'writer', 'admin'].includes(roleRaw.value)) {
+        return singleErr('TOKENS_FILE_INVALID', `${loc('role')} must be one of reader|writer|admin, got ${roleRaw.value}`);
+    }
+    const rawProjects = raw['projects'];
+    if (!Array.isArray(rawProjects)) {
+        return singleErr('TOKENS_FILE_INVALID', `${loc('projects')} must be an array`);
+    }
+    const projects = [];
+    for (let j = 0; j < rawProjects.length; j++) {
+        const entry = rawProjects[j];
+        if (typeof entry !== 'object' || entry === null) {
+            return singleErr('TOKENS_FILE_INVALID', `${loc(`projects[${j}]`)} must be a mapping`);
+        }
+        const e = entry;
+        const pname = e['name'];
+        if (typeof pname !== 'string') {
+            return singleErr('TOKENS_FILE_INVALID', `${loc(`projects[${j}].name`)} must be a string`);
+        }
+        const cap = { name: pname };
+        const pRole = e['role'];
+        if (pRole !== undefined) {
+            if (typeof pRole !== 'string' || !['reader', 'writer', 'admin'].includes(pRole)) {
+                return singleErr('TOKENS_FILE_INVALID', `${loc(`projects[${j}].role`)} must be reader|writer|admin if present`);
+            }
+            cap.role = pRole;
+        }
+        projects.push(cap);
+    }
+    const record = {
+        id: toTokenId(id.value),
+        hash: toTokenHash(hash.value),
+        role: roleRaw.value,
+        projects,
+        createdAt: createdAt.value,
+    };
+    if (name.value !== undefined)
+        record.name = name.value;
+    if (agentId.value !== undefined)
+        record.agentId = agentId.value;
+    if (userId.value !== undefined)
+        record.userId = userId.value;
+    if (expiresAt.value !== undefined)
+        record.expiresAt = expiresAt.value;
+    if (revokedAt.value !== undefined)
+        record.revokedAt = revokedAt.value;
+    return ok(record);
+}
+function normalizeRecord(r) {
+    // Defensive copy of projects so mutations on returned records don't
+    // bleed into the in-memory index.
+    return { ...r, projects: r.projects.map(p => ({ ...p })) };
+}
+function serializeRecord(r) {
+    const out = {
+        id: r.id,
+        hash: r.hash,
+        role: r.role,
+        projects: r.projects.map(p => p.role !== undefined ? { name: p.name, role: p.role } : { name: p.name }),
+        created_at: r.createdAt,
+    };
+    if (r.name !== undefined)
+        out['name'] = r.name;
+    if (r.agentId !== undefined)
+        out['agent_id'] = r.agentId;
+    if (r.userId !== undefined)
+        out['user_id'] = r.userId;
+    if (r.expiresAt !== undefined)
+        out['expires_at'] = r.expiresAt;
+    if (r.revokedAt !== undefined)
+        out['revoked_at'] = r.revokedAt;
+    return out;
+}
+function isActive(r, now) {
+    if (r.revokedAt !== undefined)
+        return false;
+    if (r.expiresAt !== undefined && new Date(r.expiresAt).getTime() < now.getTime())
+        return false;
+    return true;
+}
+//# sourceMappingURL=token-store.js.map

package/dist/auth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,qEAAqE;AACrE,8BAA8B;AAC9B,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,qBAAqB;AACrB,EAAE;AACF,wBAAwB;AACxB,kDAAkD;AAClD,mDAAmD;AACnD,wCAAwC;AACxC,oEAAoE;AACpE,EAAE;AACF,oCAAoC;AACpC,+FAA+F;AAC/F,wDAAwD;AACxD,+DAA+D;AAC/D,+EAA+E;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,OAAO,EAAE,EAAE,EAAE,SAAS,EAAe,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,OAAO,IAAI,SAAS,EACpB,SAAS,IAAI,WAAW,GAQzB,MAAM,YAAY,CAAC;AAEpB,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAC3C,MAAM,4BAA4B,GAAG,EAAE,CAAC,CAAG,0BAA0B;AACrE,MAAM,qBAAqB,GAAG,CAAC,CAAC,CAAY,yBAAyB;AAErE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEtE;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,GAAG,sBAAsB,GAAG,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,SAAS,CAAC,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,OAAO,UAAU;IAMX;IACA;IANF,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC3C,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IACvC,OAAO,GAAkB,EAAE,CAAC;IAEpC,YACU,QAAgB,EAChB,YAAgC;QADhC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,iBAAY,GAAZ,YAAY,CAAoB;IACvC,CAAC;IAEJ;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAoB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAE5C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,8BAA8B,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,8BAA8B,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACpC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,yCAAyC;IACzC,IAAI,KAAa,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExC;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,gEAAgE;YAChE,kEAAkE;YAClE,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,iCAAiC,IAAI,CAAC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,8BAA8B,IAAI,CAAC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,0EAA0E;QAC1E,oBAAoB;QACpB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,+DAA+D;IAC/D,IAAI,KAAyB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAExD,uCAAuC;IACvC,IAAI,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9C,8DAA8D;IAC9D,WAAW,CAAC,MAAY,IAAI,IAAI,EAAE;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,kEAAkE;IAClE,YAAY,CAAC,IAAe;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,2DAA2D;IAC3D,UAAU,CAAC,EAAW;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,+DAA+D;IAC/D,IAAI,KAAoB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnD;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,IAAe;QACzB,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAEtC,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,iBAAiB,EAChC,oDAAoD,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEpE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,qEAAqE;YACrE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,EAAW;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,oBAAoB,EAAY,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QAEtD,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,SAAS,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,EAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,oBAAoB,EAAY,EAAE,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC,eAAe,EAC9B,SAAS,EAAY,sDAAsD,CAAC,CAAC;QACjF,CAAC;QAED,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,IAAI,GAAc;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;SACjD,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3D,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAE9B,+EAA+E;QAC/E,gEAAgE;QAChE,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,QAAQ,CAAC,SAAS,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO;QACnB,wEAAwE;QACxE,sEAAsE;QACtE,6BAA6B;QAC7B,MAAM,KAAK,GAA4B;YACrC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;SAC1C,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAEpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,oBAAoB,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,oCAAoC,IAAI,CAAC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;CACF;AAED,8EAA8E;AAE9E,SAAS,aAAa,CAAC,IAAa,EAAE,QAAgB;IACpD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,+BAA+B;QAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC,qBAAqB,EACpC,kBAAkB,QAAQ,2BAA2B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAgC,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IACjD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B,EAAE,KAAa;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,QAAiB,EAA8B,EAAE;QAC7E,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,QAAQ;gBAAE,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;YAC/E,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACjG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IACzE,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACrF,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAC9E,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC1E,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEtF,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAM,CAAC,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC,qBAAqB,EACpC,GAAG,GAAG,CAAC,MAAM,CAAC,4CAA4C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChF,OAAO,SAAS,CAAC,qBAAqB,EACpC,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;YAC5E,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,KAAsC,CAAC;QACpD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,KAAM,CAAC;QACxB,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,KAAM,CAAC;QAC9B,IAAI,EAAE,OAAO,CAAC,KAA6B;QAC3C,QAAQ;QACR,SAAS,EAAE,SAAS,CAAC,KAAM;KAC5B,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;IACvD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;IAChE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7D,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;IACtE,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;IACtE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,oEAAoE;IACpE,kCAAkC;IAClC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,MAAM,GAAG,GAA4B;QACnC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvG,UAAU,EAAE,CAAC,CAAC,SAAS;KACxB,CAAC;IACF,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACzD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAc,EAAE,GAAS;IACzC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,75 @@
+import type { Role } from '../mcp/roles.js';
+/**
+ * Readable token identifier for CLI + audit trails. Generated at issue time.
+ * Format: `tok-<12hex>`. Distinct from the hash (lookup key) and plaintext
+ * (bearer presented by clients).
+ */
+export type TokenId = string & {
+    readonly __brand: 'TokenId';
+};
+/** SHA-256 hex digest of the plaintext bearer. Lookup key; persisted. */
+export type TokenHash = string & {
+    readonly __brand: 'TokenHash';
+};
+export declare function tokenId(s: string): TokenId;
+export declare function tokenHash(s: string): TokenHash;
+/**
+ * Per-token project access entry. Wildcard `*` matches every project in the
+ * instance at the token's global role. A named entry may optionally downgrade
+ * the role for that specific project via an explicit `role` field — the
+ * per-project cap can only REDUCE, never exceed the global role (enforced at
+ * resolve time, not load time).
+ */
+export interface ProjectCap {
+    name: string;
+    role?: Role;
+}
+/**
+ * Full token record as persisted in tokens.yaml. Plaintext is NOT stored
+ * anywhere — only the SHA-256 hash of plaintext. revokedAt is the only
+ * field that can transition on an existing record; everything else is
+ * immutable (per dec-maadb-069 lock #8).
+ */
+export interface TokenRecord {
+    id: TokenId;
+    name?: string;
+    hash: TokenHash;
+    role: Role;
+    projects: ProjectCap[];
+    agentId?: string;
+    userId?: string;
+    expiresAt?: string;
+    createdAt: string;
+    revokedAt?: string;
+}
+/**
+ * Payload accepted by TokenStore.issue. Everything a caller supplies at
+ * token creation. `id` and `hash` are generated by the store; `createdAt`
+ * is stamped at issue time.
+ */
+export interface IssueSpec {
+    name?: string;
+    role: Role;
+    projects: ProjectCap[];
+    agentId?: string;
+    userId?: string;
+    expiresAt?: string;
+}
+/**
+ * Result of a successful issue or rotate. Plaintext is returned ONCE — the
+ * caller is responsible for delivering it to the end user and it's never
+ * recoverable from the registry afterward.
+ */
+export interface IssuedToken {
+    record: TokenRecord;
+    plaintext: string;
+}
+/**
+ * Shape of tokens.yaml on disk. Top-level `name` is an optional human label
+ * for the registry file itself (distinct from per-token `name`).
+ */
+export interface TokensFileShape {
+    name?: string;
+    tokens: TokenRecord[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC;AAE/D,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEnE,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAyB;AACpE,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAA2B;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB"}

package/dist/auth/types.js

@@ -0,0 +1,15 @@
+// ============================================================================
+// Auth types — 0.7.0 Scoped Auth & Identity (dec-maadb-069 + dec-maadb-071)
+//
+// Token registry lives at <instance-root>/_auth/tokens.yaml. Plaintext tokens
+// use format `maad_pat_<32hex>` — 128-bit random + shell-safe + prefix
+// recognizable in logs and leaked-credential scanners. Plaintext is returned
+// ONCE at issue/rotate; SHA-256 hash is what persists.
+//
+// Records are IMMUTABLE except `revokedAt`. Three operations: issue, rotate,
+// revoke. Any capability change (role / identity / projects) requires revoke
+// + reissue. Rationale in dec-maadb-069 lock #8.
+// ============================================================================
+export function tokenId(s) { return s; }
+export function tokenHash(s) { return s; }
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,uDAAuD;AACvD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,iDAAiD;AACjD,+EAA+E;AAc/E,MAAM,UAAU,OAAO,CAAC,CAAS,IAAa,OAAO,CAAY,CAAC,CAAC,CAAC;AACpE,MAAM,UAAU,SAAS,CAAC,CAAS,IAAe,OAAO,CAAc,CAAC,CAAC,CAAC"}

package/dist/backend/adapter.d.ts

@@ -0,0 +1,57 @@
+import type { DocId, DocType, FilePath, DocumentRecord, DocumentQuery, ObjectQuery, DocumentMatch, ObjectMatch, ExtractedObject, Relationship, ParsedBlock, BackendStats } from '../types.js';
+export interface MaadBackend {
+    init(): void;
+    close(): void;
+    putDocument(doc: DocumentRecord): void;
+    putObjects(docId: DocId, objects: ExtractedObject[]): void;
+    putRelationships(docId: DocId, relations: Relationship[]): void;
+    putBlocks(docId: DocId, blocks: ParsedBlock[]): void;
+    putFieldIndex(docId: DocId, fields: Array<{
+        name: string;
+        value: string;
+        numericValue: number | null;
+        type: string;
+    }>): void;
+    getDocument(docId: DocId): DocumentRecord | null;
+    getDocumentsByIds(docIds: DocId[]): Map<DocId, DocumentRecord>;
+    getDocumentByPath(path: FilePath): DocumentRecord | null;
+    findDocuments(query: DocumentQuery): DocumentMatch[];
+    countDocuments(query: DocumentQuery): number;
+    findObjects(query: ObjectQuery): ObjectMatch[];
+    countObjects(query: ObjectQuery): number;
+    getRelationships(docId: DocId, direction: 'outgoing' | 'incoming' | 'both'): Relationship[];
+    getBlocks(docId: DocId): ParsedBlock[];
+    getFieldValues(docIds: DocId[], fieldNames: string[]): Map<string, Record<string, string>>;
+    aggregate(query: import('../engine/types.js').AggregateQuery): import('../engine/types.js').AggregateResult;
+    listChangesSince(opts: {
+        cursor: import('../engine/types.js').ChangesSinceParsedCursor | null;
+        limit: number;
+        docTypes?: string[] | undefined;
+    }): Array<{
+        docId: string;
+        docType: string;
+        updatedAt: string;
+        version: number;
+    }>;
+    getSubtypeInventory(limit: number): Array<{
+        primitive: string;
+        subtype: string;
+        count: number;
+        topValues: string[];
+    }>;
+    getSampleDocIds(docType: DocType, limit: number): DocId[];
+    removeDocument(docId: DocId): void;
+    getFileHash(path: FilePath): string | null;
+    getAllFileHashes(): Map<FilePath, string>;
+    getStats(): BackendStats;
+    countBrokenRefs(): number;
+    getMeta(key: string): string | null;
+    setMeta(key: string, value: string): void;
+    materializeDocument(doc: DocumentRecord, objects: ExtractedObject[], relationships: Relationship[], blocks: ParsedBlock[], fieldIndex: Array<{
+        name: string;
+        value: string;
+        numericValue: number | null;
+        type: string;
+    }>): void;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/backend/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/backend/adapter.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,KAAK,EACL,OAAO,EACP,QAAQ,EACR,cAAc,EACd,aAAa,EACb,WAAW,EACX,aAAa,EACb,WAAW,EACX,eAAe,EACf,YAAY,EACZ,WAAW,EACX,YAAY,EACb,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,WAAW;IAE1B,IAAI,IAAI,IAAI,CAAC;IACb,KAAK,IAAI,IAAI,CAAC;IAGd,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC3D,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAChE,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACrD,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAG7H,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,GAAG,IAAI,CAAC;IACjD,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC/D,iBAAiB,CAAC,IAAI,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI,CAAC;IACzD,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,EAAE,CAAC;IACrD,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC;IAC7C,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IAC/C,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC;IACzC,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,YAAY,EAAE,CAAC;IAC5F,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,WAAW,EAAE,CAAC;IAGvC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAG3F,SAAS,CAAC,KAAK,EAAE,OAAO,oBAAoB,EAAE,cAAc,GAAG,OAAO,oBAAoB,EAAE,eAAe,CAAC;IAO5G,gBAAgB,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,OAAO,oBAAoB,EAAE,wBAAwB,GAAG,IAAI,CAAC;QACrE,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;KACjC,GAAG,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAGlF,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtH,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,CAAC;IAG1D,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACnC,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3C,gBAAgB,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,IAAI,YAAY,CAAC;IACzB,eAAe,IAAI,MAAM,CAAC;IAG1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAG1C,mBAAmB,CACjB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,eAAe,EAAE,EAC1B,aAAa,EAAE,YAAY,EAAE,EAC7B,MAAM,EAAE,WAAW,EAAE,EACrB,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,GAC5F,IAAI,CAAC;CACT"}

package/dist/backend/adapter.js

@@ -0,0 +1,6 @@
+// ============================================================================
+// Backend Adapter Interface
+// Any backend implementation must satisfy this contract.
+// ============================================================================
+export {};
+//# sourceMappingURL=adapter.js.map